last executing test programs:

2.196154546s ago: executing program 0 (id=726):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="700000001000010025bd7004fbdbdf2500000000", @ANYRES32=r1, @ANYBLOB="30080600034a04000a000100aaaaaaaaaa1f000044001680400001800c0007000200002108000000100006"], 0x70}, 0x1, 0x0, 0x0, 0x1}, 0x4000000)

2.195462204s ago: executing program 0 (id=727):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000200), 0xffffffffffffffff)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20-generic\x00'}, 0x58)
unshare(0x62040200)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYRES8, @ANYRES32, @ANYRESDEC=r0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00[@D5\x00'/28], 0x50)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r4, &(0x7f0000000480), &(0x7f0000000280)=@udp=r5, 0x1}, 0x20)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000780)={r4, &(0x7f0000000380), 0x0}, 0x20)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0xfe, 0x4, 0x0, 0x1, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8}, [@alu={0x7, 0x0, 0x8, 0x0, 0x0, 0x10}]}, &(0x7f0000000540)='GPL\x00', 0x7}, 0x94)
sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="040000006800090300000000000000000a0000000000000004ffffffffffffffff4a2a00"], 0x24}}, 0x0)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000005c0), 0x0)
r7 = accept4(r1, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$fou(&(0x7f00000000c0), r7)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r8, 0xe3803000)
r9 = socket$inet6(0xa, 0x2, 0x3a)
connect$inet6(r9, &(0x7f0000000000)={0xa, 0x4e23, 0x438, @private2, 0x9}, 0x1c)
sendto$inet6(r9, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x0, 0x0, 0x0)
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4401})
writev(r10, &(0x7f0000000140)=[{&(0x7f0000000080)="0bc3ff", 0x3}, {&(0x7f0000000000)='G', 0x1}, {&(0x7f0000000240)='\x00'/10, 0xa}], 0x3)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f00000003c0)={'ip6_vti0\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x29, 0x0, 0x3, 0xfffffff9, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x80, 0x40, 0x0, 0x8001}})

1.860647926s ago: executing program 0 (id=731):
r0 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0xfffc, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev}}, 0x80, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000001001000001000000dc0000000000000079ddf87a6fb3d45ac1383b9f9d6edae23406000000000000003c6de234f51a47928ddb022e4ad434cb99572b858bb59e"], 0x18}, 0xfc00)
socket$nl_route(0x10, 0x3, 0x0)
r1 = epoll_create1(0x0)
r2 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000003c0)='cubic', 0xb)
setsockopt$sock_int(r2, 0x1, 0xc, &(0x7f0000000200), 0x4)
r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000", @ANYBLOB], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10)
ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112})
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r7, 0x0, 0x9}, 0x74)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90)
r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r8}, 0x10)
r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r9}, 0x10)
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112})
ioctl$TUNSETQUEUE(r10, 0x400454d9, &(0x7f0000000100)={'vlan0\x00', 0x400})
ppoll(&(0x7f0000000100)=[{r1, 0x1d0}, {r4, 0x80}, {r3}], 0x3, &(0x7f0000000180)={0x77359400}, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r4, 0x0, 0x86, 0xc1, &(0x7f0000000580)="45340c8c727786e54b91e248e8b1cf41f1ea91c80b98d1ce27dec79f11e27fb4c5155c6af658c0705d999b3c1016fd0ae365ae934d9093cb400e2f29cd0587c44d7bfc69e6e19bd132e4513038c907f654cf38cad12eeceb1c8bf151c7d627c8899cc47e98731d59c2b523184053c35e6c434ffa11fd7ff102809e446bec5c9240cba55141ef", &(0x7f0000000780)=""/193, 0x94, 0x0, 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000640), 0x1, 0x0, 0x9a77}, 0x50)
socket$inet_mptcp(0x2, 0x1, 0x106)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20)

1.391015577s ago: executing program 2 (id=741):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
r1 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100)={<r2=>0x0, 0x1}, &(0x7f0000000140)=0x8)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000180)={r2, 0x9}, 0x8)
sendmmsg$inet6(r1, &(0x7f0000001ac0)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x82e1, @private1, 0x7}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000080)="f852", 0x2}], 0x1}}, {{&(0x7f0000000440)={0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, '\x00', 0x29}, 0x7}, 0x1c, &(0x7f00000015c0)}}], 0x2, 0x8000) (async, rerun: 32)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000380), 0x5e) (async, rerun: 32)
accept4(r0, 0x0, 0x0, 0x80000)

1.369729706s ago: executing program 2 (id=742):
r0 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0xfffc, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev}}, 0x80, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000001001000001000000dc0000000000000079ddf87a6fb3d45ac1383b9f9d6edae23406000000000000003c6de234f51a47928ddb022e4ad434cb99572b858bb59e38"], 0x18}, 0xfc00) (async, rerun: 64)
socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1002}, 0x28) (async)
r1 = epoll_create1(0x0) (async, rerun: 64)
r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (rerun: 64)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10)
ppoll(&(0x7f0000000500)=[{r2}], 0x1, 0x0, 0x0, 0x0) (async)
ppoll(&(0x7f0000000100)=[{r1, 0x1d0}, {r3, 0x80}, {r2}], 0x3, &(0x7f0000000180)={0x77359400}, 0x0, 0x0) (async)
r4 = socket(0x2a, 0x2, 0x0)
getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0x18fd9ca9fb75925e}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x10038, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x400ccc7}, 0x4000)
sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000006500)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r5, {0xfff1}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x3, 0x7}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x408c0}, 0x4000)
r6 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async, rerun: 64)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r3, 0x0, 0x86, 0xc1, &(0x7f0000000580)="45340c8c727786e54b91e248e8b1cf41f1ea91c80b98d1ce27dec79f11e27fb4c5155c6af658c0705d999b3c1016fd0ae365ae934d9093cb400e2f29cd0587c44d7bfc69e6e19bd132e4513038c907f654cf38cad12eeceb1c8bf151c7d627c8899cc47e98731d59c2b523184053c35e6c434ffa11fd7ff102809e446bec5c9240cba55141ef", &(0x7f0000000780)=""/193, 0x94, 0x0, 0x8, 0x5, &(0x7f00000001c0)="ecfc9bbae35bbe4d", &(0x7f0000000640)="e8ac8497c3", 0x1, 0x0, 0x9a77}, 0x50) (async, rerun: 64)
r7 = socket$inet_mptcp(0x2, 0x1, 0x106) (async)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{0xffffffffffffffff, <r8=>0xffffffffffffffff}, &(0x7f00000002c0), 0x0}, 0x20)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000004c0)={r8, &(0x7f0000000380)='/', 0x0}, 0x20) (async)
recvmmsg(r7, &(0x7f0000005c80), 0x400030f, 0x0, 0x0) (async)
r9 = socket(0x2a, 0x2, 0x0) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) (async)
sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="04000000008000f03700"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, 0x0, &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) (async)
ioctl$SIOCSIFMTU(r9, 0x8922, &(0x7f0000000080)={'dummy0\x00'})

1.327065968s ago: executing program 2 (id=743):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="997425bd7000fbdbdf2515000000400001800d0001007564703a73797a32000000002c0004001400010002004e24ac4a64c9006bf9361c9428d83c77b61a2e1414bb00000000000000001400020002004e22ffffffff0000e0ffff00000053bc4af3e57c65aab38559a2"], 0x54}, 0x1, 0x0, 0x0, 0x4000080}, 0x2400c000)

1.323393714s ago: executing program 2 (id=745):
r0 = socket(0x19, 0x3, 0x2000)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x5, 0xfffffffb}, 0x10)
write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000901000000000000000005000000000800040001000000", 0x24)
socket$inet6_mptcp(0xa, 0x1, 0x106)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0xa, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000063016f00000000000bea842e82123145"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0xb}, 0x94)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}, {0x5, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x2}}}}]}, 0x79}}, 0x800)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000080), 0x4)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$sock_ifreq(r2, 0x8932, &(0x7f0000000100)={'pimreg\x00', @ifru_data=&(0x7f00000000c0)="ae25b16ceed56cc4ff70bea439d0234fe98cf79eaf3414149f222fe7f97020f1"})
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x1}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
socket$unix(0x1, 0x5, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c000000060a0b04000000000000000502000000200004801c0001800b00050072656a65637400000c00028008000140000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x74}}, 0x0)
write$tun(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="10006003ffffffffff0b7c3ee33734f7818000250108004500001c00682000fc69b3780a010100e0000001800082c38a8d9078"], 0x32)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="70000000000101040000000000000000020000002400018014000180080001000000000008000200e00000020c0002800500010000000000240002800c00028005000100000000001400018008000100ac1e000108000200e000000208000740000000000c0005800800010052412ee8"], 0x70}}, 0x0)

1.229158949s ago: executing program 1 (id=748):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)={0xac, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @private0}]}]}, 0xac}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="c00000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff02000000020000000000000000000114000400fc00000000000000000000000000000108000740000000012c00068014000500fe800000000000000000000400000031140004"], 0xc0}, 0x1, 0x0, 0x0, 0x4040081}, 0x0)
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_buf(r2, 0x6, 0xd, &(0x7f0000000000)="b8", 0x1)
setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000040)=@ccm_128={{0x304}, "e9b172ecf2655b52", "7712b91180acb093fb6b48dce5ba7c41", "0711e4b2", "e9190a5ace69e884"}, 0x28)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0x15, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000002000000000000008000000018130000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000d1000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000100000085000000a600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000018000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48)
setsockopt$inet6_tcp_int(r2, 0x6, 0x1e, 0x0, 0x0)

1.159726812s ago: executing program 1 (id=749):
socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r0)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c)
listen(r1, 0x0)
r2 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x28, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}]}]}, 0x28}}, 0x10)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r8, 0x107, 0xa, &(0x7f00000000c0)=0x1, 0x4)
setsockopt$packet_rx_ring(r8, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf84, 0x4}, 0x1c)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x18}}, 0x0)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r6, @ANYBLOB="070000000088a5001000020000000c00018005000200010000"], 0x20}, 0x1, 0x0, 0x0, 0x48050}, 0x0)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$TIPC_NL_LINK_GET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000008c0)={0x24, r10, 0x78967656d0a78869, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x24}}, 0x4004000)
sendmsg$TIPC_NL_NET_GET(r7, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f00000004c0)={0x17c, r10, 0x200, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x50, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x93}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xb}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5fc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x20}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xa8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xa000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8b}]}, @TIPC_NLA_LINK={0x38, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0xe0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x4008000}, 0x800)

1.159186345s ago: executing program 2 (id=750):
r0 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x19, 0x0, &(0x7f0000000240))
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000001d71186a"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x16, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
poll(&(0x7f0000000100)=[{r2, 0x4020}, {r2, 0x84}], 0x2, 0x3ff)
sendto$inet(r2, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10)
listen(r2, 0xda90)
socket$netlink(0x10, 0x3, 0xf)
r3 = accept4(r2, 0x0, 0x0, 0x0)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="16fdffff0206050000000014000000000700000005000500050000000500cfaed97d00000500050002000000050001000769702cd26f72742c6e6574000000000500040002000000"], 0x54}, 0x1, 0x0, 0x0, 0x810}, 0x4084)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000003c0)='sys_enter\x00', r4}, 0x18)
getsockopt$packet_buf(r3, 0x107, 0xd, &(0x7f00000005c0)=""/4096, &(0x7f0000000000)=0x1000)
pipe(&(0x7f0000000300)={<r5=>0xffffffffffffffff})
sendto$inet6(0xffffffffffffffff, 0x0, 0x91, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x3, @loopback}, 0x1c)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000340), 0x0, 0x0, 0x0, 0x0)
ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000580))
socket(0x1d, 0x3, 0x0)
r6 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_int(r6, 0x6, 0x17, &(0x7f0000000040)=0x10000, 0x4)

949.598645ms ago: executing program 0 (id=751):
socket$l2tp(0x2, 0x2, 0x73)
r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
ppoll(0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r1)
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0xfffff7fe, @empty, 0x5}, 0x1c)
close(r0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)={0x34, r4, 0x1, 0x0, 0x0, {0x7}, [@L2TP_ATTR_IFNAME={0x14}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xfffffffffffffffd}]}, 0x34}}, 0x0)
listen(r2, 0x0)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0xcb}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000)
syz_emit_ethernet(0x4a, &(0x7f0000000380)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x14, 0x6, 0x1, @local, @local, {[], {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2}}}}}}}, 0x0)

280.593812ms ago: executing program 1 (id=752):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000000)='inet_sock_set_state\x00', r0, 0x0, 0x3}, 0x18)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_int(r1, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4)
syz_init_net_socket$netrom(0x6, 0x5, 0x0)
sendmmsg(r1, &(0x7f00000007c0)=[{{&(0x7f0000000380)=@in={0x2, 0x4e24, @local}, 0x80, &(0x7f0000000140)=[{&(0x7f00000004c0)='&', 0x1}], 0x1}}], 0xf00, 0x2c000011)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) (async)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000000)='inet_sock_set_state\x00', r0, 0x0, 0x3}, 0x18) (async)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
setsockopt$inet_tcp_int(r1, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) (async)
syz_init_net_socket$netrom(0x6, 0x5, 0x0) (async)
sendmmsg(r1, &(0x7f00000007c0)=[{{&(0x7f0000000380)=@in={0x2, 0x4e24, @local}, 0x80, &(0x7f0000000140)=[{&(0x7f00000004c0)='&', 0x1}], 0x1}}], 0xf00, 0x2c000011) (async)

278.93639ms ago: executing program 1 (id=753):
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0xa, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x6f}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0xb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value=0x7b000000}, 0x94)

276.155718ms ago: executing program 2 (id=754):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x884}, 0x20000080)
r0 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4)
connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4001, 0xb, @loopback, 0x9}, 0x1c)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
listen(r1, 0xfffffffc)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r3, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x44041}, 0x0)

209.116016ms ago: executing program 1 (id=755):
setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000000c0), 0x4)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x8f5}, @val={0x1, 0x0, 0x27, 0x0, 0x14}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x27, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x0, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0xfd6c)

90.952897ms ago: executing program 0 (id=756):
bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e21, 0x10000, @dev={0xfe, 0x80, '\x00', 0x21}, 0x81}, 0x1c)
r0 = socket$packet(0x11, 0x2, 0x300)
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, 0x0, &(0x7f00000001c0))
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x1, 0x4}, 0x4)
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000080)={0x1, 0x1}, 0x8)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000040)={'vlan1\x00', {0x2, 0x4e20, @loopback}})
ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000000)={'veth1_to_bond\x00', {0x2, 0x4e21, @broadcast}})
r4 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_int(r4, 0x29, 0x21, 0x0, 0x0)
pipe(&(0x7f0000000480)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth0_to_bond\x00'})
bind$bt_l2cap(r5, &(0x7f0000000640)={0x1f, 0x1000, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xdb, 0x2}, 0xe)
ioctl$SIOCAX25ADDFWD(r5, 0x89ea, &(0x7f00000000c0)={@bcast, @default})

88.385732ms ago: executing program 0 (id=757):
r0 = socket$inet6(0xa, 0x2, 0x3a)
r1 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, 0x0, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x7e, 0x7c, 0x7c, 0x2, [@var, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}]}, @func, @volatile, @volatile, @volatile={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x96}, 0x20)
r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004000000000b00"], 0x0, 0x26, 0x0, 0x1, 0x0, 0x0, @void, @value=0xf6}, 0x28)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="180500000000000000000004000000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x5, 0xe2, &(0x7f00000002c0)=""/226, 0x0, 0x0, '\x00', 0x0, 0x25, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x94)
r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)
r5 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000080)={0x21, @remote, 0x4e20, 0x0, 'sh\x00', 0x1a, 0x80000080, 0x31}, 0x2c)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f000000d540)={'wpan0\x00', <r7=>0x0})
r8 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x38, 0x1410, 0x1, 0x70bd2c, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x24044836}, 0xc094)
clock_gettime(0x0, &(0x7f00000003c0)={<r9=>0x0, <r10=>0x0})
sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000100), 0x10, &(0x7f0000000640)={&(0x7f00000005c0)={0x7, 0x140, 0xe9, {0x77359400}, {r9, r10/1000+10000}, {0x0, 0x0, 0x1}, 0x1, @can={{0x0, 0x0, 0x1}, 0x0, 0x1, 0x0, 0x0, "8126890b3d5cc1c5"}}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
sendmsg$NL802154_CMD_SET_SHORT_ADDR(r6, &(0x7f00000121c0)={0x0, 0x0, &(0x7f0000012180)={&(0x7f0000012140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010029bd7000fddbdf250b00000006000a000500000008000300", @ANYRES32=r7, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x4008004}, 0x0)
recvmmsg(r2, &(0x7f0000004380), 0x0, 0xc0000000, &(0x7f0000004580)={0x77359400})
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x38, 0x929}, [@initr0]}, 0x0}, 0x94)
r11 = socket$inet6(0xa, 0x1, 0x0)
r12 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r12, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r11, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8)
connect$inet6(r11, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c)
r13 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r13, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x4e, 0x0, 0x0)
setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, 0x0, 0x0)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20, 0x7, @local, 0x5}, 0x1c)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)

0s ago: executing program 1 (id=758):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005002100000000080500010004"], 0x4c}}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = socket(0x40000000015, 0x5, 0x0)
bind$inet6(r3, &(0x7f00000003c0)={0xa, 0x0, 0x800000, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x4f)
syz_genetlink_get_family_id$SEG6(&(0x7f0000000000), r3)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="5000000002060108000000000000000000000009050001000600000005000400000000000d000500000076686574ecffffff030007800c00078005001400040000000900020073797a30000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000140)={0xffffff8c, {{0xa, 0x4e23, 0x0, @dev={0xfe, 0x80, '\x00', 0x21}, 0x2}}}, 0x88)
sendmsg$NFT_BATCH(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x605, 0x0, 0x0, {0x0, 0x0, 0x9}}, @NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x76980a90ff78c56d}}}, 0x7c}, 0x1, 0x0, 0x0, 0x5810}, 0x48044)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback, 0x800087}, 0x55)
listen(r0, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:36048' (ED25519) to the list of known hosts.
syzkaller login: [   57.265715][ T5829] cgroup: Unknown subsys name 'net'
[   57.454956][ T5829] cgroup: Unknown subsys name 'cpuset'
[   57.459319][ T5829] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   59.381139][ T5829] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   64.209318][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   64.215104][ T5846] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   64.217443][ T5846] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   64.220045][ T5846] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   64.223465][ T5846] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   64.233001][ T5852] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   64.235753][ T5852] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   64.248757][ T5846] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   64.252602][ T5846] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   64.255314][ T5846] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   64.259275][ T5846] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   64.262492][ T5851] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   64.265953][ T5846] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   64.268674][ T5851] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   64.272580][ T5852] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   64.557197][ T5853] chnl_net:caif_netlink_parms(): no params data found
[   64.590940][ T5847] chnl_net:caif_netlink_parms(): no params data found
[   64.630353][ T5843] chnl_net:caif_netlink_parms(): no params data found
[   64.691735][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.694897][ T5853] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.697264][ T5853] bridge_slave_0: entered allmulticast mode
[   64.700121][ T5853] bridge_slave_0: entered promiscuous mode
[   64.722833][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.725224][ T5853] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.727585][ T5853] bridge_slave_1: entered allmulticast mode
[   64.730670][ T5853] bridge_slave_1: entered promiscuous mode
[   64.760219][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.765046][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.767908][ T5847] bridge_slave_0: entered allmulticast mode
[   64.771697][ T5847] bridge_slave_0: entered promiscuous mode
[   64.787625][ T5853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.792869][ T5853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.810966][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.813638][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.816087][ T5847] bridge_slave_1: entered allmulticast mode
[   64.819181][ T5847] bridge_slave_1: entered promiscuous mode
[   64.859387][ T5853] team0: Port device team_slave_0 added
[   64.880293][ T5853] team0: Port device team_slave_1 added
[   64.883940][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.886248][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.888528][ T5843] bridge_slave_0: entered allmulticast mode
[   64.891413][ T5843] bridge_slave_0: entered promiscuous mode
[   64.896727][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.900363][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.903386][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.905672][ T5843] bridge_slave_1: entered allmulticast mode
[   64.908494][ T5843] bridge_slave_1: entered promiscuous mode
[   64.930576][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.960506][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.963767][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.974632][ T5853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.989046][ T5847] team0: Port device team_slave_0 added
[   64.992971][ T5847] team0: Port device team_slave_1 added
[   64.996407][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.999968][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.003249][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.013664][ T5853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.043857][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.048685][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.051400][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.061674][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.088772][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.091555][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.101725][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.155641][ T5843] team0: Port device team_slave_0 added
[   65.159882][ T5843] team0: Port device team_slave_1 added
[   65.175795][ T5853] hsr_slave_0: entered promiscuous mode
[   65.178971][ T5853] hsr_slave_1: entered promiscuous mode
[   65.241046][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.243946][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.253485][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.259265][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.262227][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.272558][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.294183][ T5847] hsr_slave_0: entered promiscuous mode
[   65.296933][ T5847] hsr_slave_1: entered promiscuous mode
[   65.299489][ T5847] debugfs: 'hsr0' already exists in 'hsr'
[   65.301768][ T5847] Cannot create hsr debugfs directory
[   65.393472][ T5843] hsr_slave_0: entered promiscuous mode
[   65.396035][ T5843] hsr_slave_1: entered promiscuous mode
[   65.398577][ T5843] debugfs: 'hsr0' already exists in 'hsr'
[   65.400808][ T5843] Cannot create hsr debugfs directory
[   65.583233][ T5853] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   65.612733][ T5853] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   65.629478][ T5853] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   65.651482][ T5853] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   65.695476][ T5847] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   65.705664][ T5847] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   65.712049][ T5847] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   65.730766][ T5847] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   65.798072][ T5843] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   65.817883][ T5843] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   65.828814][ T5843] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   65.841014][ T5843] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   65.929148][ T5853] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.975288][ T5853] 8021q: adding VLAN 0 to HW filter on device team0
[   65.986731][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.006653][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.009674][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.016604][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.019497][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.048887][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.056628][ T5847] 8021q: adding VLAN 0 to HW filter on device team0
[   66.089060][   T88] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.092051][   T88] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.114816][   T88] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.117687][   T88] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.125977][ T5843] 8021q: adding VLAN 0 to HW filter on device team0
[   66.151318][   T88] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.153936][   T88] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.170851][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.173437][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.191732][ T5847] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   66.275473][ T5852] Bluetooth: hci0: command tx timeout
[   66.353122][ T5852] Bluetooth: hci1: command tx timeout
[   66.355535][ T5852] Bluetooth: hci2: command tx timeout
[   66.367229][ T5853] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.398009][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.466641][ T5853] veth0_vlan: entered promiscuous mode
[   66.485518][ T5853] veth1_vlan: entered promiscuous mode
[   66.522400][ T5847] veth0_vlan: entered promiscuous mode
[   66.528512][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.539433][ T5847] veth1_vlan: entered promiscuous mode
[   66.555677][ T5853] veth0_macvtap: entered promiscuous mode
[   66.566930][ T5853] veth1_macvtap: entered promiscuous mode
[   66.591302][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.608633][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.635119][ T5847] veth0_macvtap: entered promiscuous mode
[   66.640092][ T5713] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.647174][ T5713] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.650703][ T5713] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.654644][ T5713] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.665809][ T5847] veth1_macvtap: entered promiscuous mode
[   66.706454][ T5843] veth0_vlan: entered promiscuous mode
[   66.724024][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.754993][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.765430][ T5843] veth1_vlan: entered promiscuous mode
[   66.775741][ T5908] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.779607][ T5908] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.794868][ T5908] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.798431][ T5908] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.840797][   T88] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.852779][   T88] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.901548][ T5843] veth0_macvtap: entered promiscuous mode
[   66.927085][ T5843] veth1_macvtap: entered promiscuous mode
[   66.930027][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.934249][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.960186][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.972134][   T88] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.975381][   T88] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.991609][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.009215][ T5908] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.017518][ T5853] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   67.023747][ T5908] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.031138][ T5908] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.046148][   T88] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.050488][ T5908] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.055818][   T88] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.155684][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.158142][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.206449][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.209562][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.271248][ T5921] netlink: 'syz.2.4': attribute type 16 has an invalid length.
[   67.274882][ T5921] netlink: 'syz.2.4': attribute type 17 has an invalid length.
[   67.307794][ T5921] bridge0: port 2(bridge_slave_1) entered disabled state
[   67.310738][ T5921] bridge0: port 1(bridge_slave_0) entered disabled state
[   67.372428][ T5921] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   67.376981][ T5927] IPv6: NLM_F_REPLACE set, but no existing node found!
[   67.380827][ T5921] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   67.470334][ T5925] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4'.
[   67.487381][ T5908] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   67.490303][ T5908] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   67.508906][ T5908] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   67.521358][ T5908] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   67.731406][ T5940] Zero length message leads to an empty skb
[   67.745295][ T5953] netlink: 'syz.2.9': attribute type 7 has an invalid length.
[   67.754035][ T5953] netlink: 'syz.2.9': attribute type 8 has an invalid length.
[   68.166041][ T5969] ieee802154 phy0 wpan0: encryption failed: -22
[   68.352997][   T54] Bluetooth: hci0: command tx timeout
[   68.432324][ T5852] Bluetooth: hci1: command tx timeout
[   68.434731][   T54] Bluetooth: hci2: command tx timeout
[   68.645139][ T5975] tipc: Started in network mode
[   68.647345][ T5975] tipc: Node identity 0e6e501064a5, cluster identity 4711
[   68.650988][ T5975] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   68.654472][ T5975] syzkaller0: entered promiscuous mode
[   68.656622][ T5975] syzkaller0: entered allmulticast mode
[   68.669657][ T5975] tipc: Resetting bearer <eth:syzkaller0>
[   68.674869][ T5974] tipc: Resetting bearer <eth:syzkaller0>
[   68.683885][ T5974] tipc: Disabling bearer <eth:syzkaller0>
[   69.072824][ T5980] netlink: 36 bytes leftover after parsing attributes in process `syz.1.18'.
[   69.076396][ T5980] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18'.
[   69.079743][ T5980] netlink: 36 bytes leftover after parsing attributes in process `syz.1.18'.
[   69.088475][ T5980] netlink: 36 bytes leftover after parsing attributes in process `syz.1.18'.
[   69.118286][ T5983] netlink: 'syz.0.20': attribute type 10 has an invalid length.
[   69.127948][ T5983] bridge0: port 2(bridge_slave_1) entered disabled state
[   69.131189][ T5983] bridge0: port 1(bridge_slave_0) entered disabled state
[   69.173419][ T5986] netlink: 4 bytes leftover after parsing attributes in process `syz.0.20'.
[   69.184049][ T5983] bridge0: port 2(bridge_slave_1) entered blocking state
[   69.186687][ T5983] bridge0: port 2(bridge_slave_1) entered forwarding state
[   69.189985][ T5983] bridge0: port 1(bridge_slave_0) entered blocking state
[   69.192952][ T5983] bridge0: port 1(bridge_slave_0) entered forwarding state
[   69.206477][ T5983] bond0: (slave bridge0): Enslaving as an active interface with an up link
[   69.210302][ T5986] bridge_slave_1: left allmulticast mode
[   69.213649][ T5986] bridge_slave_1: left promiscuous mode
[   69.215805][ T5986] bridge0: port 2(bridge_slave_1) entered disabled state
[   69.222181][ T5986] bridge_slave_0: left allmulticast mode
[   69.225775][ T5986] bridge_slave_0: left promiscuous mode
[   69.228007][ T5986] bridge0: port 1(bridge_slave_0) entered disabled state
[   69.249272][ T5986] bond0: (slave bridge0): Releasing backup interface
[   69.380473][ T5996] netlink: 48 bytes leftover after parsing attributes in process `syz.2.23'.
[   69.464939][ T5983] team0: Failed to send port change of device team_slave_0 via netlink (err -105)
[   69.474610][ T5983] team0: Failed to send port change of device team_slave_1 via netlink (err -105)
[   69.481379][ T5983] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   69.490203][ T5983] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   69.573077][ T5713] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   69.585259][ T5713] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   69.588816][ T5713] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   69.615707][ T5713] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   69.651163][ T5999] netlink: 120 bytes leftover after parsing attributes in process `syz.2.24'.
[   69.799936][ T6005] pim6reg99999999: entered allmulticast mode
[   70.432126][   T54] Bluetooth: hci0: command tx timeout
[   70.512225][ T5852] Bluetooth: hci1: command tx timeout
[   70.513077][   T54] Bluetooth: hci2: command tx timeout
[   70.908954][ T6038] syz.2.33 uses obsolete (PF_INET,SOCK_PACKET)
[   71.096750][ T6049] netlink: 1041 bytes leftover after parsing attributes in process `syz.0.37'.
[   71.138759][ T6049] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   71.239743][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   71.251971][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   71.559892][ T6071] netlink: 12 bytes leftover after parsing attributes in process `syz.1.45'.
[   71.594356][ T6071] Bluetooth: MGMT ver 1.23
[   71.596271][ T6071] Bluetooth: hci1: expected 19 bytes, got 2 bytes
[   71.772629][ T6075] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   71.786461][ T6079] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[   71.796427][   T10] IPVS: starting estimator thread 0...
[   71.902228][ T6085] IPVS: using max 47 ests per chain, 112800 per kthread
[   72.047532][ T6096] netlink: 'syz.0.52': attribute type 10 has an invalid length.
[   72.512979][   T54] Bluetooth: hci0: command tx timeout
[   72.543348][ T6127] __nla_validate_parse: 7 callbacks suppressed
[   72.543368][ T6127] netlink: 8 bytes leftover after parsing attributes in process `syz.1.60'.
[   72.592501][   T54] Bluetooth: hci2: command tx timeout
[   72.593051][ T5852] Bluetooth: hci1: command tx timeout
[   72.709094][ T6133] netlink: 12 bytes leftover after parsing attributes in process `syz.1.62'.
[   72.873359][ T6137] netlink: 'syz.1.64': attribute type 10 has an invalid length.
[   72.877283][ T6137] bridge0: port 2(bridge_slave_1) entered disabled state
[   72.881695][ T6137] bridge0: port 1(bridge_slave_0) entered disabled state
[   72.893115][ T6137] bridge0: port 2(bridge_slave_1) entered blocking state
[   72.896137][ T6137] bridge0: port 2(bridge_slave_1) entered forwarding state
[   72.899349][ T6137] bridge0: port 1(bridge_slave_0) entered blocking state
[   72.902390][ T6137] bridge0: port 1(bridge_slave_0) entered forwarding state
[   72.911651][ T6137] bond0: (slave bridge0): Enslaving as an active interface with an up link
[   72.917530][ T6137] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'.
[   72.921114][ T6137] bridge_slave_1: left allmulticast mode
[   72.923746][ T6137] bridge_slave_1: left promiscuous mode
[   72.926970][ T6137] bridge0: port 2(bridge_slave_1) entered disabled state
[   72.933179][ T6137] bridge_slave_0: left allmulticast mode
[   72.935549][ T6137] bridge_slave_0: left promiscuous mode
[   72.938919][ T6137] bridge0: port 1(bridge_slave_0) entered disabled state
[   72.961545][ T6137] bond0: (slave bridge0): Releasing backup interface
[   73.134912][ T6138] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   73.145411][ T6138] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   73.198157][ T6143] netlink: 204 bytes leftover after parsing attributes in process `syz.0.65'.
[   73.264537][ T6145] netlink: 12 bytes leftover after parsing attributes in process `syz.0.66'.
[   73.286134][ T5713] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.292159][ T6145] veth1_vlan: left promiscuous mode
[   73.296607][ T5713] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.302162][ T5713] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.325260][ T5713] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.495238][ T6155] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   73.669097][ T6165] netlink: 4 bytes leftover after parsing attributes in process `syz.1.72'.
[   73.687186][ T6165] 8021q: adding VLAN 0 to HW filter on device ipvlan2
[   73.690552][ T6165] team0: Device ipvlan2 is already an upper device of the team interface
[   73.875489][ T6173] netlink: 48 bytes leftover after parsing attributes in process `syz.1.73'.
[   73.915721][ T6175] netlink: 4264 bytes leftover after parsing attributes in process `syz.1.74'.
[   73.919842][ T6175] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   74.117403][ T6181] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   74.139983][ T6185] IPVS: sync thread started: state = BACKUP, mcast_ifn = tunl0, syncid = 3, id = 0
[   74.315664][ T6193] netlink: 244 bytes leftover after parsing attributes in process `syz.1.79'.
[   74.320915][ T6193] tipc: Started in network mode
[   74.323200][ T6193] tipc: Node identity ac14142f, cluster identity 4711
[   74.325851][ T6193] tipc: New replicast peer: 0.0.0.0
[   74.327862][ T6193] tipc: Enabled bearer <udp:syz2>, priority 10
[   74.383480][ T5713] IPVS: stopping backup sync thread 6185 ...
[   74.390578][ T6193] tipc: New replicast peer: 255.255.255.255
[   75.076438][ T6221] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   75.164823][ T6222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.87'.
[   75.323171][   T51] tipc: Node number set to 2886997039
[   75.452647][ T6249] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[   75.512225][ T6251] bond1: entered promiscuous mode
[   75.515106][ T6251] 8021q: adding VLAN 0 to HW filter on device bond1
[   75.936300][ T6290] bond1: left promiscuous mode
[   76.219612][ T6307] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   76.694528][ T6336] lo speed is unknown, defaulting to 1000
[   76.698773][ T6336] lo speed is unknown, defaulting to 1000
[   76.703179][ T6336] lo speed is unknown, defaulting to 1000
[   76.780809][ T6341] 8021q: adding VLAN 0 to HW filter on device bond0
[   76.785193][ T6341] 8021q: adding VLAN 0 to HW filter on device team0
[   76.793288][ T6341] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   76.814189][ T6341] netlink: 'syz.1.122': attribute type 16 has an invalid length.
[   76.817018][ T6341] netlink: 'syz.1.122': attribute type 17 has an invalid length.
[   76.873689][   T51] lo speed is unknown, defaulting to 1000
[   76.876480][ T6336] infiniband syz0: set down
[   76.878654][ T6336] infiniband syz0: added lo
[   76.914859][ T6336] RDS/IB: syz0: added
[   76.919085][ T6336] lo speed is unknown, defaulting to 1000
[   77.054341][ T6344] netlink: 'syz.2.126': attribute type 64 has an invalid length.
[   77.076968][ T6336] lo speed is unknown, defaulting to 1000
[   77.339230][ T6336] lo speed is unknown, defaulting to 1000
[   77.633418][ T6370] __nla_validate_parse: 15 callbacks suppressed
[   77.633435][ T6370] netlink: 20 bytes leftover after parsing attributes in process `syz.1.134'.
[   77.658224][ T6374] netlink: 830 bytes leftover after parsing attributes in process `syz.2.135'.
[   77.984286][ T6400] netlink: 28 bytes leftover after parsing attributes in process `syz.1.143'.
[   77.987486][ T6400] netlink: 28 bytes leftover after parsing attributes in process `syz.1.143'.
[   77.997746][ T6400] dummy0: entered promiscuous mode
[   78.000382][ T6400] team0: entered promiscuous mode
[   78.002160][ T6400] team_slave_0: entered promiscuous mode
[   78.004309][ T6400] team_slave_1: entered promiscuous mode
[   78.006759][ T6393] netlink: 36 bytes leftover after parsing attributes in process `syz.2.142'.
[   78.009893][ T6393] netlink: 40 bytes leftover after parsing attributes in process `syz.2.142'.
[   78.013799][ T6393] netlink: 12 bytes leftover after parsing attributes in process `syz.2.142'.
[   78.023120][ T6400] hsr1: Slave A (dummy0) is not up; please bring it up to get a fully working HSR network
[   78.027080][ T6400] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network
[   78.098489][ T6405] tun0: tun_chr_ioctl cmd 1074025672
[   78.100852][ T6405] tun0: ignored: set checksum disabled
[   78.151161][ T6409] netlink: 204 bytes leftover after parsing attributes in process `syz.2.147'.
[   79.005168][ T6428] netlink: 36 bytes leftover after parsing attributes in process `syz.0.152'.
[   79.008364][ T6428] netlink: 16 bytes leftover after parsing attributes in process `syz.0.152'.
[   79.314583][ T6444] lo speed is unknown, defaulting to 1000
[   79.402047][ T6447] nbd0: detected capacity change from 0 to 127
[   80.077555][ T6450] block nbd0: Receive control failed (result -104)
[   80.448578][ T6484] tap0: tun_chr_ioctl cmd 1074025681
[   81.310460][ T6509] netlink: 'syz.2.174': attribute type 1 has an invalid length.
[   81.493704][  T972] cfg80211: failed to load regulatory.db
[   81.598967][ T6524] warning: `syz.2.178' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   81.637212][ T6526] netlink: 'syz.1.181': attribute type 3 has an invalid length.
[   82.193962][ T6537] netlink: 'syz.0.185': attribute type 21 has an invalid length.
[   82.362378][ T6543] IPVS: set_ctl: invalid protocol: 59 224.0.0.2:20000
[   82.484554][ T6551] netlink: 'syz.0.191': attribute type 3 has an invalid length.
[   82.501231][ T6551] syz_tun: entered allmulticast mode
[   82.506296][ T6550] syz_tun: left allmulticast mode
[   82.930084][ T6587] delete_channel: no stack
[   82.935103][ T6587] delete_channel: no stack
[   82.939877][ T6587] delete_channel: no stack
[   82.946385][ T6587] delete_channel: no stack
[   82.950389][ T6587] delete_channel: no stack
[   82.958614][ T6587] delete_channel: no stack
[   82.966115][ T6587] delete_channel: no stack
[   82.970676][ T6587] delete_channel: no stack
[   82.977654][ T6587] delete_channel: no stack
[   82.981115][ T6587] delete_channel: no stack
[   82.984652][ T6587] delete_channel: no stack
[   82.987922][ T6587] delete_channel: no stack
[   82.991399][ T6587] delete_channel: no stack
[   82.995982][ T6587] delete_channel: no stack
[   82.999291][ T6587] delete_channel: no stack
[   83.003575][ T6587] delete_channel: no stack
[   83.007271][ T6587] delete_channel: no stack
[   83.011667][ T6587] delete_channel: no stack
[   83.015425][ T6587] delete_channel: no stack
[   83.019071][ T6587] delete_channel: no stack
[   83.023364][ T6587] delete_channel: no stack
[   83.026923][ T6587] delete_channel: no stack
[   83.030050][ T6587] delete_channel: no stack
[   83.034656][ T6587] delete_channel: no stack
[   83.038547][ T6587] delete_channel: no stack
[   83.043582][ T6587] delete_channel: no stack
[   83.046813][ T6587] delete_channel: no stack
[   83.049575][ T6587] delete_channel: no stack
[   83.052729][ T6587] delete_channel: no stack
[   83.055648][ T6587] delete_channel: no stack
[   83.059190][ T6587] delete_channel: no stack
[   83.061820][ T6587] delete_channel: no stack
[   83.066047][ T6587] delete_channel: no stack
[   83.106378][ T6594] __nla_validate_parse: 15 callbacks suppressed
[   83.106399][ T6594] netlink: 24 bytes leftover after parsing attributes in process `syz.1.202'.
[   83.141235][ T6594] netlink: 24 bytes leftover after parsing attributes in process `syz.1.202'.
[   83.212894][ T6594] tipc: Enabling of bearer <udp:syz1> rejected, failed to enable media
[   83.617238][ T6616] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   83.704352][ T6627] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   83.723326][ T6627] netlink: 2856 bytes leftover after parsing attributes in process `syz.0.215'.
[   83.882056][ T6629] syzkaller0: entered promiscuous mode
[   83.884425][ T6629] syzkaller0: entered allmulticast mode
[   85.209340][ T6642] lo speed is unknown, defaulting to 1000
[   85.360260][ T6659] netlink: 8 bytes leftover after parsing attributes in process `syz.2.225'.
[   85.373945][ T6660] ieee802154 phy0 wpan0: encryption failed: -22
[   85.434312][ T6663] sctp: [Deprecated]: syz.0.226 (pid 6663) Use of int in max_burst socket option.
[   85.434312][ T6663] Use struct sctp_assoc_value instead
[   85.586817][ T6672] lo speed is unknown, defaulting to 1000
[   85.746277][ T6675] lo speed is unknown, defaulting to 1000
[   85.949067][ T6678] lo speed is unknown, defaulting to 1000
[   86.463769][ T6692] netlink: 'syz.1.234': attribute type 10 has an invalid length.
[   86.467837][ T6692] netlink: 4 bytes leftover after parsing attributes in process `syz.1.234'.
[   86.467849][ T6694] netlink: 4 bytes leftover after parsing attributes in process `syz.1.234'.
[   86.521653][ T6696] netlink: 8 bytes leftover after parsing attributes in process `syz.2.235'.
[   86.936045][ T6720] netlink: 'syz.0.243': attribute type 10 has an invalid length.
[   86.946015][ T6720] netlink: 40 bytes leftover after parsing attributes in process `syz.0.243'.
[   86.961466][ T6720] dummy0: entered promiscuous mode
[   86.970349][ T6720] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check.
[   87.153384][ T6739] netlink: 24 bytes leftover after parsing attributes in process `syz.1.247'.
[   87.169791][ T6738] netlink: 'syz.2.249': attribute type 10 has an invalid length.
[   87.186177][ T6738] bond0: (slave bridge0): Enslaving as an active interface with an up link
[   87.192430][ T6728] netlink: 36 bytes leftover after parsing attributes in process `syz.0.246'.
[   87.202750][ T6738] bridge_slave_1: left allmulticast mode
[   87.205077][ T6738] bridge_slave_1: left promiscuous mode
[   87.207477][ T6738] bridge0: port 2(bridge_slave_1) entered disabled state
[   87.253211][ T6738] bridge_slave_0: left allmulticast mode
[   87.255872][ T6738] bridge_slave_0: left promiscuous mode
[   87.258254][ T6738] bridge0: port 1(bridge_slave_0) entered disabled state
[   87.294556][ T6738] bond0: (slave bridge0): Releasing backup interface
[   87.556842][ T6761] lo speed is unknown, defaulting to 1000
[   88.128441][ T6773] __nla_validate_parse: 6 callbacks suppressed
[   88.128575][ T6773] netlink: 8 bytes leftover after parsing attributes in process `syz.1.258'.
[   88.424542][ T6784] netlink: 'syz.2.262': attribute type 6 has an invalid length.
[   88.583198][ T6790] netlink: 'syz.2.265': attribute type 4 has an invalid length.
[   88.600436][ T6790] netlink: 'syz.2.265': attribute type 4 has an invalid length.
[   88.679268][ T6790] IPVS: persistence engine module ip_vs_pe_ not found
[   88.738000][ T6803] netlink: 'syz.0.268': attribute type 83 has an invalid length.
[   88.857038][ T6810] RDS: rds_bind could not find a transport for ::ffff:172.30.1.3, load rds_tcp or rds_rdma?
[   88.862545][ T6810] netlink: 14 bytes leftover after parsing attributes in process `syz.2.270'.
[   88.886885][ T6810] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   88.893573][ T6810] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   88.898364][ T6810] bond0 (unregistering): Released all slaves
[   88.921512][ T6812] IPv6: NLM_F_CREATE should be specified when creating new route
[   89.060634][ T6825] netlink: 16 bytes leftover after parsing attributes in process `syz.0.274'.
[   89.144911][ T6827] netlink: 20 bytes leftover after parsing attributes in process `syz.0.276'.
[   89.198645][ T6829] netlink: 'syz.0.277': attribute type 10 has an invalid length.
[   89.202201][ T6829] dummy0: left promiscuous mode
[   89.214771][ T6829] team0: Port device dummy0 added
[   90.092278][ T6861] netlink: 8 bytes leftover after parsing attributes in process `syz.2.284'.
[   90.095170][ T6861] netlink: 8 bytes leftover after parsing attributes in process `syz.2.284'.
[   90.200394][ T6864] IPv6: NLM_F_CREATE should be specified when creating new route
[   90.273816][ T6866] netlink: 4 bytes leftover after parsing attributes in process `syz.2.286'.
[   90.459698][ T6870] lo speed is unknown, defaulting to 1000
[   90.499889][ T6878] netlink: 468 bytes leftover after parsing attributes in process `syz.2.288'.
[   90.640459][ T6876] lo speed is unknown, defaulting to 1000
[   90.687271][ T6885] netlink: 204 bytes leftover after parsing attributes in process `syz.0.292'.
[   90.770393][ T6887] netlink: 4 bytes leftover after parsing attributes in process `syz.0.293'.
[   90.948508][ T6902] delete_channel: no stack
[   91.098827][ T6906] bond2: entered promiscuous mode
[   91.105399][ T6906] bond2: entered allmulticast mode
[   91.108267][ T6906] 8021q: adding VLAN 0 to HW filter on device bond2
[   91.156028][ T6910] syzkaller1: entered promiscuous mode
[   91.158157][ T6910] syzkaller1: entered allmulticast mode
[   91.519500][ T6915] netlink: 'syz.2.300': attribute type 1 has an invalid length.
[   91.648395][ T6929] lo speed is unknown, defaulting to 1000
[   91.777317][ T6932] lo speed is unknown, defaulting to 1000
[   92.200334][ T6957] ieee802154 phy1 wpan1: encryption failed: -22
[   92.659507][ T6978] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[   92.784827][ T6982] lo speed is unknown, defaulting to 1000
[   93.208109][ T6995] __nla_validate_parse: 14 callbacks suppressed
[   93.208130][ T6995] netlink: 8 bytes leftover after parsing attributes in process `syz.2.320'.
[   93.338935][ T6997] netlink: 244 bytes leftover after parsing attributes in process `syz.2.321'.
[   93.398866][ T6997] netlink: 8 bytes leftover after parsing attributes in process `syz.2.321'.
[   93.481211][ T7001] netlink: 4 bytes leftover after parsing attributes in process `syz.2.323'.
[   93.484491][ T7001] batman_adv: batadv0: Removing interface: batadv_slave_0
[   93.487730][ T7001] batman_adv: batadv0: Removing interface: batadv_slave_1
[   93.606091][ T7003] netlink: 204 bytes leftover after parsing attributes in process `syz.2.324'.
[   93.819749][ T7015] netlink: 8 bytes leftover after parsing attributes in process `syz.2.327'.
[   94.001979][ T7017] lo speed is unknown, defaulting to 1000
[   94.125061][ T7021] netlink: 'syz.2.329': attribute type 1 has an invalid length.
[   94.127982][ T7021] netlink: 8 bytes leftover after parsing attributes in process `syz.2.329'.
[   94.206008][ T7023] Driver unsupported XDP return value 0 on prog  (id 77) dev N/A, expect packet loss!
[   94.327829][ T7030] netlink: 32 bytes leftover after parsing attributes in process `syz.0.332'.
[   94.331434][ T7030] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[   95.199536][ T7057] Bluetooth: MGMT ver 1.23
[   95.706351][ T7070] netlink: 20 bytes leftover after parsing attributes in process `syz.2.343'.
[   95.750595][ T7075] netlink: 52 bytes leftover after parsing attributes in process `syz.0.344'.
[   95.888427][ T7084] lo speed is unknown, defaulting to 1000
[   96.106140][ T7094] lo speed is unknown, defaulting to 1000
[   96.361598][ T7104] netlink: 'syz.0.352': attribute type 9 has an invalid length.
[   96.563372][ T7111] (unnamed net_device) (uninitialized): option arp_validate: mode dependency failed, not supported in mode 802.3ad(4)
[   96.625681][ T7111] netlink: 'syz.0.354': attribute type 1 has an invalid length.
[   96.628683][ T7111] netlink: 'syz.0.354': attribute type 1 has an invalid length.
[   96.699311][ T7117] netlink: 'syz.1.356': attribute type 10 has an invalid length.
[   96.705096][ T7116] netlink: 'syz.1.356': attribute type 10 has an invalid length.
[   97.154468][ T7134] netlink: 'syz.1.360': attribute type 3 has an invalid length.
[   97.159497][ T7134] netlink: 'syz.1.360': attribute type 64 has an invalid length.
[   97.519811][ T7164] ieee802154 phy1 wpan1: encryption failed: -22
[   98.146909][ T7204] lo speed is unknown, defaulting to 1000
[   98.303743][ T7212] __nla_validate_parse: 8 callbacks suppressed
[   98.303764][ T7212] netlink: 4 bytes leftover after parsing attributes in process `syz.2.382'.
[   98.311193][ T7212] netlink: 28 bytes leftover after parsing attributes in process `syz.2.382'.
[   98.718568][ T7223] lo speed is unknown, defaulting to 1000
[   99.320647][ T7230] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[   99.405869][ T7249] netlink: 12 bytes leftover after parsing attributes in process `syz.0.389'.
[   99.435061][ T7249] 8021q: adding VLAN 0 to HW filter on device bond1
[   99.446513][ T7249] bond1: entered promiscuous mode
[   99.523555][ T7254] lo speed is unknown, defaulting to 1000
[   99.588294][ T7270] netlink: 32 bytes leftover after parsing attributes in process `syz.1.395'.
[   99.592224][ T7270] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[   99.633548][ T7272] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   99.668037][ T7267] netlink: 36 bytes leftover after parsing attributes in process `syz.0.394'.
[   99.671963][ T7267] netlink: 40 bytes leftover after parsing attributes in process `syz.0.394'.
[   99.674916][ T7267] netlink: 12 bytes leftover after parsing attributes in process `syz.0.394'.
[   99.678775][ T7266] netlink: 36 bytes leftover after parsing attributes in process `syz.0.394'.
[   99.682778][ T7266] netlink: 40 bytes leftover after parsing attributes in process `syz.0.394'.
[   99.686849][ T7266] netlink: 12 bytes leftover after parsing attributes in process `syz.0.394'.
[  100.524767][ T7326] netlink: 'syz.2.413': attribute type 1 has an invalid length.
[  100.527193][ T7326] netlink: 'syz.2.413': attribute type 1 has an invalid length.
[  101.450778][ T7366] lo speed is unknown, defaulting to 1000
[  101.732961][ T7369] netlink: 'syz.2.429': attribute type 1 has an invalid length.
[  101.735519][ T7369] nbd: error processing sock list
[  101.737883][ T7369] block nbd1: shutting down sockets
[  101.882472][ T7381] lo speed is unknown, defaulting to 1000
[  102.398645][ T7415] bond1: left promiscuous mode
[  102.755324][ T7441] lo speed is unknown, defaulting to 1000
[  103.612600][ T7469] netlink: 'syz.0.457': attribute type 16 has an invalid length.
[  103.615340][ T7469] netlink: 'syz.0.457': attribute type 17 has an invalid length.
[  103.618997][ T7469] __nla_validate_parse: 19 callbacks suppressed
[  103.619009][ T7469] netlink: 4 bytes leftover after parsing attributes in process `syz.0.457'.
[  103.625547][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.627794][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.630621][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.637739][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.640664][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.643378][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.645937][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.648735][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.651265][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.654143][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.657963][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.661478][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.665438][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.668386][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.670811][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.673460][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.675997][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.678710][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.681309][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.684329][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.686872][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.689319][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.691665][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.694831][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.697301][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.699740][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.702287][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.704823][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.707420][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.710026][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.715075][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.722339][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.725089][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.727381][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.735209][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.737739][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.740547][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.744484][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.747447][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.749913][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.752295][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.754595][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.756857][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.759271][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.761650][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.771050][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.774358][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.778282][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.781405][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.784621][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.787554][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.790568][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.794280][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.797498][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.800688][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.803993][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.808665][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.811852][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.815335][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.818504][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.821761][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.824902][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.827873][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.830815][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  103.834024][ T7469] IPv6: NLM_F_REPLACE set, but no existing node found!
[  104.553478][ T7489] netlink: 'syz.1.463': attribute type 10 has an invalid length.
[  104.560952][ T7489] netlink: 4 bytes leftover after parsing attributes in process `syz.1.463'.
[  104.672888][ T7500] netlink: 176 bytes leftover after parsing attributes in process `syz.0.466'.
[  104.701462][ T7502] netlink: 176 bytes leftover after parsing attributes in process `syz.0.466'.
[  104.869744][ T7513] netlink: 28 bytes leftover after parsing attributes in process `syz.0.468'.
[  104.873594][ T7513] netlink: 28 bytes leftover after parsing attributes in process `syz.0.468'.
[  104.876975][ T7513] netlink: 28 bytes leftover after parsing attributes in process `syz.0.468'.
[  104.897649][ T7512] lo speed is unknown, defaulting to 1000
[  105.686650][ T7539] IPv6: NLM_F_CREATE should be specified when creating new route
[  105.722117][ T7541] netlink: 204 bytes leftover after parsing attributes in process `syz.0.476'.
[  105.859038][ T7545] lo speed is unknown, defaulting to 1000
[  105.868084][ T7548] netlink: 36 bytes leftover after parsing attributes in process `syz.1.479'.
[  105.871588][ T7548] netlink: 'syz.1.479': attribute type 1 has an invalid length.
[  105.874133][ T7548] netlink: 224 bytes leftover after parsing attributes in process `syz.1.479'.
[  106.676552][ T7611] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  106.788357][ T7614] syzkaller1: entered promiscuous mode
[  106.801761][ T7614] syzkaller1: entered allmulticast mode
[  106.993124][   T54] Bluetooth: hci2: command 0x0405 tx timeout
[  107.000143][ T7649] netlink: 'syz.1.485': attribute type 10 has an invalid length.
[  107.077674][ T7651] lo speed is unknown, defaulting to 1000
[  108.053847][ T7673] lo speed is unknown, defaulting to 1000
[  108.681398][ T7727] sctp: [Deprecated]: syz.0.507 (pid 7727) Use of struct sctp_assoc_value in delayed_ack socket option.
[  108.681398][ T7727] Use struct sctp_sack_info instead
[  108.723328][ T7733] __nla_validate_parse: 9 callbacks suppressed
[  108.723338][ T7733] netlink: 16 bytes leftover after parsing attributes in process `syz.2.508'.
[  108.724112][ T7734] netlink: 16 bytes leftover after parsing attributes in process `syz.2.508'.
[  108.915357][ T7737] netlink: 'syz.2.509': attribute type 16 has an invalid length.
[  108.917940][ T7737] netlink: 'syz.2.509': attribute type 17 has an invalid length.
[  108.920776][ T7737] netlink: 4 bytes leftover after parsing attributes in process `syz.2.509'.
[  108.924941][ T7737] IPv6: NLM_F_REPLACE set, but no existing node found!
[  109.033904][ T7739] netlink: 16 bytes leftover after parsing attributes in process `syz.1.510'.
[  109.132876][ T7747] netlink: 4 bytes leftover after parsing attributes in process `syz.1.512'.
[  109.135875][ T7747] batman_adv: batadv0: Removing interface: batadv_slave_0
[  109.138720][ T7747] batman_adv: batadv0: Removing interface: batadv_slave_1
[  109.517071][ T7752] lo speed is unknown, defaulting to 1000
[  109.643364][ T1117] block nbd0: Possible stuck request ffff888022a00000: control (read@0,1024B). Runtime 30 seconds
[  109.647365][ T1117] block nbd0: Possible stuck request ffff888022a00200: control (read@1024,1024B). Runtime 30 seconds
[  109.651758][ T1117] block nbd0: Possible stuck request ffff888022a00400: control (read@2048,1024B). Runtime 30 seconds
[  109.655246][ T1117] block nbd0: Possible stuck request ffff888022a00600: control (read@3072,1024B). Runtime 30 seconds
[  109.761687][ T7766] lo speed is unknown, defaulting to 1000
[  110.126345][ T7787] netlink: 124 bytes leftover after parsing attributes in process `syz.1.521'.
[  110.177938][ T7790] netlink: 'syz.1.522': attribute type 1 has an invalid length.
[  110.189811][ T7790] netlink: 224 bytes leftover after parsing attributes in process `syz.1.522'.
[  110.200111][ T7789] 8021q: adding VLAN 0 to HW filter on device team0
[  110.208151][ T7789] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  110.792095][ T7800] netlink: 'syz.0.524': attribute type 1 has an invalid length.
[  110.794549][ T7800] nbd: error processing sock list
[  110.796309][ T7800] block nbd1: shutting down sockets
[  111.454188][ T7844] netlink: 16 bytes leftover after parsing attributes in process `syz.1.539'.
[  111.469845][ T7848] netlink: 16 bytes leftover after parsing attributes in process `syz.2.540'.
[  111.470158][ T7847] netlink: 16 bytes leftover after parsing attributes in process `syz.2.540'.
[  111.484406][ T7844] lo speed is unknown, defaulting to 1000
[  112.021113][ T7880] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  112.389741][ T7891] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  112.541442][ T7900] lo speed is unknown, defaulting to 1000
[  112.565231][ T7904] tipc: Enabled bearer <ib:caif0>, priority 14
[  112.575386][ T7903] tipc: Enabling of bearer <ib:caif0> rejected, already enabled
[  112.681969][ T7901] lo speed is unknown, defaulting to 1000
[  112.813685][ T7912] netlink: 'syz.1.560': attribute type 10 has an invalid length.
[  112.854575][ T7906] lo speed is unknown, defaulting to 1000
[  113.904371][ T7974] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  113.907432][ T7974] syzkaller0: entered promiscuous mode
[  113.909458][ T7974] syzkaller0: entered allmulticast mode
[  113.917615][ T7974] tipc: Resetting bearer <eth:syzkaller0>
[  114.314196][ T7982] lo speed is unknown, defaulting to 1000
[  114.658277][ T7991] lo speed is unknown, defaulting to 1000
[  114.674642][ T7968] tipc: Resetting bearer <eth:syzkaller0>
[  114.687182][ T7968] tipc: Disabling bearer <eth:syzkaller0>
[  114.915205][ T8013] ip6gre2: entered allmulticast mode
[  115.086910][ T8026] 8021q: adding VLAN 0 to HW filter on device bond0
[  115.089907][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.093794][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.098867][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.104244][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.107035][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.112030][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.117607][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.128732][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.134534][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.138925][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.142078][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.145297][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.149163][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.152937][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.156147][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.159609][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.163121][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.166466][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.169103][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.172617][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.175341][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.178908][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.181527][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.185238][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.187908][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.191278][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.194165][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.198167][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.200831][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.205527][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.208869][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.215460][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.221527][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.225872][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.229240][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.233730][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.237102][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.241685][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.245533][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.248869][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.251787][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.255465][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.258172][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.261720][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.266894][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.270525][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.273520][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.277020][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.279786][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.283620][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.286298][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.289976][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.292914][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.296523][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.299277][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.303187][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.305907][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.309497][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.312550][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.316117][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.318764][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.323080][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.325774][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.329274][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.332031][ T8026] bond0: (slave gre0): The slave device specified does not support setting the MAC address
[  115.335453][ T8026] bond0: (slave gre0): Error -95 calling set_mac_address
[  115.744881][ T8051] __nla_validate_parse: 9 callbacks suppressed
[  115.744896][ T8051] netlink: 20 bytes leftover after parsing attributes in process `syz.1.592'.
[  115.860139][ T8057] netlink: 'syz.1.595': attribute type 10 has an invalid length.
[  115.864307][ T8057] netlink: 4 bytes leftover after parsing attributes in process `syz.1.595'.
[  115.987587][ T8059] lo speed is unknown, defaulting to 1000
[  116.004408][ T8064] netlink: 4 bytes leftover after parsing attributes in process `syz.0.597'.
[  116.190842][ T8074] lo speed is unknown, defaulting to 1000
[  116.317638][ T8075] lo speed is unknown, defaulting to 1000
[  116.527006][ T8088] lo speed is unknown, defaulting to 1000
[  116.981814][ T8105] netlink: 13 bytes leftover after parsing attributes in process `syz.2.605'.
[  116.994643][ T8105] netlink: 4 bytes leftover after parsing attributes in process `syz.2.605'.
[  117.261790][ T8122] netlink: 32 bytes leftover after parsing attributes in process `syz.0.608'.
[  117.268672][ T8122] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  117.529451][ T8141] ieee802154 phy1 wpan1: encryption failed: -22
[  117.680194][ T8151] lo speed is unknown, defaulting to 1000
[  117.774048][ T8155] netlink: 32 bytes leftover after parsing attributes in process `syz.0.615'.
[  117.787213][ T8155] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  117.858906][ T8159] vxlan0: entered promiscuous mode
[  117.860969][ T8159] vxlan0: entered allmulticast mode
[  117.864533][ T5713] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  117.868380][ T5713] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  117.871167][ T5713] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  117.878260][ T5713] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  118.028473][ T8164] netem: unknown loss type 0
[  118.042277][ T8164] netem: change failed
[  118.100975][ T8176] netlink: 24 bytes leftover after parsing attributes in process `syz.2.620'.
[  118.303641][ T8188] netlink: 112 bytes leftover after parsing attributes in process `syz.2.623'.
[  118.306648][ T8188] netlink: 8 bytes leftover after parsing attributes in process `syz.2.623'.
[  118.405203][ T8192] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  118.408113][ T8192] syzkaller0: entered promiscuous mode
[  118.409996][ T8192] syzkaller0: entered allmulticast mode
[  118.423472][ T8191] tipc: Resetting bearer <eth:syzkaller0>
[  118.436455][ T8191] tipc: Disabling bearer <eth:syzkaller0>
[  118.597814][ T8202] lo speed is unknown, defaulting to 1000
[  118.981048][ T8213] lo speed is unknown, defaulting to 1000
[  119.257879][ T8232] lo speed is unknown, defaulting to 1000
[  120.448941][ T8287] lo speed is unknown, defaulting to 1000
[  120.469193][ T8293] IPVS: set_ctl: invalid protocol: 94 255.255.255.255:20001
[  120.640188][ T8295] bond0: (slave gretap0): Enslaving as an active interface with an up link
[  120.947335][ T8311] lo speed is unknown, defaulting to 1000
[  121.095080][ T8325] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  121.164757][ T8326] __nla_validate_parse: 11 callbacks suppressed
[  121.164776][ T8326] netlink: 8 bytes leftover after parsing attributes in process `syz.2.653'.
[  121.277986][ T8332] netlink: 32 bytes leftover after parsing attributes in process `syz.2.655'.
[  121.280922][ T8332] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  121.461406][ T8338] lo speed is unknown, defaulting to 1000
[  121.690049][ T8350] netlink: 40 bytes leftover after parsing attributes in process `syz.0.660'.
[  121.699937][ T8350] netlink: 24 bytes leftover after parsing attributes in process `syz.0.660'.
[  121.709285][ T8350] wg1: entered allmulticast mode
[  121.720826][ T8350] dvmrp8: entered allmulticast mode
[  121.728150][ T8352] lo speed is unknown, defaulting to 1000
[  121.920221][ T8350] lo speed is unknown, defaulting to 1000
[  122.090899][ T8360] lo speed is unknown, defaulting to 1000
[  122.329944][ T8348] wg1: left allmulticast mode
[  122.332113][ T8348] dvmrp8: left allmulticast mode
[  122.410136][ T8359] lo speed is unknown, defaulting to 1000
[  122.516649][ T8378] netlink: 'syz.2.667': attribute type 10 has an invalid length.
[  122.555648][ T8378] netlink: 4 bytes leftover after parsing attributes in process `syz.2.667'.
[  122.629161][ T8379] netlink: 8 bytes leftover after parsing attributes in process `syz.2.667'.
[  123.138037][ T8411] syzkaller1: entered promiscuous mode
[  123.140293][ T8411] syzkaller1: entered allmulticast mode
[  123.319412][ T8418] netlink: 'syz.0.678': attribute type 10 has an invalid length.
[  123.332366][ T8418] netlink: 4 bytes leftover after parsing attributes in process `syz.0.678'.
[  123.709702][ T8451] netlink: 32 bytes leftover after parsing attributes in process `syz.2.684'.
[  123.721832][ T8451] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  123.799210][ T8455] netlink: 16 bytes leftover after parsing attributes in process `syz.1.686'.
[  123.803151][ T8458] netlink: 36 bytes leftover after parsing attributes in process `syz.2.687'.
[  123.863310][ T8463] netlink: 'syz.0.688': attribute type 1 has an invalid length.
[  124.038074][ T8490] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  124.110978][ T8494] lo speed is unknown, defaulting to 1000
[  124.439410][ T8513] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  124.600443][ T8517] netlink: 'syz.2.704': attribute type 10 has an invalid length.
[  124.966188][ T8540] lo speed is unknown, defaulting to 1000
[  125.170035][ T8543] lo speed is unknown, defaulting to 1000
[  125.379271][ T8545] lo speed is unknown, defaulting to 1000
[  125.731961][ T8567] lo speed is unknown, defaulting to 1000
[  126.349341][ T8590] lo speed is unknown, defaulting to 1000
[  126.470104][ T8598] __nla_validate_parse: 20 callbacks suppressed
[  126.470115][ T8598] netlink: 200 bytes leftover after parsing attributes in process `syz.2.721'.
[  126.475803][ T8598] netlink: 200 bytes leftover after parsing attributes in process `syz.2.721'.
[  126.619069][ T8602] netlink: 8 bytes leftover after parsing attributes in process `syz.0.722'.
[  126.925833][ T8620] netlink: 32 bytes leftover after parsing attributes in process `syz.0.726'.
[  126.928589][ T8620] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  126.997934][ T8622] lo speed is unknown, defaulting to 1000
[  127.115497][ T8630] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  127.719960][ T8665] netlink: 4 bytes leftover after parsing attributes in process `syz.2.740'.
[  128.170377][ T8704] can: request_module (can-proto-0) failed.
[  129.097898][ T8724] IPVS: set_ctl: invalid protocol: 33 172.20.20.187:20000
[  129.152119][ T8728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.758'.
[  129.187770][ T8728] netlink: 'syz.1.758': attribute type 5 has an invalid length.
[  129.191126][ T8728] netlink: 28 bytes leftover after parsing attributes in process `syz.1.758'.
[  129.209159][ T8730] ==================================================================
[  129.212578][ T8730] BUG: KASAN: slab-use-after-free in __xfrm_state_delete+0x696/0xca0
[  129.215838][ T8730] Write of size 8 at addr ffff88810e8c56b0 by task syz.0.757/8730
[  129.219754][ T8730] 
[  129.220760][ T8730] CPU: 1 UID: 0 PID: 8730 Comm: syz.0.757 Not tainted syzkaller #0 PREEMPT(full) 
[  129.220805][ T8730] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  129.220816][ T8730] Call Trace:
[  129.220838][ T8730]  <TASK>
[  129.220846][ T8730]  dump_stack_lvl+0x189/0x250
[  129.220876][ T8730]  ? __kasan_check_byte+0x12/0x40
[  129.220900][ T8730]  ? __pfx_dump_stack_lvl+0x10/0x10
[  129.220916][ T8730]  ? lock_release+0x4b/0x3e0
[  129.220939][ T8730]  ? __virt_addr_valid+0x4a5/0x5c0
[  129.220959][ T8730]  print_report+0xca/0x240
[  129.220980][ T8730]  ? __xfrm_state_delete+0x696/0xca0
[  129.220997][ T8730]  kasan_report+0x118/0x150
[  129.221016][ T8730]  ? __xfrm_state_delete+0x696/0xca0
[  129.221040][ T8730]  __xfrm_state_delete+0x696/0xca0
[  129.221064][ T8730]  xfrm_state_flush+0x45f/0x770
[  129.221086][ T8730]  pfkey_flush+0x13f/0x340
[  129.221107][ T8730]  ? __pfx_pfkey_flush+0x10/0x10
[  129.221126][ T8730]  ? kmem_cache_free+0x18f/0x400
[  129.221148][ T8730]  pfkey_sendmsg+0xbfe/0x1090
[  129.221168][ T8730]  ? trace_sched_exit_tp+0x36/0x110
[  129.221187][ T8730]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  129.221212][ T8730]  ? aa_sock_msg_perm+0xf1/0x1d0
[  129.221233][ T8730]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  129.221249][ T8730]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  129.221265][ T8730]  __sock_sendmsg+0x21c/0x270
[  129.221287][ T8730]  ____sys_sendmsg+0x505/0x830
[  129.221305][ T8730]  ? __pfx_____sys_sendmsg+0x10/0x10
[  129.221325][ T8730]  ? import_iovec+0x74/0xa0
[  129.221343][ T8730]  ___sys_sendmsg+0x21f/0x2a0
[  129.221361][ T8730]  ? __pfx____sys_sendmsg+0x10/0x10
[  129.221390][ T8730]  ? __fget_files+0x2a/0x420
[  129.221410][ T8730]  ? __fget_files+0x3a0/0x420
[  129.221432][ T8730]  __x64_sys_sendmsg+0x19b/0x260
[  129.221450][ T8730]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  129.221471][ T8730]  ? rcu_is_watching+0x15/0xb0
[  129.221485][ T8730]  ? do_syscall_64+0xbe/0x3b0
[  129.221501][ T8730]  do_syscall_64+0xfa/0x3b0
[  129.221513][ T8730]  ? lockdep_hardirqs_on+0x9c/0x150
[  129.221533][ T8730]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.221547][ T8730]  ? exc_page_fault+0x9f/0xf0
[  129.221567][ T8730]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.221581][ T8730] RIP: 0033:0x7f11d818ec29
[  129.221597][ T8730] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  129.221611][ T8730] RSP: 002b:00007f11d8fda038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  129.221629][ T8730] RAX: ffffffffffffffda RBX: 00007f11d83d6090 RCX: 00007f11d818ec29
[  129.221641][ T8730] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b
[  129.221651][ T8730] RBP: 00007f11d8211e41 R08: 0000000000000000 R09: 0000000000000000
[  129.221660][ T8730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  129.221670][ T8730] R13: 00007f11d83d6128 R14: 00007f11d83d6090 R15: 00007ffdfeb80168
[  129.221686][ T8730]  </TASK>
[  129.221693][ T8730] 
[  129.332529][ T8730] Allocated by task 7188:
[  129.334242][ T8730]  kasan_save_track+0x3e/0x80
[  129.336103][ T8730]  __kasan_slab_alloc+0x6c/0x80
[  129.337989][ T8730]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  129.340073][ T8730]  xfrm_state_alloc+0x24/0x2f0
[  129.341962][ T8730]  __find_acq_core+0x8a7/0x1c00
[  129.343864][ T8730]  xfrm_find_acq+0x78/0xa0
[  129.345612][ T8730]  xfrm_alloc_userspi+0x6b3/0xc90
[  129.347551][ T8730]  xfrm_user_rcv_msg+0x7a3/0xab0
[  129.349453][ T8730]  netlink_rcv_skb+0x208/0x470
[  129.351281][ T8730]  xfrm_netlink_rcv+0x79/0x90
[  129.353105][ T8730]  netlink_unicast+0x82f/0x9e0
[  129.354947][ T8730]  netlink_sendmsg+0x805/0xb30
[  129.356796][ T8730]  __sock_sendmsg+0x21c/0x270
[  129.358620][ T8730]  ____sys_sendmsg+0x505/0x830
[  129.360481][ T8730]  ___sys_sendmsg+0x21f/0x2a0
[  129.362344][ T8730]  __x64_sys_sendmsg+0x19b/0x260
[  129.364241][ T8730]  do_syscall_64+0xfa/0x3b0
[  129.366004][ T8730]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.368242][ T8730] 
[  129.369178][ T8730] Freed by task 51:
[  129.370655][ T8730]  kasan_save_track+0x3e/0x80
[  129.372458][ T8730]  kasan_save_free_info+0x46/0x50
[  129.374434][ T8730]  __kasan_slab_free+0x5b/0x80
[  129.376271][ T8730]  kmem_cache_free+0x18f/0x400
[  129.378225][ T8730]  xfrm_state_gc_task+0x52d/0x6b0
[  129.380190][ T8730]  process_scheduled_works+0xae1/0x17b0
[  129.382417][ T8730]  worker_thread+0x8a0/0xda0
[  129.384230][ T8730]  kthread+0x711/0x8a0
[  129.385844][ T8730]  ret_from_fork+0x439/0x7d0
[  129.387642][ T8730]  ret_from_fork_asm+0x1a/0x30
[  129.389518][ T8730] 
[  129.390465][ T8730] The buggy address belongs to the object at ffff88810e8c5680
[  129.390465][ T8730]  which belongs to the cache xfrm_state of size 928
[  129.395908][ T8730] The buggy address is located 48 bytes inside of
[  129.395908][ T8730]  freed 928-byte region [ffff88810e8c5680, ffff88810e8c5a20)
[  129.401237][ T8730] 
[  129.402206][ T8730] The buggy address belongs to the physical page:
[  129.404672][ T8730] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810e8c4900 pfn:0x10e8c4
[  129.408570][ T8730] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  129.411800][ T8730] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  129.414684][ T8730] page_type: f5(slab)
[  129.416293][ T8730] raw: 057ff00000000040 ffff88801bfadb40 dead000000000122 0000000000000000
[  129.419534][ T8730] raw: ffff88810e8c4900 00000000800e0009 00000000f5000000 0000000000000000
[  129.422798][ T8730] head: 057ff00000000040 ffff88801bfadb40 dead000000000122 0000000000000000
[  129.426156][ T8730] head: ffff88810e8c4900 00000000800e0009 00000000f5000000 0000000000000000
[  129.429444][ T8730] head: 057ff00000000002 ffffea00043a3101 00000000ffffffff 00000000ffffffff
[  129.432746][ T8730] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  129.436007][ T8730] page dumped because: kasan: bad access detected
[  129.438437][ T8730] page_owner tracks the page as allocated
[  129.440645][ T8730] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6126, tgid 6125 (syz.1.60), ts 72466679868, free_ts 72403978065
[  129.447837][ T8730]  post_alloc_hook+0x240/0x2a0
[  129.449718][ T8730]  get_page_from_freelist+0x21e4/0x22c0
[  129.451882][ T8730]  __alloc_frozen_pages_noprof+0x181/0x370
[  129.454170][ T8730]  alloc_pages_mpol+0x232/0x4a0
[  129.456076][ T8730]  allocate_slab+0x8a/0x370
[  129.457863][ T8730]  ___slab_alloc+0xbeb/0x1420
[  129.459725][ T8730]  kmem_cache_alloc_noprof+0x283/0x3c0
[  129.461891][ T8730]  xfrm_state_alloc+0x24/0x2f0
[  129.463806][ T8730]  pfkey_add+0x6e4/0x2e00
[  129.465527][ T8730]  pfkey_sendmsg+0xbfe/0x1090
[  129.467419][ T8730]  __sock_sendmsg+0x21c/0x270
[  129.469321][ T8730]  ____sys_sendmsg+0x505/0x830
[  129.471236][ T8730]  ___sys_sendmsg+0x21f/0x2a0
[  129.473112][ T8730]  __x64_sys_sendmsg+0x19b/0x260
[  129.475052][ T8730]  do_syscall_64+0xfa/0x3b0
[  129.476853][ T8730]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.479185][ T8730] page last free pid 6121 tgid 6115 stack trace:
[  129.481638][ T8730]  __free_frozen_pages+0xbc4/0xd30
[  129.483679][ T8730]  __slab_free+0x303/0x3c0
[  129.485468][ T8730]  qlist_free_all+0x97/0x140
[  129.487310][ T8730]  kasan_quarantine_reduce+0x148/0x160
[  129.489442][ T8730]  __kasan_slab_alloc+0x22/0x80
[  129.491332][ T8730]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  129.493466][ T8730]  security_inode_alloc+0x39/0x330
[  129.495474][ T8730]  inode_init_always_gfp+0x9ed/0xdc0
[  129.497564][ T8730]  alloc_inode+0x82/0x1b0
[  129.499280][ T8730]  __sock_create+0x12d/0x9f0
[  129.501088][ T8730]  __sys_socket+0xd7/0x1b0
[  129.502862][ T8730]  __x64_sys_socket+0x7a/0x90
[  129.504695][ T8730]  do_syscall_64+0xfa/0x3b0
[  129.506482][ T8730]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.508799][ T8730] 
[  129.509748][ T8730] Memory state around the buggy address:
[  129.512027][ T8730]  ffff88810e8c5580: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[  129.515093][ T8730]  ffff88810e8c5600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  129.518222][ T8730] >ffff88810e8c5680: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  129.521469][ T8730]                                      ^
[  129.523679][ T8730]  ffff88810e8c5700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  129.526829][ T8730]  ffff88810e8c5780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  129.530099][ T8730] ==================================================================
[  129.533599][ T8730] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  129.536467][ T8730] CPU: 1 UID: 0 PID: 8730 Comm: syz.0.757 Not tainted syzkaller #0 PREEMPT(full) 
[  129.539995][ T8730] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  129.543887][ T8730] Call Trace:
[  129.545193][ T8730]  <TASK>
[  129.546382][ T8730]  dump_stack_lvl+0x99/0x250
[  129.548195][ T8730]  ? __asan_memcpy+0x40/0x70
[  129.550027][ T8730]  ? __pfx_dump_stack_lvl+0x10/0x10
[  129.552058][ T8730]  ? __pfx__printk+0x10/0x10
[  129.553916][ T8730]  vpanic+0x281/0x750
[  129.555605][ T8730]  ? __pfx_vpanic+0x10/0x10
[  129.557377][ T8730]  ? irqentry_exit+0x74/0x90
[  129.559144][ T8730]  panic+0xb9/0xc0
[  129.560603][ T8730]  ? __pfx_panic+0x10/0x10
[  129.562370][ T8730]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  129.564705][ T8730]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  129.567086][ T8730]  ? __xfrm_state_delete+0x696/0xca0
[  129.569188][ T8730]  check_panic_on_warn+0x89/0xb0
[  129.571183][ T8730]  ? __xfrm_state_delete+0x696/0xca0
[  129.573262][ T8730]  end_report+0x78/0x160
[  129.574941][ T8730]  kasan_report+0x129/0x150
[  129.576738][ T8730]  ? __xfrm_state_delete+0x696/0xca0
[  129.578805][ T8730]  __xfrm_state_delete+0x696/0xca0
[  129.580858][ T8730]  xfrm_state_flush+0x45f/0x770
[  129.582814][ T8730]  pfkey_flush+0x13f/0x340
[  129.584624][ T8730]  ? __pfx_pfkey_flush+0x10/0x10
[  129.586522][ T8730]  ? kmem_cache_free+0x18f/0x400
[  129.588420][ T8730]  pfkey_sendmsg+0xbfe/0x1090
[  129.590279][ T8730]  ? trace_sched_exit_tp+0x36/0x110
[  129.592339][ T8730]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  129.594407][ T8730]  ? aa_sock_msg_perm+0xf1/0x1d0
[  129.596392][ T8730]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  129.598474][ T8730]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  129.600475][ T8730]  __sock_sendmsg+0x21c/0x270
[  129.602345][ T8730]  ____sys_sendmsg+0x505/0x830
[  129.604225][ T8730]  ? __pfx_____sys_sendmsg+0x10/0x10
[  129.606316][ T8730]  ? import_iovec+0x74/0xa0
[  129.608109][ T8730]  ___sys_sendmsg+0x21f/0x2a0
[  129.609992][ T8730]  ? __pfx____sys_sendmsg+0x10/0x10
[  129.612076][ T8730]  ? __fget_files+0x2a/0x420
[  129.613877][ T8730]  ? __fget_files+0x3a0/0x420
[  129.615726][ T8730]  __x64_sys_sendmsg+0x19b/0x260
[  129.617681][ T8730]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  129.619804][ T8730]  ? rcu_is_watching+0x15/0xb0
[  129.621652][ T8730]  ? do_syscall_64+0xbe/0x3b0
[  129.623521][ T8730]  do_syscall_64+0xfa/0x3b0
[  129.625275][ T8730]  ? lockdep_hardirqs_on+0x9c/0x150
[  129.627282][ T8730]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.629570][ T8730]  ? exc_page_fault+0x9f/0xf0
[  129.631357][ T8730]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.633607][ T8730] RIP: 0033:0x7f11d818ec29
[  129.635381][ T8730] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  129.642957][ T8730] RSP: 002b:00007f11d8fda038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  129.646173][ T8730] RAX: ffffffffffffffda RBX: 00007f11d83d6090 RCX: 00007f11d818ec29
[  129.649239][ T8730] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b
[  129.652364][ T8730] RBP: 00007f11d8211e41 R08: 0000000000000000 R09: 0000000000000000
[  129.655567][ T8730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  129.658624][ T8730] R13: 00007f11d83d6128 R14: 00007f11d83d6090 R15: 00007ffdfeb80168
[  129.661713][ T8730]  </TASK>
[  129.663605][ T8730] Kernel Offset: disabled
[  129.665290][ T8730] Rebooting in 86400 seconds..

VM DIAGNOSIS:
11:01:16  Registers:
info registers vcpu 0

CPU#0
RAX=8f1654d295d20100 RBX=ffffffff819683f8 RCX=8f1654d295d20100 RDX=0000000000000001
RSI=ffffffff8d9b06d9 RDI=ffffffff8be33f00 RBP=ffffffff8de07eb8 RSP=ffffffff8de07d80
R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4
R12=ffffffff8fa2ee30 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a20
RIP=ffffffff8b72e3f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b863d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00002000000044c0 CR3=000000010e8e2000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f696b9a7498 00007f696b9a7470 XMM03=00007f696b9a74a8 00007f696b9a74a0
XMM04=00007f696c50d100 00007f696b9a7460 XMM05=00007f696b9a7478 00007f696b9a74c0
XMM06=00007f696b9a74b8 00007f696b9a74b0 XMM07=00007f696b9a74a8 00007f696b9a74a0
XMM08=0000000000000000 00007f696b812f0f XMM09=0000000000000000 00007f696b812fed
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000079 RBX=0000000000000079 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000001119 RDI=000000000000111a RBP=00000000000003f8 RSP=ffffc9002878eeb0
R8 =ffff888106f88237 R9 =1ffff11020df1046 R10=dffffc0000000000 R11=ffffffff854fac30
R12=dffffc0000000000 R13=ffffffff99ad790a R14=ffffffff99dcc480 R15=0000000000000000
RIP=ffffffff854facac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f11d8fda6c0 ffffffff 00c00000
GS =0000 ffff8881a3c3d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f11d8fd9fc8 CR3=000000010d7d0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f11d83a7498 00007f11d83a7470 XMM03=00007f11d83a74a8 00007f11d83a74a0
XMM04=00007f11d8f0d100 00007f11d83a7460 XMM05=00007f11d83a7478 00007f11d83a74c0
XMM06=00007f11d83a74b8 00007f11d83a74b0 XMM07=00007f11d83a74a8 00007f11d83a74a0
XMM08=0000000000000000 00007f11d8212f0f XMM09=0000000000000000 00007f11d8212fed
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
