last executing test programs:

1.10783002s ago: executing program 0 (id=598):
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x109942, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000580))
ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0xe, 0x7}]})
ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x6}]})
write$ppp(r0, &(0x7f0000000200)="7d9d917972", 0x5)

1.058583166s ago: executing program 0 (id=601):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg$unix(r1, &(0x7f0000003580)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000380)="a1", 0x1}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB="0000000014"], 0x30, 0x40400d1}}], 0x1, 0x810)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000002d40)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
r4 = gettid()
sendmsg$unix(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000640)='Q', 0x1}], 0x1, &(0x7f0000001040)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=0xee01, @ANYRES32=0x0, @ANYBLOB="0000000030000000000000000100000001000000", @ANYRES32=r3, @ANYRES32=r2, @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="1c000000000000000100000402000000", @ANYRES32, @ANYRES32=0xee01, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r2, @ANYBLOB="0000000018"], 0xa0}, 0x4004881)

990.736635ms ago: executing program 0 (id=602):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002})
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000040)="0bc3ff", 0x3}, {&(0x7f0000000000)='G', 0x1}, {&(0x7f0000000100)="0000000000008d34d3e2", 0xa}], 0x3)

939.992672ms ago: executing program 0 (id=605):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="fc0100001900010000000000ffdbdf2500000000000000000000ffffac1414bbac1414bb0000000000000000000000004e22000bffff00000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000090000000000000080000000000000000000000000000000fcffffff00000000000000000000000044010500fc000000000000000000000000000004000000003c00000000000000ac1414bb000000000000000000000000ff34000000020000000000000000000000000000fe8000000000000000000000000000bb000000003c0000000a000000ffffffff000000000000000000000000fdffffff0403000000080000000800000000000000000000000000000000000000000001000000003200000000000000000000000000000000000000000000000335000001000400080000000000000000e0000002000000000000000000000000000000003300000000000000ff02"], 0x1fc}, 0x1, 0x0, 0x0, 0x20006854}, 0x800)

939.690338ms ago: executing program 0 (id=607):
unshare(0x6a040000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
socket(0x80000000000000a, 0x2, 0x0)
socket(0x80000000000000a, 0x2, 0x0)
close(0x4)

700.075009ms ago: executing program 0 (id=613):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8)
sendto$inet6(r0, &(0x7f0000000100)="0929b66488", 0x5, 0xc001, &(0x7f0000000280)={0xa, 0x0, 0x4, @private0, 0x81}, 0x1c)
getsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040), &(0x7f0000000000)=0x3)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x7, 0x2000000000032, 0xffffffffffffffff, 0x0)

570.388799ms ago: executing program 2 (id=617):
r0 = socket$inet6(0xa, 0x3, 0x7)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c)
sendmmsg(r0, &(0x7f000000d6c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[], 0xc}}], 0x1, 0x40001f4)

519.710631ms ago: executing program 2 (id=618):
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4)
bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000080)=0xcd, 0x4)
connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10)
sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0)
setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f00000002c0)=0xc5, 0x4)
recvmmsg(r0, &(0x7f0000007080)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000005a40)=""/25, 0x19}, 0x5}], 0x1, 0x45833af92e4b39ff, 0x0)

257.211259ms ago: executing program 2 (id=619):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000001800dd8d000000000000000002000004fe000006"], 0x1c}}, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @remote}, {0x2, 0x0, @private}})
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000004c0)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x0, {0x2, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2900}}, 0x1c}}, 0x8c0)

256.996933ms ago: executing program 1 (id=620):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000000c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000b1f8306e05d1e4aab009c16b5c05077115d0749619ca39f89974785ae0619b77c6585f678ac92a3b6b4148f56b43c3dd75d75f97c8f92f60a2def458df05e2fbfb3e849b2b3cffd4f29446ae60dd76654b2639b2bc14350706214a6ab7a712d4317fbc3ca01d0d3ed6110b3775903141a5091a4d3db8eb335414fbdb288aba73aaf6d18000a3a2a069cf7f9402e1425bb6bc370576aa1faea0fe222671ecf99038fce8dba53dcb11f87cca"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)={@ifindex, r0, 0x11}, 0xa)

200.365469ms ago: executing program 1 (id=621):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newtaction={0x64, 0x30, 0xb, 0x0, 0x0, {}, [{0x50, 0x1, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x10}, @TCA_CT_ZONE={0x6, 0x4, 0x1ff}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0)

200.137678ms ago: executing program 2 (id=622):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'geneve0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x1, 0x2}, {0xd, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0)

150.160039ms ago: executing program 1 (id=623):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt(r0, 0x84, 0x7f, &(0x7f0000000040)="020c0000098011e8", 0x8)

149.833502ms ago: executing program 1 (id=624):
r0 = socket$igmp6(0xa, 0x3, 0x2)
socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528)
syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "268435", 0x14, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xf3d8}}}}}}}, 0x0)

70.01437ms ago: executing program 2 (id=625):
r0 = socket$inet6(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendto$inet6(r0, 0x0, 0x0, 0x20000808, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @loopback}, 0x1c)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x3d10, 0x4)
sendto$inet6(r0, &(0x7f0000000000)="8d", 0x1, 0x0, 0x0, 0x0)
recvmmsg(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}, 0xfffffffc}], 0x1, 0x22021, 0x0)

69.726466ms ago: executing program 2 (id=626):
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
write$cgroup_int(r0, &(0x7f0000000200), 0x806000)
unshare(0x2a020400)
read$alg(r0, 0x0, 0x0)
write$cgroup_devices(r0, 0x0, 0x0)
read(r0, &(0x7f0000000180)=""/50, 0x32)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x26, 0x0, @void}, 0x10)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c0000000a000000080000000000000f050000000000000000000003000000000200000001000000000000000000000000000003000000000400000004000000000000000000300000000000"], &(0x7f0000000040)=""/249, 0x5e, 0xf9, 0x3}, 0x28)
r1 = socket(0x1, 0x1, 0x1)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff)
sendmsg$NBD_CMD_CONNECT(r2, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f0000000500)={0x3c, r3, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x40d5}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000)
setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000240)="90ce18c8d75cc644d798d731e2ec4641", 0x10)

224.728µs ago: executing program 1 (id=627):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0xe, 0x1, &(0x7f0000000100)=@raw=[@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0xfffffffffffffff4}], 0x0}, 0x94)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0x94, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48)

0s ago: executing program 1 (id=628):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$int_in(r0, 0x5452, &(0x7f00000000c0)=0x400)
r2 = getpid()
ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000140)=r2)
sendmsg$inet(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x400c941)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:54235' (ED25519) to the list of known hosts.
syzkaller login: [   56.959522][ T5579] cgroup: Unknown subsys name 'net'
[   57.068610][ T5579] cgroup: Unknown subsys name 'cpuset'
[   57.072577][ T5579] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.270796][ T5579] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   62.144747][ T5000] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   62.151676][ T5000] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   62.156681][ T5000] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   62.161152][ T5000] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   62.165295][ T5000] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   62.189752][   T54] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   62.194659][   T54] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   62.199325][   T54] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   62.206136][   T54] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   62.213124][ T5609] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   62.218382][ T5609] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   62.222581][ T5609] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   62.237065][ T5000] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   62.250538][ T5000] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   62.258278][ T5000] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   62.828368][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.832141][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.835377][ T5608] bridge_slave_0: entered allmulticast mode
[   62.838967][ T5608] bridge_slave_0: entered promiscuous mode
[   62.854717][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.858489][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.862717][ T5608] bridge_slave_1: entered allmulticast mode
[   62.869830][ T5608] bridge_slave_1: entered promiscuous mode
[   62.897737][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.919357][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   62.967643][ T5608] team0: Port device team_slave_0 added
[   62.994186][ T5608] team0: Port device team_slave_1 added
[   63.001867][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.005303][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.008565][ T5605] bridge_slave_0: entered allmulticast mode
[   63.012541][ T5605] bridge_slave_0: entered promiscuous mode
[   63.042470][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.045966][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.049172][ T5605] bridge_slave_1: entered allmulticast mode
[   63.053143][ T5605] bridge_slave_1: entered promiscuous mode
[   63.059284][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.062319][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.073392][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.091212][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.094176][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.104829][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.132257][ T5600] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.135253][ T5600] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.137686][ T5600] bridge_slave_0: entered allmulticast mode
[   63.140940][ T5600] bridge_slave_0: entered promiscuous mode
[   63.144582][ T5600] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.147445][ T5600] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.149990][ T5600] bridge_slave_1: entered allmulticast mode
[   63.152733][ T5600] bridge_slave_1: entered promiscuous mode
[   63.157214][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.180944][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.193641][ T5608] hsr_slave_0: entered promiscuous mode
[   63.196343][ T5608] hsr_slave_1: entered promiscuous mode
[   63.218259][ T5600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.223428][ T5605] team0: Port device team_slave_0 added
[   63.227628][ T5605] team0: Port device team_slave_1 added
[   63.231795][ T5600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.287411][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.290515][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.299963][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.307787][ T5600] team0: Port device team_slave_0 added
[   63.312813][ T5600] team0: Port device team_slave_1 added
[   63.323350][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.325778][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.336218][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.380458][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.383358][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.394722][ T5600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.401815][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.404761][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.415768][ T5600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.493997][ T5605] hsr_slave_0: entered promiscuous mode
[   63.497427][ T5605] hsr_slave_1: entered promiscuous mode
[   63.499949][ T5605] debugfs: 'hsr0' already exists in 'hsr'
[   63.502037][ T5605] Cannot create hsr debugfs directory
[   63.555464][ T5600] hsr_slave_0: entered promiscuous mode
[   63.558673][ T5600] hsr_slave_1: entered promiscuous mode
[   63.561606][ T5600] debugfs: 'hsr0' already exists in 'hsr'
[   63.563903][ T5600] Cannot create hsr debugfs directory
[   63.720653][ T5608] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   63.728691][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   63.742476][ T5608] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   63.749380][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   63.766863][ T5608] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   63.771726][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   63.800160][ T5608] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   63.809719][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   63.900530][ T5605] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   63.912815][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   63.917316][ T5605] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   63.922664][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   63.932984][ T5605] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   63.940456][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   63.950396][ T5605] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   63.958235][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   64.039765][ T5600] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   64.047626][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   64.051385][ T5600] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   64.059678][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   64.072728][ T5600] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   64.080325][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   64.084115][ T5600] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   64.092706][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   64.128175][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.167196][ T5608] 8021q: adding VLAN 0 to HW filter on device team0
[   64.185356][ T5000] Bluetooth: hci0: command tx timeout
[   64.188957][ T1164] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.192422][ T1164] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.204374][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.207598][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.252188][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.265195][ T5000] Bluetooth: hci1: command tx timeout
[   64.304753][ T5605] 8021q: adding VLAN 0 to HW filter on device team0
[   64.329341][   T29] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.332197][   T29] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.339630][ T5600] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.347368][   T29] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.349758][   T29] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.356732][ T5000] Bluetooth: hci2: command tx timeout
[   64.367877][ T5600] 8021q: adding VLAN 0 to HW filter on device team0
[   64.384700][   T29] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.387160][   T29] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.402494][   T29] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.405490][   T29] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.413588][ T5605] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   64.418605][ T5605] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   64.747553][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.811985][ T5608] veth0_vlan: entered promiscuous mode
[   64.830898][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.843768][ T5608] veth1_vlan: entered promiscuous mode
[   64.855157][ T5600] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.909080][ T5608] veth0_macvtap: entered promiscuous mode
[   64.922258][ T5608] veth1_macvtap: entered promiscuous mode
[   64.951689][ T5605] veth0_vlan: entered promiscuous mode
[   64.974581][ T5600] veth0_vlan: entered promiscuous mode
[   64.979037][ T5605] veth1_vlan: entered promiscuous mode
[   64.993851][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.001421][ T5600] veth1_vlan: entered promiscuous mode
[   65.013788][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.035728][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.040688][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.052069][ T5605] veth0_macvtap: entered promiscuous mode
[   65.056476][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.060637][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.079527][ T5605] veth1_macvtap: entered promiscuous mode
[   65.127406][ T5600] veth0_macvtap: entered promiscuous mode
[   65.148429][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.168828][ T5600] veth1_macvtap: entered promiscuous mode
[   65.176321][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.221423][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.233034][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.234305][   T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.241893][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.246566][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.251238][   T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.262971][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.298766][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.324825][   T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.328977][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.335507][   T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.339615][   T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.352623][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.366534][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.443148][ T1164] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.456345][ T1164] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.479142][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.485550][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.492150][ T5608] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   65.528691][   T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.535738][   T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.596588][   T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.609665][   T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.861242][ T5732] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8'.
[   66.157139][ T5751] netlink: 100 bytes leftover after parsing attributes in process `syz.0.16'.
[   66.265973][ T5000] Bluetooth: hci0: command tx timeout
[   66.318308][ T5759] netlink: 100 bytes leftover after parsing attributes in process `syz.0.20'.
[   66.356503][ T5000] Bluetooth: hci1: command tx timeout
[   66.427128][ T5000] Bluetooth: hci2: command tx timeout
[   66.690935][ T5785] hsr0: entered promiscuous mode
[   66.696861][ T5785] netlink: 4 bytes leftover after parsing attributes in process `syz.0.33'.
[   66.749248][ T5601] IPVS: starting estimator thread 0...
[   66.802106][ T5792] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   66.845316][ T5790] IPVS: using max 48 ests per chain, 115200 per kthread
[   67.215648][ T5820] netlink: 8 bytes leftover after parsing attributes in process `syz.1.49'.
[   67.270905][ T5824] batman_adv: batadv0: Adding interface: ip6gretap1
[   67.273375][ T5824] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   67.286075][ T5824] batman_adv: batadv0: Interface activated: ip6gretap1
[   67.664045][ T5845] erspan1: entered promiscuous mode
[   67.666389][ T5845] erspan1: entered allmulticast mode
[   67.669943][ T5843] Zero length message leads to an empty skb
[   68.345081][ T5000] Bluetooth: hci0: command tx timeout
[   68.435410][ T5000] Bluetooth: hci1: command tx timeout
[   68.505759][ T5000] Bluetooth: hci2: command tx timeout
[   68.557641][ T5888] syzkaller0: entered promiscuous mode
[   68.559609][ T5888] syzkaller0: entered allmulticast mode
[   68.582373][ T5888] tipc: Started in network mode
[   68.584555][ T5888] tipc: Node identity c66044b6e81f, cluster identity 4711
[   68.590824][ T5888] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   68.596181][ T5887] tipc: Resetting bearer <eth:syzkaller0>
[   68.609404][ T5887] tipc: Disabling bearer <eth:syzkaller0>
[   69.007356][ T5926] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) !
[   69.011930][ T5926] netlink: 40 bytes leftover after parsing attributes in process `syz.1.97'.
[   69.042421][ T5930] Driver unsupported XDP return value 0 on prog  (id 13) dev N/A, expect packet loss!
[   69.134335][   T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   69.147765][   T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   69.153385][   T12] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   69.159447][   T12] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   69.217456][ T5951] netlink: 'syz.1.103': attribute type 49 has an invalid length.
[   69.496774][ T5977] netlink: 4 bytes leftover after parsing attributes in process `syz.2.115'.
[   69.743502][ T5994] netlink: 'syz.2.123': attribute type 1 has an invalid length.
[   70.053450][ T6017] The dccp option matching is deprecated and scheduled to be removed in 2027.
[   70.053450][ T6017] Please contact the netfilter-devel mailing list or update your nftables rules.
[   70.425451][ T5000] Bluetooth: hci0: command tx timeout
[   70.516676][ T5000] Bluetooth: hci1: command tx timeout
[   70.595834][ T5000] Bluetooth: hci2: command tx timeout
[   70.974229][ T6070] tipc: Started in network mode
[   70.979232][ T6070] tipc: Node identity 222c8e7de534, cluster identity 4711
[   70.982310][ T6070] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   71.009242][ T6070] syzkaller0: entered promiscuous mode
[   71.011504][ T6070] syzkaller0: entered allmulticast mode
[   71.014001][ T6070] tipc: Resetting bearer <eth:syzkaller0>
[   71.024803][ T6069] tipc: Resetting bearer <eth:syzkaller0>
[   71.970594][ T6069] tipc: Disabling bearer <eth:syzkaller0>
[   72.133641][ T6086] syz.0.162 uses obsolete (PF_INET,SOCK_PACKET)
[   72.142798][ T6087] netlink: 'syz.2.164': attribute type 12 has an invalid length.
[   72.146696][ T6087] netlink: 'syz.2.164': attribute type 29 has an invalid length.
[   72.150094][ T6087] netlink: 148 bytes leftover after parsing attributes in process `syz.2.164'.
[   72.370457][ T6101] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[   73.727679][ T6167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.199'.
[   73.878028][ T6177] netlink: 8 bytes leftover after parsing attributes in process `syz.2.205'.
[   73.882620][ T6177] netlink: 4 bytes leftover after parsing attributes in process `syz.2.205'.
[   73.889850][ T6177] netlink: 'syz.2.205': attribute type 14 has an invalid length.
[   73.902518][ T6177] netlink: 'syz.2.205': attribute type 11 has an invalid length.
[   73.957318][ T6181] Cannot find add_set index 0 as target
[   74.253159][ T6215] Bluetooth: MGMT ver 1.23
[   74.338846][ T6223] tipc: Failed to remove unknown binding: 66,1,1/0:3129390638/3129390640
[   74.358914][ T6223] tipc: Started in network mode
[   74.365013][ T6223] tipc: Node identity 4246, cluster identity 4711
[   74.369875][ T6223] tipc: Node number set to 16966
[   75.298442][ T6318] netlink: 'syz.0.257': attribute type 1 has an invalid length.
[   75.313553][ T6318] bond1: entered promiscuous mode
[   75.316690][ T6318] 8021q: adding VLAN 0 to HW filter on device bond1
[   75.340918][ T6318] 8021q: adding VLAN 0 to HW filter on device bond2
[   75.346857][ T6318] bond1: (slave bond2): making interface the new active one
[   75.352213][ T6318] bond2: entered promiscuous mode
[   75.357416][ T6318] bond1: (slave bond2): Enslaving as an active interface with an up link
[   75.483207][ T6335] netlink: 'syz.1.264': attribute type 10 has an invalid length.
[   75.490374][ T6335] netdevsim netdevsim1 netdevsim1: entered allmulticast mode
[   75.506979][ T6335] bridge0: port 3(netdevsim1) entered blocking state
[   75.513688][ T6335] bridge0: port 3(netdevsim1) entered disabled state
[   75.529094][ T6335] netdevsim netdevsim1 netdevsim1: entered promiscuous mode
[   75.669351][ T6345] netlink: 8 bytes leftover after parsing attributes in process `syz.0.269'.
[   76.181012][ T6373] syzkaller0: entered promiscuous mode
[   76.188802][ T6373] syzkaller0: entered allmulticast mode
[   76.266367][ T5000] Bluetooth: hci0: command tx timeout
[   76.395762][ T6379] syzkaller0: entered promiscuous mode
[   76.400223][ T6379] syzkaller0: entered allmulticast mode
[   76.758014][ T1380] ieee802154 phy0 wpan0: encryption failed: -22
[   76.761330][ T1380] ieee802154 phy1 wpan1: encryption failed: -22
[   77.330665][ T6433] netlink: 12 bytes leftover after parsing attributes in process `syz.1.312'.
[   77.677837][ T6459] IPv6: addrconf: prefix option has invalid lifetime
[   78.715381][ T6497] netlink: 28 bytes leftover after parsing attributes in process `syz.2.339'.
[   78.718367][ T6497] netlink: 28 bytes leftover after parsing attributes in process `syz.2.339'.
[   78.887314][ T6507] netlink: 'syz.1.343': attribute type 3 has an invalid length.
[   79.172893][ T6531] syzkaller0: entered promiscuous mode
[   79.174824][ T6531] syzkaller0: entered allmulticast mode
[   79.256724][ T6535] netlink: 380 bytes leftover after parsing attributes in process `syz.2.357'.
[   79.259772][ T6535] netlink: 380 bytes leftover after parsing attributes in process `syz.2.357'.
[   79.262886][ T6535] netlink: 22 bytes leftover after parsing attributes in process `syz.2.357'.
[   79.300831][   T24] IPVS: starting estimator thread 0...
[   79.395267][ T6540] IPVS: using max 81 ests per chain, 194400 per kthread
[   79.507497][ T6558] netlink: 12 bytes leftover after parsing attributes in process `syz.2.368'.
[   79.662453][ T6574] netlink: 8 bytes leftover after parsing attributes in process `syz.2.376'.
[   79.671298][ T6574] IPVS: sh: FWM 3 0x00000003 - no destination available
[   80.193466][ T6614] bond1: entered allmulticast mode
[   80.218527][ T6614] macvlan2: entered promiscuous mode
[   80.222541][ T6614] macvlan2: entered allmulticast mode
[   80.230407][ T6614] bond1: entered promiscuous mode
[   80.237058][ T6614] 8021q: adding VLAN 0 to HW filter on device macvlan2
[   80.243927][ T6614] bond1: left promiscuous mode
[   80.382880][ T6628] xt_recent: hitcount (33554435) is larger than allowed maximum (65535)
[   80.915114][ T6677] macvtap1: entered allmulticast mode
[   80.917701][ T6677] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[   80.922219][ T6677] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[   80.929032][ T6677] 8021q: adding VLAN 0 to HW filter on device macvtap1
[   80.980151][ T6677] netdevsim netdevsim2 netdevsim0: left allmulticast mode
[   81.029436][ T5601] netdevsim netdevsim2 netdevsim0: left promiscuous mode
[   81.088059][ T6683] netlink: 8 bytes leftover after parsing attributes in process `syz.1.421'.
[   81.091046][ T6683] netlink: 312 bytes leftover after parsing attributes in process `syz.1.421'.
[   82.227678][ T6774] netlink: 'syz.2.462': attribute type 1 has an invalid length.
[   82.922137][ T6812] __nla_validate_parse: 4 callbacks suppressed
[   82.922152][ T6812] netlink: 28 bytes leftover after parsing attributes in process `syz.0.478'.
[   83.129744][ T6824] netlink: 'syz.0.483': attribute type 2 has an invalid length.
[   83.133307][ T6824] netlink: 'syz.0.483': attribute type 2 has an invalid length.
[   83.467084][ T6844] sctp: [Deprecated]: syz.0.492 (pid 6844) Use of struct sctp_assoc_value in delayed_ack socket option.
[   83.467084][ T6844] Use struct sctp_sack_info instead
[   83.583438][ T6850] xt_hashlimit: size too large, truncated to 1048576
[   83.765939][ T6868] netlink: 12 bytes leftover after parsing attributes in process `syz.2.502'.
[   83.831060][ T6873] netlink: 'syz.2.505': attribute type 58 has an invalid length.
[   83.836045][ T6873] netlink: 20 bytes leftover after parsing attributes in process `syz.2.505'.
[   84.057379][ T6882] netlink: 36 bytes leftover after parsing attributes in process `syz.2.509'.
[   84.543044][ T6903] netlink: 28 bytes leftover after parsing attributes in process `syz.2.519'.
[   84.548108][ T6903] netlink: 32 bytes leftover after parsing attributes in process `syz.2.519'.
[   84.551952][ T6903] netlink: 28 bytes leftover after parsing attributes in process `syz.2.519'.
[   84.556958][ T6903] netlink: 32 bytes leftover after parsing attributes in process `syz.2.519'.
[   84.901044][ T6933] netlink: 20 bytes leftover after parsing attributes in process `syz.1.534'.
[   84.905399][ T6933] netlink: 20 bytes leftover after parsing attributes in process `syz.1.534'.
[   85.107505][ T6949] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[   85.989024][ T6985] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0)
[   86.130265][ T6995] syzkaller1: entered promiscuous mode
[   86.135145][ T6995] syzkaller1: entered allmulticast mode
[   87.028065][  T941] cfg80211: failed to load regulatory.db
[   88.051895][ T7031] __nla_validate_parse: 3 callbacks suppressed
[   88.051915][ T7031] netlink: 8 bytes leftover after parsing attributes in process `syz.0.580'.
[   88.111933][ T7032] netlink: 52 bytes leftover after parsing attributes in process `syz.0.580'.
[   89.911259][ T7075] IPVS: set_ctl: invalid protocol: 136 172.30.0.3:20005
[   89.950600][ T7078] warning: `syz.2.600' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   90.248089][ T7104] netlink: 'syz.2.612': attribute type 6 has an invalid length.
[   90.831317][ T7127] netlink: 4 bytes leftover after parsing attributes in process `syz.2.622'.
[   90.871288][ T7130] xt_hashlimit: size too large, truncated to 1048576
[   91.033295][ T7143] ------------[ cut here ]------------
[   91.035869][ T7143] 1
[   91.035878][ T7143] WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x2d/0x140, CPU#1: syz.1.629/7143
[   91.039661][ T7143] Modules linked in:
[   91.041135][ T7143] CPU: 1 UID: 0 PID: 7143 Comm: syz.1.629 Not tainted syzkaller #0 PREEMPT(full) 
[   91.044482][ T7143] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   91.048030][ T7143] RIP: 0010:ip_rt_bug+0x2d/0x140
[   91.049810][ T7143] Code: fa 55 41 57 41 56 41 55 41 54 53 48 89 d3 e8 9a 27 b9 f7 66 90 e8 93 27 b9 f7 31 ff 48 89 de ba 02 00 00 00 e8 14 aa 68 ff 90 <0f> 0b 90 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 49
[   91.057161][ T7143] RSP: 0018:ffffc900041af1c0 EFLAGS: 00010286
[   91.059425][ T7143] RAX: f84c3e3e3e902200 RBX: ffff8881b8ca1280 RCX: 0000000000000401
[   91.062584][ T7143] RDX: 0000000000000002 RSI: ffffffff8dfa5bcd RDI: ffffffff8c28ade0
[   91.065504][ T7143] RBP: ffffc900041af4c0 R08: ffffffff9030a9f7 R09: 1ffffffff206153e
[   91.068265][ T7143] R10: dffffc0000000000 R11: fffffbfff206153f R12: dffffc0000000000
[   91.071117][ T7143] R13: 0000000000000000 R14: ffff8881b8ca1280 R15: dffffc0000000000
[   91.073830][ T7143] FS:  00007f611fefe6c0(0000) GS:ffff8882a9290000(0000) knlGS:0000000000000000
[   91.076885][ T7143] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   91.079631][ T7143] CR2: 0000001b33022ff8 CR3: 00000001a83e1000 CR4: 0000000000352ef0
[   91.083013][ T7143] Call Trace:
[   91.084262][ T7143]  <TASK>
[   91.085311][ T7143]  ip_push_pending_frames+0x8b/0x110
[   91.086934][ T7143]  __icmp_send+0x11e4/0x1690
[   91.088560][ T7143]  ? __icmp_send+0x22b/0x1690
[   91.090170][ T7143]  ? __pfx___icmp_send+0x10/0x10
[   91.091924][ T7143]  ? ip_route_input_noref+0xad/0x270
[   91.093635][ T7143]  ? __pfx_ip_route_input_noref+0x10/0x10
[   91.095634][ T7143]  ? tcp_v4_early_demux+0x465/0x9c0
[   91.097426][ T7143]  ? tcp_v4_early_demux+0x5a7/0x9c0
[   91.099310][ T7143]  ip_options_compile+0x80/0xb0
[   91.101091][ T7143]  ip_rcv_finish_core+0xaa2/0x1c00
[   91.102760][ T7143]  ip_rcv_finish+0x14c/0x2a0
[   91.104317][ T7143]  NF_HOOK+0x336/0x3c0
[   91.105737][ T7143]  ? sock_wfree+0x26e/0x750
[   91.107247][ T7143]  ? __pfx_ip_rcv_finish+0x10/0x10
[   91.109005][ T7143]  ? NF_HOOK+0x9e/0x3c0
[   91.110450][ T7143]  ? __pfx_NF_HOOK+0x10/0x10
[   91.112103][ T7143]  ? __pfx_ip_rcv_finish+0x10/0x10
[   91.113976][ T7143]  ? netif_receive_skb+0x102/0xbf0
[   91.115959][ T7143]  ? __pfx_ip_rcv+0x10/0x10
[   91.117436][ T7143]  netif_receive_skb+0x45b/0xbf0
[   91.119165][ T7143]  ? __pfx_netif_receive_skb+0x10/0x10
[   91.121340][ T7143]  ? tun_rx_batched+0x185/0x790
[   91.123326][ T7143]  tun_rx_batched+0x1de/0x790
[   91.125447][ T7143]  ? __build_skb+0x62/0x440
[   91.127392][ T7143]  ? __pfx_tun_rx_batched+0x10/0x10
[   91.129554][ T7143]  ? tun_get_user+0x2787/0x43e0
[   91.131566][ T7143]  ? tun_get_user+0x2787/0x43e0
[   91.133635][ T7143]  ? tun_get_user+0x2394/0x43e0
[   91.135813][ T7143]  ? tun_get_user+0x2394/0x43e0
[   91.137950][ T7143]  ? __local_bh_enable_ip+0xd0/0x130
[   91.140221][ T7143]  tun_get_user+0x2bbc/0x43e0
[   91.142209][ T7143]  ? tun_get_user+0x2787/0x43e0
[   91.144583][ T7143]  ? aa_file_perm+0x50e/0x15e0
[   91.146598][ T7143]  ? __pfx_tun_get_user+0x10/0x10
[   91.148344][ T7143]  ? __lock_acquire+0x6b5/0x2cf0
[   91.150064][ T7143]  ? ref_tracker_alloc+0x35c/0x4c0
[   91.151900][ T7143]  ? __pfx_ref_tracker_alloc+0x10/0x10
[   91.153722][ T7143]  ? tun_get+0x1c/0x2f0
[   91.155277][ T7143]  ? tun_get+0x1c/0x2f0
[   91.156687][ T7143]  ? tun_get+0x1c/0x2f0
[   91.158440][ T7143]  ? tun_get+0x1c/0x2f0
[   91.160218][ T7143]  tun_chr_write_iter+0x113/0x200
[   91.162386][ T7143]  vfs_write+0x61d/0xb90
[   91.164143][ T7143]  ? __pfx_vfs_write+0x10/0x10
[   91.166133][ T7143]  ? __fget_files+0x2a/0x420
[   91.168015][ T7143]  ksys_write+0x150/0x270
[   91.169767][ T7143]  ? __pfx_ksys_write+0x10/0x10
[   91.171752][ T7143]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   91.174181][ T7143]  do_syscall_64+0x15f/0xf80
[   91.176147][ T7143]  ? trace_irq_disable+0x3b/0x140
[   91.178159][ T7143]  ? clear_bhb_loop+0x40/0x90
[   91.180038][ T7143]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   91.182372][ T7143] RIP: 0033:0x7f611ef5d60e
[   91.184259][ T7143] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[   91.191956][ T7143] RSP: 002b:00007f611fefdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   91.195324][ T7143] RAX: ffffffffffffffda RBX: 00007f611fefe6c0 RCX: 00007f611ef5d60e
[   91.198478][ T7143] RDX: 0000000000000046 RSI: 0000200000000400 RDI: 00000000000000c8
[   91.201599][ T7143] RBP: 00007f611f032d69 R08: 0000000000000000 R09: 0000000000000000
[   91.204817][ T7143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   91.208081][ T7143] R13: 00007f611f216038 R14: 00007f611f215fa0 R15: 00007fff4838a9a8
[   91.211216][ T7143]  </TASK>
[   91.212497][ T7143] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   91.215415][ T7143] CPU: 1 UID: 0 PID: 7143 Comm: syz.1.629 Not tainted syzkaller #0 PREEMPT(full) 
[   91.219007][ T7143] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   91.223138][ T7143] Call Trace:
[   91.224575][ T7143]  <TASK>
[   91.225935][ T7143]  vpanic+0x56c/0xa60
[   91.227916][ T7143]  ? __pfx__printk+0x10/0x10
[   91.229756][ T7143]  ? __pfx_vpanic+0x10/0x10
[   91.231569][ T7143]  ? is_bpf_text_address+0x292/0x2b0
[   91.233673][ T7143]  ? is_bpf_text_address+0x26/0x2b0
[   91.235749][ T7143]  panic+0xc5/0xd0
[   91.237302][ T7143]  ? __pfx_panic+0x10/0x10
[   91.239222][ T7143]  __warn+0x315/0x4c0
[   91.240897][ T7143]  ? ip_rt_bug+0x2d/0x140
[   91.242814][ T7143]  ? ip_rt_bug+0x2d/0x140
[   91.244595][ T7143]  __report_bug+0x29a/0x540
[   91.246435][ T7143]  ? NF_HOOK+0x336/0x3c0
[   91.248213][ T7143]  ? netif_receive_skb+0x45b/0xbf0
[   91.250332][ T7143]  ? tun_rx_batched+0x1de/0x790
[   91.252321][ T7143]  ? ip_rt_bug+0x2d/0x140
[   91.254123][ T7143]  ? __pfx___report_bug+0x10/0x10
[   91.256184][ T7143]  ? ip_rt_bug+0x2d/0x140
[   91.257916][ T7143]  report_bug+0x16a/0x220
[   91.259762][ T7143]  ? ip_rt_bug+0x2d/0x140
[   91.261671][ T7143]  ? ip_rt_bug+0x2f/0x140
[   91.263523][ T7143]  handle_bug+0x9c/0x200
[   91.265396][ T7143]  exc_invalid_op+0x1a/0x50
[   91.267276][ T7143]  asm_exc_invalid_op+0x1a/0x20
[   91.269327][ T7143] RIP: 0010:ip_rt_bug+0x2d/0x140
[   91.271455][ T7143] Code: fa 55 41 57 41 56 41 55 41 54 53 48 89 d3 e8 9a 27 b9 f7 66 90 e8 93 27 b9 f7 31 ff 48 89 de ba 02 00 00 00 e8 14 aa 68 ff 90 <0f> 0b 90 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 49
[   91.279487][ T7143] RSP: 0018:ffffc900041af1c0 EFLAGS: 00010286
[   91.282104][ T7143] RAX: f84c3e3e3e902200 RBX: ffff8881b8ca1280 RCX: 0000000000000401
[   91.285511][ T7143] RDX: 0000000000000002 RSI: ffffffff8dfa5bcd RDI: ffffffff8c28ade0
[   91.288734][ T7143] RBP: ffffc900041af4c0 R08: ffffffff9030a9f7 R09: 1ffffffff206153e
[   91.292064][ T7143] R10: dffffc0000000000 R11: fffffbfff206153f R12: dffffc0000000000
[   91.295406][ T7143] R13: 0000000000000000 R14: ffff8881b8ca1280 R15: dffffc0000000000
[   91.298880][ T7143]  ip_push_pending_frames+0x8b/0x110
[   91.301183][ T7143]  __icmp_send+0x11e4/0x1690
[   91.303161][ T7143]  ? __icmp_send+0x22b/0x1690
[   91.305053][ T7143]  ? __pfx___icmp_send+0x10/0x10
[   91.307138][ T7143]  ? ip_route_input_noref+0xad/0x270
[   91.309357][ T7143]  ? __pfx_ip_route_input_noref+0x10/0x10
[   91.311442][ T7143]  ? tcp_v4_early_demux+0x465/0x9c0
[   91.313597][ T7143]  ? tcp_v4_early_demux+0x5a7/0x9c0
[   91.315655][ T7143]  ip_options_compile+0x80/0xb0
[   91.317608][ T7143]  ip_rcv_finish_core+0xaa2/0x1c00
[   91.319815][ T7143]  ip_rcv_finish+0x14c/0x2a0
[   91.321806][ T7143]  NF_HOOK+0x336/0x3c0
[   91.323567][ T7143]  ? sock_wfree+0x26e/0x750
[   91.325544][ T7143]  ? __pfx_ip_rcv_finish+0x10/0x10
[   91.327713][ T7143]  ? NF_HOOK+0x9e/0x3c0
[   91.329473][ T7143]  ? __pfx_NF_HOOK+0x10/0x10
[   91.331444][ T7143]  ? __pfx_ip_rcv_finish+0x10/0x10
[   91.333649][ T7143]  ? netif_receive_skb+0x102/0xbf0
[   91.335826][ T7143]  ? __pfx_ip_rcv+0x10/0x10
[   91.337831][ T7143]  netif_receive_skb+0x45b/0xbf0
[   91.339873][ T7143]  ? __pfx_netif_receive_skb+0x10/0x10
[   91.342001][ T7143]  ? tun_rx_batched+0x185/0x790
[   91.344013][ T7143]  tun_rx_batched+0x1de/0x790
[   91.346320][ T7143]  ? __build_skb+0x62/0x440
[   91.348187][ T7143]  ? __pfx_tun_rx_batched+0x10/0x10
[   91.350282][ T7143]  ? tun_get_user+0x2787/0x43e0
[   91.352245][ T7143]  ? tun_get_user+0x2787/0x43e0
[   91.354165][ T7143]  ? tun_get_user+0x2394/0x43e0
[   91.356094][ T7143]  ? tun_get_user+0x2394/0x43e0
[   91.358005][ T7143]  ? __local_bh_enable_ip+0xd0/0x130
[   91.360111][ T7143]  tun_get_user+0x2bbc/0x43e0
[   91.361989][ T7143]  ? tun_get_user+0x2787/0x43e0
[   91.364041][ T7143]  ? aa_file_perm+0x50e/0x15e0
[   91.365942][ T7143]  ? __pfx_tun_get_user+0x10/0x10
[   91.367953][ T7143]  ? __lock_acquire+0x6b5/0x2cf0
[   91.369685][ T7143]  ? ref_tracker_alloc+0x35c/0x4c0
[   91.371722][ T7143]  ? __pfx_ref_tracker_alloc+0x10/0x10
[   91.373946][ T7143]  ? tun_get+0x1c/0x2f0
[   91.375658][ T7143]  ? tun_get+0x1c/0x2f0
[   91.377355][ T7143]  ? tun_get+0x1c/0x2f0
[   91.379072][ T7143]  ? tun_get+0x1c/0x2f0
[   91.380760][ T7143]  tun_chr_write_iter+0x113/0x200
[   91.382820][ T7143]  vfs_write+0x61d/0xb90
[   91.384581][ T7143]  ? __pfx_vfs_write+0x10/0x10
[   91.386696][ T7143]  ? __fget_files+0x2a/0x420
[   91.388716][ T7143]  ksys_write+0x150/0x270
[   91.390619][ T7143]  ? __pfx_ksys_write+0x10/0x10
[   91.392718][ T7143]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   91.395313][ T7143]  do_syscall_64+0x15f/0xf80
[   91.397203][ T7143]  ? trace_irq_disable+0x3b/0x140
[   91.399224][ T7143]  ? clear_bhb_loop+0x40/0x90
[   91.401095][ T7143]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   91.403494][ T7143] RIP: 0033:0x7f611ef5d60e
[   91.405354][ T7143] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[   91.413184][ T7143] RSP: 002b:00007f611fefdfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   91.416247][ T7143] RAX: ffffffffffffffda RBX: 00007f611fefe6c0 RCX: 00007f611ef5d60e
[   91.418938][ T7143] RDX: 0000000000000046 RSI: 0000200000000400 RDI: 00000000000000c8
[   91.422284][ T7143] RBP: 00007f611f032d69 R08: 0000000000000000 R09: 0000000000000000
[   91.425525][ T7143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   91.428672][ T7143] R13: 00007f611f216038 R14: 00007f611f215fa0 R15: 00007fff4838a9a8
[   91.431960][ T7143]  </TASK>
[   91.434407][ T7143] Kernel Offset: disabled
[   91.436294][ T7143] Rebooting in 86400 seconds..
