last executing test programs:

8.729495ms ago: executing program 0 (id=1):
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[{0x10, 0x29, 0xfff}, {0x10, 0x110, 0xb}], 0x20}, 0x40)

0s ago: executing program 2 (id=3):
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf20000000000000160005003f1b48013d030100000000009500000000000000bc26000000000000bf67000000000000070200000fff07006702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000008100d591d568253e9988431ec068e3a83683d58719d721839a447f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:49840' (ED25519) to the list of known hosts.
syzkaller login: [   48.684536][ T5816] cgroup: Unknown subsys name 'net'
[   48.796597][ T5816] cgroup: Unknown subsys name 'cpuset'
[   48.800687][ T5816] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.429378][ T5816] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   60.328109][ T5219] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   60.331056][ T5219] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   60.333923][ T5219] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   60.336812][ T5219] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   60.339607][ T5219] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   60.354048][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   60.356575][   T55] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   60.359326][ T5833] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   60.362207][ T5833] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   60.364775][ T5833] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   60.390336][ T5219] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   60.393030][ T5219] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   60.395817][ T5219] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   60.398917][ T5219] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   60.401615][ T5219] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   60.617199][ T5831] chnl_net:caif_netlink_parms(): no params data found
[   60.661306][ T5827] chnl_net:caif_netlink_parms(): no params data found
[   60.714533][ T5835] chnl_net:caif_netlink_parms(): no params data found
[   60.743220][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.746730][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.749241][ T5831] bridge_slave_0: entered allmulticast mode
[   60.751910][ T5831] bridge_slave_0: entered promiscuous mode
[   60.772712][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.775456][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.777590][ T5831] bridge_slave_1: entered allmulticast mode
[   60.780189][ T5831] bridge_slave_1: entered promiscuous mode
[   60.820604][ T5827] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.822787][ T5827] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.825559][ T5827] bridge_slave_0: entered allmulticast mode
[   60.828367][ T5827] bridge_slave_0: entered promiscuous mode
[   60.837703][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.845322][ T5827] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.847646][ T5827] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.850201][ T5827] bridge_slave_1: entered allmulticast mode
[   60.852910][ T5827] bridge_slave_1: entered promiscuous mode
[   60.857540][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   60.907841][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.910039][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.912172][ T5835] bridge_slave_0: entered allmulticast mode
[   60.914929][ T5835] bridge_slave_0: entered promiscuous mode
[   60.919195][ T5827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.922785][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.925742][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.927899][ T5835] bridge_slave_1: entered allmulticast mode
[   60.930493][ T5835] bridge_slave_1: entered promiscuous mode
[   60.936131][ T5831] team0: Port device team_slave_0 added
[   60.948930][ T5827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   60.953343][ T5831] team0: Port device team_slave_1 added
[   60.965556][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.970407][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   61.008471][ T5827] team0: Port device team_slave_0 added
[   61.027796][ T5827] team0: Port device team_slave_1 added
[   61.030060][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.032041][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.039373][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.045661][ T5835] team0: Port device team_slave_0 added
[   61.057694][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.059766][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.067530][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.071944][ T5835] team0: Port device team_slave_1 added
[   61.101948][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.104261][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.112152][ T5827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.117059][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.119094][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.126637][ T5827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.134618][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.136685][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.145354][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.157874][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.159955][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.168252][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.183246][ T5831] hsr_slave_0: entered promiscuous mode
[   61.186555][ T5831] hsr_slave_1: entered promiscuous mode
[   61.213815][ T5827] hsr_slave_0: entered promiscuous mode
[   61.216254][ T5827] hsr_slave_1: entered promiscuous mode
[   61.218428][ T5827] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   61.220795][ T5827] Cannot create hsr debugfs directory
[   61.244282][ T5835] hsr_slave_0: entered promiscuous mode
[   61.246482][ T5835] hsr_slave_1: entered promiscuous mode
[   61.248534][ T5835] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   61.250757][ T5835] Cannot create hsr debugfs directory
[   61.540703][ T5827] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   61.547783][ T5827] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   61.558746][ T5827] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   61.569869][ T5827] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   61.596242][ T5831] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   61.602756][ T5831] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   61.609848][ T5831] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   61.641908][ T5831] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   61.672965][ T5835] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   61.680737][ T5835] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   61.687050][ T5835] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   61.698407][ T5835] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   61.814487][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.819562][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.825838][ T5827] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.844704][ T5831] 8021q: adding VLAN 0 to HW filter on device team0
[   61.851372][ T5835] 8021q: adding VLAN 0 to HW filter on device team0
[   61.862307][ T1958] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.865198][ T1958] bridge0: port 1(bridge_slave_0) entered forwarding state
[   61.875673][ T1958] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.878434][ T1958] bridge0: port 1(bridge_slave_0) entered forwarding state
[   61.884588][ T1958] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.886851][ T1958] bridge0: port 2(bridge_slave_1) entered forwarding state
[   61.891053][ T5827] 8021q: adding VLAN 0 to HW filter on device team0
[   61.902241][ T1088] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.904693][ T1088] bridge0: port 2(bridge_slave_1) entered forwarding state
[   61.919113][ T1958] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.921743][ T1958] bridge0: port 1(bridge_slave_0) entered forwarding state
[   61.939410][ T1088] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.941589][ T1088] bridge0: port 2(bridge_slave_1) entered forwarding state
[   62.128004][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.178524][ T5835] veth0_vlan: entered promiscuous mode
[   62.183390][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.198047][ T5835] veth1_vlan: entered promiscuous mode
[   62.228062][ T5827] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.248605][ T5831] veth0_vlan: entered promiscuous mode
[   62.255005][ T5835] veth0_macvtap: entered promiscuous mode
[   62.268923][ T5831] veth1_vlan: entered promiscuous mode
[   62.271501][ T5835] veth1_macvtap: entered promiscuous mode
[   62.312321][ T5827] veth0_vlan: entered promiscuous mode
[   62.317611][ T5831] veth0_macvtap: entered promiscuous mode
[   62.322929][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.331263][ T5831] veth1_macvtap: entered promiscuous mode
[   62.339455][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.342434][ T5827] veth1_vlan: entered promiscuous mode
[   62.352630][ T5835] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.356313][ T5835] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.359558][ T5835] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.362707][ T5835] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.383006][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.397361][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.414800][ T5833] Bluetooth: hci2: command tx timeout
[   62.414815][ T5830] Bluetooth: hci1: command tx timeout
[   62.416976][ T5219] Bluetooth: hci0: command tx timeout
[   62.422758][ T5831] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.426361][ T5831] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.429772][ T5831] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.432912][ T5831] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.470783][ T5827] veth0_macvtap: entered promiscuous mode
[   62.488896][ T5827] veth1_macvtap: entered promiscuous mode
[   62.528474][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.541009][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.547101][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.549560][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.553305][  T957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.555680][ T5827] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.555712][ T5827] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.555724][ T5827] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.555735][ T5827] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.567409][  T957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.610977][ T1958] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.615060][ T1958] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.638357][ T1088] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.640686][ T1088] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.663361][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.670182][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.689010][ T5835] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   62.699418][ T1958] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.701760][ T1958] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.748241][ T5894] ------------[ cut here ]------------
[   62.749902][ T5894] verifier bug: REG INVARIANTS VIOLATION (true_reg1): range bounds violation u64=[0x491b64a38, 0x8003fca38] s64=[0x491b64a38, 0x8003fca38] u32=[0x1485b3f, 0x1481b3f] s32=[0x1485b3f, 0x1481b3f] var_off=(0x1485b3f, 0xf00000000)(1)
[   62.766417][ T5894] WARNING: CPU: 0 PID: 5894 at kernel/bpf/verifier.c:2689 reg_bounds_sanity_check+0x6e6/0xc20
[   62.769542][ T5894] Modules linked in:
[   62.770936][ T5894] CPU: 0 UID: 0 PID: 5894 Comm: syz.2.3 Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0 PREEMPT(full) 
[   62.775633][ T5894] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   62.778774][ T5894] RIP: 0010:reg_bounds_sanity_check+0x6e6/0xc20
[   62.780603][ T5894] Code: 24 20 4c 8b 44 24 60 4c 8b 4c 24 58 41 ff 75 00 53 41 57 55 ff 74 24 38 ff 74 24 70 ff 74 24 40 e8 6f 8f aa ff 48 83 c4 38 90 <0f> 0b 90 90 48 bb 00 00 00 00 00 fc ff df 4d 89 f7 4c 8b 74 24 08
[   62.786294][ T5894] RSP: 0018:ffffc9000394ef08 EFLAGS: 00010282
[   62.788173][ T5894] RAX: 7c144bd15c87f500 RBX: 0000000001485b3f RCX: 0000000000080000
[   62.790617][ T5894] RDX: ffffc9000908a000 RSI: 0000000000005bf1 RDI: 0000000000005bf2
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   62.792989][ T5894] RBP: 0000000001485b3f R08: 0000000000000003 R09: 0000000000000004
[   62.795585][ T5894] R10: dffffc0000000000 R11: fffffbfff1bfaa6c R12: ffff88802ef35000
[   62.798095][ T5894] R13: ffff88802ef35020 R14: ffff88802ef35038 R15: 0000000001481b3f
[   62.800477][ T5894] FS:  00007fe6ae7f66c0(0000) GS:ffff8880b861f000(0000) knlGS:0000000000000000
[   62.803079][ T5894] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   62.805303][ T5894] CR2: 0000555557dde808 CR3: 000000002404e000 CR4: 00000000000006f0
[   62.808130][ T5894] Call Trace:
[   62.809133][ T5894]  <TASK>
[   62.810023][ T5894]  reg_set_min_max+0x214/0x300
[   62.811450][ T5894]  check_cond_jmp_op+0x159b/0x2910
[   62.812941][ T5894]  ? __pfx_check_cond_jmp_op+0x10/0x10
[   62.815348][ T5894]  ? do_check+0xa66c/0xe520
[   62.816777][ T5894]  do_check+0x6751/0xe520
[   62.818139][ T5894]  ? __pfx_do_check+0x10/0x10
[   62.819597][ T5894]  ? init_func_state+0x1ddf/0x2d20
[   62.821087][ T5894]  do_check_common+0x1918/0x2470
[   62.822631][ T5894]  bpf_check+0x1746a/0x1d2e0
[   62.824234][ T5894]  ? _raw_spin_unlock_irqrestore+0x85/0x110
[   62.826052][ T5894]  ? lockdep_hardirqs_on+0x9c/0x150
[   62.827684][ T5894]  ? __lock_acquire+0xab9/0xd20
[   62.829358][ T5894]  ? __pfx___mutex_trylock_common+0x10/0x10
[   62.831280][ T5894]  ? css_rstat_updated+0x1a5/0xca0
[   62.832925][ T5894]  ? __lock_acquire+0xab9/0xd20
[   62.834530][ T5894]  ? __pfx_bpf_check+0x10/0x10
[   62.835983][ T5894]  ? ktime_get_with_offset+0x8c/0x2a0
[   62.837599][ T5894]  ? seqcount_lockdep_reader_access+0x123/0x1c0
[   62.839472][ T5894]  ? lockdep_hardirqs_on+0x9c/0x150
[   62.841082][ T5894]  ? ktime_get_with_offset+0x8c/0x2a0
[   62.842750][ T5894]  ? seqcount_lockdep_reader_access+0x175/0x1c0
[   62.844860][ T5894]  ? __pfx_seqcount_lockdep_reader_access+0x10/0x10
[   62.846788][ T5894]  ? __asan_memset+0x22/0x50
[   62.848192][ T5894]  ? bpf_obj_name_cpy+0x194/0x1e0
[   62.849692][ T5894]  ? bpf_lsm_bpf_prog_load+0x9/0x20
[   62.851236][ T5894]  ? security_bpf_prog_load+0x7f/0x310
[   62.852836][ T5894]  bpf_prog_load+0x1318/0x1930
[   62.854382][ T5894]  ? __pfx_bpf_prog_load+0x10/0x10
[   62.855922][ T5894]  ? bpf_lsm_bpf+0x9/0x20
[   62.857261][ T5894]  ? security_bpf+0x7e/0x300
[   62.858711][ T5894]  __sys_bpf+0x528/0x870
[   62.860008][ T5894]  ? __pfx___sys_bpf+0x10/0x10
[   62.861503][ T5894]  ? exc_page_fault+0x76/0xf0
[   62.862913][ T5894]  __x64_sys_bpf+0x7c/0x90
[   62.864333][ T5894]  do_syscall_64+0xfa/0x3b0
[   62.865727][ T5894]  ? lockdep_hardirqs_on+0x9c/0x150
[   62.867280][ T5894]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   62.869087][ T5894]  ? exc_page_fault+0x9f/0xf0
[   62.870524][ T5894]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   62.872481][ T5894] RIP: 0033:0x7fe6b098e9a9
[   62.874136][ T5894] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   62.879749][ T5894] RSP: 002b:00007fe6ae7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[   62.882337][ T5894] RAX: ffffffffffffffda RBX: 00007fe6b0bb5fa0 RCX: 00007fe6b098e9a9
[   62.884856][ T5894] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005
[   62.887459][ T5894] RBP: 00007fe6b0a10d69 R08: 0000000000000000 R09: 0000000000000000
[   62.889974][ T5894] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   62.892561][ T5894] R13: 0000000000000001 R14: 00007fe6b0bb5fa0 R15: 00007ffe8ba1f058
[   62.895141][ T5894]  </TASK>
[   62.896068][ T5894] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   62.898214][ T5894] CPU: 0 UID: 0 PID: 5894 Comm: syz.2.3 Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0 PREEMPT(full) 
[   62.901739][ T5894] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   62.904730][ T5894] Call Trace:
[   62.905710][ T5894]  <TASK>
[   62.906613][ T5894]  dump_stack_lvl+0x99/0x250
[   62.908003][ T5894]  ? __asan_memcpy+0x40/0x70
[   62.909379][ T5894]  ? __pfx_dump_stack_lvl+0x10/0x10
[   62.910943][ T5894]  ? __pfx__printk+0x10/0x10
[   62.912324][ T5894]  panic+0x2db/0x790
[   62.913544][ T5894]  ? __pfx_panic+0x10/0x10
[   62.914925][ T5894]  ? show_trace_log_lvl+0x4fb/0x550
[   62.916501][ T5894]  __warn+0x31b/0x4b0
[   62.917710][ T5894]  ? reg_bounds_sanity_check+0x6e6/0xc20
[   62.919441][ T5894]  ? reg_bounds_sanity_check+0x6e6/0xc20
[   62.921119][ T5894]  report_bug+0x2be/0x4f0
[   62.922396][ T5894]  ? reg_bounds_sanity_check+0x6e6/0xc20
[   62.924053][ T5894]  ? reg_bounds_sanity_check+0x6e6/0xc20
[   62.925716][ T5894]  ? reg_bounds_sanity_check+0x6e8/0xc20
[   62.927438][ T5894]  handle_bug+0x84/0x160
[   62.928739][ T5894]  exc_invalid_op+0x1a/0x50
[   62.930135][ T5894]  asm_exc_invalid_op+0x1a/0x20
[   62.931586][ T5894] RIP: 0010:reg_bounds_sanity_check+0x6e6/0xc20
[   62.933512][ T5894] Code: 24 20 4c 8b 44 24 60 4c 8b 4c 24 58 41 ff 75 00 53 41 57 55 ff 74 24 38 ff 74 24 70 ff 74 24 40 e8 6f 8f aa ff 48 83 c4 38 90 <0f> 0b 90 90 48 bb 00 00 00 00 00 fc ff df 4d 89 f7 4c 8b 74 24 08
[   62.939177][ T5894] RSP: 0018:ffffc9000394ef08 EFLAGS: 00010282
[   62.941032][ T5894] RAX: 7c144bd15c87f500 RBX: 0000000001485b3f RCX: 0000000000080000
[   62.943279][ T5894] RDX: ffffc9000908a000 RSI: 0000000000005bf1 RDI: 0000000000005bf2
[   62.945676][ T5894] RBP: 0000000001485b3f R08: 0000000000000003 R09: 0000000000000004
[   62.948116][ T5894] R10: dffffc0000000000 R11: fffffbfff1bfaa6c R12: ffff88802ef35000
[   62.950449][ T5894] R13: ffff88802ef35020 R14: ffff88802ef35038 R15: 0000000001481b3f
[   62.952769][ T5894]  reg_set_min_max+0x214/0x300
[   62.954157][ T5894]  check_cond_jmp_op+0x159b/0x2910
[   62.955679][ T5894]  ? __pfx_check_cond_jmp_op+0x10/0x10
[   62.957312][ T5894]  ? do_check+0xa66c/0xe520
[   62.958775][ T5894]  do_check+0x6751/0xe520
[   62.960162][ T5894]  ? __pfx_do_check+0x10/0x10
[   62.961609][ T5894]  ? init_func_state+0x1ddf/0x2d20
[   62.963218][ T5894]  do_check_common+0x1918/0x2470
[   62.964775][ T5894]  bpf_check+0x1746a/0x1d2e0
[   62.966208][ T5894]  ? _raw_spin_unlock_irqrestore+0x85/0x110
[   62.968033][ T5894]  ? lockdep_hardirqs_on+0x9c/0x150
[   62.969641][ T5894]  ? __lock_acquire+0xab9/0xd20
[   62.971142][ T5894]  ? __pfx___mutex_trylock_common+0x10/0x10
[   62.972908][ T5894]  ? css_rstat_updated+0x1a5/0xca0
[   62.974485][ T5894]  ? __lock_acquire+0xab9/0xd20
[   62.975989][ T5894]  ? __pfx_bpf_check+0x10/0x10
[   62.977493][ T5894]  ? ktime_get_with_offset+0x8c/0x2a0
[   62.979200][ T5894]  ? seqcount_lockdep_reader_access+0x123/0x1c0
[   62.981086][ T5894]  ? lockdep_hardirqs_on+0x9c/0x150
[   62.982669][ T5894]  ? ktime_get_with_offset+0x8c/0x2a0
[   62.984318][ T5894]  ? seqcount_lockdep_reader_access+0x175/0x1c0
[   62.986196][ T5894]  ? __pfx_seqcount_lockdep_reader_access+0x10/0x10
[   62.988122][ T5894]  ? __asan_memset+0x22/0x50
[   62.989480][ T5894]  ? bpf_obj_name_cpy+0x194/0x1e0
[   62.990931][ T5894]  ? bpf_lsm_bpf_prog_load+0x9/0x20
[   62.992462][ T5894]  ? security_bpf_prog_load+0x7f/0x310
[   62.994039][ T5894]  bpf_prog_load+0x1318/0x1930
[   62.995532][ T5894]  ? __pfx_bpf_prog_load+0x10/0x10
[   62.997032][ T5894]  ? bpf_lsm_bpf+0x9/0x20
[   62.998355][ T5894]  ? security_bpf+0x7e/0x300
[   62.999805][ T5894]  __sys_bpf+0x528/0x870
[   63.001145][ T5894]  ? __pfx___sys_bpf+0x10/0x10
[   63.002633][ T5894]  ? exc_page_fault+0x76/0xf0
[   63.004055][ T5894]  __x64_sys_bpf+0x7c/0x90
[   63.005375][ T5894]  do_syscall_64+0xfa/0x3b0
[   63.006700][ T5894]  ? lockdep_hardirqs_on+0x9c/0x150
[   63.008203][ T5894]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   63.009989][ T5894]  ? exc_page_fault+0x9f/0xf0
[   63.011372][ T5894]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   63.013058][ T5894] RIP: 0033:0x7fe6b098e9a9
[   63.014367][ T5894] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   63.019857][ T5894] RSP: 002b:00007fe6ae7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[   63.022252][ T5894] RAX: ffffffffffffffda RBX: 00007fe6b0bb5fa0 RCX: 00007fe6b098e9a9
[   63.024557][ T5894] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005
[   63.026843][ T5894] RBP: 00007fe6b0a10d69 R08: 0000000000000000 R09: 0000000000000000
[   63.029133][ T5894] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   63.031427][ T5894] R13: 0000000000000001 R14: 00007fe6b0bb5fa0 R15: 00007ffe8ba1f058
[   63.033715][ T5894]  </TASK>
[   63.035187][ T5894] Kernel Offset: disabled
[   63.036501][ T5894] Rebooting in 86400 seconds..

VM DIAGNOSIS:
10:41:55  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000034 RBX=0000000000000034 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000008b9a RDI=0000000000008b9b RBP=00000000000003f8 RSP=ffffc9000394e6b0
R8 =ffff888020650237 R9 =1ffff110040ca046 R10=dffffc0000000000 R11=ffffffff85472aa0
R12=dffffc0000000000 R13=ffffffff99af58ae R14=ffffffff99dfa1e0 R15=0000000000000000
RIP=ffffffff85472b1c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fe6ae7f66c0 ffffffff 00c00000
GS =0000 ffff8880b861f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000555557dde808 CR3=000000002404e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007fe6b0a11ec1
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=aac4ec2458e9c500 RBX=ffffffff81976a48 RCX=aac4ec2458e9c500 RDX=0000000000000001
RSI=ffffffff8d99883e RDI=ffffffff8be29f40 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f9b R9 =1ffff11026cc65f3 R10=dffffc0000000000 R11=ffffed1026cc65f4
R12=ffffffff8fa1e8f0 R13=0000000000000001 R14=0000000000000001 R15=1ffff110200d3000
RIP=ffffffff8b6e84f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000080 CR3=000000010fe8c000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fa90fd86478 00007fa90fd86450 XMM03=00007fa90fd86488 00007fa90fd86480
XMM04=00007fa9108ed100 00007fa90fd86440 XMM05=00007fa90fd86458 00007fa90fd864a0
XMM06=00007fa90fd86498 00007fa90fd86490 XMM07=00007fa90fd86488 00007fa90fd86480
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007fa90fc11ec1
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
