last executing test programs:

2.726906375s ago: executing program 2 (id=771):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4)
bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x20, 0xe8}]}, 0x10)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f00)={&(0x7f0000001dc0)={0x28, 0x15, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x5}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x5}]}, 0x28}}, 0x20004000)
sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
sendmmsg$inet(r2, &(0x7f0000000e40)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000a40)="44b896818dd13e040b09e9ff5327615afa549fe545b6e79585e067af4328bcc41f778fcecf104cf2318418907de2bda01878a558af061d15e45bfcba7610e1717120c4cd89550ca5069f6a023247437795a1028586291e3ff5ae2d9cd5d53032ac1d8e3f03fda211e4e8b45b57f046dcfde576d968f876c7f903e2fa43dca292ba5c8b339bb8d32875e723f56bf3f8c656c5c528a5b6976144b187c3d58e6bcb45d0236937b54f453e4f6db1a782473b11431baad933e77f6f394fcbec25197f80c65b92d44f127521fcbb98834bb63497275e62728c2cbdc74c00fe08a87b6b289b57110406423a213e83d1fc90e352b7ebdf6a7de4dfca1639d411be33644cafb5342e5653b5c01fce094b85f2af40d7feb1798e5cb1d29daa5def62e1aebf349a8801ab83566259fdb9b404f3d53ddb2ebdf1f25336da5560b6264253327846a1735ef6d24fcfc8dbe6ed7f05dee713c26b5912fbf3ef8fbdcea57709fd9840cd1e93c6397528fffeadc580a1758834f7266a7dd63f9b3f15185a9373beb9bef45bf0ce359f523be49540d1f6cc546e55d0997e7ac631a60bc084f1ab2d51d666a6ae1210ee05d21a2be362e2d4143f765317921bd355f58363b83a93adacd2a3a55da508c627adc43e2f812b1d639b5f210e9f57cf112cc502f9f8ee41569f3b485d95adfcd3dd078b7aababc5a604751bcebd2e703065485474410bf05de82509eea11a76173967b825ef781dc5fa072c10760136f921275805d2a7c4695fec50bee14af2a0c1768a36a44ceefcd6603d300b27b1a386483f7eddb2b9258aa7b5973101163ae29b5410f6902e46af5d4e023d1fc0f8bc25e2c28e2b5f23a0a944f92b5000fff978bc21cdd864f8eddfb3644aaecefb0966adf1ee3d669400c3c5f57bc9c9701f57a5953d5113d732634c0bf6ec4a84ae389f0c51b2683d7532235aee8a20ccd0100ef2cc3523c2f3d9eb2dd7314fe4b400b700b893148031ceb55715352db73da9debaa8806fab91497d0d561bd0bf2b8fbf810c23bed7bf2792bcc6738044f94f", 0x2ea}], 0x1}}], 0x1, 0x0)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4)
sendto$inet(r2, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x8e}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x76}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70)
connect$inet(r4, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0)
sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0xbc, r5, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2c}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x56}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3c9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xffffffff}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x60}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x46}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x20048010}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$igmp(0x2, 0x3, 0x2)

1.849741564s ago: executing program 2 (id=783):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8)
r1 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r1, &(0x7f0000002d00)=[{{&(0x7f0000001080)={0xa, 0x4e22, 0x1, @private2, 0x10001}, 0x1c, &(0x7f00000010c0)=[{&(0x7f00000011c0)="e6", 0x1}], 0x1}}], 0x1, 0x0)
shutdown(r1, 0x1)
getsockopt$bt_hci(r1, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9)
setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, 0x0, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001200)={0x1f, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000490000000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000008c0)="89", 0x0}, 0x32)
setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000080)=0x49e1, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0)
r3 = socket(0x29, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xe, 0x5}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x3e, 0x1, {0x0, 0xb, 0x5}}}}, @TCA_RATE={0x6, 0x5, {0x9, 0x6}}]}, 0x48}}, 0x4000010)
syz_init_net_socket$netrom(0x6, 0x5, 0x0)
bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e23, @broadcast}, 0x10)
sendmsg$IPSET_CMD_PROTOCOL(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000000106011a50e471f7cc04210400000000000000000a0000030500010007000000050001000700000005000100070000000500010007000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20004011}, 0x200488c1)

1.488562236s ago: executing program 1 (id=791):
socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14)
socket$isdn_base(0x22, 0x3, 0x0)
socket$vsock_stream(0x28, 0x1, 0x0)
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10)
pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0)
r3 = socket$kcm(0x11, 0x2, 0x0)
sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000100)=@ieee802154={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0202}}}, 0x80, 0x0}, 0x24040008)
socket$unix(0x1, 0x5, 0x0)
r4 = socket(0x10, 0x803, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4)
connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000003c0), 0x3)
getsockopt$bt_hci(r5, 0x11a, 0x2, 0x0, &(0x7f0000000040))
unshare(0x62040200)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x42, 0x6, 0x8, 0x0, 0x1}, 0x48)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r6}, 0x50)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000300)={'gre0\x00', 0x0})
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r7}, 0x38)
shutdown(0xffffffffffffffff, 0x1)
recvmmsg(0xffffffffffffffff, &(0x7f0000000180), 0x3db66e6159adff3, 0x10100, 0x0)
unshare(0x42020000)

1.148916618s ago: executing program 0 (id=794):
socket$nl_xfrm(0x10, 0x3, 0x6) (async)
r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000005c0)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYRES8], 0x10) (async)
close(r0) (async)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
listen(r1, 0xd75)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{0xffffffffffffffff, <r2=>0xffffffffffffffff}, &(0x7f0000000500), &(0x7f0000000540)=r0}, 0x20)
ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000380)={0x0, 0x0, "3b05829cb4f83234965bf0e7670faaeffce54967a307ce873d4e80b5e0799060c7383e6114ef31d1ac55ce4a65927d4023ff5b1ee624e189dcba631c71d81280e60c05131a163a8daea6ad8524a0b18ac5603081ccc8dba31fd18ce5488e1d1150af79440e1dd80410949612746cf56a7dbc8152b34a070de02ed2911d29f69143bcc2aa14b8bf53fc78a07b4f286606e956c0a6646dd44faa6ba91f520c45f649447f00ec6fc14b9f203be7caea3db5fc51ed3d2912d9bfa3a499c13ee16550a7de7ef3b57bb6e412b59607d6ef6bea1a837a0eb06603dadc75617c965d177a51ce67e6ff16bec2da30507131118acac772f4a34dd69207b48e76d184f24624", "3692c060b69848833718a2c5f1719c940907f788ca829c30d25c80b18575afa8b1b0d9ea23777ad7cb8316498e6b431c44c86f97f8b699cdc2f24e84cab30fa88cc16761dc7a64bb6fdfae161d99393fe631770adf7c0e3cbe8d4677b6bc737df343a0a1480745d40a9c98d32c9d71a325050297214180acc049e7a087c91ef109697ef2389dd24c3b8ced68c239efce89392910b5381e65ef689caef9c81c860b2aded57c45d4634a11accdc66e6afb0b23dfebfac9ebb7a2a36ccb64b8c11e0a2e60e428334b59f9109b3990d4391040080b6e02a14e37d2034b74fc6ce514ea640dbcc1bd705cb65fe9ac3652ea8d588380da31fea9776002ae687b0d2fc2c178cdce3c5dcd05f38b514016c06d5ad9c7c1615c73836787ee6bc1264a4c16794fde33b7cf77cf295a6eeb015d5ffeb4975b2782429be145e2a5c30e9b9c1341db467d273e72dae678a68d6dd6342e9ed485e0bd429d4ec5cf64f952231bd6f4df64aca13b6cf6a3cd3836749c06da20fb1227de9687fbb5842cf99a64dbd3b81437d344770fca1252c728c386253dd72d4b08cef200eebe149e6e4fcf3e03e89f74b6bf5ce5a48a901926745af89d53d40581f54dd1baacd92fbd1d76e8af0928fce3fb8f60fe2b0f98d648213914d255366dc45706dc7722062d7d4d96e424f9c75f6b7a42ca86fb6a525e522c8c7857385c672d678faec2a4dff67ad2ea7ac845cc79513a91424a406365ccfb6debd3518c71e1f78f44d4f1a1e8f53e600f547da67311098a3d775a55dbaac45ac7df53b80f2c31f4658671e83ccfc445fdca561e01b2920c13576d6f8b808f4060186e4d31b6b4445fd9bfcaaf71326ac15e343b7906c5d5676894566befb725ddeb672e2e3e6c3f52247fbdab2344b88bfae6369f596d537fcbcdba64de80209b28ab2f8add45d2bc60d691dbd22fb2fe3f8f288232ad6fce6d2abc07880e253460aa5433cd98a331d007d0e3e7d7ece1f3764d883b21dc5644ad5b5b8f190db50cbf1e247c3c204813af1fa06713427d50476e0a96a44168658bc9666c1b1f1e4d097c9789e0313223a9641a7ad938b6562cb4a13b90b1a15b8f6b4e6075dd0e59b33f966509dc34ae16a51b27eb069b4bb77ac0bd3af1a0df0d817622057f681bc38047c249db8e89ec57c1c0beaebed49b15767f89e7534f33a73b265d1dc97ea4871dab2af20fc1bfe87dba4351b82ee7aaabffbca7d0b01ad68b1ccb0b3182c090aefc6e4dc3d229bba0b7063075bb1f1ffea60d9599c00f801b0a21f850e72168783a3ab336248fdc5601f2c2fce1a5d36efcb72c4a63ed43681000cd86831f4d6b1f81733e32667ddf235f0204990c4c8fa0c33c7169067c6ce9c1f8e7f31b55e31036d661833d47bf3762d222eddf049634464e720f3c73a6c5a4ea70c95916610a85625507d3db98a57003bf9204c8d87c2d6ac14b491ebe13182c0cbbd7220273f53c8bd019ade137107f060b3daecff66335eccd855fc6553bbd5bd2b87cd2c799b214a60c8ace0c072a782f7a2efa8a8cd0d6f8dc4aaaee4c3606f7300242dd0f37a9f82e29220e11d7e50e4a1ed9573c6c3d4f2525b579282e240aba598ca28f007cc15203cbca7ddb60af2933a2b887acc51e2805656411cd0fc8742e4b2f9a731c0aa94c50e0501fc3a605231b0b464d0aa3941a5de64153db6a2fd78a23411605092e9db59a7ac22cbbbf985330f4e8dcd388d16d96493cee6cc83a8afce01560f127b29fb0a24df2cd29baae5164b6a22f3ea2264057fdfbce1d69e1db0603ae48a01846d577a32afff1db490e7953cf80c3db63a7cba4636ae6389671205f3bc91c2c0595fffa208309605d23504b81382b743dfb45c68bc629622a0b16ab499bed25c6d998b90ea340c31376080217a07073f7ea2c257882ac11b8dbbbbef3805df7c58326038d33acd23dd38fb09339647d8a97eb2031984ee183e334711b53f4404ca07fc47adc847b16c6932fe08943c825d049e6f6233071f6eb931636b175eac62313d0a1abddebaed417eec250b2e573aefd1a9d682d22ce45fe560fca8b12d5a037fa81c215dad646cb11c720dfb9b980a6ac44ec4b6e95c27eb8bb058e298873c7bef80d8bc6e097927ad6707242bdc1a9f2341436a2f4e8059adb310b94a3190353dfa1a28c66990851669c8c082847a3fe27494c5dfbca82b88636fea3fec2a9d03e70b676d959ad92c842458916c78de7ee3bd8ed7193fab1cfbf80ebaba0ce67b36bcabf96715989ba850f93eb6bc4088267b9a1cd99d95e0aea7b091967edecb87d4b848ee5457d0a3d9e1b0bdeb033bf6455ae45320f1b80ace746b49b17f22b6e471ed7e618203ea0b3ba96875edb9632585742af79a7d6ec1412d52cfac21671522bfb82bc690f12fb1fd8125a19c7d2ad1fc8be0cc1e6f079d4f38586e329e886077a0bb23ba534ef418bfdce5c043c1ba17d664647d31a23aa83375c075c6e20ee261d6e43d6e30af38d9a40d7866c3cd7f67b0aae8580bdc2220de06c98393751ad3b360f3e704c687be46cdebe0e782cafa7b00e5b943941a3a309cfb9e6e2a08df0b35e8b0f086b3a47ff983c06aa4073b96f0e83eff4e539b81480b418f5873fd5499de10d61a72b039ec936d1d5ac9b9d7408d25a9e5569620eee08744302b047eca9decec6dfb0e40c51569eb5e1f5af448146276aa4b10bd8d1b6c8c5b2d2957e9153ac212541fa61a2b855d07229ee9162bc2cc679942e416c7ed6f56ccd4bb2904746600cfc01527345c2820a06b741afea6c0ac0a3fe16e74d73a4ebf2586e9ffa4b6e046cdfa5b77c78c909eaae7cce8f99743ce10bc1483889b73168109526d016e2497bcd1e522b8cdf16d9b933a4f44cced017a06ae1826458ebab0d69cdfe3766307120287ed4c65c0697ab9145daca822109b3dfeea0d3e84f727ab9782e3b4ef3c24a504ebc045578620ba86e641a3890de0106f7a5c8cc8bd80533467ff532b1a7e3ab4895ebbaea70447025cfeda104c02e567d6ad85d3b46a3efdba55e63c69c0c60353855d13ecd32ff73e0dd71c4a15ab44ac20d158e3ba3410dc38cb0806b3ef2c60c8fb53646cd474d50d397cdc51062150d831567e483784ce8cbbfb1e55836c4d43878c305a7a9bc7bc34f7a73eaed0af0904711f04b344cec8987169e5332d54ca222ea1e0273ef4ce291239f83d1d126c396a1f003cebb6f42540ac43fe6587b91e0fae1e1b86b13e528b875769034c47db7db99962342b7f06ba6e372ba32b42f8420a9b8cf50bd780b5ab5f80351665bced6114ae73779ca0b0e1fd70fe32abc7465b5b8c18c9251e6d22b1e51acbcddf37b95d14f7f526f0dc62b1fd88d64e19fc307e3b4b8c73cb855bf88504482cd3d6726a654ae951b551de92d0d148be3040ce3f7b14a6fdea0076aa5dc1a1c1bf55f2f80918b83e848ab0ca1f2f1506c4e8848abb2c5fdb772ea3980bfa7df0217f50c8f6a285bb17bc3d063d998e6e22fb105588b4aa786202914f3473f38183b290bf251888a41a2005e803c44a9a6723dc035cc7b73562d38217724e89d1154f4809d94c69b6d07d31d01258a26f736bf8f82658be735bce93905ac652f71feae45937100b274f125b9c8e9d5f74688be92db450eaec2b00ea5fa5907a6581b77791758ca9b2c7c77395bb07fc93064b8848d1876d1ee07ed19e120486de2eedd764bdf92a2759a619f49717c399cf3cc35c97543cb2040256796015af1bccc4ad170b0b3f02e6c2975e706250aded3d513b8eb2f79173d5ed0c81baee8743276879c6fe085bed26351baf3991f7193586bd7eff5a5bb7927ad139997b91df8268d7cf231ba30691acde5c8549299ec87397db53a16fdb63bf227e14470431e7654f43430a90a4dbc3575297f940a56085b0a663165fb05445a13cafe51bf35ade00243900823d79977133e317853489ac1c8ebe49a323acde37f16330d3b5f1a4208ce4e56a6e7a1426fca819ea7350356ef50ecc302ee650fa7d3da663e587809c627329736d84f62d7cfa6aac843397aec06a4ac2d4f1cfb0b2cd64360d155bc534887b926f9cb2c00399cda4eddcfbe2fb7f378cb2d10d8307e35faf1778d63590b2c3337c7249721c9b58a76dd7503a0c16e2bfb88222279396d80d8b4e41ffaef65f984265c36dfac466a5ddae82f492902326b90fd82a267af7612ed2929ba574164b382a44785a0fe7958e1ff0a4134b96d728528a21e294b21cf01132d8e2b4a556b1aa068ff3c6d277450016d063ea40f4a11b862128f459a896a8589ec96e919aea712e54c051b6b9f487d5892c740477a0e111937ba1d338f48552a2cf1469615f60b31bd17fc163dec6473ce5275d477d0fb9589ae0299d9d040f6a777da2d66024de54beb7c80d87b18aed6419b89c46ff9c787c06db7febcc3d60eb3a211b4006c1d209653ce791f61d722de2fbd760f32d1d966690ed8fc226330306a6769f0e7d9c205757c82af0a68a867baefe4456d1ef1296f0ea6ed568d5b6a5d9ba873c17dd2f8039de59138723871c0530071403e57281929593a51330fdccb77cdcd3047f31fa14c69df22f29efe2362a4d9e93b48e091ba45a3b270bbf524e7da9cfb10a9433329f5a414cb19bda46193caea6984ad24e25aebd89edce7c362e1ad637255abaeb72ee2d55d78e23ca592d654257ee4be3963c6d5f94ac48270b094dbf6e28c4cb6201682d2df6607434d51e8321301874034b34159a7fefb8022340570bf09430df0e12c4b5cd9ddd633aa5c60b0493c3cb5855c1bf16649bf615de60c05b839c000997d8bc1f34ed54c82e4eb3354a38e2e946269a57035d6a41851a29b5b041043dc5311b31df46c55cfff8eac9c6bb4d4fbb9d08fdbfef0c734a745ed97d33751df674394ff178aeac56ecdaaa93c636f3a4d8cbbc02be64ccc9e4078f302680628f980eb025497a5dea560c5291993c3f6427cfdcb315a2ac8700a04fd6b0898bba653312a20206ffdbe744917c30cdddac40fba7eb72988f001ca16ca1882bc431a21c7de192ef2df2f06da0421c0a4570b90b5ba46f027371ddac67c5d171a63d0172e0432f4f6d937fa1f2dae1cb8334410fe2abc735deebae86e8029fc91362048974b0d4692da96180004a4cc77756a19e145f38c7d4690a966ccb4dc8432deefe232aec4cd72761ec722ecc80956c4aa7c088a64cb57b3a103306ae17b920831bc1b44aca6a0aedb509ef4dde183d2fb898d4b5a6fa3b44b79291c4330edaa90122a65c360c0fc2f055a4fd2f315b676f63610cc8b56e28f63fd77b683d0116f6beb7da2f67e9e77a7e101db64288c2ab05569be888cb767653ba69b43cd5febe3b8ba16a097e66134730c11f5ef4801bd8ec5c993317a906d4db5"}) (async)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={<r3=>0xffffffffffffffff})
shutdown(r3, 0x0) (async)
recvmsg$unix(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@cred={{0x1c, 0x1, 0x2, {<r4=>0x0}}}], 0x20}, 0x0)
syz_open_procfs$namespace(r4, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000280)={r2, &(0x7f0000000200)}, 0x20) (async)
socket$inet_icmp_raw(0x2, 0x3, 0x1) (async)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async)
close(0x4) (async)
r5 = socket$l2tp6(0xa, 0x2, 0x73)
sendmmsg$inet6(r5, &(0x7f0000002c00)=[{{&(0x7f0000000100)={0xa, 0x4e21, 0x8, @dev={0xfe, 0x80, '\x00', 0x17}, 0xc}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=[@dstopts_2292={{0x14, 0x29, 0x4, {0x2c}}}], 0x14}}], 0x1, 0x40010) (async)
syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@ipv6_newrule={0x60, 0x20, 0x803, 0x70bd26, 0x25dfdbfb, {0xa, 0x10, 0x80, 0x8, 0xdd, 0x0, 0x0, 0x2}, [@FIB_RULE_POLICY=@FRA_IIFNAME={0x14, 0x3, 'syzkaller1\x00'}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x20}}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x4, 0x10001}]}, 0x60}, 0x1, 0x0, 0x0, 0x20048001}, 0x4000004) (async)
bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'gre0\x00', &(0x7f00000001c0)={'erspan0\x00', <r7=>0x0, 0x7, 0x8000, 0x3, 0x3, {{0x14, 0x4, 0x0, 0x7, 0x50, 0x67, 0x0, 0x5f, 0x29, 0x0, @private=0xa010101, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@timestamp={0x44, 0x14, 0x44, 0x0, 0x0, [0x12a6, 0x4, 0x3, 0x3]}, @ssrr={0x89, 0x7, 0x72, [@multicast2]}, @noop, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x1b, 0x11, [@empty, @multicast1, @empty, @broadcast, @empty, @rand_addr=0x64010101]}]}}}}})
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000240)=ANY=[@ANYBLOB="b000000008021100000108021100000008021100000010000000020000005819ea9fa1794bcb5a59e8cfee4e79a3a9fa906975f6e8c5e5fb4b2a7752d4f0577b8b1d139029cb85ebeccb91abbc45aeff414735599e0ffd6cc09be0941fcdcf0576a6b6905ab527f5d429e46f76cd9300fd3d6e25ecc487fdf313e106ab8f143bf99a2d6dd77b80ee0dac72e6fe8dda6411512da1be22b01577d6bea07ad502631d36af03"], 0x1e) (async)
r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001b80)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000042000000b700000000000010950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836801ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d09a0a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a504a0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e4a9f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r7, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}, 0x10}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r8, 0x0, 0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) (async)
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})

1.089710818s ago: executing program 0 (id=795):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802d000180140003000000000000000000000000000000000014000400ff010000000f000000000000000000010c000280050001"], 0xac}}, 0x0)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r2, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r3)
r4 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r4, 0x0)
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r7, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0)
socket$pppl2tp(0x18, 0x1, 0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002000)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
unshare(0x6a040000)
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
r8 = socket(0x2000000000000021, 0x2, 0x10000000000002)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="58000000020600000000000000000000000500000000000000001b7f5b920d6a47d20c0000000900020200000000000000001100030068f733e31f58"], 0x58}}, 0x0)
connect$rxrpc(r8, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24)
sendmmsg(r8, 0x0, 0x0, 0x0)
recvmmsg(r8, 0x0, 0x0, 0x10002, 0x0)
recvmsg$kcm(r8, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x12000)
sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)={0x24, 0x7, 0x6, 0x5, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x8800}, 0x20040000)

968.477592ms ago: executing program 2 (id=796):
socket$rds(0x15, 0x5, 0x0)
unshare(0x24060400)
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff})
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
splice(r0, 0x0, r1, 0x0, 0x100000000, 0x4)
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
shutdown(r2, 0x2)
sendmsg$inet(r2, &(0x7f0000001200)={0x0, 0x0, 0x0}, 0x20000000) (async)
sendmsg$inet(r2, &(0x7f0000001200)={0x0, 0x0, 0x0}, 0x20000000)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000440)={'batadv0\x00', <r5=>0x0})
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)={0x24, r4, 0x1, 0x70bd28, 0x1, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x24}}, 0x80) (async)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)={0x24, r4, 0x1, 0x70bd28, 0x1, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x24}}, 0x80)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
unshare(0x200)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000140))
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRES32, @ANYBLOB='\b'], 0x20}, 0x1, 0x0, 0x0, 0xc090}, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000600)={{{@in=@multicast1, @in=@loopback}}, {{@in6=@private1}, 0x0, @in=@dev}}, 0x0) (async)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000600)={{{@in=@multicast1, @in=@loopback}}, {{@in6=@private1}, 0x0, @in=@dev}}, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000540), &(0x7f0000000580)=0xc) (async)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000540), &(0x7f0000000580)=0xc)
r9 = getpid()
syz_open_procfs$namespace(r9, &(0x7f00000011c0)='ns/user\x00') (async)
syz_open_procfs$namespace(r9, &(0x7f00000011c0)='ns/user\x00')
socket$netlink(0x10, 0x3, 0x0) (async)
r10 = socket$netlink(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0) (async)
r11 = socket$netlink(0x10, 0x3, 0x0)
getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) (async)
getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000040)={0x0, <r12=>0x0}, &(0x7f0000000080)=0xc)
sendmsg$netlink(r10, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)={0x3c, 0x2e, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r12}, @nested={0xa, 0x0, 0x0, 0x1, [@generic="976b64086860"]}, @nested={0x15, 0x1, 0x0, 0x1, [@generic="3fb3ebf5f9cbd1185eeba9c895d0e5001a"]}]}, 0x3c}], 0x1}, 0x0) (async)
sendmsg$netlink(r10, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)={0x3c, 0x2e, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r12}, @nested={0xa, 0x0, 0x0, 0x1, [@generic="976b64086860"]}, @nested={0x15, 0x1, 0x0, 0x1, [@generic="3fb3ebf5f9cbd1185eeba9c895d0e5001a"]}]}, 0x3c}], 0x1}, 0x0)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000700), &(0x7f0000000740)=0xc)

899.064709ms ago: executing program 2 (id=797):
r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
close(r0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0f0000000400000004000000a2"], 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000500), 0x4)
close(0x3)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000000)=0x20, 0x4)
setsockopt$sock_attach_bpf(r4, 0x1, 0x34, &(0x7f00000000c0)=r3, 0x4)
close(r4)
setsockopt$inet_mreqn(r4, 0x0, 0x8d67b3f23ca55593, &(0x7f0000000100)={@empty, @loopback}, 0xc)
syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/pid_for_children\x00')
socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'veth1_to_bridge\x00', 0x200}, 0x18)
r5 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000)
socket$packet(0x11, 0x3, 0x300)

898.692339ms ago: executing program 2 (id=798):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0xfffffffffffffec7, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4041}, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r2)
r3 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x23c, 0x19, 0x1, 0x0, 0x10, {{@in=@remote, @in=@remote, 0x0, 0x0, 0xffff, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x9, 0x8}, {0x1, 0x0, 0x80}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, [@tmpl={0x184, 0x5, [{{@in=@local, 0x0, 0x32}, 0x0, @in=@broadcast}, {{@in=@local, 0x0, 0x2b}, 0x0, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x800}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x32}, 0x0, @in=@multicast1, 0x800000, 0x3}, {{@in6=@mcast1, 0x0, 0x33}, 0x0, @in=@private=0xa010101, 0x3504, 0x2, 0x0, 0x1, 0x0, 0xabf}, {{@in6=@local, 0x4d4, 0x6c}, 0x0, @in=@loopback, 0x3}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x2b}, 0x2, @in6=@private1, 0x0, 0x4, 0x0, 0xfc, 0x1}]}]}, 0x23c}}, 0x0)
listen(r3, 0x0)
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r7, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0)
close(0xffffffffffffffff)
socket$inet6_mptcp(0xa, 0x1, 0x106)
r8 = socket$inet6_mptcp(0xa, 0x1, 0x106)
getsockopt$inet6_tcp_int(r8, 0x6, 0x2b, 0x0, 0x0)
listen(0xffffffffffffffff, 0x9)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r10, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x800)

610.078484ms ago: executing program 1 (id=799):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}]}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x2400}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x88}}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40100, 0x0)
tee(r1, r1, 0x100000001, 0x6)
sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x84)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5)
close(0x4)
syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00')
unshare(0x6a040000)
r2 = socket(0x8, 0x3, 0x0)
shutdown(r2, 0x1)
readv(0xffffffffffffffff, 0x0, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10)
setsockopt$inet_mreq(r3, 0x0, 0x20, &(0x7f0000000080)={@private=0xa010101, @dev={0xac, 0x14, 0x14, 0x31}}, 0x8)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000300)={'sit0\x00', &(0x7f00000004c0)={'syztnl0\x00', 0x0, 0x7800, 0x8000, 0x9, 0x10, {{0x5, 0x4, 0x1, 0x12, 0x14, 0x67, 0x0, 0x9, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x3b}}}}})
syz_open_procfs$namespace(0x0, 0x0)
unshare(0x6a040000)
r4 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)={0x20, 0x140c, 0x1, 0x70bd28, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048005}, 0x4000)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="05000000040000c7f341d3e4b12125a000060000000400000000000000", @ANYRES32, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48)
r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x15, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r6, @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r7 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r7, 0x0, 0x0)

520.132948ms ago: executing program 1 (id=800):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
sendmsg$IPCTNL_MSG_CT_GET_STATS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x14, 0x5, 0x1, 0xfba55e05dbb73356, 0x0, 0x0, {0x1, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x800)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
socket$xdp(0x2c, 0x3, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000100)=0x9, 0x4)
bind$can_raw(r1, &(0x7f0000000000), 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x10, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="91102200001d000095ffff0000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94)
bind$can_raw(r1, &(0x7f0000000080)={0x1d, 0x0, 0x16}, 0x10)
socket$l2tp6(0xa, 0x2, 0x73)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
r2 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c)
recvmmsg$unix(r2, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_int(r3, 0x0, 0x14, &(0x7f0000000000)=0x40, 0x4)
sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000)
bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000016000000b4000000"], 0x48)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x8102, 0x0)
ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000240)={'ip_vti0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}})
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5)
r5 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000180), 0x35c, 0x0)
preadv(r5, 0x0, 0x0, 0x2, 0x5)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='westwood\x00', 0x9)
sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11)

378.09365ms ago: executing program 1 (id=801):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
socket$kcm(0x21, 0x2, 0x2) (async)
r1 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$inet(r1, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="14000000000000001001000002000000010000000000000014000000000000001001000002"], 0x30}, 0x0) (async)
sendmsg$inet(r1, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="14000000000000001001000002000000010000000000000014000000000000001001000002"], 0x30}, 0x0)
setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000080)=0x1, 0x4)
setsockopt$inet_int(r0, 0x0, 0x1, &(0x7f0000000000)=0xffffff7e, 0x4)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10)

320.109995ms ago: executing program 1 (id=802):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000200)=<r2=>0x0)
sendmsg$nl_generic(r1, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0xb8, 0x3b, 0x301, 0x270bd24, 0x25dfdbfa, {0x8}, [@typed={0x8, 0xb5, 0x0, 0x0, @pid=r2}, @generic="07dc24c5b56cedbffd3ab97d15b55845bf7f5ba4467f0f896f822d832281f91ce031758de3d23ab6f439a2d86f03c19d9889f7bb30416179a77e6ed4fc6c8931bb383542c595ae9541bd4036eaa5d7d214828fc626ee216822dd71794c8d4a55d94ac901ba1fae5e92c25d4dc61ffe9756e5ce2417afe48de3e3027809584da18146e1413100"/148, @typed={0x8, 0xbe, 0x0, 0x0, @u32=0x7fff}]}, 0xb8}}, 0x4000000)
r3 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4)
r4 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bond_slave_1\x00', <r5=>0x0})
bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x19, r5, 0x1, 0xb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}}, 0x14)
sendto$packet(r3, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x8100, r5}, 0x14)
r6 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x9, 0x4, 0x8, 0x2, 0x0, 0x1}, 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r6, &(0x7f0000000340), &(0x7f0000000900)=@udp6, 0x2}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1b, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="af000000000000007910480000000000730a04ff0000000095000000001d0000"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x4}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000180)='nv\x00', 0x3)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=@gettfilter={0x0, 0x2e, 0x200, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0xffff, 0x3}, {0xa, 0xffff}, {0xe, 0xfff2}}, [{0x0, 0xb, 0x80000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x40010}, 0x0)
r8 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
setsockopt$llc_int(r8, 0x10c, 0x6, &(0x7f00000003c0)=0x7, 0x4)
shutdown(r0, 0x2)

319.60319ms ago: executing program 1 (id=803):
socket$inet_icmp_raw(0x2, 0x3, 0x1)
close(0x4)
syz_open_procfs$namespace(0x0, 0x0)
unshare(0x6a040000)
socket(0x8, 0x3, 0x0)
socket$kcm(0x2, 0x1, 0x84)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r0)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c)
listen(r1, 0x0)
r2 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
socket$inet6(0xa, 0x5, 0x0)
r3 = accept(r1, 0x0, 0x0)
sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='P\x00\x00\b', @ANYRES16=0x0, @ANYBLOB="08002dbd7000fedbdf2501000000050005000600000008000200080000002c000680060001000a000000060005004e20000008000300e00000020500020050000000060001000a000000"], 0x50}, 0x1, 0x0, 0x0, 0x85}, 0x14)
connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x40c0)
sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x0)

230.273988ms ago: executing program 0 (id=804):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000180)={0x4000}, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00'})
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000600)=@mangle={'mangle\x00', 0x1f, 0x6, 0x618, 0x0, 0x318, 0x458, 0x0, 0xf8, 0x548, 0x548, 0x548, 0x548, 0x548, 0x6, &(0x7f00000002c0), {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x9}}]}, @HL={0x28, 'HL\x00', 0x0, {0x2}}}, {{@ipv6={@empty, @private0, [0xff000000, 0xffffffff, 0xff, 0xff], [0xff, 0xffffffff, 0xffffffff, 0xff], 'geneve0\x00', 'veth1\x00', {0xff}, {}, 0x84, 0x2, 0x4, 0xb06867b99a767b39}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xb}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x8}}}, {{@ipv6={@private2, @loopback, [0xff, 0xff, 0xff, 0xffffffff], [0xff, 0xffffff00, 0xba6617f9db2bb707, 0xff], 'vxcan1\x00', 'veth1_to_bridge\x00', {0xff}, {0xff}, 0x62, 0x7f, 0x1, 0x57}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}}}, @inet=@rpfilter={{0x28}, {0x2}}]}, @HL={0x28, 'HL\x00', 0x0, {0x1, 0xf2}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xc}}, @private0, [0xffffff00, 0xffffff00, 0xffffffff, 0xffffffff], [0x0, 0xffffffff, 0xff000000], 'erspan0\x00', 'vlan0\x00', {}, {0xff}, 0x8, 0x5, 0x1, 0x28}, 0x0, 0x100, 0x140, 0x0, {}, [@common=@eui64={{0x28}}, @common=@srh={{0x30}, {0x2c, 0x0, 0xd, 0x50, 0xa9, 0x0, 0x60}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0xe11d, 0xfffff4ef, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e24}}}, {{@ipv6={@loopback, @dev={0xfe, 0x80, '\x00', 0x2a}, [0xff000000, 0xffffff00, 0xff], [0xffffff00, 0xff, 0xffffffff, 0xffffffff], 'vxcan1\x00', 'nicvf0\x00', {}, {0xff}, 0x3a, 0x9, 0x0, 0x5}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@remote, @ipv6=@private2={0xfc, 0x2, '\x00', 0x5}, 0x3a, 0x19, 0x3}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x678)
sendfile(r1, r1, &(0x7f0000000040)=0x3c, 0x9)
setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000021c0)=0x1, 0x4)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x401, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'rose0\x00', 0x112})
r3 = socket$packet(0x11, 0x3, 0x300)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102})
ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000000)={'geneve1\x00', 0x400})
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'bond0\x00', <r6=>0x0})
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in=@dev={0xac, 0x14, 0x14, 0x28}, 0x0, 0x33}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {}, {}, {}, 0x0, 0x3502, 0x2}, [@offload={0xc, 0x1c, {r6, 0x6}}, @algo_auth_trunc={0x4c, 0x14, {{'sha1\x00'}}}]}, 0x148}}, 0x0)
sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="08002abd7000fedbdf250f000000050035008500000008003900ffff000008000b00ff01000008000300", @ANYRES32=r6, @ANYBLOB="08003200ff00000005002d0000000000e900310000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4050}, 0x800)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'rose0\x00', <r8=>0x0})
r9 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000011000100"/20, @ANYRES32=r8], 0x20}}, 0x0)
setsockopt(r0, 0x1, 0x10000000000009, &(0x7f0000000100)="0100ddff", 0x507b420f2d51f971)
connect$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, @none, 0x1}, 0xa)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e1d, 0x80000003, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x1c)

138.15571ms ago: executing program 0 (id=805):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='illinois\x00', 0x9)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000001080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @local}}}], 0x20}, 0x0)
recvmsg$unix(r2, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300)
socket$alg(0x26, 0x5, 0x0)
bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x3, @loopback, 0x8}, 0x1c)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4)
sendto$inet6(r0, &(0x7f00000000c0)="b2", 0x1, 0x24008844, &(0x7f0000000040)={0xa, 0x2, 0x80398, @empty, 0xfffffffe}, 0x1c)
r3 = socket$alg(0x26, 0x5, 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
ioctl$SIOCSIFMTU(r4, 0x89b1, &(0x7f0000000040)={'syz_tun\x00', 0xfffffffe})
r5 = accept4(r3, 0x0, 0x0, 0x0)
pwritev(r0, &(0x7f0000002640)=[{&(0x7f0000000080)="4b8306028add39187ab03b0a89e1eb35da49ebd909", 0x15}, {&(0x7f0000000100)="e1bef42e69c317e4e4eaa38ae641507c6575d87f587e22", 0x17}, {&(0x7f0000001180)="80e7b408f3265f47255c686f5497176bd603ccd9863ac98b743ca3cd1773ffc9d7f555119b42b2e0171587d45ab38d640baaa10f3bd7d0862325039f595d7ad262b73f44703e6592b802c1b32c149d544fcf629fff417a3117b21fcc2752daf8f39adb016adba2f8b6e67f43cc7be7e19e6645bf5a02793840dffa00496a6fd6445ffa8e5e6dc21bbbaa64cfda19cb89ca9a7381704c6dcbf8bbd97ac6994db5be14e1cd84d81cdfb5e42682cb79f59daeb8090e2b035ea38c0c91796f0d4784b94acab8b132da4b1a9a4bce543d285c9171d348f145bd89fa4ebf13a9f07898e6fd097b89216cccdf83013be4", 0xed}, {&(0x7f0000001280)="777de037455df358e33f3d74fbe09f6782ed1760355dd3d413ca0262a0f6af9b04ce087a1c428b174533e0fc128e460609fe0e0ed5daa9977e9ad9a4dcc60fca3ca325683736d8379e9f25071e9eb94ee01d745bd8ef3290e956f13907", 0x5d}, {&(0x7f0000000140)="cb7e7471b0862815", 0x8}, {&(0x7f0000001300)="2f3db8acdf20d0c25548796ae98afef973cdb4cf021357afe175408a4ad404bd19b9146a1d203e427f65428d529c5d5dbcdd614ac1373ae7a82ec142e050217a5da3f0b4ba1a9554f2441ada4c739558c4172676608b463a714795512c81ecab06d0cbaf9fed82a95f9d63a69170b19e6a0a2d0f29919f37588c736f0272ae6e250f1cb245a5caf95b3b527a77b288dfe2f85917e122507a9fc3cb993957e175bbf7dfc140bd0833c6692c2274f7c22802f9fedae423c35783d491fa", 0xbc}, {&(0x7f0000001000)="15c58f58719a4d54fbf26d7e07e805fb7e8a125d114c0994dc48274f8ae5a1087c", 0x21}, {&(0x7f00000014c0)="0ffaa446781d7f19f4cd6608623deb02895cd8c75fc4d83e650a0f42d5133d361beeef7f86689710cd4e71dba911c7542383e3ecaa48901104de262ecc10e7cc7da6f869684b242820a2605bd817cc477876c8c24d7d5736c8b1789ffcb7195733ac78777e57e79354fae311d4a7724144038a7d355433be4bf2ff92627f16f11e6afa6647a44dea8e071301307781b8ad4e0533420462179be6706ab2e7d4790453888b2e95c64e8f2aacd77e483edaa57ddf184b69a7", 0xb7}, {&(0x7f00000025c0)="328b02a57b450fd6f5041eff77e0aa4e1e7d634135ec7c70f9c6175fcac8cfae80883b970f4082932fee7b09b5afdc1585ffef6903b8b5030b219dec382a080237c40e287b8bf6f8491210656a941c6a68a243604ec2148778847dbe7a7372d80ca47c5d1e8a690b49ef279521ac1278d512a5", 0x73}], 0x9, 0x8, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
unshare(0x0)
shutdown(r1, 0x1)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
socket$kcm(0x29, 0x2, 0x0)
shutdown(r0, 0x1)

57.510094ms ago: executing program 0 (id=806):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r0) (async)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4)
connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) (async)
sendmmsg(r1, &(0x7f0000000ac0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4010) (async)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv6_newrule={0x44, 0x20, 0x1, 0x0, 0x0, {0xa, 0x80, 0x40, 0x0, 0x0, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x44}, 0x1, 0x0, 0x0, 0x42}, 0x40000) (async)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0)
setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f00000003c0)=@ccm_128={{0x303}, "4206f9c95436c8f0", "c66992cbf1eccd9bd21a7048c660caf3", '4w\x00', "3f7dc9959b100b76"}, 0x28)

53.603021ms ago: executing program 0 (id=807):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0))
syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000700), r1)
sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000880)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000840)={&(0x7f0000000140)={0x1c, r3, 0x10, 0x70bd2c, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x90)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
r4 = socket(0x8000000010, 0x2, 0x0)
write(r4, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000180)={{0x2, 0x4e23, @empty}, {0x20000010304, @local}, 0x0, {0x2, 0x4e20, @remote}})
r5 = socket$nl_rdma(0x10, 0x3, 0x14)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000b70200000100e0ff5070000028000000770000000000000095000200000000007ae9413df8ff0af5aa35339f4b382c4cad9db67dc983134d04ef2fd6fa7a9b857b72abaca100af1ba23d699b89e890c10500000000000000000000000000ac0e064c27bdfbd301150500000000000000bfdc995279d64072aacbb0595b95060000009ad3bf16a461e48e955a772d4062093f4cb1c3d9532abad2085401f098eb039ae4f4103699b9e079227e98cc07c09c1a72cb6d47cef1595e84d21951010f0274b1445a2ad6a7ad73827cccc21842599e0ae7b91f0b858b9267aa0b28d69a74ffdea613e892f0f9ff9468e4cb6dd65fd7bf3124702c6b1c2aea53ee0cb83ff180aa18b625d1667459c7cba77cedca0bff6d8370c33e2bd9cebd29c152ff9dc8c2772fe552fecfcd1778b0838100000031d521207e7423d86508416780983c2f380bc01cefe9773a9a5cd5b24aa24a561e72393c0ce2bf44825b05c1779fe74f884c2472ab45c2af60289cb199963312dd1929096c6f49d116f1612a7b97f77169fa5e8a66a372ef8e3ee7167f7d2a26fc6c3cfa4dc5860277223d6eb3460e3b10a0dc9495635a9fca19d7beb5e700498b43bdadc916c01264d22d7969530633f94b257fbc5da7a96820e31044c0b0f62619c9e351996185e4015510875b774666ba5c0ba9845ad25b578d7d714ff3a85586b9b452301f5470d0e0ae5d7f82f178f0c7c9c8f44c390c8a2c5be9e24a125420912ec9a3149f87b35ef1169f05e49164a4944e7b4da21f6f57020dd4f1f4f15edd7a0b1e24c6f79e3ea72a29c7928f000000006c5c8dddea685405273c7967d2c1a14efe0d53cb4b95a1ed7203000000ed52e5c08822cdcf2bc058ff9aab481926312fc7c88b1044e8c1c17d8c562edf69f4db96e059c49ec69a6086b5a3d24f4c8b10ab5f6a9f9eb5c881883e5671bbca4614df48103ca6e40891"], &(0x7f00000003c0)='GPL\x00', 0x9, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x1, r0}, 0x94)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r5, &(0x7f0000001a00)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="2800000011148d8a29bd7000fcdbdf2508004b001300000008000100000000000800030003000000320a55da2c5d5ef4f68f619cb083a5673149bc83e46a4831621f9acdb0cc90561b"], 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4004800)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001", @ANYRESHEX=r3, @ANYRESHEX=r4], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a40000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003140000001100010000000000000000000300000a357ba1d95cb63b7d4f529cb0036026c54783f2e6f4a467a5c0776f6317d94a7ee067d7811b5aaada9cbff00413403665f218e028aa824be3e43eeb04f722cc8d837e4271e3e923af5f1e62aeebb59fe3391901a148b42a7aacbaa059fa4068b685df2f84b9477ea9b74146ed237d988f01202adc52b6028060ae8fb40393803dde8fd3357d08fc51bff98555863070e6b08012248bd2d90f731f5838a6ffdd3b65e35eab711612a29f369abdbdac3390f36d6e242f1b670ee641c452cab0a64a47"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x20000841)
r6 = socket$kcm(0xa, 0x922000000003, 0x11)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r1)
setsockopt$sock_attach_bpf(r6, 0x29, 0x24, &(0x7f0000000080), 0x4)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0)
sendmsg$kcm(r6, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x8, @mcast1, 0x3, 0xffffffff}, 0x80, &(0x7f0000001880)=[{&(0x7f0000000780)="f4000900062b3325fe80000000000000dc8b850f238466cc00007a000000ad6e911b51818462b400", 0x28}], 0x1}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'bridge0\x00', 0xc201})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = socket(0x1, 0x803, 0x0)
getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14)
sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x4c, 0x10, 0x401, 0x70bd2d, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gre={{0x8}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x23}}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x4c}}, 0x0)
socket$kcm(0x2, 0xa, 0x2)

0s ago: executing program 2 (id=808):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3b, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0x4000000)
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4)
r3 = socket$can_raw(0x1d, 0x3, 0x1)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000340)='kfree\x00', r4, 0x0, 0x6}, 0x4e)
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000480), r5)
sendmsg$NLBL_MGMT_C_ADDDEF(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000300000000000004000000080002000500"], 0x24}}, 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, 0x0, 0x0)
r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7000000}, [@map_val={0x18, 0x0, 0x2, 0x0, r7}, @ldst={0x3, 0x0, 0x3}]}, &(0x7f0000000180)='syzkaller\x00', 0x3}, 0x94)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bond_slave_1\x00', <r8=>0x0})
bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x19, r8, 0x1, 0xb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}}, 0x14)
sendto$packet(r2, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x8100, r8}, 0x14)
readv(r2, &(0x7f0000000200)=[{&(0x7f0000000340)=""/145, 0x91}, {&(0x7f0000000500)=""/188, 0xbc}], 0x2)
r9 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000005c0)=ANY=[@ANYBLOB="09000000040000000800000002000000000000afa2c34d49ee411dda000a51075adb347e446bc2ec804bdfcba194dab745f1171ee9b74ef5d1f3b39003bc873d553ff6a28d", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r9, &(0x7f0000000340), &(0x7f0000000900)=@udp6, 0x2}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1b, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="af000000000000007910480000000000730a04ff0000000095000000001d0000"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x4}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94)
r10 = socket$rds(0x15, 0x5, 0x0)
setsockopt$RDS_CANCEL_SENT_TO(r10, 0x114, 0x7, 0x0, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000180)='nv\x00', 0x3)
r11 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r11, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=@gettfilter={0x0, 0x2e, 0x200, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0xffff, 0x3}, {0xa, 0xffff}, {0xe, 0xfff2}}, [{0x0, 0xb, 0x80000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x40010}, 0x0)
shutdown(r0, 0x2)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:55919' (ED25519) to the list of known hosts.
syzkaller login: [   48.358851][ T5805] cgroup: Unknown subsys name 'net'
[   48.565339][ T5805] cgroup: Unknown subsys name 'cpuset'
[   48.570857][ T5805] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.075167][ T5805] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   54.188097][ T5236] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   54.196062][ T5849] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   54.199394][ T5849] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   54.203149][ T5849] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   54.207161][ T5849] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   54.222594][ T5849] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   54.226565][ T5849] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   54.230281][ T5849] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   54.241553][ T5846] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   54.245301][ T5849] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   54.264942][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   54.268725][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   54.273021][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   54.276165][   T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   54.279006][   T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   54.534476][ T5848] chnl_net:caif_netlink_parms(): no params data found
[   54.611185][ T5843] chnl_net:caif_netlink_parms(): no params data found
[   54.625840][ T5853] chnl_net:caif_netlink_parms(): no params data found
[   54.697646][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.700675][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.704930][ T5848] bridge_slave_0: entered allmulticast mode
[   54.708891][ T5848] bridge_slave_0: entered promiscuous mode
[   54.746320][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.748924][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.752286][ T5848] bridge_slave_1: entered allmulticast mode
[   54.756117][ T5848] bridge_slave_1: entered promiscuous mode
[   54.797428][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.799929][ T5853] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.802968][ T5853] bridge_slave_0: entered allmulticast mode
[   54.806870][ T5853] bridge_slave_0: entered promiscuous mode
[   54.831271][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.834485][ T5853] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.837207][ T5853] bridge_slave_1: entered allmulticast mode
[   54.840144][ T5853] bridge_slave_1: entered promiscuous mode
[   54.846101][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.875205][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.879125][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.882241][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.884789][ T5843] bridge_slave_0: entered allmulticast mode
[   54.887509][ T5843] bridge_slave_0: entered promiscuous mode
[   54.925419][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.928572][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.933478][ T5843] bridge_slave_1: entered allmulticast mode
[   54.937408][ T5843] bridge_slave_1: entered promiscuous mode
[   54.950011][ T5853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.954751][ T5848] team0: Port device team_slave_0 added
[   54.958561][ T5853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.972956][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.976775][ T5848] team0: Port device team_slave_1 added
[   54.992899][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.023358][ T5853] team0: Port device team_slave_0 added
[   55.042226][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.044872][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.054098][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.059711][ T5853] team0: Port device team_slave_1 added
[   55.064369][ T5843] team0: Port device team_slave_0 added
[   55.074225][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.076559][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.085825][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.092746][ T5843] team0: Port device team_slave_1 added
[   55.119036][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.121579][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.131251][ T5853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.175609][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.179029][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.187931][ T5853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.196568][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.199426][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.209758][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.229501][ T5848] hsr_slave_0: entered promiscuous mode
[   55.232037][ T5848] hsr_slave_1: entered promiscuous mode
[   55.235552][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.238296][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.247516][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.302581][ T5853] hsr_slave_0: entered promiscuous mode
[   55.305669][ T5853] hsr_slave_1: entered promiscuous mode
[   55.308331][ T5853] debugfs: 'hsr0' already exists in 'hsr'
[   55.310411][ T5853] Cannot create hsr debugfs directory
[   55.349306][ T5843] hsr_slave_0: entered promiscuous mode
[   55.352298][ T5843] hsr_slave_1: entered promiscuous mode
[   55.354696][ T5843] debugfs: 'hsr0' already exists in 'hsr'
[   55.356769][ T5843] Cannot create hsr debugfs directory
[   55.619936][ T5848] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   55.633339][ T5848] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   55.639499][ T5848] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   55.653048][ T5848] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   55.685731][ T5853] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   55.693231][ T5853] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   55.707759][ T5853] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   55.722583][ T5853] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   55.750820][ T5843] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   55.757364][ T5843] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   55.769529][ T5843] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   55.776958][ T5843] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   55.859495][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.877082][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[   55.893916][  T327] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.896537][  T327] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.909301][  T327] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.912272][  T327] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.927282][ T5853] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.949633][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.970741][ T5853] 8021q: adding VLAN 0 to HW filter on device team0
[   55.984119][  T327] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.987220][  T327] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.999944][  T327] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.003147][  T327] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.011263][ T5843] 8021q: adding VLAN 0 to HW filter on device team0
[   56.026995][ T3322] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.029375][ T3322] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.051285][ T3322] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.054337][ T3322] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.217598][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.264492][ T5853] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.270480][ T5848] veth0_vlan: entered promiscuous mode
[   56.279669][ T5848] veth1_vlan: entered promiscuous mode
[   56.307532][ T5853] veth0_vlan: entered promiscuous mode
[   56.310737][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.322437][ T5853] veth1_vlan: entered promiscuous mode
[   56.329665][ T5848] veth0_macvtap: entered promiscuous mode
[   56.338335][ T5848] veth1_macvtap: entered promiscuous mode
[   56.343094][   T54] Bluetooth: hci2: command tx timeout
[   56.345543][   T54] Bluetooth: hci0: command tx timeout
[   56.347462][   T54] Bluetooth: hci1: command tx timeout
[   56.372934][ T5843] veth0_vlan: entered promiscuous mode
[   56.375489][ T5853] veth0_macvtap: entered promiscuous mode
[   56.383385][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.389529][ T5853] veth1_macvtap: entered promiscuous mode
[   56.394600][ T5843] veth1_vlan: entered promiscuous mode
[   56.398741][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.418745][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.428812][ T5843] veth0_macvtap: entered promiscuous mode
[   56.431436][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.436069][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.439636][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.444606][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.450081][ T5843] veth1_macvtap: entered promiscuous mode
[   56.454753][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.470295][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.475308][   T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.483983][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.487119][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.493574][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.496488][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.506049][ T5874] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.522915][ T5874] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.534985][ T5874] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.548046][ T5874] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.571739][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.575231][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.618176][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.622376][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.648492][ T1096] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.653882][ T1096] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.705518][ T1090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.711942][ T1090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.726051][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.728574][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.738908][ T5848] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   56.759103][ T1090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.770563][ T1090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.861440][ T5844] IPVS: starting estimator thread 0...
[   56.984016][ T5917] IPVS: using max 80 ests per chain, 192000 per kthread
[   57.006043][ T5925] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3'.
[   57.022440][ T5925] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3'.
[   57.025493][ T5925] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3'.
[   57.042637][ T5926] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   57.108578][ T5926] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   57.169408][ T5926] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   57.321881][ T5940] netlink: 'syz.0.8': attribute type 1 has an invalid length.
[   57.500382][ T5957] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   57.697305][ T5963] TCP: tcp_parse_options: Illegal window scaling value 254 > 14 received
[   57.700650][ T5963] netlink: 36 bytes leftover after parsing attributes in process `syz.2.13'.
[   57.707602][ T5963] netlink: 16 bytes leftover after parsing attributes in process `syz.2.13'.
[   57.710624][ T5963] netlink: 36 bytes leftover after parsing attributes in process `syz.2.13'.
[   57.713892][ T5963] netlink: 36 bytes leftover after parsing attributes in process `syz.2.13'.
[   57.802214][ T5972] dvmrp0: entered allmulticast mode
[   57.959865][ T5986] netlink: 108 bytes leftover after parsing attributes in process `syz.0.18'.
[   58.040044][ T5988] Illegal XDP return value 4294967294 on prog  (id 10) dev N/A, expect packet loss!
[   58.162117][ T5995] netlink: 8 bytes leftover after parsing attributes in process `syz.0.21'.
[   58.189607][ T5995] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   58.199550][ T5995] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[   58.280560][ T5926] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   58.412531][ T5846] Bluetooth: hci1: command tx timeout
[   58.414340][ T5846] Bluetooth: hci0: command tx timeout
[   58.415009][   T54] Bluetooth: hci2: command tx timeout
[   58.924745][ T6003] netlink: 4040 bytes leftover after parsing attributes in process `syz.0.23'.
[   58.927805][ T6003] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   58.930418][ T6003] batman_adv: batadv0: Removing interface: batadv_slave_0
[   58.935058][ T6003] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   58.937806][ T6003] batman_adv: batadv0: Removing interface: batadv_slave_1
[   58.993971][ T6006] syz.2.24 uses obsolete (PF_INET,SOCK_PACKET)
[   59.883791][   T12] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.896927][   T13] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.911418][   T13] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.914211][   T13] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.924430][ T6031] wg1 speed is unknown, defaulting to 1000
[   59.927098][ T6031] wg1 speed is unknown, defaulting to 1000
[   59.930137][ T6031] wg1 speed is unknown, defaulting to 1000
[   59.935944][ T6029] siw: device registration error -23
[   59.957542][ T6031] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[   59.977261][ T6031] wg1 speed is unknown, defaulting to 1000
[   59.987776][ T6031] wg1 speed is unknown, defaulting to 1000
[   59.993577][ T6033] wg1 speed is unknown, defaulting to 1000
[   60.005913][ T6031] wg1 speed is unknown, defaulting to 1000
[   60.066672][ T6040] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies.
[   60.179496][ T6044] wg1 speed is unknown, defaulting to 1000
[   60.415414][ T6072] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms
[   60.491692][   T54] Bluetooth: hci2: command tx timeout
[   60.495407][ T5846] Bluetooth: hci1: command tx timeout
[   60.504604][   T54] Bluetooth: hci0: command tx timeout
[   60.639194][ T6085] wg1 speed is unknown, defaulting to 1000
[   60.769221][ T6085] wg1 speed is unknown, defaulting to 1000
[   60.884507][ T6102] Zero length message leads to an empty skb
[   61.364117][ T6112] wg1 speed is unknown, defaulting to 1000
[   61.405029][ T6114] ieee802154 phy0 wpan0: encryption failed: -22
[   61.503955][ T6120] batadv1: entered promiscuous mode
[   61.506301][ T6120] batadv1: entered allmulticast mode
[   61.777603][ T6142] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   61.967764][ T6177] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   62.014973][ T6182] IPv6: addrconf: prefix option has invalid lifetime
[   62.067085][ T6187] warning: `syz.0.57' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   62.243122][ T6201] tipc: Started in network mode
[   62.244968][ T6201] tipc: Node identity 4, cluster identity 4711
[   62.247052][ T6201] tipc: Node number set to 4
[   62.571699][   T54] Bluetooth: hci0: command tx timeout
[   62.573584][   T54] Bluetooth: hci2: command tx timeout
[   62.575608][ T5846] Bluetooth: hci1: command tx timeout
[   62.589600][ T6218] team_slave_0: entered promiscuous mode
[   62.592330][ T6218] team_slave_1: entered promiscuous mode
[   62.608116][ T6218] macsec1: entered promiscuous mode
[   62.610395][ T6218] team0: entered promiscuous mode
[   62.771373][ T6227] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies.
[   62.835421][ T6230] lo: entered allmulticast mode
[   62.839021][ T6230] lo: left allmulticast mode
[   62.963830][ T6238] __nla_validate_parse: 2 callbacks suppressed
[   62.963843][ T6238] netlink: 104 bytes leftover after parsing attributes in process `syz.2.71'.
[   62.973383][ T6237] netlink: 104 bytes leftover after parsing attributes in process `syz.2.71'.
[   63.034218][ T6242] wg1 speed is unknown, defaulting to 1000
[   63.091253][  T792] IPVS: starting estimator thread 0...
[   63.104759][ T6245] ieee802154 phy0 wpan0: encryption failed: -22
[   63.192512][ T6247] IPVS: using max 45 ests per chain, 108000 per kthread
[   63.455221][ T6270] wg1 speed is unknown, defaulting to 1000
[   63.460047][ T6271] wg1 speed is unknown, defaulting to 1000
[   63.614163][ T6282] netlink: 24 bytes leftover after parsing attributes in process `syz.0.81'.
[   63.628842][ T6284] netlink: 24 bytes leftover after parsing attributes in process `syz.0.81'.
[   63.988597][ T6310] sctp: [Deprecated]: syz.1.86 (pid 6310) Use of int in max_burst socket option deprecated.
[   63.988597][ T6310] Use struct sctp_assoc_value instead
[   64.054834][ T6313] sctp: [Deprecated]: syz.1.87 (pid 6313) Use of struct sctp_assoc_value in delayed_ack socket option.
[   64.054834][ T6313] Use struct sctp_sack_info instead
[   64.060964][ T6313] tipc: Can't bind to reserved service type 1
[   64.072954][ T6312] wg1 speed is unknown, defaulting to 1000
[   64.342871][ T6323] netlink: 'syz.1.89': attribute type 1 has an invalid length.
[   64.434981][ T6324] netlink: 12 bytes leftover after parsing attributes in process `syz.2.88'.
[   64.469981][ T6329] netlink: 'syz.1.90': attribute type 1 has an invalid length.
[   64.595610][ T6343] netlink: 32 bytes leftover after parsing attributes in process `syz.1.95'.
[   64.599980][ T6343] netlink: 32 bytes leftover after parsing attributes in process `syz.1.95'.
[   64.611819][ T6337] netlink: 56 bytes leftover after parsing attributes in process `syz.0.94'.
[   64.614858][ T6337] netlink: 8 bytes leftover after parsing attributes in process `syz.0.94'.
[   64.618868][ T6337] netlink: 24 bytes leftover after parsing attributes in process `syz.0.94'.
[   64.757764][ T6356] Bluetooth: MGMT ver 1.23
[   64.815094][ T6356] wg1 speed is unknown, defaulting to 1000
[   64.823036][ T6362] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   64.843162][ T6359] wg1 speed is unknown, defaulting to 1000
[   65.134944][ T6370] wg1 speed is unknown, defaulting to 1000
[   65.323415][ T6375] wg1 speed is unknown, defaulting to 1000
[   65.675270][ T6385] siw: device registration error -23
[   65.699344][ T6400] netlink: 'syz.2.108': attribute type 1 has an invalid length.
[   65.703641][ T6401] netlink: 'syz.2.108': attribute type 1 has an invalid length.
[   65.886861][ T6422] netlink: 'syz.1.113': attribute type 1 has an invalid length.
[   65.889438][ T6422] netlink: 'syz.1.113': attribute type 3 has an invalid length.
[   65.895267][ T6422] NCSI netlink: No device for ifindex 246
[   66.432242][ T6457] wg1 speed is unknown, defaulting to 1000
[   66.637514][ T6473] wg1 speed is unknown, defaulting to 1000
[   66.733533][ T6484] bridge0: port 2(bridge_slave_1) entered disabled state
[   66.737364][ T6484] bridge0: port 1(bridge_slave_0) entered disabled state
[   66.846104][ T6484] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   66.858516][ T6484] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   66.914910][   T12] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.917700][   T12] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.920594][   T12] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.924392][   T12] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.931629][ T6491] wg1 speed is unknown, defaulting to 1000
[   67.139709][ T6510] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies.
[   67.185850][ T6513] wg1 speed is unknown, defaulting to 1000
[   67.275641][ T6520] lo speed is unknown, defaulting to 1000
[   67.277783][ T6520] lo speed is unknown, defaulting to 1000
[   67.280087][ T6520] lo speed is unknown, defaulting to 1000
[   67.287934][ T6520] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[   67.299176][ T6520] lo speed is unknown, defaulting to 1000
[   67.303132][ T6520] lo speed is unknown, defaulting to 1000
[   67.308374][ T6520] lo speed is unknown, defaulting to 1000
[   67.314718][ T6520] lo speed is unknown, defaulting to 1000
[   67.321211][ T6520] netlink: 'syz.1.136': attribute type 12 has an invalid length.
[   67.378813][ T6518] netlink: 'syz.2.137': attribute type 13 has an invalid length.
[   67.382458][ T6518] netlink: 'syz.2.137': attribute type 17 has an invalid length.
[   67.411724][ T6518] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   67.439868][ T6518] wg1 speed is unknown, defaulting to 1000
[   67.442948][ T6518] lo speed is unknown, defaulting to 1000
[   68.033327][ T6532] __nla_validate_parse: 6 callbacks suppressed
[   68.033337][ T6532] netlink: 44 bytes leftover after parsing attributes in process `syz.0.139'.
[   68.039297][ T6532] netlink: 35 bytes leftover after parsing attributes in process `syz.0.139'.
[   68.043734][ T6532] netlink: 'syz.0.139': attribute type 5 has an invalid length.
[   68.046955][ T6532] netlink: 35 bytes leftover after parsing attributes in process `syz.0.139'.
[   68.546184][ T6537] netlink: 44 bytes leftover after parsing attributes in process `syz.2.141'.
[   68.606829][ T6541] wg1 speed is unknown, defaulting to 1000
[   68.609725][ T6541] lo speed is unknown, defaulting to 1000
[   69.150021][ T6556] 8021q: adding VLAN 0 to HW filter on device bond1
[   69.159497][ T6556] vlan2: entered allmulticast mode
[   69.162233][ T6556] veth1: entered allmulticast mode
[   69.476554][ T6559] batman_adv: batadv0: Removing interface: batadv_slave_1
[   69.716138][ T6569] netlink: 20 bytes leftover after parsing attributes in process `syz.2.149'.
[   69.724875][ T6569] netlink: 24 bytes leftover after parsing attributes in process `syz.2.149'.
[   69.728532][ T6569] netlink: 24 bytes leftover after parsing attributes in process `syz.2.149'.
[   69.732763][ T6569] netlink: 12 bytes leftover after parsing attributes in process `syz.2.149'.
[   70.003003][ T6583] validate_nla: 3 callbacks suppressed
[   70.003012][ T6583] netlink: 'syz.2.153': attribute type 1 has an invalid length.
[   70.089223][ T6588] team0: Device lo is loopback device. Loopback devices can't be added as a team port
[   70.096180][ T6588] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   70.210514][ T6599] wg1 speed is unknown, defaulting to 1000
[   70.215981][ T6599] lo speed is unknown, defaulting to 1000
[   70.247413][  T792] IPVS: starting estimator thread 0...
[   70.353163][ T6610] IPVS: using max 80 ests per chain, 192000 per kthread
[   71.054903][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   71.057771][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   71.067263][ T6620] netlink: 16386 bytes leftover after parsing attributes in process `syz.1.162'.
[   71.207135][ T5874] IPVS: stop unused estimator thread 0...
[   71.266898][ T6638] netlink: 'syz.2.167': attribute type 4 has an invalid length.
[   71.293928][ T6638] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   71.297375][ T6638] IPv6: NLM_F_CREATE should be set when creating new route
[   71.465282][ T6651] netlink: 104 bytes leftover after parsing attributes in process `syz.0.170'.
[   71.511775][ T6653] wg1 speed is unknown, defaulting to 1000
[   71.519227][ T6653] lo speed is unknown, defaulting to 1000
[   71.765451][ T6659] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.847617][ T6659] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.919308][ T6659] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.978123][ T6659] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   72.077135][ T5874] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   72.092986][ T5874] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   72.104929][ T5874] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   72.120057][ T5874] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   72.470460][ T6681] netlink: 'syz.2.178': attribute type 1 has an invalid length.
[   72.660980][ T6697] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   72.732668][ T6700] wg1 speed is unknown, defaulting to 1000
[   72.735396][ T6700] lo speed is unknown, defaulting to 1000
[   73.228451][ T6739] __nla_validate_parse: 4 callbacks suppressed
[   73.228466][ T6739] netlink: 28 bytes leftover after parsing attributes in process `syz.0.189'.
[   73.243871][ T6739] netlink: 28 bytes leftover after parsing attributes in process `syz.0.189'.
[   73.608324][ T6771] wg1 speed is unknown, defaulting to 1000
[   73.611244][ T6771] lo speed is unknown, defaulting to 1000
[   73.645049][   T24] IPVS: starting estimator thread 0...
[   73.652554][ T6771] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144
[   73.731416][ T6774] IPVS: using max 81 ests per chain, 194400 per kthread
[   73.916586][   T12] IPVS: stop unused estimator thread 0...
[   74.249530][ T6784] wg1 speed is unknown, defaulting to 1000
[   74.255421][ T6784] lo speed is unknown, defaulting to 1000
[   74.309096][ T6786] wg1 speed is unknown, defaulting to 1000
[   74.315182][ T6786] lo speed is unknown, defaulting to 1000
[   74.348584][ T6787] ip6gretap0: entered promiscuous mode
[   74.350794][ T6787] : entered allmulticast mode
[   74.352587][ T6787] ip6gretap0: entered allmulticast mode
[   74.356178][ T6787] netlink: 16 bytes leftover after parsing attributes in process `syz.0.199'.
[   74.716451][ T6807] netlink: 'syz.1.201': attribute type 1 has an invalid length.
[   75.134265][ T6823] netlink: 'syz.0.207': attribute type 1 has an invalid length.
[   75.237872][ T6827] netlink: 8 bytes leftover after parsing attributes in process `syz.0.209'.
[   75.245523][ T6827] netlink: 68 bytes leftover after parsing attributes in process `syz.0.209'.
[   75.253498][ T6827] netlink: 28 bytes leftover after parsing attributes in process `syz.0.209'.
[   75.266121][ T6827] bridge0: port 1(bridge_slave_0) entered disabled state
[   75.270676][ T6827] bridge0: port 2(bridge_slave_1) entered disabled state
[   75.287895][  T792] wg1 speed is unknown, defaulting to 1000
[   75.410088][ T6833] netlink: 16 bytes leftover after parsing attributes in process `syz.0.212'.
[   75.414411][ T6833] sch_fq: defrate 0 ignored.
[   75.532348][ T6837] wg1 speed is unknown, defaulting to 1000
[   75.535161][ T6837] lo speed is unknown, defaulting to 1000
[   75.594606][ T6847] netlink: 'syz.0.217': attribute type 13 has an invalid length.
[   75.610565][ T6851] netlink: 'syz.1.218': attribute type 1 has an invalid length.
[   75.850038][ T6863] syzkaller0: entered promiscuous mode
[   75.852235][ T6863] syzkaller0: entered allmulticast mode
[   76.757048][ T6894] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   76.817402][ T6894] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   76.878497][ T6894] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   76.976039][ T6894] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   77.078331][ T5874] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   77.087399][ T5874] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   77.103989][ T5874] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   77.116258][ T5874] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   77.179413][ T6909] netlink: 64 bytes leftover after parsing attributes in process `syz.2.235'.
[   77.308675][ T6921] netlink: 'syz.0.240': attribute type 161 has an invalid length.
[   77.311529][ T6921] netlink: 20 bytes leftover after parsing attributes in process `syz.0.240'.
[   77.329351][ T6921] wg1 speed is unknown, defaulting to 1000
[   77.332226][ T6921] lo speed is unknown, defaulting to 1000
[   77.518328][ T6932] wg1 speed is unknown, defaulting to 1000
[   77.523642][ T6932] lo speed is unknown, defaulting to 1000
[   77.553288][ T6928] bridge_slave_0: left allmulticast mode
[   77.556932][ T6928] bridge_slave_0: left promiscuous mode
[   77.561801][ T6928] bridge0: port 1(bridge_slave_0) entered disabled state
[   77.575127][ T6928] bridge_slave_1: left allmulticast mode
[   77.577646][ T6928] bridge_slave_1: left promiscuous mode
[   77.580283][ T6928] bridge0: port 2(bridge_slave_1) entered disabled state
[   77.588072][ T6928] bond0: (slave bond_slave_0): Releasing backup interface
[   77.596406][ T6928] bond0: (slave bond_slave_1): Releasing backup interface
[   77.613109][ T6928] team0: Port device team_slave_0 removed
[   77.621036][ T6928] team0: Port device team_slave_1 removed
[   77.625136][ T6928] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[   77.662280][   T24] syz1: Port: 1 Link DOWN
[   77.673177][ T6936] netlink: 'syz.0.244': attribute type 1 has an invalid length.
[   77.790765][ T6940] netlink: 468 bytes leftover after parsing attributes in process `syz.0.244'.
[   78.461805][ T6957] __nla_validate_parse: 4 callbacks suppressed
[   78.461818][ T6957] netlink: 4 bytes leftover after parsing attributes in process `syz.2.249'.
[   78.641704][ T6965] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.714600][ T6965] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.779994][ T6965] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.832046][ T6965] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.958060][ T6981] netlink: 8 bytes leftover after parsing attributes in process `syz.1.254'.
[   79.000483][ T6983] netlink: 40 bytes leftover after parsing attributes in process `syz.1.255'.
[   79.053290][ T6985] IPVS: set_ctl: invalid protocol: 2 0.0.0.0:20002
[   79.114731][ T6985] netlink: 104 bytes leftover after parsing attributes in process `syz.1.256'.
[   79.186283][ T6992] netlink: 20 bytes leftover after parsing attributes in process `syz.2.259'.
[   79.222021][ T6990] netlink: 104 bytes leftover after parsing attributes in process `syz.1.258'.
[   79.265601][ T6996] netlink: 8 bytes leftover after parsing attributes in process `syz.1.260'.
[   79.406083][ T7000] wg1 speed is unknown, defaulting to 1000
[   79.409892][ T7000] lo speed is unknown, defaulting to 1000
[   79.551839][ T7014] netlink: 136 bytes leftover after parsing attributes in process `syz.2.266'.
[   79.555547][ T7014] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check.
[   79.572223][ T7014] wg1 speed is unknown, defaulting to 1000
[   79.575333][ T7014] lo speed is unknown, defaulting to 1000
[   79.676203][ T7020] syzkaller1: entered promiscuous mode
[   79.678193][ T7020] syzkaller1: entered allmulticast mode
[   79.683354][ T7020] syzkaller1: left promiscuous mode
[   79.685317][ T7020] syzkaller1: left allmulticast mode
[   80.168627][ T7048] netlink: 'syz.2.275': attribute type 1 has an invalid length.
[   80.312904][ T7051] IPVS: Error connecting to the multicast addr
[   80.623116][   T13] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   80.631128][   T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   80.639915][   T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   80.649113][   T12] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   81.243188][ T7076] wg1 speed is unknown, defaulting to 1000
[   81.246122][ T7076] lo speed is unknown, defaulting to 1000
[   81.285942][   T24] IPVS: starting estimator thread 0...
[   81.293448][    T9] cfg80211: failed to load regulatory.db
[   81.382760][ T7079] IPVS: using max 81 ests per chain, 194400 per kthread
[   81.519301][ T7086] veth0_to_bridge: entered promiscuous mode
[   81.524811][ T7085] veth0_to_bridge: left promiscuous mode
[   81.960160][ T7098] wg1 speed is unknown, defaulting to 1000
[   81.963002][ T7098] lo speed is unknown, defaulting to 1000
[   82.144229][ T7108] wg1 speed is unknown, defaulting to 1000
[   82.147983][ T7108] lo speed is unknown, defaulting to 1000
[   82.567043][ T7126] netlink: 'syz.0.299': attribute type 30 has an invalid length.
[   82.732441][ T7143] netlink: 36 bytes leftover after parsing attributes in process `syz.0.304'.
[   82.736405][ T7143] 8021q: VLANs not supported on ipvlan1
[   82.741215][ T7143] netlink: 24 bytes leftover after parsing attributes in process `syz.0.304'.
[   82.952473][ T7151] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   83.613802][ T7167] netlink: 'syz.2.310': attribute type 6 has an invalid length.
[   83.617427][ T7167] netlink: 'syz.2.310': attribute type 6 has an invalid length.
[   83.797461][ T7193] netlink: 8 bytes leftover after parsing attributes in process `syz.1.315'.
[   84.008186][ T7206] netlink: 8 bytes leftover after parsing attributes in process `syz.1.319'.
[   84.069188][ T7206] netlink: 16 bytes leftover after parsing attributes in process `syz.1.319'.
[   84.074096][ T7206] netlink: 36 bytes leftover after parsing attributes in process `syz.1.319'.
[   84.229331][ T7215] wg1 speed is unknown, defaulting to 1000
[   84.232420][ T7215] lo speed is unknown, defaulting to 1000
[   84.292345][ T7216] wg1 speed is unknown, defaulting to 1000
[   84.296152][ T7216] lo speed is unknown, defaulting to 1000
[   84.439813][ T7223] wg1 speed is unknown, defaulting to 1000
[   84.443769][ T7223] lo speed is unknown, defaulting to 1000
[   84.547597][ T7229] netlink: 20 bytes leftover after parsing attributes in process `syz.0.326'.
[   84.591212][ T7231] netlink: 'syz.1.327': attribute type 7 has an invalid length.
[   84.594959][ T7231] netlink: 8 bytes leftover after parsing attributes in process `syz.1.327'.
[   84.738861][ T7233] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.768242][ T7238] wg1 speed is unknown, defaulting to 1000
[   84.820989][ T7238] lo speed is unknown, defaulting to 1000
[   84.827478][ T7233] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.846172][ T7239] wg1 speed is unknown, defaulting to 1000
[   84.851719][ T7239] lo speed is unknown, defaulting to 1000
[   84.905387][ T7233] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.983545][ T7233] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   85.049700][ T7250] wg1 speed is unknown, defaulting to 1000
[   85.054144][ T7250] lo speed is unknown, defaulting to 1000
[   85.086123][   T24] IPVS: starting estimator thread 0...
[   85.100457][ T5875] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   85.107706][ T5875] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   85.115530][ T5875] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   85.133491][ T5875] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   85.183506][ T7253] IPVS: using max 79 ests per chain, 189600 per kthread
[   85.189666][ T7257] netlink: 8 bytes leftover after parsing attributes in process `syz.1.335'.
[   85.198685][ T7257] openvswitch: netlink: Flow set message rejected, Key attribute missing.
[   85.426758][   T12] IPVS: stop unused estimator thread 0...
[   85.454731][ T7270] wg1 speed is unknown, defaulting to 1000
[   85.459445][ T7270] lo speed is unknown, defaulting to 1000
[   85.556568][ T7278] netlink: 44 bytes leftover after parsing attributes in process `syz.2.340'.
[   85.618612][ T7275] wg1 speed is unknown, defaulting to 1000
[   85.625559][ T7275] lo speed is unknown, defaulting to 1000
[   85.633006][ T7279] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20004
[   85.637129][ T7278] wg1 speed is unknown, defaulting to 1000
[   85.649352][ T7278] lo speed is unknown, defaulting to 1000
[   85.750535][ T7283] netlink: 'syz.2.341': attribute type 1 has an invalid length.
[   86.279603][ T7315] wg1 speed is unknown, defaulting to 1000
[   86.283906][ T7315] lo speed is unknown, defaulting to 1000
[   86.310145][ T7316] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.348'.
[   86.314655][ T7316] netlink: 24 bytes leftover after parsing attributes in process `syz.0.348'.
[   86.837453][ T7356] wg1 speed is unknown, defaulting to 1000
[   86.840796][ T7356] lo speed is unknown, defaulting to 1000
[   87.361274][ T7380] wg1 speed is unknown, defaulting to 1000
[   87.366555][ T7380] lo speed is unknown, defaulting to 1000
[   87.737654][ T7393] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 4300
[   87.779205][ T7390] wg1 speed is unknown, defaulting to 1000
[   87.784734][ T7390] lo speed is unknown, defaulting to 1000
[   87.968330][ T7404] sch_tbf: burst 19872 is lower than device lo mtu (65550) !
[   88.031770][ T7411] openvswitch: netlink: Key 0 has unexpected len 2 expected 0
[   88.065058][ T7411] netlink: get zone limit has 4 unknown bytes
[   88.186991][ T7416] wg1 speed is unknown, defaulting to 1000
[   88.190783][ T7416] lo speed is unknown, defaulting to 1000
[   88.219304][ T7421] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   88.237807][ T7421] batman_adv: batadv0: Removing interface: batadv_slave_1
[   88.256592][ T7424] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   88.462384][ T7436] wg1 speed is unknown, defaulting to 1000
[   88.467005][ T7436] lo speed is unknown, defaulting to 1000
[   88.655909][ T7461] wg1 speed is unknown, defaulting to 1000
[   88.658786][ T7461] lo speed is unknown, defaulting to 1000
[   88.964545][ T7473] macsec2: entered promiscuous mode
[   88.966429][ T7473] macsec2: entered allmulticast mode
[   89.268938][ T7498] netlink: 'syz.0.395': attribute type 1 has an invalid length.
[   89.575706][ T7509] __nla_validate_parse: 14 callbacks suppressed
[   89.575722][ T7509] netlink: 12 bytes leftover after parsing attributes in process `syz.1.397'.
[   89.746720][ T7522] netlink: 'syz.1.400': attribute type 1 has an invalid length.
[   89.750408][ T7522] netlink: 24 bytes leftover after parsing attributes in process `syz.1.400'.
[   89.938298][ T7533] wg1 speed is unknown, defaulting to 1000
[   89.942784][ T7533] lo speed is unknown, defaulting to 1000
[   89.997807][ T7534] wg1 speed is unknown, defaulting to 1000
[   90.000825][ T7534] lo speed is unknown, defaulting to 1000
[   90.276423][ T7542] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   90.334122][ T7542] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   90.390519][ T7542] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   90.440758][ T7542] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   90.529841][   T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   90.565567][   T12] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   90.603161][ T5875] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   90.606643][ T5875] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   91.059652][ T7556] netlink: 'syz.2.409': attribute type 1 has an invalid length.
[   91.154413][ T7558] netlink: 'syz.0.410': attribute type 1 has an invalid length.
[   91.446318][ T7574] wg1 speed is unknown, defaulting to 1000
[   91.449145][ T7574] lo speed is unknown, defaulting to 1000
[   91.809434][ T7584] netlink: 'syz.1.418': attribute type 1 has an invalid length.
[   91.923441][ T7586] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40
[   92.074828][ T7589] netlink: 'syz.2.420': attribute type 1 has an invalid length.
[   92.077897][ T7589] netlink: 24 bytes leftover after parsing attributes in process `syz.2.420'.
[   92.434581][ T7609] wg1 speed is unknown, defaulting to 1000
[   92.438676][ T7609] lo speed is unknown, defaulting to 1000
[   92.474158][ T7612] tipc: Started in network mode
[   92.476217][ T7612] tipc: Node identity bed744b085c4, cluster identity 4711
[   92.478987][ T7612] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   92.489734][ T7612] tipc: Resetting bearer <eth:syzkaller0>
[   92.505854][ T7608] tipc: Disabling bearer <eth:syzkaller0>
[   92.685695][ T7620] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold
[   92.916428][ T7631] syz.0.430: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[   92.925872][ T7631] CPU: 0 UID: 0 PID: 7631 Comm: syz.0.430 Not tainted syzkaller #0 PREEMPT(full) 
[   92.925889][ T7631] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   92.925896][ T7631] Call Trace:
[   92.925902][ T7631]  <TASK>
[   92.925907][ T7631]  dump_stack_lvl+0x189/0x250
[   92.925928][ T7631]  ? __pfx_dump_stack_lvl+0x10/0x10
[   92.925966][ T7631]  ? __pfx__printk+0x10/0x10
[   92.925982][ T7631]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   92.925997][ T7631]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   92.926012][ T7631]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[   92.926028][ T7631]  warn_alloc+0x214/0x310
[   92.926047][ T7631]  ? stack_depot_save_flags+0x41b/0x860
[   92.926064][ T7631]  ? __pfx_warn_alloc+0x10/0x10
[   92.926082][ T7631]  ? kasan_save_track+0x4f/0x80
[   92.926098][ T7631]  ? xskq_create+0x56/0x170
[   92.926114][ T7631]  ? xsk_init_queue+0xb0/0x110
[   92.926128][ T7631]  ? xsk_setsockopt+0x4dc/0x8d0
[   92.926142][ T7631]  ? do_sock_setsockopt+0x17c/0x1b0
[   92.926154][ T7631]  ? __x64_sys_setsockopt+0x13f/0x1b0
[   92.926165][ T7631]  ? do_syscall_64+0xfa/0x3b0
[   92.926176][ T7631]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   92.926194][ T7631]  __vmalloc_node_range_noprof+0x125/0x12f0
[   92.926233][ T7631]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[   92.926251][ T7631]  ? xskq_create+0x56/0x170
[   92.926271][ T7631]  ? __kasan_kmalloc+0x93/0xb0
[   92.926288][ T7631]  vmalloc_user_noprof+0xad/0xf0
[   92.926305][ T7631]  ? xskq_create+0xbf/0x170
[   92.926322][ T7631]  xskq_create+0xbf/0x170
[   92.926342][ T7631]  xsk_init_queue+0xb0/0x110
[   92.926360][ T7631]  xsk_setsockopt+0x4dc/0x8d0
[   92.926377][ T7631]  ? __pfx_xsk_setsockopt+0x10/0x10
[   92.926393][ T7631]  ? __pfx_aa_sk_perm+0x10/0x10
[   92.926413][ T7631]  ? aa_sock_opt_perm+0xff/0x1b0
[   92.926433][ T7631]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[   92.926444][ T7631]  ? __pfx_xsk_setsockopt+0x10/0x10
[   92.926462][ T7631]  do_sock_setsockopt+0x17c/0x1b0
[   92.926478][ T7631]  __x64_sys_setsockopt+0x13f/0x1b0
[   92.926494][ T7631]  do_syscall_64+0xfa/0x3b0
[   92.926505][ T7631]  ? lockdep_hardirqs_on+0x9c/0x150
[   92.926522][ T7631]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   92.926533][ T7631]  ? exc_page_fault+0x9f/0xf0
[   92.926551][ T7631]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   92.926563][ T7631] RIP: 0033:0x7f193878eba9
[   92.926574][ T7631] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   92.926611][ T7631] RSP: 002b:00007f19395a9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[   92.926633][ T7631] RAX: ffffffffffffffda RBX: 00007f19389d6090 RCX: 00007f193878eba9
[   92.926642][ T7631] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000a
[   92.926649][ T7631] RBP: 00007f1938811e19 R08: 0000000000000004 R09: 0000000000000000
[   92.926656][ T7631] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[   92.926663][ T7631] R13: 00007f19389d6128 R14: 00007f19389d6090 R15: 00007ffd56b9ccd8
[   92.926685][ T7631]  </TASK>
[   92.926813][ T7631] Mem-Info:
[   93.055704][ T7631] active_anon:5417 inactive_anon:0 isolated_anon:0
[   93.055704][ T7631]  active_file:1195 inactive_file:38253 isolated_file:0
[   93.055704][ T7631]  unevictable:1768 dirty:50 writeback:0
[   93.055704][ T7631]  slab_reclaimable:9752 slab_unreclaimable:65324
[   93.055704][ T7631]  mapped:18165 shmem:2440 pagetables:986
[   93.055704][ T7631]  sec_pagetables:0 bounce:0
[   93.055704][ T7631]  kernel_misc_reclaimable:0
[   93.055704][ T7631]  free:291752 free_pcp:14933 free_cma:0
[   93.075768][ T7631] Node 0 active_anon:11828kB inactive_anon:0kB active_file:2732kB inactive_file:144816kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:46420kB dirty:92kB writeback:0kB shmem:4904kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6176kB pagetables:1932kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   93.089172][ T7631] Node 1 active_anon:9840kB inactive_anon:0kB active_file:2048kB inactive_file:8196kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:26240kB dirty:108kB writeback:0kB shmem:4856kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5588kB pagetables:1944kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   93.099728][ T7631] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[   93.109131][ T7631] lowmem_reserve[]: 0 814 814 814 814
[   93.111006][ T7631] Node 0 DMA32 free:292260kB boost:0kB min:33720kB low:42148kB high:50576kB reserved_highatomic:0KB free_highatomic:0KB active_anon:11828kB inactive_anon:0kB active_file:2732kB inactive_file:144816kB unevictable:3536kB writepending:92kB present:1556484kB managed:833672kB mlocked:0kB bounce:0kB free_pcp:36584kB local_pcp:20884kB free_cma:0kB
[   93.122022][ T7631] lowmem_reserve[]: 0 0 0 0 0
[   93.124138][ T7631] Node 1 DMA32 free:458492kB boost:0kB min:19172kB low:23964kB high:28756kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:116kB local_pcp:0kB free_cma:0kB
[   93.136315][ T7631] lowmem_reserve[]: 0 0 854 854 854
[   93.140995][ T7631] Node 1 Normal free:400896kB boost:0kB min:36576kB low:45720kB high:54864kB reserved_highatomic:0KB free_highatomic:0KB active_anon:9840kB inactive_anon:0kB active_file:2048kB inactive_file:8196kB unevictable:3536kB writepending:108kB present:1048576kB managed:874952kB mlocked:0kB bounce:0kB free_pcp:23172kB local_pcp:15176kB free_cma:0kB
[   93.152068][ T7631] lowmem_reserve[]: 0 0 0 0 0
[   93.153752][ T7631] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[   93.158077][ T7631] Node 0 DMA32: 1333*4kB (UM) 604*8kB (UME) 353*16kB (UME) 185*32kB (UME) 111*64kB (UME) 36*128kB (UE) 19*256kB (UME) 14*512kB (UME) 11*1024kB (UME) 7*2048kB (UME) 54*4096kB (M) = 292260kB
[   93.164942][ T7631] Node 1 DMA32: 3*4kB (UM) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 3*2048kB (UM) 109*4096kB (M) = 458492kB
[   93.171656][ T7631] Node 1 Normal: 174*4kB (ME) 427*8kB (UME) 573*16kB (UME) 311*32kB (UME) 157*64kB (UM) 38*128kB (UM) 21*256kB (UM) 4*512kB (UM) 7*1024kB (M) 2*2048kB (M) 84*4096kB (M) = 400896kB
[   93.177886][ T7631] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   93.180885][ T7631] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   93.184782][ T7631] 41888 total pagecache pages
[   93.186373][ T7631] 0 pages in swap cache
[   93.188476][ T7631] Free swap  = 124996kB
[   93.189891][ T7631] Total swap = 124996kB
[   93.191377][ T7631] 786301 pages RAM
[   93.192661][ T7631] 0 pages HighMem/MovableOnly
[   93.194218][ T7631] 240651 pages reserved
[   93.195621][ T7631] 0 pages cma reserved
[   93.653087][ T7667] netlink: 20 bytes leftover after parsing attributes in process `syz.1.437'.
[   93.656396][ T7667] netlink: 20 bytes leftover after parsing attributes in process `syz.1.437'.
[   94.086759][ T7673] netlink: 8 bytes leftover after parsing attributes in process `syz.2.439'.
[   94.321077][ T7682] wg1 speed is unknown, defaulting to 1000
[   94.325093][ T7682] lo speed is unknown, defaulting to 1000
[   94.497897][ T7686] wg1 speed is unknown, defaulting to 1000
[   94.504063][ T7686] lo speed is unknown, defaulting to 1000
[   94.705562][ T7706] netlink: 36 bytes leftover after parsing attributes in process `syz.2.445'.
[   94.719871][ T7707] macsec1: entered promiscuous mode
[   94.722903][ T7707] macsec1: entered allmulticast mode
[   95.696528][ T7732] netlink: 'syz.0.451': attribute type 1 has an invalid length.
[   95.699885][ T7732] netlink: 8 bytes leftover after parsing attributes in process `syz.0.451'.
[   95.843671][ T7734] netlink: 4 bytes leftover after parsing attributes in process `syz.0.452'.
[   95.972515][ T7752] wg1 speed is unknown, defaulting to 1000
[   95.975466][ T7752] lo speed is unknown, defaulting to 1000
[   96.054601][ T7756] netlink: 'syz.0.456': attribute type 1 has an invalid length.
[   97.660686][ T7794] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue
[   97.680042][ T7794] netlink: 4 bytes leftover after parsing attributes in process `syz.1.465'.
[   98.536846][ T7799] wg1 speed is unknown, defaulting to 1000
[   98.539704][ T7799] lo speed is unknown, defaulting to 1000
[   98.643364][ T7811] netlink: 36 bytes leftover after parsing attributes in process `syz.0.469'.
[   98.646343][ T7811] netlink: 16 bytes leftover after parsing attributes in process `syz.0.469'.
[   98.649389][ T7811] netlink: 36 bytes leftover after parsing attributes in process `syz.0.469'.
[   98.654528][ T7811] netlink: 36 bytes leftover after parsing attributes in process `syz.0.469'.
[   98.853113][ T7816] wg1 speed is unknown, defaulting to 1000
[   98.855888][ T7816] lo speed is unknown, defaulting to 1000
[   98.990423][ T7820] wg1 speed is unknown, defaulting to 1000
[   98.997822][ T7820] lo speed is unknown, defaulting to 1000
[   99.187573][ T7827] siw: device registration error -23
[   99.364667][ T7835] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR
[  100.571039][ T7862] wg1 speed is unknown, defaulting to 1000
[  100.604741][ T7862] lo speed is unknown, defaulting to 1000
[  100.613107][ T7865] ieee802154 phy1 wpan1: encryption failed: -22
[  100.730160][ T7877] wg1 speed is unknown, defaulting to 1000
[  100.733249][ T7877] lo speed is unknown, defaulting to 1000
[  100.778394][ T7863] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  100.866880][ T7877] wg1 speed is unknown, defaulting to 1000
[  100.870688][ T7877] lo speed is unknown, defaulting to 1000
[  101.324909][ T7905] netlink: 16 bytes leftover after parsing attributes in process `syz.1.488'.
[  101.448189][ T7920] wg1 speed is unknown, defaulting to 1000
[  101.452321][ T7920] lo speed is unknown, defaulting to 1000
[  101.616792][ T7943] netlink: 'syz.0.495': attribute type 4 has an invalid length.
[  101.629682][ T7943] netlink: 'syz.0.495': attribute type 4 has an invalid length.
[  102.001136][ T7955] wg1 speed is unknown, defaulting to 1000
[  102.005939][ T7955] lo speed is unknown, defaulting to 1000
[  102.343384][ T7961] netlink: 40 bytes leftover after parsing attributes in process `syz.1.501'.
[  102.520426][ T7972] wg1 speed is unknown, defaulting to 1000
[  102.523129][ T7972] lo speed is unknown, defaulting to 1000
[  102.983192][ T8002] netlink: 240 bytes leftover after parsing attributes in process `syz.2.508'.
[  103.359259][ T8019] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  104.683030][ T8036] netlink: 32 bytes leftover after parsing attributes in process `syz.0.520'.
[  104.701652][ T8036] netlink: 'syz.0.520': attribute type 10 has an invalid length.
[  104.716588][ T8036] 8021q: adding VLAN 0 to HW filter on device team0
[  104.721967][ T8036] bond0: (slave team0): Enslaving as an active interface with an up link
[  104.725701][   T24] syz1: Port: 1 Link ACTIVE
[  104.815248][ T8046] netlink: 'syz.1.518': attribute type 1 has an invalid length.
[  104.818846][ T8046] netlink: 24 bytes leftover after parsing attributes in process `syz.1.518'.
[  104.829989][ T8033] netlink: 40 bytes leftover after parsing attributes in process `syz.2.519'.
[  105.005088][ T8054] netlink: 36 bytes leftover after parsing attributes in process `syz.0.524'.
[  105.008895][ T8054] netlink: 16 bytes leftover after parsing attributes in process `syz.0.524'.
[  105.013012][ T8054] netlink: 36 bytes leftover after parsing attributes in process `syz.0.524'.
[  105.016733][ T8054] netlink: 36 bytes leftover after parsing attributes in process `syz.0.524'.
[  105.092715][ T8056] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  105.578374][ T8059] netlink: 'syz.2.526': attribute type 1 has an invalid length.
[  105.595418][ T8059] 8021q: adding VLAN 0 to HW filter on device bond1
[  105.606637][ T8059] bond1: (slave geneve2): making interface the new active one
[  105.609892][ T8059] bond1: (slave geneve2): Enslaving as an active interface with an up link
[  105.617719][ T8059] bond1: entered promiscuous mode
[  105.620702][ T8059] geneve2: entered promiscuous mode
[  105.633002][ T8062] wg1 speed is unknown, defaulting to 1000
[  105.636669][ T8062] lo speed is unknown, defaulting to 1000
[  105.677570][ T8069] trusted_key: syz.2.526 sent an empty control message without MSG_MORE.
[  105.687519][ T8065] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  106.543791][ T8102] __nla_validate_parse: 21 callbacks suppressed
[  106.543803][ T8102] netlink: 16 bytes leftover after parsing attributes in process `syz.0.536'.
[  106.549614][ T8102] netlink: 120 bytes leftover after parsing attributes in process `syz.0.536'.
[  106.559837][ T8102] netlink: 16 bytes leftover after parsing attributes in process `syz.0.536'.
[  106.628277][ T8112] wg1 speed is unknown, defaulting to 1000
[  106.631246][ T8112] lo speed is unknown, defaulting to 1000
[  106.635555][ T8099] netlink: 4 bytes leftover after parsing attributes in process `syz.2.535'.
[  107.712628][ T8134] netlink: 'syz.2.542': attribute type 10 has an invalid length.
[  107.735239][ T8134] 8021q: adding VLAN 0 to HW filter on device batadv0
[  107.743333][ T8134] bond0: (slave batadv0): Enslaving as an active interface with an up link
[  108.040335][ T8153] netlink: 4 bytes leftover after parsing attributes in process `syz.0.547'.
[  108.043553][ T8153] netlink: 4 bytes leftover after parsing attributes in process `syz.0.547'.
[  108.197845][ T8161] netlink: 4 bytes leftover after parsing attributes in process `syz.0.549'.
[  108.397964][ T8171] netlink: 'syz.0.550': attribute type 3 has an invalid length.
[  108.409353][ T8171] netlink: 124 bytes leftover after parsing attributes in process `syz.0.550'.
[  108.410411][ T8174] netlink: 32 bytes leftover after parsing attributes in process `syz.2.551'.
[  108.417696][ T8174] netlink: 'syz.2.551': attribute type 1 has an invalid length.
[  108.477602][ T8180] netlink: 8 bytes leftover after parsing attributes in process `syz.2.553'.
[  108.537769][ T8187] siw: device registration error -23
[  108.544581][ T8187] netlink: 'syz.2.554': attribute type 12 has an invalid length.
[  108.722170][ T8190] syzkaller0: entered promiscuous mode
[  108.725359][ T8190] syzkaller0: entered allmulticast mode
[  108.730378][ T8190] netlink: 'syz.2.555': attribute type 1 has an invalid length.
[  108.867936][ T8200] wg1 speed is unknown, defaulting to 1000
[  108.872397][ T8200] lo speed is unknown, defaulting to 1000
[  109.319928][ T8214] netlink: 'syz.1.561': attribute type 3 has an invalid length.
[  109.328290][ T8214] netlink: 'syz.1.561': attribute type 3 has an invalid length.
[  109.393622][ T8214] netlink: 'syz.1.561': attribute type 15 has an invalid length.
[  111.185497][ T8245] tipc: Enabled bearer <ib:ip6gre0>, priority 10
[  111.483846][ T8259] wg1 speed is unknown, defaulting to 1000
[  111.505084][ T8259] lo speed is unknown, defaulting to 1000
[  111.668972][ T8273] wg1 speed is unknown, defaulting to 1000
[  111.683324][ T8273] lo speed is unknown, defaulting to 1000
[  111.706637][ T8281] wg1 speed is unknown, defaulting to 1000
[  111.723291][ T8281] lo speed is unknown, defaulting to 1000
[  111.744684][ T8282] wg1 speed is unknown, defaulting to 1000
[  111.747634][ T8282] lo speed is unknown, defaulting to 1000
[  111.780269][ T8288] IPVS: set_ctl: invalid protocol: 44 255.255.255.255:20004
[  111.847896][ T8290] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_tx_wq": -EINTR
[  112.020423][ T8305] wg1 speed is unknown, defaulting to 1000
[  112.028251][ T8305] lo speed is unknown, defaulting to 1000
[  112.089171][ T8309] __nla_validate_parse: 7 callbacks suppressed
[  112.089180][ T8309] netlink: 32 bytes leftover after parsing attributes in process `syz.1.585'.
[  112.145647][ T2290] hid-generic 0005:046D:5505.0001: unknown main item tag 0x0
[  112.149094][ T2290] hid-generic 0005:046D:5505.0001: unknown main item tag 0x0
[  112.153055][ T2290] hid-generic 0005:046D:5505.0001: reserved main item tag 0xe
[  112.165351][ T2290] hid-generic 0005:046D:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  112.277873][ T8320] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  112.302833][ T5844] tipc: Node number set to 991118512
[  112.663155][ T8333] siw: device registration error -23
[  112.668794][ T8333] netlink: 'syz.2.592': attribute type 12 has an invalid length.
[  113.111543][ T8364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.598'.
[  113.117665][ T8364] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.598'.
[  113.127096][ T8364] netlink: zone id is out of range
[  113.129898][ T8364] netlink: zone id is out of range
[  113.131827][ T8364] netlink: zone id is out of range
[  113.133664][ T8364] netlink: zone id is out of range
[  113.135543][ T8364] netlink: get zone limit has 8 unknown bytes
[  113.182736][ T8365] wg1 speed is unknown, defaulting to 1000
[  113.185750][ T8365] lo speed is unknown, defaulting to 1000
[  113.281925][ T8365] wg1 speed is unknown, defaulting to 1000
[  113.288412][ T8365] lo speed is unknown, defaulting to 1000
[  113.492734][ T8374] wg1 speed is unknown, defaulting to 1000
[  113.497340][ T8374] lo speed is unknown, defaulting to 1000
[  113.633834][ T8382] bridge3: entered allmulticast mode
[  113.647177][ T8382] netlink: 4 bytes leftover after parsing attributes in process `syz.1.602'.
[  113.806750][ T8385] wg1 speed is unknown, defaulting to 1000
[  113.814099][ T8385] lo speed is unknown, defaulting to 1000
[  114.024734][ T8395] netlink: 36 bytes leftover after parsing attributes in process `syz.0.605'.
[  114.049697][ T8395] netlink: 'syz.0.605': attribute type 1 has an invalid length.
[  114.054368][ T8395] netlink: 224 bytes leftover after parsing attributes in process `syz.0.605'.
[  114.165863][ T8403] syzkaller0: create flow: hash 3404376889 index 1
[  114.165886][ T5875] syzkaller0: tun_net_xmit 76
[  114.171122][ T5875] syzkaller0: tun_net_xmit 48
[  114.192002][ T5909] syzkaller0: tun_net_xmit 76
[  114.197616][ T8402] syzkaller0: delete flow: hash 3404376889 index 1
[  114.207496][ T8404] netlink: 44 bytes leftover after parsing attributes in process `syz.1.607'.
[  115.129676][ T8425] RDS: rds_bind could not find a transport for ::4000:0:20:0, load rds_tcp or rds_rdma?
[  115.305714][ T8438] wg1 speed is unknown, defaulting to 1000
[  115.309483][ T8438] lo speed is unknown, defaulting to 1000
[  116.055698][ T8468] wg1 speed is unknown, defaulting to 1000
[  116.059278][ T8468] lo speed is unknown, defaulting to 1000
[  116.326503][ T8472] RDS: rds_bind could not find a transport for ::ffff:172.30.1.3, load rds_tcp or rds_rdma?
[  116.388048][ T8475] netlink: 4 bytes leftover after parsing attributes in process `syz.1.625'.
[  116.487465][ T8489] wg1 speed is unknown, defaulting to 1000
[  116.529723][ T8489] lo speed is unknown, defaulting to 1000
[  116.550820][ T8493] netlink: 'syz.1.628': attribute type 11 has an invalid length.
[  116.740380][ T8502] wg1 speed is unknown, defaulting to 1000
[  116.743567][ T8502] lo speed is unknown, defaulting to 1000
[  117.708999][ T8538] netlink: 12 bytes leftover after parsing attributes in process `syz.1.641'.
[  117.722135][ T8538] netlink: 8 bytes leftover after parsing attributes in process `syz.1.641'.
[  117.869757][ T8542] tipc: Resetting bearer <ib:ip6gre0>
[  118.237449][ T8558] openvswitch: netlink: Flow set message rejected, Key attribute missing.
[  118.250146][ T8558] siw: device registration error -23
[  118.298471][ T8542] vlan2: left allmulticast mode
[  118.300561][ T8542] veth1: left allmulticast mode
[  118.304337][ T8542] ip6gretap0: left allmulticast mode
[  118.306587][ T8542] : left allmulticast mode
[  118.313558][ T2290] wg1 speed is unknown, defaulting to 1000
[  118.320942][ T2290] syz0: Port: 1 Link DOWN
[  118.351281][ T8560] IPVS: set_ctl: invalid protocol: 60 172.20.20.170:21
[  118.355480][ T8560] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold
[  118.369461][ T5874] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  118.375017][ T5874] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  118.378516][ T5874] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  118.385939][ T5874] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  118.520556][ T8580] can: request_module (can-proto-3) failed.
[  118.645775][ T8587] netlink: 4 bytes leftover after parsing attributes in process `syz.2.652'.
[  118.709573][ T8601] tipc: Enabling of bearer <ib:nicvf0> rejected, failed to enable media
[  118.899767][ T8615] wg1 speed is unknown, defaulting to 1000
[  118.905927][ T8615] lo speed is unknown, defaulting to 1000
[  119.007834][ T8615] wg1 speed is unknown, defaulting to 1000
[  119.010875][ T8615] lo speed is unknown, defaulting to 1000
[  119.655699][ T8628] netlink: 100 bytes leftover after parsing attributes in process `syz.1.662'.
[  119.860728][ T8643] wg1 speed is unknown, defaulting to 1000
[  119.863920][ T8643] lo speed is unknown, defaulting to 1000
[  119.871638][   T33] audit: type=1800 audit(1757630351.525:2): pid=8652 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.668" name="memory.events" dev="tmpfs" ino=1142 res=0 errno=0
[  119.895345][   T33] audit: type=1804 audit(1757630351.525:3): pid=8652 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.668" name="/newroot/218/memory.events" dev="tmpfs" ino=1142 res=1 errno=0
[  120.720615][ T8672] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR
[  120.733985][ T8663] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  120.860047][ T8679] netlink: 'syz.2.674': attribute type 1 has an invalid length.
[  120.860070][ T8678] netlink: 'syz.2.674': attribute type 1 has an invalid length.
[  121.496066][ T8725] netlink: 8 bytes leftover after parsing attributes in process `syz.0.686'.
[  121.504694][ T8725] netlink: 3 bytes leftover after parsing attributes in process `syz.0.686'.
[  121.519979][ T8725] batadv0: entered promiscuous mode
[  121.525758][ T8725] batadv0: entered allmulticast mode
[  121.739926][ T8744] netlink: 36 bytes leftover after parsing attributes in process `syz.2.691'.
[  121.744266][ T8744] netlink: 16 bytes leftover after parsing attributes in process `syz.2.691'.
[  121.748048][ T8744] netlink: 36 bytes leftover after parsing attributes in process `syz.2.691'.
[  121.752031][ T8744] netlink: 36 bytes leftover after parsing attributes in process `syz.2.691'.
[  121.927275][ T8776] netlink: 'syz.1.697': attribute type 21 has an invalid length.
[  122.014349][ T8785] wg1 speed is unknown, defaulting to 1000
[  122.019918][ T8785] lo speed is unknown, defaulting to 1000
[  122.408692][ T8802] wg1 speed is unknown, defaulting to 1000
[  122.415851][ T8802] lo speed is unknown, defaulting to 1000
[  122.448168][ T8799] netlink: 'syz.0.704': attribute type 4 has an invalid length.
[  122.627711][ T8831] siw: device registration error -23
[  122.823816][ T8842] netlink: 'syz.1.713': attribute type 1 has an invalid length.
[  123.361272][ T8849] __nla_validate_parse: 8 callbacks suppressed
[  123.361281][ T8849] netlink: 4 bytes leftover after parsing attributes in process `syz.2.715'.
[  124.067405][ T8870] netlink: 8 bytes leftover after parsing attributes in process `syz.0.721'.
[  124.070408][ T8870] netlink: 84 bytes leftover after parsing attributes in process `syz.0.721'.
[  124.081124][ T8870] dvmrp8: entered allmulticast mode
[  124.097843][ T8870] wg1 speed is unknown, defaulting to 1000
[  124.100821][ T8870] lo speed is unknown, defaulting to 1000
[  124.132804][ T8869] dvmrp8: left allmulticast mode
[  124.256882][ T8877] wg1 speed is unknown, defaulting to 1000
[  124.259978][ T8877] lo speed is unknown, defaulting to 1000
[  125.427219][ T8915] wg1 speed is unknown, defaulting to 1000
[  125.431264][ T8915] lo speed is unknown, defaulting to 1000
[  125.859495][ T8945] netlink: 24 bytes leftover after parsing attributes in process `syz.2.744'.
[  125.868725][ T8945] netlink: 4 bytes leftover after parsing attributes in process `syz.2.744'.
[  126.407760][ T8957] netlink: 20 bytes leftover after parsing attributes in process `syz.1.748'.
[  126.517485][ T8966] wg1 speed is unknown, defaulting to 1000
[  126.522778][ T8966] lo speed is unknown, defaulting to 1000
[  126.590090][ T8977] netlink: 'syz.1.754': attribute type 1 has an invalid length.
[  126.779749][ T8985] netlink: 60 bytes leftover after parsing attributes in process `syz.1.757'.
[  126.784984][ T8985] netlink: 'syz.1.757': attribute type 98 has an invalid length.
[  126.802429][ T8985] wg1 speed is unknown, defaulting to 1000
[  126.805253][ T8985] lo speed is unknown, defaulting to 1000
[  126.876997][ T8990] netlink: 12 bytes leftover after parsing attributes in process `syz.1.759'.
[  126.905747][ T8993] IPVS: sync thread started: state = BACKUP, mcast_ifn = hsr0, syncid = 1, id = 0
[  127.646781][ T9007] netlink: 'syz.0.764': attribute type 1 has an invalid length.
[  127.663080][ T9007] 8021q: adding VLAN 0 to HW filter on device bond2
[  127.668513][ T9008] netlink: 4 bytes leftover after parsing attributes in process `syz.0.764'.
[  127.760340][ T9016] netlink: 16 bytes leftover after parsing attributes in process `syz.0.767'.
[  127.871197][ T9036] netlink: 'syz.2.768': attribute type 1 has an invalid length.
[  127.888704][ T9035] wg1 speed is unknown, defaulting to 1000
[  127.902076][ T9035] lo speed is unknown, defaulting to 1000
[  128.008390][ T9035] wg1 speed is unknown, defaulting to 1000
[  128.015515][ T9035] lo speed is unknown, defaulting to 1000
[  128.222398][ T9053] wg1 speed is unknown, defaulting to 1000
[  128.226364][ T9053] lo speed is unknown, defaulting to 1000
[  128.297830][ T9055] wg1 speed is unknown, defaulting to 1000
[  128.302283][ T9055] lo speed is unknown, defaulting to 1000
[  128.406517][ T9060] TCP: TCP_TX_DELAY enabled
[  128.677733][ T9073] siw: device registration error -23
[  128.683636][ T9073] netlink: 'syz.0.778': attribute type 12 has an invalid length.
[  128.785323][ T9081] __nla_validate_parse: 2 callbacks suppressed
[  128.785332][ T9081] netlink: 4 bytes leftover after parsing attributes in process `syz.1.782'.
[  128.866817][ T9086] netlink: 20 bytes leftover after parsing attributes in process `syz.0.784'.
[  128.895126][ T9098] raw_sendmsg: syz.1.785 forgot to set AF_INET. Fix it!
[  128.907186][ T9086] netlink: 4 bytes leftover after parsing attributes in process `syz.0.784'.
[  129.091157][ T9113] netlink: 23 bytes leftover after parsing attributes in process `syz.0.788'.
[  129.246787][ T9127] wg1 speed is unknown, defaulting to 1000
[  129.250319][ T9127] lo speed is unknown, defaulting to 1000
[  129.349658][ T9127] wg1 speed is unknown, defaulting to 1000
[  129.353036][ T9127] lo speed is unknown, defaulting to 1000
[  129.552029][ T9143] netlink: 92 bytes leftover after parsing attributes in process `syz.0.795'.
[  129.643921][ T9144] wg1 speed is unknown, defaulting to 1000
[  129.647730][ T9144] lo speed is unknown, defaulting to 1000
[  129.788076][ T9154] netlink: 16 bytes leftover after parsing attributes in process `syz.2.798'.
[  129.793199][ T9154] netlink: 16 bytes leftover after parsing attributes in process `syz.2.798'.
[  130.055921][ T9157] wg1 speed is unknown, defaulting to 1000
[  130.058663][ T9157] lo speed is unknown, defaulting to 1000
[  130.362217][ T9171] wg1 speed is unknown, defaulting to 1000
[  130.364823][ T9171] lo speed is unknown, defaulting to 1000
[  130.607268][ T9185] siw: device registration error -23
[  130.610852][ T9185] netlink: 'syz.0.807': attribute type 12 has an invalid length.
[  130.654213][ T9187] netlink: 8 bytes leftover after parsing attributes in process `syz.2.808'.
Connection to localhost closed by remote host.
[  131.038353][ T8312] ==================================================================
[  131.041050][ T8312] BUG: KASAN: slab-use-after-free in __mutex_lock+0x801/0x1350
[  131.043593][ T8312] Read of size 8 at addr ffff88802051c0a0 by task khidpd_046d5505/8312
[  131.046997][ T8312] 
[  131.047791][ T8312] CPU: 0 UID: 0 PID: 8312 Comm: khidpd_046d5505 Not tainted syzkaller #0 PREEMPT(full) 
[  131.047801][ T8312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  131.047805][ T8312] Call Trace:
[  131.047809][ T8312]  <TASK>
[  131.047812][ T8312]  dump_stack_lvl+0x189/0x250
[  131.047822][ T8312]  ? __kasan_check_byte+0x12/0x40
[  131.047833][ T8312]  ? __pfx_dump_stack_lvl+0x10/0x10
[  131.047840][ T8312]  ? lock_release+0x4b/0x3e0
[  131.047850][ T8312]  ? __virt_addr_valid+0x4a5/0x5c0
[  131.047858][ T8312]  print_report+0xca/0x240
[  131.047868][ T8312]  ? __mutex_lock+0x801/0x1350
[  131.047874][ T8312]  kasan_report+0x118/0x150
[  131.047883][ T8312]  ? __mutex_lock+0x801/0x1350
[  131.047890][ T8312]  __mutex_lock+0x801/0x1350
[  131.047896][ T8312]  ? __mutex_lock+0x5bb/0x1350
[  131.047903][ T8312]  ? l2cap_unregister_user+0x6a/0x1b0
[  131.047913][ T8312]  ? __pfx___mutex_lock+0x10/0x10
[  131.047919][ T8312]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  131.047931][ T8312]  l2cap_unregister_user+0x6a/0x1b0
[  131.047940][ T8312]  hidp_session_thread+0x3c9/0x410
[  131.047950][ T8312]  ? __pfx_hidp_session_thread+0x10/0x10
[  131.047958][ T8312]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  131.047966][ T8312]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  131.047976][ T8312]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  131.047985][ T8312]  ? __kthread_parkme+0x7b/0x200
[  131.047993][ T8312]  ? __kthread_parkme+0x1a1/0x200
[  131.047999][ T8312]  kthread+0x711/0x8a0
[  131.048007][ T8312]  ? __pfx_hidp_session_thread+0x10/0x10
[  131.048016][ T8312]  ? __pfx_kthread+0x10/0x10
[  131.048023][ T8312]  ? _raw_spin_unlock_irq+0x23/0x50
[  131.048032][ T8312]  ? lockdep_hardirqs_on+0x9c/0x150
[  131.048041][ T8312]  ? __pfx_kthread+0x10/0x10
[  131.048048][ T8312]  ret_from_fork+0x3fc/0x770
[  131.048055][ T8312]  ? __pfx_ret_from_fork+0x10/0x10
[  131.048061][ T8312]  ? __switch_to_asm+0x39/0x70
[  131.048069][ T8312]  ? __switch_to_asm+0x33/0x70
[  131.048076][ T8312]  ? __pfx_kthread+0x10/0x10
[  131.048083][ T8312]  ret_from_fork_asm+0x1a/0x30
[  131.048093][ T8312]  </TASK>
[  131.048095][ T8312] 
[  131.118433][ T8312] Allocated by task 5853:
[  131.119832][ T8312]  kasan_save_track+0x3e/0x80
[  131.121417][ T8312]  __kasan_kmalloc+0x93/0xb0
[  131.122941][ T8312]  __kmalloc_noprof+0x27a/0x4f0
[  131.124587][ T8312]  hci_alloc_dev_priv+0x28/0x2060
[  131.126294][ T8312]  vhci_create_device+0x120/0x650
[  131.127973][ T8312]  vhci_write+0x3ce/0x4a0
[  131.129425][ T8312]  vfs_write+0x5c9/0xb30
[  131.130840][ T8312]  ksys_write+0x145/0x250
[  131.132284][ T8312]  do_syscall_64+0xfa/0x3b0
[  131.133805][ T8312]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  131.135801][ T8312] 
[  131.136620][ T8312] Freed by task 9171:
[  131.137973][ T8312]  kasan_save_track+0x3e/0x80
[  131.139558][ T8312]  kasan_save_free_info+0x46/0x50
[  131.141241][ T8312]  __kasan_slab_free+0x5b/0x80
[  131.142884][ T8312]  kfree+0x18e/0x440
[  131.144212][ T8312]  bt_host_release+0x82/0x90
[  131.145754][ T8312]  device_release+0x9c/0x1c0
[  131.147343][ T8312]  kobject_put+0x22b/0x480
[  131.148838][ T8312]  vhci_release+0x15a/0x1a0
[  131.150367][ T8312]  __fput+0x44c/0xa70
[  131.151698][ T8312]  task_work_run+0x1d4/0x260
[  131.153245][ T8312]  do_exit+0x6b5/0x2300
[  131.154660][ T8312]  do_group_exit+0x21c/0x2d0
[  131.156191][ T8312]  get_signal+0x1286/0x1340
[  131.157709][ T8312]  arch_do_signal_or_restart+0x9a/0x750
[  131.159538][ T8312]  exit_to_user_mode_loop+0x75/0x110
[  131.161370][ T8312]  do_syscall_64+0x2bd/0x3b0
[  131.162924][ T8312]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  131.164898][ T8312] 
[  131.165713][ T8312] Last potentially related work creation:
[  131.167611][ T8312]  kasan_save_stack+0x3e/0x60
[  131.169183][ T8312]  kasan_record_aux_stack+0xbd/0xd0
[  131.170913][ T8312]  insert_work+0x3d/0x330
[  131.172418][ T8312]  __queue_work+0xbaf/0xfb0
[  131.174073][ T8312]  queue_work_on+0x181/0x270
[  131.175627][ T8312]  process_scheduled_works+0xae1/0x17b0
[  131.177497][ T8312]  worker_thread+0x8a0/0xda0
[  131.179204][ T8312]  kthread+0x711/0x8a0
[  131.180577][ T8312]  ret_from_fork+0x3fc/0x770
[  131.182434][ T8312]  ret_from_fork_asm+0x1a/0x30
[  131.184424][ T8312] 
[  131.185423][ T8312] Second to last potentially related work creation:
[  131.187698][ T8312]  kasan_save_stack+0x3e/0x60
[  131.189581][ T8312]  kasan_record_aux_stack+0xbd/0xd0
[  131.191717][ T8312]  insert_work+0x3d/0x330
[  131.193497][ T8312]  __queue_work+0xcd2/0xfb0
[  131.195219][ T8312]  call_timer_fn+0x17e/0x5f0
[  131.197118][ T8312]  __run_timer_base+0x646/0x860
[  131.199130][ T8312]  run_timer_softirq+0xb7/0x180
[  131.200835][ T8312]  handle_softirqs+0x286/0x870
[  131.202417][ T8312]  __irq_exit_rcu+0xca/0x1f0
[  131.203960][ T8312]  irq_exit_rcu+0x9/0x30
[  131.205508][ T8312]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  131.207368][ T8312]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  131.209363][ T8312] 
[  131.210220][ T8312] The buggy address belongs to the object at ffff88802051c000
[  131.210220][ T8312]  which belongs to the cache kmalloc-8k of size 8192
[  131.215877][ T8312] The buggy address is located 160 bytes inside of
[  131.215877][ T8312]  freed 8192-byte region [ffff88802051c000, ffff88802051e000)
[  131.221394][ T8312] 
[  131.222398][ T8312] The buggy address belongs to the physical page:
[  131.225012][ T8312] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20518
[  131.228547][ T8312] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  131.231780][ T8312] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  131.234465][ T8312] page_type: f5(slab)
[  131.235791][ T8312] raw: 00fff00000000040 ffff88801a442280 0000000000000000 dead000000000001
[  131.238602][ T8312] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  131.241428][ T8312] head: 00fff00000000040 ffff88801a442280 0000000000000000 dead000000000001
[  131.244747][ T8312] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  131.248266][ T8312] head: 00fff00000000003 ffffea0000814601 00000000ffffffff 00000000ffffffff
[  131.251806][ T8312] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  131.255355][ T8312] page dumped because: kasan: bad access detected
[  131.257520][ T8312] page_owner tracks the page as allocated
[  131.259598][ T8312] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5588, tgid 5588 (rcS), ts 32832780699, free_ts 32820356764
[  131.267544][ T8312]  post_alloc_hook+0x240/0x2a0
[  131.269389][ T8312]  get_page_from_freelist+0x21e4/0x22c0
[  131.271197][ T8312]  __alloc_frozen_pages_noprof+0x181/0x370
[  131.273198][ T8312]  alloc_pages_mpol+0x232/0x4a0
[  131.274818][ T8312]  allocate_slab+0x8a/0x370
[  131.276487][ T8312]  ___slab_alloc+0xbeb/0x1420
[  131.278370][ T8312]  __kmalloc_cache_noprof+0x296/0x3d0
[  131.280245][ T8312]  tomoyo_init_log+0x111f/0x1f70
[  131.281924][ T8312]  tomoyo_supervisor+0x340/0x1480
[  131.283627][ T8312]  tomoyo_env_perm+0x149/0x1e0
[  131.285275][ T8312]  tomoyo_find_next_domain+0x15cf/0x1aa0
[  131.287140][ T8312]  tomoyo_bprm_check_security+0x11c/0x180
[  131.289031][ T8312]  security_bprm_check+0x89/0x270
[  131.290717][ T8312]  bprm_execve+0x8ee/0x1450
[  131.292462][ T8312]  do_execveat_common+0x510/0x6a0
[  131.294464][ T8312]  __x64_sys_execve+0x94/0xb0
[  131.296430][ T8312] page last free pid 5582 tgid 5582 stack trace:
[  131.299027][ T8312]  __free_frozen_pages+0xbc4/0xd30
[  131.301155][ T8312]  __slab_free+0x303/0x3c0
[  131.303002][ T8312]  qlist_free_all+0x97/0x140
[  131.304944][ T8312]  kasan_quarantine_reduce+0x148/0x160
[  131.306921][ T8312]  __kasan_slab_alloc+0x22/0x80
[  131.308561][ T8312]  __kmalloc_cache_noprof+0x1be/0x3d0
[  131.310271][ T8312]  tomoyo_init_log+0x183/0x1f70
[  131.311864][ T8312]  tomoyo_supervisor+0x340/0x1480
[  131.313562][ T8312]  tomoyo_path_permission+0x25a/0x380
[  131.315364][ T8312]  tomoyo_check_open_permission+0x2b6/0x3b0
[  131.317338][ T8312]  security_file_open+0xb1/0x270
[  131.318981][ T8312]  do_dentry_open+0x384/0x13f0
[  131.320586][ T8312]  vfs_open+0x3b/0x340
[  131.321952][ T8312]  path_openat+0x2ee5/0x3830
[  131.323526][ T8312]  do_filp_open+0x1fa/0x410
[  131.325036][ T8312]  do_sys_openat2+0x121/0x1c0
[  131.326617][ T8312] 
[  131.327430][ T8312] Memory state around the buggy address:
[  131.329459][ T8312]  ffff88802051bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  131.332291][ T8312]  ffff88802051c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  131.335366][ T8312] >ffff88802051c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  131.338685][ T8312]                                ^
[  131.340909][ T8312]  ffff88802051c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  131.344059][ T8312]  ffff88802051c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  131.346989][ T8312] ==================================================================
[  131.350638][ T8312] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  131.353264][ T8312] CPU: 0 UID: 0 PID: 8312 Comm: khidpd_046d5505 Not tainted syzkaller #0 PREEMPT(full) 
[  131.356892][ T8312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  131.360625][ T8312] Call Trace:
[  131.361734][ T8312]  <TASK>
[  131.362764][ T8312]  dump_stack_lvl+0x99/0x250
[  131.364413][ T8312]  ? __asan_memcpy+0x40/0x70
[  131.366138][ T8312]  ? __pfx_dump_stack_lvl+0x10/0x10
[  131.368308][ T8312]  ? __pfx__printk+0x10/0x10
[  131.370389][ T8312]  vpanic+0x281/0x750
[  131.372146][ T8312]  ? __pfx_vpanic+0x10/0x10
[  131.374178][ T8312]  ? irqentry_exit+0x74/0x90
[  131.376215][ T8312]  panic+0xb9/0xc0
[  131.377538][ T8312]  ? __pfx_panic+0x10/0x10
[  131.379299][ T8312]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  131.381807][ T8312]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  131.384411][ T8312]  ? __mutex_lock+0x801/0x1350
[  131.386495][ T8312]  check_panic_on_warn+0x89/0xb0
[  131.388667][ T8312]  ? __mutex_lock+0x801/0x1350
[  131.390714][ T8312]  end_report+0x78/0x160
[  131.392196][ T8312]  kasan_report+0x129/0x150
[  131.393764][ T8312]  ? __mutex_lock+0x801/0x1350
[  131.395427][ T8312]  __mutex_lock+0x801/0x1350
[  131.397026][ T8312]  ? __mutex_lock+0x5bb/0x1350
[  131.398758][ T8312]  ? l2cap_unregister_user+0x6a/0x1b0
[  131.400617][ T8312]  ? __pfx___mutex_lock+0x10/0x10
[  131.402288][ T8312]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  131.404214][ T8312]  l2cap_unregister_user+0x6a/0x1b0
[  131.406011][ T8312]  hidp_session_thread+0x3c9/0x410
[  131.407778][ T8312]  ? __pfx_hidp_session_thread+0x10/0x10
[  131.409673][ T8312]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  131.411633][ T8312]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  131.413751][ T8312]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  131.415814][ T8312]  ? __kthread_parkme+0x7b/0x200
[  131.417467][ T8312]  ? __kthread_parkme+0x1a1/0x200
[  131.419135][ T8312]  kthread+0x711/0x8a0
[  131.420577][ T8312]  ? __pfx_hidp_session_thread+0x10/0x10
[  131.422463][ T8312]  ? __pfx_kthread+0x10/0x10
[  131.424048][ T8312]  ? _raw_spin_unlock_irq+0x23/0x50
[  131.425810][ T8312]  ? lockdep_hardirqs_on+0x9c/0x150
[  131.427462][ T8312]  ? __pfx_kthread+0x10/0x10
[  131.428983][ T8312]  ret_from_fork+0x3fc/0x770
[  131.430552][ T8312]  ? __pfx_ret_from_fork+0x10/0x10
[  131.432248][ T8312]  ? __switch_to_asm+0x39/0x70
[  131.433837][ T8312]  ? __switch_to_asm+0x33/0x70
[  131.435430][ T8312]  ? __pfx_kthread+0x10/0x10
[  131.436954][ T8312]  ret_from_fork_asm+0x1a/0x30
[  131.438552][ T8312]  </TASK>
[  131.440234][ T8312] Kernel Offset: disabled
[  131.441674][ T8312] Rebooting in 86400 seconds..

VM DIAGNOSIS:
22:39:22  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000066 RBX=0000000000000066 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000661f370
R8 =ffff88801fe90237 R9 =1ffff11003fd2046 R10=dffffc0000000000 R11=ffffffff854f4b80
R12=dffffc0000000000 R13=ffffffff99ad48f1 R14=ffffffff99dc9420 R15=0000000000000000
RIP=ffffffff854f4bfc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8640000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000555583e0d5c8 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00007f79cea12ee7 XMM09=0000000000000000 00007f79cea12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=d171565f826cd600 RBX=ffffffff819683f8 RCX=d171565f826cd600 RDX=0000000000000001
RSI=ffffffff8d9afc08 RDI=ffffffff8be33880 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f9b R9 =1ffff11026cc65f3 R10=dffffc0000000000 R11=ffffed1026cc65f4
R12=ffffffff8fa2f030 R13=0000000000000001 R14=0000000000000001 R15=1ffff1102001f000
RIP=ffffffff8b7253f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c40000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f1939507d60 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00ff000000000000 ff00000000000000 XMM05=0000000000000836 0000000000003130
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffff0000 ffffffffffff0000 XMM09=6c6c696b66722f36 7968702f31313230
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
