last executing test programs:

1m3.196730151s ago: executing program 2 (id=229):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)={0x14, 0x0, 0x4}, 0x14}}, 0x0)
syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r0)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000fc0), r0)
sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000001c0)={0x1c, r1, 0x926fdb2c68a18847, 0x70bd29, 0x2, {0x6}, [@NL802154_ATTR_WPAN_PHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40040)

1m3.090175685s ago: executing program 2 (id=231):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x0)
pselect6(0x40, &(0x7f0000000140)={0x5, 0x6, 0x8, 0x8, 0x0, 0x2, 0x0, 0x8}, &(0x7f0000000180)={0x9, 0x2, 0x7fff, 0x22c, 0x5, 0x0, 0xa9e, 0x7}, &(0x7f00000001c0)={0x7fffffff, 0x9, 0x81, 0xa1, 0x3, 0xff, 0x1, 0xffff}, &(0x7f0000000200)={0x77359400}, 0x0)
connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001e80)={0x6, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94)
r1 = socket$can_bcm(0x1d, 0x2, 0x2)
sendmsg$can_bcm(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x5, 0x3, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "9dfc47318ccc3455"}}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_netfilter(0x10, 0x3, 0xc)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="6a0e6435f82b96e120e95ef657c67f3804ab3fd20f854380e05a23b6758439b1bcc2af4612a9ffbedef954ca796197b2ad54eb4aa5e40f7e0679b02c55444cd757567b124e1c78808a05eac11e93d4de3287", 0x52)
bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bridge0\x00'})
socket(0x10, 0x80002, 0x0)
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00')
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="54000000090601080000000000000000050000000900020073797a310000000005000100070000002c000780060004404e21000005000700e30000000c00018008000140850101010c00028008000140"], 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWSETELEM={0x2c, 0xb, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x54}}, 0x0)

1m3.089908198s ago: executing program 1 (id=232):
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
sendmmsg$inet6(r0, &(0x7f0000003500)=[{{&(0x7f0000000380)={0xa, 0x4e23, 0x0, @loopback, 0x8}, 0x1c, 0x0, 0x0, &(0x7f0000001900)=[@tclass={{0x14, 0x29, 0x43, 0xd}}], 0x18}}], 0x1, 0x0)

1m3.087640657s ago: executing program 1 (id=233):
sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b00000000002010400000000000000000700000608000940ffffffff080004400000008108000840000000032000018006"], 0xb0}, 0x1, 0x0, 0x0, 0x8004}, 0x10)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002801c000b8018"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000)

1m2.977548287s ago: executing program 1 (id=234):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10)
r1 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)={0x14, 0x0, 0x10, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x2000c844)

1m2.977244934s ago: executing program 2 (id=235):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xa, 0x7, 0x6, 0x8c}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r1}, 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r0}, &(0x7f0000000080), &(0x7f0000000200)=r1}, 0x20)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)

1m2.918350764s ago: executing program 1 (id=237):
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000080)={0x4001, 0x1, 0x0, 0x9}, 0x10)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="20000000160001002bbd7000fbdbdf250a40"], 0x20}, 0x1, 0x0, 0x0, 0x20040000}, 0x10)

1m2.918061759s ago: executing program 2 (id=238):
r0 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x1, {0x41}}, 0x10)
listen(r0, 0x1)
r1 = socket$tipc(0x1e, 0x5, 0x0)
sendmsg$tipc(r1, &(0x7f00000002c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x2, 0x0, {0x41}}, 0x10, 0x0}, 0x0)
close(0x3)

1m2.868761352s ago: executing program 1 (id=239):
r0 = socket$kcm(0x2, 0x200000000000001, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004081)
r1 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000040)="89000000120081ae08060cdc030000017f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c0001000c080c00bdad01409bbc7a46e39a8285dcdf12176679df069163ce955fed0009d78f0a947ee2b49e33538afaeb2713f450ebd010a20ff27fff", 0x89}], 0x1}, 0xff0f000020000080)

1m2.868419032s ago: executing program 2 (id=240):
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000180)=0x8, 0x4)
r1 = socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', <r2=>0x0})
r3 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c)
setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4)
r4 = socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', <r5=>0x0})
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4)
bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r5}, 0x10)
bind$xdp(r0, &(0x7f0000000240)={0x2c, 0x1, r2, 0x0, r3}, 0x60)
ppoll(0x0, 0x0, 0x0, 0x0, 0x0)

1m2.768459689s ago: executing program 0 (id=242):
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}, {{0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}], 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000100)=[{{0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}], 0x8)

1m2.768075384s ago: executing program 0 (id=243):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001400)={0xa8, r1, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x7c, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x74, 0x3, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'dummy0\x00'}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'filter\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'l2tp\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, 'IDLETIMER\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x273a}]}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0xa8}}, 0x0)

1m2.668611131s ago: executing program 0 (id=244):
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20)
r1 = socket$netlink(0x10, 0x3, 0x400000000000004)
writev(r1, &(0x7f0000000140)=[{&(0x7f0000000240)="480000001400190d09004beafd0d8c562c84ed7a80ffe05e959126dda8900db462060f000000000000a2bc5603ca00000f7f8900000ec00000000101ff0000000309ff5bffff00c7", 0x48}], 0x1)

1m2.66833188s ago: executing program 0 (id=245):
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)

1m2.597518476s ago: executing program 0 (id=246):
r0 = socket$netlink(0x10, 0x3, 0x4)
write(r0, &(0x7f0000000040)="2700000014000707030e0400120f13b7b9120000008a151f750800390000000000008000000000", 0x27)

1m2.597078885s ago: executing program 0 (id=247):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x15}, @NFTA_CT_DIRECTION={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x1400, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

1m1.183553145s ago: executing program 1 (id=248):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0)
getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800)
sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x74, 0x64, 0xf31, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff3, 0xffff}, {0x0, 0xd}}, [@filter_kind_options=@f_flower={{0xb}, {0x44, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x40, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0xfffffffffffffe08, 0x1, 0xfffffffb}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x401}]}]}]}}]}, 0x74}, 0x1, 0x0, 0x0, 0x10}, 0x44044)

45.984442843s ago: executing program 2 (id=249):
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)='/proc/net/\x00\x00t4/c+\x0fG\xf9aK\fX\a0\x04\x00\x00\x82q\xee'}, 0x39)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)

43.602186989s ago: executing program 32 (id=247):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x15}, @NFTA_CT_DIRECTION={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x1400, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

17.04151697s ago: executing program 33 (id=248):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0)
getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800)
sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x74, 0x64, 0xf31, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff3, 0xffff}, {0x0, 0xd}}, [@filter_kind_options=@f_flower={{0xb}, {0x44, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x40, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0xfffffffffffffe08, 0x1, 0xfffffffb}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x401}]}]}]}}]}, 0x74}, 0x1, 0x0, 0x0, 0x10}, 0x44044)

0s ago: executing program 34 (id=249):
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000000)='/proc/net/\x00\x00t4/c+\x0fG\xf9aK\fX\a0\x04\x00\x00\x82q\xee'}, 0x39)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:60260' (ED25519) to the list of known hosts.
syzkaller login: [   56.286773][ T5816] cgroup: Unknown subsys name 'net'
[   56.363861][ T5816] cgroup: Unknown subsys name 'cpuset'
[   56.376314][ T5816] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.042691][ T5816] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   63.207487][ T5835] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   63.212907][ T5835] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   63.216158][ T5835] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   63.220263][ T5835] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   63.223535][ T5835] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   63.226810][ T5835] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   63.248196][ T5835] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   63.263272][ T5842] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   63.265699][ T5839] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   63.267160][ T5842] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   63.268675][ T5839] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   63.273678][ T5839] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   63.276767][ T5839] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   63.286562][ T5839] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   63.292103][ T5839] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   63.616142][ T5831] chnl_net:caif_netlink_parms(): no params data found
[   63.709525][ T5836] chnl_net:caif_netlink_parms(): no params data found
[   63.821629][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.825628][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.829432][ T5831] bridge_slave_0: entered allmulticast mode
[   63.833474][ T5831] bridge_slave_0: entered promiscuous mode
[   63.854812][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.858053][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.860800][ T5831] bridge_slave_1: entered allmulticast mode
[   63.864657][ T5831] bridge_slave_1: entered promiscuous mode
[   63.907925][ T5840] chnl_net:caif_netlink_parms(): no params data found
[   63.916666][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.921390][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.924089][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.926831][ T5836] bridge_slave_0: entered allmulticast mode
[   63.930341][ T5836] bridge_slave_0: entered promiscuous mode
[   63.934472][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.936708][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.940365][ T5836] bridge_slave_1: entered allmulticast mode
[   63.943171][ T5836] bridge_slave_1: entered promiscuous mode
[   63.964940][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.035406][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.041625][ T5831] team0: Port device team_slave_0 added
[   64.055045][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.060499][ T5831] team0: Port device team_slave_1 added
[   64.132621][ T5836] team0: Port device team_slave_0 added
[   64.135221][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.138987][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.141252][ T5840] bridge_slave_0: entered allmulticast mode
[   64.144711][ T5840] bridge_slave_0: entered promiscuous mode
[   64.148217][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.150621][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.159989][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.165012][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.168774][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.171574][ T5840] bridge_slave_1: entered allmulticast mode
[   64.175334][ T5840] bridge_slave_1: entered promiscuous mode
[   64.182708][ T5836] team0: Port device team_slave_1 added
[   64.185819][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.189076][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.196712][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.235158][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.254138][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.256616][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.266332][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.274266][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.322833][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.325475][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.335739][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.365535][ T5840] team0: Port device team_slave_0 added
[   64.373319][ T5840] team0: Port device team_slave_1 added
[   64.382121][ T5831] hsr_slave_0: entered promiscuous mode
[   64.385417][ T5831] hsr_slave_1: entered promiscuous mode
[   64.485832][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.490940][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.501990][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.520789][ T5836] hsr_slave_0: entered promiscuous mode
[   64.524007][ T5836] hsr_slave_1: entered promiscuous mode
[   64.526869][ T5836] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   64.530793][ T5836] Cannot create hsr debugfs directory
[   64.533742][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.536433][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.546487][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.663868][ T5840] hsr_slave_0: entered promiscuous mode
[   64.667011][ T5840] hsr_slave_1: entered promiscuous mode
[   64.670357][ T5840] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   64.673308][ T5840] Cannot create hsr debugfs directory
[   64.937270][ T5831] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   64.948858][ T5831] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   64.983028][ T5831] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   65.002107][ T5831] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   65.052337][ T5836] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   65.066061][ T5836] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   65.092735][ T5836] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   65.117358][ T5836] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   65.169843][ T5840] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   65.185557][ T5840] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   65.195429][ T5840] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   65.210919][ T5840] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   65.334445][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.340218][ T5835] Bluetooth: hci0: command tx timeout
[   65.340258][ T5839] Bluetooth: hci1: command tx timeout
[   65.342818][ T5843] Bluetooth: hci2: command tx timeout
[   65.393065][ T5831] 8021q: adding VLAN 0 to HW filter on device team0
[   65.403199][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.427942][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.430933][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.452832][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.455691][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.480050][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.491738][ T5836] 8021q: adding VLAN 0 to HW filter on device team0
[   65.520020][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.522883][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.527624][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.530587][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.584337][ T5840] 8021q: adding VLAN 0 to HW filter on device team0
[   65.621276][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.624182][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.644996][ T3606] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.648534][ T3606] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.887352][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.961067][ T5831] veth0_vlan: entered promiscuous mode
[   65.970719][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.976075][ T5831] veth1_vlan: entered promiscuous mode
[   65.985487][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.033824][ T5831] veth0_macvtap: entered promiscuous mode
[   66.063058][ T5831] veth1_macvtap: entered promiscuous mode
[   66.073272][ T5836] veth0_vlan: entered promiscuous mode
[   66.085933][ T5840] veth0_vlan: entered promiscuous mode
[   66.093262][ T5836] veth1_vlan: entered promiscuous mode
[   66.115842][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.126628][ T5840] veth1_vlan: entered promiscuous mode
[   66.138747][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.155672][ T5831] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.160242][ T5831] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.163165][ T5831] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.166432][ T5831] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.187426][ T5836] veth0_macvtap: entered promiscuous mode
[   66.215116][ T5836] veth1_macvtap: entered promiscuous mode
[   66.232968][ T5840] veth0_macvtap: entered promiscuous mode
[   66.269583][ T5840] veth1_macvtap: entered promiscuous mode
[   66.283453][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.310263][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.342983][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.362985][ T5836] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.366174][ T5836] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.370663][ T5836] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.374150][ T5836] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.383898][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.390537][   T83] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.397450][   T83] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.401990][ T5840] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.405242][ T5840] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.412385][ T5840] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.415930][ T5840] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.469528][ T3606] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.472446][ T3606] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.574233][ T5831] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   66.591459][   T83] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.594089][   T83] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.658355][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.661030][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.740815][   T83] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.744083][   T83] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.760081][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.763183][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.056106][ T5912] pim6reg: entered allmulticast mode
[   67.070783][ T5912] pim6reg: left allmulticast mode
[   67.169485][ T5918] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10'.
[   67.212382][ T5920] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.11'.
[   67.422061][ T5843] Bluetooth: hci2: command tx timeout
[   67.422102][ T5839] Bluetooth: hci0: command tx timeout
[   67.422145][ T5839] Bluetooth: hci1: command tx timeout
[   67.558096][ T5932] bridge0: port 2(bridge_slave_1) entered disabled state
[   67.561604][ T5932] bridge0: port 1(bridge_slave_0) entered disabled state
[   67.667792][ T5932] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   67.674255][ T5932] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   67.699969][ T5942] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   67.736246][ T5932] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   67.741239][ T5932] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   67.744062][ T5932] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   67.746784][ T5932] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   67.903776][ T5947] delete_channel: no stack
[   67.960985][ T5950] Zero length message leads to an empty skb
[   68.116726][ T5963] netlink: 'syz.1.32': attribute type 1 has an invalid length.
[   68.120398][ T5963] netlink: 236 bytes leftover after parsing attributes in process `syz.1.32'.
[   68.186079][ T5965] x_tables: duplicate underflow at hook 2
[   68.214621][ T5968] netlink: 'syz.2.34': attribute type 29 has an invalid length.
[   68.221028][ T5968] netlink: 'syz.2.34': attribute type 29 has an invalid length.
[   68.226035][ T5968] netlink: 488 bytes leftover after parsing attributes in process `syz.2.34'.
[   68.269093][ T5965] netlink: 104 bytes leftover after parsing attributes in process `syz.1.33'.
[   68.412944][ T5978] netlink: 24 bytes leftover after parsing attributes in process `syz.1.38'.
[   68.417795][ T5978] netlink: 24 bytes leftover after parsing attributes in process `syz.1.38'.
[   68.672652][ T5993] netlink: 'syz.2.45': attribute type 17 has an invalid length.
[   69.208863][ T6015] netlink: 16 bytes leftover after parsing attributes in process `syz.2.56'.
[   69.219028][ T6015] openvswitch: netlink: Missing key (keys=40, expected=80)
[   69.332400][ T6017] xt_l2tp: v2 sid > 0xffff: 4294901760
[   69.491376][ T6025] netlink: 280 bytes leftover after parsing attributes in process `syz.0.61'.
[   69.497924][ T5839] Bluetooth: hci1: command tx timeout
[   69.499602][ T5835] Bluetooth: hci2: command tx timeout
[   69.499637][ T5835] Bluetooth: hci0: command tx timeout
[   70.126084][ T6058] xt_TCPMSS: Only works on TCP SYN packets
[   70.611376][ T6078] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   71.048138][ T6087] netlink: 'syz.2.85': attribute type 1 has an invalid length.
[   71.057646][ T6087] netlink: 236 bytes leftover after parsing attributes in process `syz.2.85'.
[   71.104021][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   71.109027][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   71.231108][ T6091] syzkaller0: entered promiscuous mode
[   71.233404][ T6091] syzkaller0: entered allmulticast mode
[   71.501112][  T791] cfg80211: failed to load regulatory.db
[   71.584128][ T5843] Bluetooth: hci2: command tx timeout
[   71.584188][ T5839] Bluetooth: hci0: command tx timeout
[   71.586362][ T5835] Bluetooth: hci1: command tx timeout
[   72.628422][ T6116] ip6t_srh: unknown srh match flags  4000
[   72.997114][ T6139] netlink: 16 bytes leftover after parsing attributes in process `syz.0.109'.
[   73.270251][ T6155] netlink: 28 bytes leftover after parsing attributes in process `syz.0.117'.
[   73.452303][ T6165] netlink: 'syz.1.122': attribute type 9 has an invalid length.
[   73.901326][ T6182] netlink: 'syz.0.129': attribute type 27 has an invalid length.
[   73.990647][ T6185] netlink: 24 bytes leftover after parsing attributes in process `syz.1.130'.
[   74.626203][ T6215] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.144'.
[   74.908246][ T6229] netlink: 'syz.1.151': attribute type 21 has an invalid length.
[   74.912933][ T6229] netlink: 128 bytes leftover after parsing attributes in process `syz.1.151'.
[   74.921043][ T6229] netlink: 3 bytes leftover after parsing attributes in process `syz.1.151'.
[   75.027312][ T6234] netlink: 'syz.1.153': attribute type 5 has an invalid length.
[   75.094483][ T6238] netlink: 8 bytes leftover after parsing attributes in process `syz.1.155'.
[   75.271094][ T6246] Bluetooth: MGMT ver 1.23
[   75.356928][ T6248] netlink: 20 bytes leftover after parsing attributes in process `syz.1.160'.
[   75.369851][ T6248] netlink: 40 bytes leftover after parsing attributes in process `syz.1.160'.
[   75.621725][ T6259] wg1 speed is unknown, defaulting to 1000
[   75.623670][ T6259] wg1 speed is unknown, defaulting to 1000
[   75.648491][ T6259] wg1 speed is unknown, defaulting to 1000
[   75.656152][ T6259] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   75.664933][ T6262] netlink: 8 bytes leftover after parsing attributes in process `syz.2.167'.
[   75.675971][ T6259] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[   75.679914][ T6262] bridge0: port 2(bridge_slave_1) entered disabled state
[   75.682774][ T6262] bridge0: port 1(bridge_slave_0) entered disabled state
[   75.749630][ T6259] wg1 speed is unknown, defaulting to 1000
[   75.753247][ T6259] wg1 speed is unknown, defaulting to 1000
[   75.764305][ T6259] wg1 speed is unknown, defaulting to 1000
[   76.196947][ T6296] netlink: 'syz.2.182': attribute type 11 has an invalid length.
[   76.386051][ T6306] tipc: Started in network mode
[   76.400711][ T6306] tipc: Node identity 0e0599bd641e, cluster identity 4711
[   76.403827][ T6306] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   76.421410][ T6306] tipc: Resetting bearer <eth:syzkaller0>
[   76.454471][ T6304] tipc: Disabling bearer <eth:syzkaller0>
[   77.342868][ T6355] openvswitch: netlink: Message has 5 unknown bytes.
[   77.518851][ T6367] xt_cgroup: invalid path, errno=-2
[   77.552522][ T6369] syz.0.215 uses obsolete (PF_INET,SOCK_PACKET)
[   77.659418][ T6373] netlink: 'syz.2.217': attribute type 14 has an invalid length.
[   77.683531][ T6373] netlink: 'syz.2.217': attribute type 14 has an invalid length.
[   78.017368][ T6332] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   78.144411][ T6407] __nla_validate_parse: 3 callbacks suppressed
[   78.144424][ T6407] netlink: 27 bytes leftover after parsing attributes in process `syz.1.230'.
[   78.273592][ T6413] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   78.481436][ T6429] netlink: 4 bytes leftover after parsing attributes in process `syz.0.241'.
[   82.757721][    C1] sched: DL replenish lagged too much
[  132.848892][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[  132.861056][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[  194.700557][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[  194.707840][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[  255.804232][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[  255.811051][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[  283.079227][   T34] INFO: task kworker/1:6:5886 blocked for more than 144 seconds.
[  283.081603][   T34]       Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0
[  283.085453][   T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  283.555293][   T34] task:kworker/1:6     state:D stack:25280 pid:5886  tgid:5886  ppid:2      task_flags:0x4208060 flags:0x00004000
[  283.570528][   T34] Workqueue: events_power_efficient reg_check_chans_work
[  283.572749][   T34] Call Trace:
[  283.573845][   T34]  <TASK>
[  283.574756][   T34]  __schedule+0x16f5/0x4d00
[  283.576134][   T34]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  284.282474][   T34]  ? schedule+0x165/0x360
[  284.284292][   T34]  ? __pfx___schedule+0x10/0x10
[  284.286217][   T34]  ? schedule+0x91/0x360
[  284.301377][   T34]  schedule+0x165/0x360
[  284.303124][   T34]  schedule_preempt_disabled+0x13/0x30
[  284.305216][   T34]  __mutex_lock+0x724/0xe80
[  284.307054][   T34]  ? __mutex_lock+0x51b/0xe80
[  285.912359][   T34]  ? reg_check_chans_work+0x95/0xf00
[  286.045053][   T34]  ? __pfx___mutex_lock+0x10/0x10
[  286.047202][   T34]  ? lockdep_unlock+0x89/0x120
[  286.363188][   T34]  ? validate_chain+0x897/0x2140
[  286.364938][   T34]  reg_check_chans_work+0x95/0xf00
[  286.366617][   T34]  ? __lock_acquire+0xab9/0xd20
[  288.266780][   T34]  ? __pfx_reg_check_chans_work+0x10/0x10
[  288.279611][   T34]  ? process_scheduled_works+0x9ef/0x17b0
[  288.281430][   T34]  ? _raw_spin_unlock_irq+0x23/0x50
[  288.283003][   T34]  ? process_scheduled_works+0x9ef/0x17b0
[  288.285131][   T34]  ? process_scheduled_works+0x9ef/0x17b0
[  288.287104][   T34]  process_scheduled_works+0xae1/0x17b0
[  289.321253][   T34]  ? __pfx_process_scheduled_works+0x10/0x10
[  289.323239][   T34]  worker_thread+0x8a0/0xda0
[  289.324701][   T34]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  289.326667][   T34]  ? __kthread_parkme+0x7b/0x200
[  291.474895][   T34]  kthread+0x711/0x8a0
[  291.476228][   T34]  ? __pfx_worker_thread+0x10/0x10
[  291.489626][   T34]  ? __pfx_kthread+0x10/0x10
[  291.491382][   T34]  ? _raw_spin_unlock_irq+0x23/0x50
[  291.493244][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  291.495327][   T34]  ? __pfx_kthread+0x10/0x10
[  291.496960][   T34]  ret_from_fork+0x3fc/0x770
[  291.639579][   T34]  ? __pfx_ret_from_fork+0x10/0x10
[  291.641644][   T34]  ? __switch_to_asm+0x39/0x70
[  291.643461][   T34]  ? __switch_to_asm+0x33/0x70
[  291.645268][   T34]  ? __pfx_kthread+0x10/0x10
[  291.647017][   T34]  ret_from_fork_asm+0x1a/0x30
[  291.987785][   T34]  </TASK>
[  291.989436][   T34] 
[  291.989436][   T34] Showing all locks held in the system:
[  291.992057][   T34] 2 locks held by kworker/u8:1/13:
[  291.993701][   T34] 3 locks held by kworker/u10:0/27:
[  291.995417][   T34]  #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  292.164126][   T34]  #1: ffffc9000060fbc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  292.181289][   T34]  #2: ffffffff8f51d808 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60
[  292.593192][   T34] 1 lock held by khungtaskd/34:
[  292.594877][   T34]  #0: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
[  292.890424][   T34] 3 locks held by kworker/u10:1/36:
[  292.892500][   T34] 2 locks held by kworker/1:1/47:
[  292.894395][   T34] 6 locks held by kworker/u10:3/64:
[  292.896347][   T34] 3 locks held by kworker/u9:6/3606:

VM DIAGNOSIS:
07:52:39  Registers:
info registers vcpu 0

CPU#0
RAX=000000000000000d RBX=000000000000000d RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000068f6d0
R8 =ffff888107230237 R9 =1ffff11020e46046 R10=dffffc0000000000 R11=ffffffff85478780
R12=dffffc0000000000 R13=ffffffff99af98da R14=ffffffff99dfe6e0 R15=0000000000000000
RIP=ffffffff854787fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f380f5f8253 CR3=0000000110730000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000ff0000000000 XMM03=0000000000000000 00000000000000ff
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=97aebe7829f73d00 RBX=ffff88810b8b9cc0 RCX=97aebe7829f73d00 RDX=0000000000000002
RSI=ffffffff8d998b3a RDI=ffffffff8be29dc0 RBP=ffffc900001e0730 RSP=ffffc900001e0678
R8 =ffffffff8fa1f4f7 R9 =1ffffffff1f43e9e R10=dffffc0000000000 R11=fffffbfff1f43e9f
R12=ffffffff8a09b023 R13=ffff8881158059c0 R14=ffffffff8185b0dd R15=1ffff9200003c0d4
RIP=ffffffff8b6f3a21 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fa54d5a0ff8 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000ff0000000000 00000000000000ff XMM01=2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000ff0000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 972824ada111c600
XMM08=0006240804800306 800404a400000006 XMM09=656b5f5f2e676972 6f5f74696e695f63
XMM10=3463313061396666 6666666666660a79 XMM11=695f636e5f766461 7461622062203063
XMM12=666666666666660a 79656b5f5f2e7465 XMM13=5f73766f20622030 3866633130613966
XMM14=342e79656b5f5f2e 74656e5f74696e69 XMM15=6663313061396666 6666666666660a31
