last executing test programs:

1.305515186s ago: executing program 0 (id=55):
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x11, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xc59, 0x0, 0x0, 0x0, 0x4}, {}, {}, [@alu={0x4, 0x0, 0x9, 0x4, 0x7, 0x6, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x3, 0x8, 0x8, 0x8, 0xfffffffffffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x1, 0x79, &(0x7f0000000200)=""/121, 0x0, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x0, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0xb, 0x7, 0x9}, 0x10, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000300)=[{0x4, 0x2, 0xa, 0xa}, {0x4, 0x4, 0x8, 0xa}], 0x10, 0x6}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r0, 0x0, 0x41, 0x96, &(0x7f0000000400)="ddfe4ebfa11d25c2a4cbdbc03637156d1dc5ba28d6cee38456822038e061e3b4b72af8f7e8a875b6fa702ef48687de413dd6bbf4447684280e8eeb91b822a0915b", &(0x7f0000000480)=""/150, 0x1, 0x0, 0x5, 0xa1, &(0x7f0000000540)="1a45512071", &(0x7f0000000580)="d273fcfeeb6c0b505040b5c7f8bb50e29f0872b2cbdc7a303d971fb80f7448fade06dc3af9b69fd6c1274f86d4129b9e0e4e942124a77189fc6f52c2ff9b1782bc2309013d263cd6a31917b5ebdafc13bd19ca447aeb8bd4b37dc48084d9ecceb1bd655e2e22e3c5abe77e4980f1f994da6159110697ea03173747a5443a343fcafb407518fb3e7a9b8ae1566b9519f992426e51441dda4c98b5f2e24598ed262f", 0x4, 0x0, 0xefe}, 0x50)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_POSITION_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x50}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='d\x00\x00\x00'], 0x64}, 0x1, 0x0, 0x0, 0x20000010}, 0x0)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000003c0)={0xffffffffffffffff, &(0x7f0000000580)="629377324c4e889db3651c28e0367542086307f733249e58959b4db73ebc66686c306f683416c9df783600bd9b75d0de20d84916ae1d50585acf1762b1c3f77e36f096d919d102328881a827a0afd0ffe7167de9f8beb2e26cf5d8d7d0799c2e3a9e8993d082352f1277343c426e53c4aa95dd0b13272947830e441a6c01010b52242ab3fb4b63b67a71f8abcedaa8a0653af109ad669eb49c7cb38cb809be6bbb0fe1148a5b3b330b92161821c495e85943c7aa8da24cb23fbb1bf4d4d24aa889576ca1561bac1081e6a8394d0e5994e6caebb5900933983d2afc42ed0974a4584a7dd99a0049770486c19a50c0ef98", 0x0}, 0x8b)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f00000000c0)=ANY=[@ANYBLOB="bc000000", @ANYRES16=r2, @ANYBLOB="010028bd7000fddbdf250c000000180001801400020076657468305f746f5f626f6e6400000090000380"], 0xbc}}, 0x0)

1.188040859s ago: executing program 0 (id=57):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xb8, r1, 0x420, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xd2a}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8}]}, @TIPC_NLA_BEARER={0x78, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @private=0xa010101}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x51b}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @remote}}, {0x14, 0x2, @in={0x2, 0x4e24, @local}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x8000}, 0x40800)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x7, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000841}, 0x20)
unshare(0x10000680)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800208}, 0xc, &(0x7f0000000400)={&(0x7f0000000300)={0xec, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_TX_SHARE={0xc, 0xa6, 0x7f}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xf, 0xa9, @name2}, @DEVLINK_ATTR_RATE_TX_SHARE={0xc}, @DEVLINK_ATTR_RATE_NODE_NAME={0xa1, 0xa8, @random="1a7c48b408fc6824dd5837a3eb1a999f5083d386043006b51934c1f24532c6953b08c2725b3d426d33233ac726a61fb418d83be3b771841e07832f2413d81ff807133aa61be3a6433225983e96fce5ee5a64c85bc31346c4751d9235293f035ca4a62a31fa5691a8f1b109bd9cf6284936d86ddca2513238a1e92e9e2938d5cd4841d7349be06edc0977a05150234465f484074a56b9c5a9aa9abc00e0"}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0xffff}]}, 0xec}, 0x1, 0x0, 0x0, 0x44001}, 0x4008040)
r4 = socket$netlink(0x10, 0x3, 0xb)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000480), r4)
ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000004c0)=<r5=>0x0)
r6 = syz_open_procfs$namespace(r5, &(0x7f0000000500)='ns/pid\x00')
r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
accept4$bt_l2cap(r7, &(0x7f0000000540)={0x1f, 0x0, @fixed}, &(0x7f0000000580)=0xe, 0x800)
openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0), 0x20003, 0x0)
r8 = bpf$ITER_CREATE(0x21, &(0x7f0000000600), 0x8)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r8, 0x89f2, 0xfffffffffffffffc)
unshare(0x2060900)
r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r8, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x68, 0x0, 0x8, 0x401, 0x0, 0x0, {0x7}, [@CTA_TIMEOUT_DATA={0x44, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xf66a}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x80000}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xa0000000}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x800}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x481}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x8}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x40}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000802}, 0x40001)
ioctl$EXT4_IOC_GET_ES_CACHE(r6, 0xc020662a, &(0x7f0000000780)={0x7fff, 0x0, 0x6, 0xffffff89, 0x3, 0x0, [{0x8000, 0xfffffffffffffffd, 0x2440, '\x00', 0x4}, {0x1, 0x0, 0x2}, {0x0, 0x6, 0x9, '\x00', 0x100}]})
r10 = getuid()
r11 = getgid()
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f00000008c0)={0x0, 0x0, <r12=>0x0}, &(0x7f0000000900)=0xc)
setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000001000)=@nat={'nat\x00', 0x19, 0x4, 0x6c0, [0x200000000940, 0x0, 0x0, 0x200000000a8e, 0x200000000b9c], 0x0, &(0x7f0000000880), &(0x7f0000000940)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x9, 0x41, 0x15, 'macvtap0\x00', 'bond0\x00', 'sit0\x00', 'team_slave_1\x00', @local, [0x0, 0x0, 0xff, 0xff, 0x0, 0x7f], @multicast, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0xd6, 0x11e, [], [@common=@STANDARD={'\x00', 0x8, {0xffffffffffffffff}}, @snat={'snat\x00', 0x10, {{@dev={'\xaa\xaa\xaa\xaa\xaa', 0x2d}, 0xfffffffffffffffc}}}], @common=@ERROR={'ERROR\x00', 0x20, {"7067dd05632de2ebc55fe577556e1b7ac5ed79821119152718d3704ca612"}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc, 0x1, [{0x5, 0x48, 0x890d, 'wg0\x00', 'vlan1\x00', 'pim6reg1\x00', 'wlan0\x00', @empty, [0xff, 0xff, 0xff, 0x0, 0xff], @random="b7b1a92594ec", [0x0, 0xeb3ab8902df0fdf6, 0x0, 0x0, 0xff], 0x6e, 0xa6, 0xde, [], [@snat={'snat\x00', 0x10, {{@broadcast, 0xfffffffffffffffc}}}], @arpreply={'arpreply\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x2, [{0x5, 0x7, 0x8809, 'ip6_vti0\x00', 'sit0\x00', 'xfrm0\x00', 'veth0_to_bond\x00', @link_local, [0xff, 0x0, 0xff, 0x0, 0xff], @random="f44cdf502916", [0xff, 0x0, 0x0, 0x0, 0x0, 0xff], 0xee, 0x11e, 0x156, [@owner={{'owner\x00', 0x0, 0x18}, {{0xee01, r10, r11, r12, 0x4, 0x7}}}, @devgroup={{'devgroup\x00', 0x0, 0x18}, {{0x1, 0xe19b, 0xd4, 0x52e, 0x7}}}], [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}], @snat={'snat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0xffffffffffffffff}}}}, {0x9, 0x50, 0x22eb, 'team_slave_0\x00', 'veth0_to_bridge\x00', 'veth1_to_hsr\x00', 'team_slave_1\x00', @random="9ee0cb7b17f5", [0x0, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, [0xff, 0x0, 0x0, 0x0, 0x0, 0xff], 0x13e, 0x2a6, 0x2de, [@stp={{'stp\x00', 0x0, 0x48}, {{0xff, {0x4, 0x100, 0x8, @broadcast, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0x1, 0xa, 0x5, 0xa0, @empty, [0x0, 0x80, 0x0, 0xff, 0xff], 0x4e21, 0x4e22, 0x2, 0x7ff, 0x7, 0x3, 0x9, 0x1ff, 0xfff, 0x1000}, 0x420, 0xc10}}}, @arp={{'arp\x00', 0x0, 0x38}, {{0x30a, 0x91b, 0x2, @dev={0xac, 0x14, 0x14, 0x10}, 0xff, @broadcast, 0x0, @broadcast, [0x0, 0x0, 0x1fe], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], 0xa8, 0x4}}}], [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x1, 'system_u:object_r:src_t:s0\x00'}}}, @snat={'snat\x00', 0x10, {{@remote, 0x10}}}], @arpreply={'arpreply\x00', 0x10, {{@local, 0xfffffffffffffffc}}}}]}]}, 0x738)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001080))
connect$pppoe(r8, &(0x7f00000010c0)={0x18, 0x0, {0x4, @multicast}}, 0x1e)
r13 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r13, &(0x7f0000001100)={0x1f, 0x2, 0x1}, 0x6)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000011c0)={{r8}, &(0x7f0000001140), &(0x7f0000001180)='%+9llu \x00'}, 0x20)

1.121821669s ago: executing program 1 (id=59):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x200000000c40, 0x0, 0x0, 0x200000000c70, 0x200000000ca0], 0x11, 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="00000000000000f9ffff000000000000000000000000000000000000000000000000000000000000feffffff00000d00000000000000000000000000000000000000000000000000000000000000000000000000000000004405ffff000000000000000000000000080000000000000000000000000000000000e0ff0000000000000000319eee304ed414a300000000"]}, 0x108)

1.115916473s ago: executing program 0 (id=60):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
connect$bt_sco(r1, 0x0, 0x0)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1982f80cdecd07f8908a983a7c9fb81c2ba7f7e87c991f30e50d1b3bbe4cf2a2f5d4571b6568ada51bc121c9139d2a8e0638c84066b1759081802"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r2}, 0x10)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x620, 0x1d0, 0x5c8, 0x0, 0x5c8, 0x0, 0x6b0, 0x6b0, 0x6b0, 0x6b0, 0x6b0, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [0xffffff00, 0x0, 0x0, 0x1f9814788dbf7ab2], 'veth1\x00', 'syz_tun\x00'}, 0x11e, 0xa8, 0x1d0, 0x1f000000, {0x0, 0x7}}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@ipv6={@loopback, @dev, [], [], 'batadv_slave_0\x00', 'ip6gretap0\x00', {}, {}, 0x2b}, 0x0, 0xa8, 0xd0, 0x7400}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x68}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@inet=@socket3={{0x28}, 0x2}]}, @inet=@TOS={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@mcast2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x680)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0)
ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r4)
socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r4, 0x9)
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="84000000", @ANYRES16=r7, @ANYBLOB="010000000000fbdbdf250100000008000200000000000500050000000000080003000100000048000180050002002000000006000100020000000800060003000000080003"], 0x84}}, 0x20000000)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'bridge_slave_1\x00', <r8=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000001d00070f000000000000000007000000", @ANYRES32=r8], 0x24}}, 0x0)

991.953204ms ago: executing program 1 (id=62):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0)
r2 = socket$netlink(0x10, 0x3, 0x0)
writev(r2, &(0x7f0000000400)=[{&(0x7f00000000c0)="390000001000111867090707a640400f0021ff3f30000000170a001700000000040037000900030001632564b758b9a64411f6bb744dc48f57", 0x39}], 0x1)
r3 = socket(0xf, 0x3, 0x1)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)={@private1}, &(0x7f0000000100)=0x14)
r4 = socket(0x10, 0x3, 0x0)
r5 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', <r6=>0x0})
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000001080), r7)
r9 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000740)=@newsa={0x138, 0x10, 0x413, 0x70bd29, 0x0, {{@in=@remote, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x20, 0x21}, {@in=@remote, 0x0, 0x3c}, @in=@remote, {0x0, 0x2, 0x0, 0x0, 0x8, 0x81000, 0x81}, {0x0, 0x5, 0x4, 0x4000006}, {0x0, 0xfffffff9, 0x80000}, 0x0, 0x0, 0x2, 0x4, 0x81, 0x68}, [@algo_comp={0x48, 0x3, {{'lzjh\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x612fc0b6c779297b}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0xc0081)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x278, 0xffffffff, 0xf8, 0xf8, 0xf8, 0xffffffff, 0xffffffff, 0x2f0, 0x2f0, 0x2f0, 0xffffffff, 0x4, 0x0, {[{{@ip={@rand_addr, @loopback, 0x0, 0x0, 'veth0_to_team\x00', 'wlan0\x00', {}, {}, 0x73}, 0x0, 0x70, 0x98, 0x0, {0x100000000000000}}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28}}, {{@ip={@private, @loopback, 0x0, 0x0, 'batadv_slave_0\x00', 'veth1\x00'}, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d8)
r10 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r10, &(0x7f0000000380)={{0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0xa}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48)
syz_init_net_socket$netrom(0x6, 0x5, 0x0)
r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r11, &(0x7f0000000140)={0x1f, 0xffff, 0x3}, 0x6)
write(r11, &(0x7f00000000c0)="4b0003000000", 0x6)
sendmsg$NLBL_MGMT_C_VERSION(r7, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000010c0)={0x14, r8, 0x1}, 0x14}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000000)=@newqdisc={0x60, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c}, {0x4}}]}, @qdisc_kind_options=@q_plug={{0x9}, {0xc}}]}, 0x60}}, 0x0)
r12 = accept(r2, &(0x7f0000000440)=@alg, &(0x7f0000000200)=0x80)
bind$alg(r12, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cast5)\x00'}, 0x58)
sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000129bddf2512000000"], 0x54}, 0x1, 0x0, 0x0, 0x20000880}, 0x4000400)
sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfc, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x40088)
sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000001f0007012dbd700000400000017c00001c00fc8018009900f2a9a3b9aff9efa0f8893977b3a5df730c331a6349d48d674d68000180599c02800400728014000700"/80], 0x50}, 0x1, 0x0, 0x0, 0xc000}, 0xc010)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vxcan1\x00'})

824.045158ms ago: executing program 1 (id=65):
r0 = socket$inet6(0xa, 0x1, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612)
r2 = socket$can_bcm(0x1d, 0x2, 0x2)
r3 = socket$unix(0x1, 0x5, 0x0)
recvmmsg$unix(r3, &(0x7f0000004480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x60, 0x0)
connect$can_bcm(r2, &(0x7f0000000000), 0x10)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', <r4=>0x0})
sendmsg$can_bcm(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x1d, r4}, 0x10, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d6fe682c6100000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000004"], 0x20000600}}, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000400)={'vxcan0\x00', <r5=>0x0})
sendmsg$can_bcm(r2, &(0x7f0000000480)={&(0x7f0000000380)={0x1d, r5, 0x0, 0x4000}, 0x10, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[], 0x80}, 0x1, 0x0, 0x0, 0x4000}, 0x4044001)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f000068d000/0x2000)=nil, 0x2000, 0x8, 0x22051, r6, 0x0)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x7}, 0x8)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@private2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x12}}, {{@in6=@private1, 0x0, 0x6c}, 0x0, @in, 0x3501, 0x4}}, 0xe8)
close(r0)

776.067629ms ago: executing program 2 (id=66):
clock_gettime(0x7, &(0x7f00000008c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf250b000000700002800800010081ffffff040004002c0003800800020000000000080001000300000008000100ff0700000800010008000000080002000100000008000100400000002400038008000200930d0000080001001a080000080002000e000000080001000008000008000200070000003800078083856b406f92c1e3eaa80b1508000200ef0600000c000300000000000000000008000100ff0100000c00040004000000000000000c000300b20900000000000044000280140003800800010000800000080002000900000004000400080002008a3e5a1708000200000800000400040008000200050000000800010057000000040004002c0009800800020004000000080001000500000008000100ffffffff0800010051f9ffff0800010007000000"], 0x12c}, 0x1, 0x0, 0x0, 0x20044814}, 0x4013)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="3400000010000d04aabd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="01000000240500001400128009000100626f6e64"], 0x34}}, 0x0)
connect$netlink(r2, &(0x7f0000000040)=@proc={0x10, 0x0, 0x25dfdbfe, 0x200000}, 0xc)

775.538321ms ago: executing program 1 (id=67):
r0 = socket(0x10, 0x3, 0x0)
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt(r1, 0x84, 0x7d, &(0x7f00000002c0)="aa8e0cf56164be5b", 0x8)
r2 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth0_to_hsr\x00', <r3=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0xf0b, 0xfffffffd, 0x203, {0x60, 0x0, 0x0, r3, {0x6, 0xfff1}, {0xffff, 0xffff}, {0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x800000003b9aca00}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000054}, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r5 = openat$cgroup_ro(r4, &(0x7f0000000200)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0)
writev(r5, &(0x7f0000000900)=[{&(0x7f0000000540)='x', 0x1}], 0x1)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r5, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x10, 0x140f, 0x200, 0x70bd2c, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0x8801}, 0x40801)
connect$netlink(r6, &(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x10}, 0xc)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0xa4, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_PHYS_PORT_ID={0x24, 0x22, "c97defd798aa9dee0290d67004f485945055e75162566a2f3c7f25f091715600"}, @IFLA_MASTER={0x8}, @IFLA_ALT_IFNAME={0x14, 0x35, 'veth1\x00'}, @IFLA_XDP={0x44, 0x2b, 0x0, 0x1, [@IFLA_XDP_EXPECTED_FD={0x8}, @IFLA_XDP_EXPECTED_FD={0x1e}, @IFLA_XDP_FD={0x8}, @IFLA_XDP_EXPECTED_FD={0x8}, @IFLA_XDP_EXPECTED_FD={0x8}, @IFLA_XDP_FD={0x8}, @IFLA_XDP_EXPECTED_FD={0x8}, @IFLA_XDP_EXPECTED_FD={0x8}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x24000804}, 0x10)

664.796563ms ago: executing program 1 (id=68):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000003d0007010000000004000000047c000004001280080001800400f58056bfb5b1bae88581379fe119d4522551530f32b5aa99670f11787eb8fd1effc117967baf6a633b3d7103468cc41b431511c6be5b0e519cd365f3b8578cd9af624773a2e070e73b3e936fcedebedb2f23fc9f7de9822a7f3c42fa00ebe448dfe4a8f6d4024e3e1d17d2146968298f07d6d9a800967d007d24d2055b16ff004e866bb8a449e57b2cf9af78eaeea6f8a1cf9bee0fd2e014a3f1c48e2d4cfbcc61b0c27a42c6b0dedb1458ccb5defe829408651caba038c4e0f16c53e39f8db196"], 0x20}}, 0x44)
sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf250401f2800800180009ac0f"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="6000000010000108fdfffffffddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="000000042104020008001b000000000038001a8004002d8030000a80050008"], 0x60}, 0x1, 0x0, 0x0, 0x4040080}, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@newsa={0x13c, 0x10, 0x713, 0x70bd2d, 0x0, {{@in=@broadcast, @in=@loopback, 0x0, 0x7, 0x0, 0x0, 0xa}, {@in=@local, 0x0, 0x3c}, @in6=@private1, {0x0, 0xfffffffffffffffe, 0x7, 0x100000}, {0x0, 0x0, 0xfffffffffffffff8}, {0x0, 0x0, 0x8}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(md5)\x00'}, 0x0, 0x40}}]}, 0x13c}}, 0x0)
getsockopt$inet6_int(r2, 0x29, 0x9, &(0x7f0000000140), &(0x7f0000000180)=0x4)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48)
unshare(0x22020600)
r5 = socket$kcm(0x11, 0x3, 0x0)
r6 = socket$kcm(0x10, 0x3, 0x10)
socket$inet6_udp(0xa, 0x2, 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@cgroup=r7, r7, 0x2f, 0x14, 0x4, @void, @value=r7}, 0x20)
socket$pppl2tp(0x18, 0x1, 0x1)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000a00)=@ipv4_delrule={0x1c, 0x21, 0x1, 0x0, 0x0, {0x2, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}}, 0x1c}, 0x1, 0x0, 0x0, 0x4010}, 0x0)
sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)="1400000016000b63d25a80648c2594f91124fc60", 0x14}], 0x1}, 0x0)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = socket$inet(0x2b, 0x801, 0x0)
setsockopt$ARPT_SO_SET_ADD_COUNTERS(r9, 0x0, 0x61, &(0x7f00000001c0)={'filter\x00', 0x4}, 0x68)
ioctl$sock_SIOCETHTOOL(r8, 0x8946, 0x0)
setsockopt$sock_attach_bpf(r5, 0x107, 0x17, 0x0, 0x0)

663.466674ms ago: executing program 2 (id=69):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x200000000c40, 0x0, 0x0, 0x200000000c70, 0x200000000ca0], 0x11, 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="00000000000000000000060000000000000000000000000000000000000000000000000000000000feffffff00000d00000000000000000000000000000000000000000000000000000000000000000000000000000000004405ffff000000000000000000000000080000000000000000000000000000000000e0ff0000000000000000319eee304ed414a300000000"]}, 0x108)

544.882188ms ago: executing program 2 (id=70):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000340), 0xffffffffffffffff)
r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0)
setsockopt$ax25_int(r2, 0x101, 0x4, &(0x7f0000000180)=0x2, 0x4)
sendmsg$DEVLINK_CMD_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000380)={0x34, r1, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000000)

423.448246ms ago: executing program 2 (id=71):
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r1=>0x0}) (async)
r2 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r2, &(0x7f0000000180)=@id={0x1e, 0x3, 0x3, {0x4e20, 0x3}}, 0x10) (async)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r1, @ANYRES32=r1, @ANYBLOB="00080000075005002c0012800b00010062726964676500001c00028006000900090000000600270001"], 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x44040)

322.395156ms ago: executing program 2 (id=72):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff)
r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r0)
sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r1, 0x100, 0x70bd26, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x40000)

254.126526ms ago: executing program 1 (id=73):
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={0x0, 0x0, 0x5a}, 0x28)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0)
sendmsg$nl_route_sched(r1, 0x0, 0x4000010)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r3 = socket(0x10, 0x803, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0, r5}, 0x18)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xf0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'})
r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d)
ioctl$sock_netdev_private(r8, 0x8914, &(0x7f0000000000))
ioctl$sock_ax25_SIOCADDRT(r7, 0x890b, &(0x7f00000000c0)={@default, @default, 0x7, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null]})
syz_init_net_socket$ax25(0x3, 0x3, 0xc4)
ioctl$sock_ax25_SIOCADDRT(r7, 0x890b, &(0x7f0000000240)={@default, @bcast, 0x4, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]})
sendmsg$nl_route_sched(r3, 0x0, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x58, 0x2c, 0xd27, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, {0xc, 0x4}, {}, {0xfff2, 0xf}}, [@filter_kind_options=@f_bpf={{0x8}, {0x2c, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x9, 0x10, 0x6, 0x5}]}}, @TCA_BPF_FD={0x8}]}}]}, 0x58}}, 0x20040054)
socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000006a0001002abd7000ffdbdf25008100000000000008"], 0x20}, 0x1, 0x0, 0x0, 0x4040000}, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000380), 0xffffffffffffffff)
socket(0x2, 0x80805, 0x0)
socket$nl_route(0x10, 0x3, 0x0)

184.349335ms ago: executing program 2 (id=74):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001500)=ANY=[@ANYBLOB="d8000000000203000000000000000000020000053c0002802c00018014000300fc00000000000000000000000000000114000400000000000000000000000000000000010c00028005000100210000000400038004000180"], 0xd8}}, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r3, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000100)=@ethtool_coalesce={0xe, 0x0, 0x1000, 0x6, 0x400000, 0x7ff, 0x4, 0xc0000000, 0x402, 0x9, 0x5, 0x5, 0x3, 0x4006, 0x80, 0xfffffffc, 0x0, 0x37e9, 0x80000004, 0x1, 0x6, 0xfffffff9, 0x3}})
syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', &(0x7f0000000340)=@default_ap_ssid, 0x6, 0x2)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)=@flushpolicy={0x38, 0x12, 0x105, 0x0, 0x0, "", [@address_filter={0x28, 0x1a, {@in=@private=0xa010102, @in=@private=0xa010100, 0xa, 0x6, 0x9}}]}, 0x38}}, 0x20040810)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = socket(0x10, 0x3, 0x0)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000580), 0xffffffffffffffff)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x4c, r7, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x8, 0x8e}}]}, 0x4c}}, 0x0)
r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000240)='kfree_skb\x00', r9, 0x0, 0x8}, 0x18)
setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000280)=r9, 0x4)
setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000180)={0x2d6}, 0x10)
write(r6, &(0x7f0000000000)="240000001a005f0400f9f407000904018000200000000000000000000800010000000000", 0x24)
setsockopt$PNPIPE_ENCAP(r6, 0x113, 0x1, &(0x7f0000000240), 0x4)
r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, r10, 0x9c3fa077fa966179, 0x70bd29, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916d, 0x15}}}}}, 0x20}}, 0x4000054)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="0003230c1100"})
r11 = socket$kcm(0x10, 0x2, 0x0)
write$cgroup_subtree(r11, &(0x7f0000000000)=ANY=[@ANYBLOB="36400000260091"], 0xfe33)
r12 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
openat$cgroup_devices(r12, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0)

182.186332ms ago: executing program 0 (id=75):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x200000000c40, 0x0, 0x0, 0x9, 0x200000000ca0], 0x11, 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000fffff9000000000000000000feffffff00000d00000000000000000000000000000000000000000000000000000000000000000000000000000000004405ffff000000000000000000000000080000000000000000000000000000000000e0ff0000000000000000319eee304ed414a300000000"]}, 0x108)

63.441942ms ago: executing program 0 (id=76):
socket$inet6_udp(0xa, 0x2, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@bridge_delneigh={0x30, 0x1e, 0x1, 0x0, 0x25dfdbfc, {0x7}, [@NDA_LLADDR={0xa}, @NDA_MASTER={0x8, 0x9, 0x2}]}, 0x30}}, 0x0)

0s ago: executing program 0 (id=77):
sendto$inet6(0xffffffffffffffff, &(0x7f0000000240)="7800000018001f07b9409b0dffff000d0216be0402030605060140034300080012000000fac8388827a685a168d0bf46d323456511000000caaf6c26c2742145", 0x40, 0x4000000, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000800b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10)
bpf$MAP_CREATE(0x700000000000000, &(0x7f0000000440)=@base={0x1d, 0x4, 0x2, 0x0, 0x201, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5}, 0x48)
r2 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'macsec0\x00', <r4=>0x0})
r5 = socket(0x10, 0x803, 0x0)
r6 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r7=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newtfilter={0x7c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x50, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0x1, 0x1, 0x3, 0x1, 0x4, 0x2, 0x6, 0x7ffffffa, [{0x200, 0x500, 0x3, 0x6}, {0x6783, 0x2, 0x8001, 0x10}, {0x0, 0x53, 0xa9, 0x1}]}}, @TCA_U32_LINK={0x8}]}}]}, 0x7c}}, 0x24040084)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000240012800b0001006d616373656300001400028005000a0000"], 0x44}}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:38982' (ED25519) to the list of known hosts.
syzkaller login: [   57.383129][ T5812] cgroup: Unknown subsys name 'net'
[   57.539152][ T5812] cgroup: Unknown subsys name 'cpuset'
[   57.544087][ T5812] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   59.810504][ T5812] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   65.036911][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   65.041811][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   65.044471][   T54] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   65.047553][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   65.051289][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   65.054962][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   65.058221][   T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   65.063189][ T5840] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   65.067573][ T5840] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   65.071169][ T5840] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   65.083157][ T5841] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   65.088209][ T5841] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   65.093102][ T5841] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   65.100926][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   65.107280][ T5842] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   65.430808][ T5830] chnl_net:caif_netlink_parms(): no params data found
[   65.478801][ T5828] chnl_net:caif_netlink_parms(): no params data found
[   65.542181][ T5827] chnl_net:caif_netlink_parms(): no params data found
[   65.662744][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.667160][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.670374][ T5830] bridge_slave_0: entered allmulticast mode
[   65.674051][ T5830] bridge_slave_0: entered promiscuous mode
[   65.680461][ T5828] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.683417][ T5828] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.688924][ T5828] bridge_slave_0: entered allmulticast mode
[   65.693769][ T5828] bridge_slave_0: entered promiscuous mode
[   65.699118][ T5828] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.701813][ T5828] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.704923][ T5828] bridge_slave_1: entered allmulticast mode
[   65.710011][ T5828] bridge_slave_1: entered promiscuous mode
[   65.720834][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.723297][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.726290][ T5830] bridge_slave_1: entered allmulticast mode
[   65.729278][ T5830] bridge_slave_1: entered promiscuous mode
[   65.798815][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.805725][ T5828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.820343][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.824719][ T5828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.828200][ T5827] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.830719][ T5827] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.833511][ T5827] bridge_slave_0: entered allmulticast mode
[   65.837489][ T5827] bridge_slave_0: entered promiscuous mode
[   65.887065][ T5827] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.889921][ T5827] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.892896][ T5827] bridge_slave_1: entered allmulticast mode
[   65.897716][ T5827] bridge_slave_1: entered promiscuous mode
[   65.917153][ T5828] team0: Port device team_slave_0 added
[   65.940779][ T5828] team0: Port device team_slave_1 added
[   65.946018][ T5827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.951952][ T5830] team0: Port device team_slave_0 added
[   65.974188][ T5830] team0: Port device team_slave_1 added
[   65.978241][ T5827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.982131][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.984577][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.995136][ T5828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   66.003399][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_1
[   66.007303][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   66.018535][ T5828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   66.086981][ T5827] team0: Port device team_slave_0 added
[   66.090155][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0
[   66.092666][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   66.103663][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   66.112869][ T5827] team0: Port device team_slave_1 added
[   66.125852][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1
[   66.128416][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   66.138468][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   66.198713][ T5828] hsr_slave_0: entered promiscuous mode
[   66.202103][ T5828] hsr_slave_1: entered promiscuous mode
[   66.222293][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_0
[   66.224720][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   66.234761][ T5827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   66.268886][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_1
[   66.271906][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   66.284084][ T5827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   66.318063][ T5830] hsr_slave_0: entered promiscuous mode
[   66.320457][ T5830] hsr_slave_1: entered promiscuous mode
[   66.322776][ T5830] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   66.325644][ T5830] Cannot create hsr debugfs directory
[   66.396298][ T5827] hsr_slave_0: entered promiscuous mode
[   66.399045][ T5827] hsr_slave_1: entered promiscuous mode
[   66.401731][ T5827] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   66.404272][ T5827] Cannot create hsr debugfs directory
[   66.655008][ T5828] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   66.666388][ T5828] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   66.705341][ T5828] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   66.723029][ T5828] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   66.775668][ T5830] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   66.784785][ T5830] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   66.800983][ T5830] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   66.822802][ T5830] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   66.912091][ T5827] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   66.923848][ T5827] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   66.929937][ T5827] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   66.948634][ T5827] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   66.990289][ T5828] 8021q: adding VLAN 0 to HW filter on device bond0
[   67.033656][ T5828] 8021q: adding VLAN 0 to HW filter on device team0
[   67.049636][ T1090] bridge0: port 1(bridge_slave_0) entered blocking state
[   67.052258][ T1090] bridge0: port 1(bridge_slave_0) entered forwarding state
[   67.067971][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0
[   67.081556][ T1090] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.084278][ T1090] bridge0: port 2(bridge_slave_1) entered forwarding state
[   67.123846][ T5830] 8021q: adding VLAN 0 to HW filter on device team0
[   67.127907][ T5842] Bluetooth: hci0: command tx timeout
[   67.130264][ T5842] Bluetooth: hci2: command tx timeout
[   67.132387][ T5842] Bluetooth: hci1: command tx timeout
[   67.150875][ T1090] bridge0: port 1(bridge_slave_0) entered blocking state
[   67.153317][ T1090] bridge0: port 1(bridge_slave_0) entered forwarding state
[   67.161638][ T5828] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   67.183700][ T1090] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.186659][ T1090] bridge0: port 2(bridge_slave_1) entered forwarding state
[   67.248043][ T5827] 8021q: adding VLAN 0 to HW filter on device bond0
[   67.266774][ T5827] 8021q: adding VLAN 0 to HW filter on device team0
[   67.274922][   T68] bridge0: port 1(bridge_slave_0) entered blocking state
[   67.277861][   T68] bridge0: port 1(bridge_slave_0) entered forwarding state
[   67.299252][   T68] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.301740][   T68] bridge0: port 2(bridge_slave_1) entered forwarding state
[   67.412679][ T5828] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.462385][ T5828] veth0_vlan: entered promiscuous mode
[   67.490424][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.498089][ T5828] veth1_vlan: entered promiscuous mode
[   67.549562][ T5830] veth0_vlan: entered promiscuous mode
[   67.579822][ T5830] veth1_vlan: entered promiscuous mode
[   67.622338][ T5827] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.630219][ T5828] veth0_macvtap: entered promiscuous mode
[   67.649508][ T5828] veth1_macvtap: entered promiscuous mode
[   67.683908][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.692988][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.712800][ T5830] veth0_macvtap: entered promiscuous mode
[   67.721591][ T5828] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.724850][ T5828] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.729179][ T5828] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.732491][ T5828] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.750126][ T5830] veth1_macvtap: entered promiscuous mode
[   67.760545][ T5827] veth0_vlan: entered promiscuous mode
[   67.783807][ T5827] veth1_vlan: entered promiscuous mode
[   67.811783][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.872756][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.885869][ T5827] veth0_macvtap: entered promiscuous mode
[   67.921974][ T5827] veth1_macvtap: entered promiscuous mode
[   67.933573][ T5830] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.939449][ T5830] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.943071][ T5830] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.946823][ T5830] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.973075][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.977055][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   68.012914][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_0
[   68.046298][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_1
[   68.053411][ T1088] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   68.058052][ T1088] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   68.091326][ T5827] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   68.094960][ T5827] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   68.105434][ T5827] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   68.108821][ T5827] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   68.174028][ T5828] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   68.187000][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   68.195870][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   68.309548][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   68.322771][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   68.395689][   T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   68.399104][   T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   68.502027][ T5901] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode
[   68.530653][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   68.534083][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   68.546929][ T5902] bridge_slave_0: left allmulticast mode
[   68.549379][ T5902] bridge_slave_0: left promiscuous mode
[   68.552401][ T5902] bridge0: port 1(bridge_slave_0) entered disabled state
[   68.570527][ T5902] bridge_slave_1: left allmulticast mode
[   68.572911][ T5902] bridge_slave_1: left promiscuous mode
[   68.576938][ T5902] bridge0: port 2(bridge_slave_1) entered disabled state
[   68.584701][ T5902] bond0: (slave bond_slave_0): Releasing backup interface
[   68.592524][ T5901] netlink: 'syz.1.4': attribute type 10 has an invalid length.
[   68.601394][ T5902] bond0: (slave bond_slave_1): Releasing backup interface
[   68.618422][ T5902] team0: Port device team_slave_0 removed
[   68.627473][ T5902] team0: Port device team_slave_1 removed
[   68.630520][ T5902] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   68.633560][ T5902] batman_adv: batadv0: Removing interface: batadv_slave_0
[   68.639932][ T5902] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   68.651458][ T5902] batman_adv: batadv0: Removing interface: batadv_slave_1
[   68.679358][ T5901] mac80211_hwsim hwsim3 wlan1: left allmulticast mode
[   68.698098][ T5901] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   68.841319][ T5911] pim6reg1: entered promiscuous mode
[   68.843149][ T5911] pim6reg1: entered allmulticast mode
[   68.853768][ T5911] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5'.
[   68.870893][ T5917] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3'.
[   68.882621][ T5917] openvswitch: netlink: Missing key (keys=40, expected=100)
[   69.024746][ T5919] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7'.
[   69.028372][ T5919] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7'.
[   69.033768][ T5919] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   69.043898][ T5919] IPVS: set_ctl: invalid protocol: 0 224.0.0.1:20002
[   69.050964][ T5919] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7'.
[   69.151029][ T5929] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable
[   69.225168][ T5832] Bluetooth: hci1: command tx timeout
[   69.227621][ T5832] Bluetooth: hci2: command tx timeout
[   69.229959][ T5832] Bluetooth: hci0: command tx timeout
[   69.297182][ T5931] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11'.
[   69.386768][ T5940] netlink: 'syz.1.14': attribute type 1 has an invalid length.
[   69.389540][ T5940] netlink: 224 bytes leftover after parsing attributes in process `syz.1.14'.
[   69.394369][ T5940] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14'.
[   69.394425][ T5941] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14'.
[   69.414457][ T5933] Zero length message leads to an empty skb
[   69.467819][ T5940] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14'.
[   69.519794][ T5941] (unnamed net_device) (uninitialized): option active_slave: mode dependency failed, not supported in mode balance-xor(2)
[   69.594165][ T5949] netlink: 'syz.0.17': attribute type 11 has an invalid length.
[   69.652860][ T5953] syzkaller0: entered promiscuous mode
[   69.655685][ T5953] syzkaller0: entered allmulticast mode
[   69.864448][ T5955] syz.2.19 uses obsolete (PF_INET,SOCK_PACKET)
[   70.881006][ T5963] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input4
[   70.904088][ T5965] xt_TPROXY: Can be used only with -p tcp or -p udp
[   71.100130][ T5973] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.252758][ T5986] vlan2: entered promiscuous mode
[   71.254524][ T5986] bond0: entered promiscuous mode
[   71.256967][ T5986] bond_slave_0: entered promiscuous mode
[   71.259235][ T5986] bond_slave_1: entered promiscuous mode
[   71.288452][ T5832] Bluetooth: hci0: command tx timeout
[   71.290278][ T5832] Bluetooth: hci2: command tx timeout
[   71.292102][ T5842] Bluetooth: hci1: command tx timeout
[   71.294618][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[   71.296849][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[   71.610557][ T6016] xt_TPROXY: Can be used only with -p tcp or -p udp
[   71.693031][ T6021] bridge1: the hash_elasticity option has been deprecated and is always 16
[   71.791854][ T6027] warning: `syz.1.45' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   72.054300][ T6040] xt_CT: No such helper "snmp"
[   72.354845][ T6057] netlink: 'syz.1.53': attribute type 1 has an invalid length.
[   72.727493][ T6074] 0: renamed from hsr_slave_1 (while UP)
[   72.744099][ T6074] 0: entered allmulticast mode
[   72.753691][ T6074] A link change request failed with some changes committed already. Interface c0 may have been left with an inconsistent configuration, please check.
[   72.864541][ T6079] netlink: 'syz.2.64': attribute type 1 has an invalid length.
[   72.964658][ T6085] veth1: entered promiscuous mode
[   72.974569][ T6085] netlink: 'syz.1.67': attribute type 8 has an invalid length.
[   72.978179][ T6085] A link change request failed with some changes committed already. Interface veth1 may have been left with an inconsistent configuration, please check.
[   73.366918][ T5832] Bluetooth: hci0: command tx timeout
[   73.368713][ T5842] Bluetooth: hci2: command tx timeout
[   73.370190][ T5832] Bluetooth: hci1: command tx timeout
[   73.629998][ T5278] udevd[5278]: worker [5834] terminated by signal 33 (Unknown signal 33)
[   73.633520][ T5278] udevd[5278]: worker [5834] failed while handling '/devices/virtual/block/loop0'
Connection to localhost closed by remote host.
[   73.757961][   T95] cfg80211: failed to load regulatory.db
[   73.836022][ T5966] ==================================================================
[   73.838840][ T5966] BUG: KASAN: slab-use-after-free in __mutex_lock+0x738/0xe80
[   73.841207][ T5966] Read of size 8 at addr ffff8880229040a0 by task khidpd_10cf05df/5966
[   73.844680][ T5966] 
[   73.845884][ T5966] CPU: 1 UID: 0 PID: 5966 Comm: khidpd_10cf05df Not tainted 6.16.0-rc6-syzkaller-00135-gcf074eca0065-dirty #0 PREEMPT(full) 
[   73.845896][ T5966] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   73.845903][ T5966] Call Trace:
[   73.845909][ T5966]  <TASK>
[   73.845939][ T5966]  dump_stack_lvl+0x189/0x250
[   73.845955][ T5966]  ? __kasan_check_byte+0x12/0x40
[   73.845970][ T5966]  ? __pfx_dump_stack_lvl+0x10/0x10
[   73.845978][ T5966]  ? lock_release+0x4b/0x3e0
[   73.845988][ T5966]  ? __virt_addr_valid+0x4a5/0x5c0
[   73.845999][ T5966]  print_report+0xca/0x230
[   73.846007][ T5966]  ? __mutex_lock+0x738/0xe80
[   73.846016][ T5966]  kasan_report+0x118/0x150
[   73.846027][ T5966]  ? __mutex_lock+0x738/0xe80
[   73.846036][ T5966]  __mutex_lock+0x738/0xe80
[   73.846045][ T5966]  ? __mutex_lock+0x51b/0xe80
[   73.846054][ T5966]  ? l2cap_unregister_user+0x6a/0x1b0
[   73.846064][ T5966]  ? __pfx___mutex_lock+0x10/0x10
[   73.846073][ T5966]  ? __pfx___timer_delete_sync+0x10/0x10
[   73.846087][ T5966]  l2cap_unregister_user+0x6a/0x1b0
[   73.846096][ T5966]  hidp_session_thread+0x3c9/0x410
[   73.846107][ T5966]  ? __pfx_hidp_session_thread+0x10/0x10
[   73.846114][ T5966]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   73.846126][ T5966]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   73.846135][ T5966]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   73.846143][ T5966]  ? __kthread_parkme+0x7b/0x200
[   73.846154][ T5966]  ? __kthread_parkme+0x1a1/0x200
[   73.846164][ T5966]  kthread+0x711/0x8a0
[   73.846174][ T5966]  ? __pfx_hidp_session_thread+0x10/0x10
[   73.846182][ T5966]  ? __pfx_kthread+0x10/0x10
[   73.846191][ T5966]  ? _raw_spin_unlock_irq+0x23/0x50
[   73.846202][ T5966]  ? lockdep_hardirqs_on+0x9c/0x150
[   73.846210][ T5966]  ? __pfx_kthread+0x10/0x10
[   73.846219][ T5966]  ret_from_fork+0x3fc/0x770
[   73.846229][ T5966]  ? __pfx_ret_from_fork+0x10/0x10
[   73.846237][ T5966]  ? __switch_to_asm+0x39/0x70
[   73.846247][ T5966]  ? __switch_to_asm+0x33/0x70
[   73.846256][ T5966]  ? __pfx_kthread+0x10/0x10
[   73.846265][ T5966]  ret_from_fork_asm+0x1a/0x30
[   73.846277][ T5966]  </TASK>
[   73.846281][ T5966] 
[   73.913943][ T5966] Allocated by task 5828:
[   73.915434][ T5966]  kasan_save_track+0x3e/0x80
[   73.917023][ T5966]  __kasan_kmalloc+0x93/0xb0
[   73.918628][ T5966]  __kmalloc_noprof+0x27a/0x4f0
[   73.920344][ T5966]  hci_alloc_dev_priv+0x28/0x2040
[   73.921964][ T5966]  vhci_create_device+0x120/0x6e0
[   73.923526][ T5966]  vhci_write+0x3ce/0x4a0
[   73.924877][ T5966]  vfs_write+0x54b/0xa90
[   73.926268][ T5966]  ksys_write+0x145/0x250
[   73.927661][ T5966]  do_syscall_64+0xfa/0x3b0
[   73.929154][ T5966]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   73.931085][ T5966] 
[   73.931914][ T5966] Freed by task 5828:
[   73.933268][ T5966]  kasan_save_track+0x3e/0x80
[   73.934792][ T5966]  kasan_save_free_info+0x46/0x50
[   73.936401][ T5966]  __kasan_slab_free+0x62/0x70
[   73.937921][ T5966]  kfree+0x18e/0x440
[   73.939164][ T5966]  bt_host_release+0x82/0x90
[   73.940604][ T5966]  device_release+0x9c/0x1c0
[   73.942080][ T5966]  kobject_put+0x22b/0x480
[   73.943535][ T5966]  vhci_release+0x88/0xd0
[   73.944992][ T5966]  __fput+0x44c/0xa70
[   73.946436][ T5966]  task_work_run+0x1d4/0x260
[   73.948074][ T5966]  do_exit+0x6b5/0x22e0
[   73.949671][ T5966]  do_group_exit+0x21c/0x2d0
[   73.951271][ T5966]  __x64_sys_exit_group+0x3f/0x40
[   73.953121][ T5966]  x64_sys_call+0x21ba/0x21c0
[   73.954674][ T5966]  do_syscall_64+0xfa/0x3b0
[   73.956093][ T5966]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   73.957996][ T5966] 
[   73.958810][ T5966] Last potentially related work creation:
[   73.960822][ T5966]  kasan_save_stack+0x3e/0x60
[   73.962496][ T5966]  kasan_record_aux_stack+0xbd/0xd0
[   73.964353][ T5966]  insert_work+0x3d/0x330
[   73.965807][ T5966]  __queue_work+0xbd9/0xfe0
[   73.967301][ T5966]  queue_work_on+0x181/0x270
[   73.968785][ T5966]  process_scheduled_works+0xae1/0x17b0
[   73.970561][ T5966]  worker_thread+0x8a0/0xda0
[   73.972054][ T5966]  kthread+0x711/0x8a0
[   73.973441][ T5966]  ret_from_fork+0x3fc/0x770
[   73.975055][ T5966]  ret_from_fork_asm+0x1a/0x30
[   73.976868][ T5966] 
[   73.977643][ T5966] Second to last potentially related work creation:
[   73.979693][ T5966]  kasan_save_stack+0x3e/0x60
[   73.981130][ T5966]  kasan_record_aux_stack+0xbd/0xd0
[   73.982852][ T5966]  insert_work+0x3d/0x330
[   73.984406][ T5966]  __queue_work+0xcfc/0xfe0
[   73.985917][ T5966]  call_timer_fn+0x17e/0x5f0
[   73.987442][ T5966]  __run_timer_base+0x646/0x860
[   73.989043][ T5966]  run_timer_softirq+0xb7/0x180
[   73.990621][ T5966]  handle_softirqs+0x286/0x870
[   73.992186][ T5966]  __irq_exit_rcu+0xca/0x1f0
[   73.993689][ T5966]  irq_exit_rcu+0x9/0x30
[   73.995092][ T5966]  sysvec_apic_timer_interrupt+0xa6/0xc0
[   73.996914][ T5966]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   73.998762][ T5966] 
[   73.999516][ T5966] The buggy address belongs to the object at ffff888022904000
[   73.999516][ T5966]  which belongs to the cache kmalloc-8k of size 8192
[   74.003613][ T5966] The buggy address is located 160 bytes inside of
[   74.003613][ T5966]  freed 8192-byte region [ffff888022904000, ffff888022906000)
[   74.007880][ T5966] 
[   74.008646][ T5966] The buggy address belongs to the physical page:
[   74.010819][ T5966] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22900
[   74.013524][ T5966] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   74.016160][ T5966] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   74.018443][ T5966] page_type: f5(slab)
[   74.019649][ T5966] raw: 00fff00000000040 ffff88801a442280 dead000000000122 0000000000000000
[   74.022217][ T5966] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   74.025299][ T5966] head: 00fff00000000040 ffff88801a442280 dead000000000122 0000000000000000
[   74.028379][ T5966] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   74.031258][ T5966] head: 00fff00000000003 ffffea00008a4001 00000000ffffffff 00000000ffffffff
[   74.033908][ T5966] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   74.036950][ T5966] page dumped because: kasan: bad access detected
[   74.039458][ T5966] page_owner tracks the page as allocated
[   74.041499][ T5966] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 5812, tgid 5812 (syz-executor), ts 59810268280, free_ts 34807222526
[   74.047926][ T5966]  post_alloc_hook+0x240/0x2a0
[   74.049610][ T5966]  get_page_from_freelist+0x21e4/0x22c0
[   74.051609][ T5966]  __alloc_frozen_pages_noprof+0x181/0x370
[   74.053601][ T5966]  alloc_pages_mpol+0x232/0x4a0
[   74.055284][ T5966]  allocate_slab+0x8a/0x3b0
[   74.056849][ T5966]  ___slab_alloc+0xbfc/0x1480
[   74.058528][ T5966]  __kvmalloc_node_noprof+0x429/0x5f0
[   74.060337][ T5966]  setup_clusters+0x3e/0x1770
[   74.061808][ T5966]  __se_sys_swapon+0x161d/0x1ec0
[   74.063372][ T5966]  do_syscall_64+0xfa/0x3b0
[   74.064792][ T5966]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.066800][ T5966] page last free pid 5283 tgid 5283 stack trace:
[   74.069168][ T5966]  __free_frozen_pages+0xc71/0xe70
[   74.071052][ T5966]  __slab_free+0x326/0x400
[   74.072652][ T5966]  qlist_free_all+0x97/0x140
[   74.074224][ T5966]  kasan_quarantine_reduce+0x148/0x160
[   74.076052][ T5966]  __kasan_slab_alloc+0x22/0x80
[   74.077612][ T5966]  kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[   74.079519][ T5966]  __alloc_skb+0x112/0x2d0
[   74.080985][ T5966]  netlink_sendmsg+0x5c6/0xb30
[   74.082550][ T5966]  __sock_sendmsg+0x21c/0x270
[   74.084201][ T5966]  ____sys_sendmsg+0x505/0x830
[   74.085972][ T5966]  ___sys_sendmsg+0x21f/0x2a0
[   74.087669][ T5966]  __x64_sys_sendmsg+0x19b/0x260
[   74.089466][ T5966]  do_syscall_64+0xfa/0x3b0
[   74.091081][ T5966]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.093051][ T5966] 
[   74.093864][ T5966] Memory state around the buggy address:
[   74.095706][ T5966]  ffff888022903f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   74.098380][ T5966]  ffff888022904000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.101164][ T5966] >ffff888022904080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.104076][ T5966]                                ^
[   74.105951][ T5966]  ffff888022904100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.108678][ T5966]  ffff888022904180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.111324][ T5966] ==================================================================
[   74.115655][ T5966] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   74.118288][ T5966] CPU: 1 UID: 0 PID: 5966 Comm: khidpd_10cf05df Not tainted 6.16.0-rc6-syzkaller-00135-gcf074eca0065-dirty #0 PREEMPT(full) 
[   74.122707][ T5966] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   74.125904][ T5966] Call Trace:
[   74.126914][ T5966]  <TASK>
[   74.127871][ T5966]  dump_stack_lvl+0x99/0x250
[   74.129422][ T5966]  ? __asan_memcpy+0x40/0x70
[   74.130957][ T5966]  ? __pfx_dump_stack_lvl+0x10/0x10
[   74.132690][ T5966]  ? __pfx__printk+0x10/0x10
[   74.134267][ T5966]  panic+0x2db/0x790
[   74.135535][ T5966]  ? __pfx_panic+0x10/0x10
[   74.136950][ T5966]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[   74.138708][ T5966]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   74.140518][ T5966]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   74.142582][ T5966]  ? print_memory_metadata+0x314/0x400
[   74.144326][ T5966]  ? __mutex_lock+0x738/0xe80
[   74.145944][ T5966]  check_panic_on_warn+0x89/0xb0
[   74.147648][ T5966]  ? __mutex_lock+0x738/0xe80
[   74.149242][ T5966]  end_report+0x78/0x160
[   74.150639][ T5966]  kasan_report+0x129/0x150
[   74.152079][ T5966]  ? __mutex_lock+0x738/0xe80
[   74.153503][ T5966]  __mutex_lock+0x738/0xe80
[   74.154944][ T5966]  ? __mutex_lock+0x51b/0xe80
[   74.156444][ T5966]  ? l2cap_unregister_user+0x6a/0x1b0
[   74.158173][ T5966]  ? __pfx___mutex_lock+0x10/0x10
[   74.159867][ T5966]  ? __pfx___timer_delete_sync+0x10/0x10
[   74.161807][ T5966]  l2cap_unregister_user+0x6a/0x1b0
[   74.163544][ T5966]  hidp_session_thread+0x3c9/0x410
[   74.165284][ T5966]  ? __pfx_hidp_session_thread+0x10/0x10
[   74.167076][ T5966]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   74.168885][ T5966]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   74.170753][ T5966]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   74.172633][ T5966]  ? __kthread_parkme+0x7b/0x200
[   74.174217][ T5966]  ? __kthread_parkme+0x1a1/0x200
[   74.175948][ T5966]  kthread+0x711/0x8a0
[   74.177407][ T5966]  ? __pfx_hidp_session_thread+0x10/0x10
[   74.179564][ T5966]  ? __pfx_kthread+0x10/0x10
[   74.181158][ T5966]  ? _raw_spin_unlock_irq+0x23/0x50
[   74.182862][ T5966]  ? lockdep_hardirqs_on+0x9c/0x150
[   74.184579][ T5966]  ? __pfx_kthread+0x10/0x10
[   74.186207][ T5966]  ret_from_fork+0x3fc/0x770
[   74.187744][ T5966]  ? __pfx_ret_from_fork+0x10/0x10
[   74.189560][ T5966]  ? __switch_to_asm+0x39/0x70
[   74.191656][ T5966]  ? __switch_to_asm+0x33/0x70
[   74.193511][ T5966]  ? __pfx_kthread+0x10/0x10
[   74.195201][ T5966]  ret_from_fork_asm+0x1a/0x30
[   74.196861][ T5966]  </TASK>
[   74.198484][ T5966] Kernel Offset: disabled
[   74.200055][ T5966] Rebooting in 86400 seconds..

VM DIAGNOSIS:
11:17:06  Registers:
info registers vcpu 0

CPU#0
RAX=fffffffffffffff0 RBX=ffffc90003108000 RCX=0000000000000000 RDX=ffffc9000310f648
RSI=dffffc0000000000 RDI=ffffc9000310f608 RBP=dffffc0000000000 RSP=ffffc9000310f4e0
R8 =ffffc9000310fd70 R9 =0000000000000000 R10=ffffc9000310f658 R11=fffff52000621ecd
R12=1ffff92000621ec2 R13=1ffff92000621ec3 R14=ffffc9000310f618 R15=ffffc9000310f608
RIP=ffffffff8172d0b9 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555579ee9500 ffffffff 00c00000
GS =0000 ffff8880b8623000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c2bc400 CR3=000000010ee32000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00000000ff000000 0000000000000000 XMM05=3f3f3f3f3f3f3f3f 3f3f3f3f3f3f3f3f
XMM06=9999999999999999 9999999999999999 XMM07=2020202020202020 2020202020202020
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000000 RBX=0000000000000000 RCX=0000000000000000 RDX=00000000000003f9
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f9 RSP=ffffc90003bef390
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff85461d20
R12=dffffc0000000000 R13=dffffc0000000000 R14=ffffffff99df6300 R15=0000000000000000
RIP=ffffffff85461d9c RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c23000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffc1fe08ff0 CR3=00000000299d0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 00000000000000ff XMM01=0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a
XMM02=0000000000000000 000000000000ffff XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
