last executing test programs:

44.519774186s ago: executing program 0 (id=1):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='io.stat\x00', 0x26e1, 0x0)
close(r0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x8901, 0x0)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c23003f)
write$cgroup_devices(r0, 0x0, 0xa)

44.460166956s ago: executing program 1 (id=2):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x0, 0xca, 0x0, 0x0, 0x200000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(r1)
recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r2=>0xffffffffffffffff]}}], 0x18}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x5, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61128c030000000061138c8800000000bf30000000000000150000000009240b2d03010000000000950000a7000000006916700000000000bf67000000000000b5070000fcff0304670600001f000000370300000ef90060bf050000000000007e650000000000006507f9ff01000000470700004c0000005f75000000000000bf54000000000000070400000400f9fead4301000000000095000000000000000500000000000000950000000000000032ed3c5be9529914953170d2d7ffffff8ecf264e9981db7d04df3244c7bd7e7e7f2f1754558f2278af6d71c19a5e12814cb1d8a5d4601d15871637b65f8903dc8700a0b9bdb7dd399700d6c4f6f3be4b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fc9de56c9d8a814261bd81762bab839dfa66810b5b40d893ea8fe0185473d51b546c087431d770000000767c955cfa1f6ab689fde4de5f832c8b664e73b99b6c2e0ab330e1c7feada70600000000000000b7010001000000009af619e3cca4d19e0dee5eb106774a8f3e6916df85aaf34c4756ad3a6d9fee0000000000000000c8fb735fd552bdc206004aeb0743eb3dc819b6cf5c8a0700000000000000a13d0045fb3cdaffa673a6bb55d8c85f21dce44aba5387e35350481aedac065b5031e56723888fb126a163f16fb2ad9bc1172bec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67a993716dbf580469f11294b4800a045ea11b3566bf3a649878e582f2af97787f696649a462e7ee4bcf89cbf2f0800000000000000b2c4acb07a10d6732f54beb40000040000000000000000000000000200f674629709e7e78f4ddc211bc304f0bd9d42ca019dd5d022cf74686e9fbe2562671cd47840a7afaab43176e65ec1118d46e4e827f3477523dcfa17690884f8d2001e03a651bb96589a7eab010e861bbd0000000000000000c5904c647802cf86f1b4c3005f33d83f84e98a72fbbecd106425563d80bd0d0d703f37ca153f601ae899a53f6715a0080034b0c94cce69945205480a55c22fe394ac000000000000000000040000000000437d57defb79ea6a58b83eeed729a2f95e6a1fc3857fb51b324be00000000000000090867f7a3b9bc43717188cb8426286fc55fc57cc3c6de4aa67babf350709e282a4f2bf59f46e20465eae865dbfd533b1cb2d540d0490cd5248715c74b6bd0248a9a0b413bbdfb5351defc6e34a961f3593920411e112c9df23a29c072d3460eb37beb5bbc04600c64acad9a04ffe62875177b51d2f0c6d7194c26789d2bec2d0846831455b8fcd03beaeca2c1335d8a49a92f9d2bef5f485c4fff4cf710b7d00000000000000009d47d564a838bdf8901a719431a9b0ef918ec0ec79037cb61df16379e3bf2a8100000007e8512e21080315e62559e8dd67dae85177d899d9e078f80585837f0e943b8820b19c75d243a78d8c2093c59cbc4c55f1578cff737502ea2d8d0b9dc946dcb38692dcc8db84834cc7726429cb20603b5338184f9856eeaec437fc3446b6c5ffe5db28aa802e37d3c4f259d616307d8aa46ca094049c0ddc1caaed5485b4ff030000182620bcba2316f9e6df0c8647f6ff0000000000000000386096e4a4ff86042f0b42027ff933d2dfe2d5baffacc9dc2411302a185ea454af5839be28b7d040c1fe1ce0fd63fa7f32b8ab6cd6a8b8bf1b693e4ffeca635d84c376b03a58677dd9f8c2a6fa126c7dad3f9e939c92d63ab1cf2fbea26a60b951914aba5c0696cc64e66b9b0f2c4444f8c391c0d9b647a3be4885a055ce3879a91fb62ca97e6526286c14c80b6dc981c5ae6ebf0778ea01a3a44e01ab79bcddbb83266a1ce1a1dea83ebb89d07b4d05aa09ad2904040e7784e96cd66b04204d47b1c66d5a84e7c3de1d1062fd8a23d1b402003c177e76dbca599691164ade323ad4a17abe99975cba748bc2379eed5a83dc94947eb18976db6ca6d35bfb65a3d8b5129d5263b66dbae6c2baa9bbec017646569fa99537aa453f3e6b2acebeddb6c32a87455f351efcd8385100f33d6b0c3195e229bd30260941825ba884d7db07e1212033409e62d7154cc68a7ee910e393470cdb781817f85373a647fd1b626035b666f224a66c0e47e15c6b836b324318507501a0f4b2cc9153167fd839a483615cbc2ad1a7d1528f01bf91b950a9bcd7d06491e1a355e476365f653d2d94ba898ab8d64d70bdb364ef3adb5ba1e4d9d5002da76ccec5d5184e912aaf5a945ae062e670fafb8cf0afee51c851546bb38c5ef303000000000000002ecdc2b82059750f019a418e3e8d20b6bf768a7db1f8472713452553149a4634418de7eda7b2e682271c6e62f5dfaabba46560dfa410e1f334a5f60791b275368469ddc42f7712bff1689f2ffbf5268cc0572e23afd4c402b154ae94c1f65d7d4a79272945287c79b4b70183d2cde66c7225106a064a1800d777372b2b43326821d5c1c78fda699c7484f3e5fc8bbce6fb3039569646b0de22c431d90c12d48e314d8a5ef4db14a110da070000002c4f7bd7f36f814ed92197fe3eb0843c2681c609231825b8a27ba301142cec8a6fd85965f83ff4dd40296e5fb5678d93d0daee45c43bdb9bde9c1d1c988b909fdf78cfda5da3dc28792b10fb8f3f22ece745c074f86f471489337a9a8d9ad7f310aa50c983b490f561bc420289b6aa0fc3f43f8a4548aa9c723ce466287760f919afbb94b0410ff06071de3aa1c199f407347af666713096a422fbc70671ac08f9256ab0079c101a724136352af2895899effda7bcd127ba98521eb4b04b2a821935ee3b216190e21fb059f9519c4804283d2ce09977842ff7309ad2c4d8f0420dfc8cdb1b37ad52985a88ca4cdc1e37715362a59f7c9c7df793d69f974399859e622ec3a1bab735a1aa489fe50619fe399eddaf92f67755cb54824685444a58731ee166ae65412709b853a5df7ce44220fc188c00291843d66e69da3744f39f5f6113fbe390b22cdbefb90ca2a51b1ff21f384e7bf076825aadaf02da77eeefb8875d630b7575e661b90eb6cd98674c92f179b2675b1f6c86712846ddae87bb3a3887b56292356270e85888c25a1c8ae958906ef6b71e1b800107da1c5608fe05d2f4265a5300000000000000007c737c911c049ae7dc9d77edecaf9685c53ac264e9f02ffcf0318af80c99ea2020b1e1f47cfdd6097c49b5f4bb92bb9133df719f35d4bf730784f1caa8e4e16f4eeb535c059a700d57e4d6c83c4a35a6ef44f135657d3d41856235253326d937125b6f23af7eb95bac231b84c6935a3a6d24d18f7e379db2fd5e76d5ad0d5b4a6c155e8759eb0e7b39ef433861158bd496ecafb3d1c50294e43d5895df1a2de536f5d85e0a000049277bc09533ceead6812fdfb5ef59b15069ea0df6a3eee0484c848fe4e6e7461ffc3917e4e07d250d9459ebea5fd4e26fc04eb38e70597fcb693cb2f7506f5f50b9f73a25bb83b6c71240e5d725ff567d9745a3ba5462524648a93360fb2b9feb1401e309"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8020, 0x90000, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x2, 0x6}, 0x8224, 0x2, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x20)
write$cgroup_subtree(r2, &(0x7f0000000c00)=ANY=[@ANYRES8=r1, @ANYBLOB='>'], 0x12)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f0, 0x0)

44.457607408s ago: executing program 2 (id=3):
bpf$MAP_CREATE(0x0, 0x0, 0x50)
r0 = socket$kcm(0x10, 0x2, 0x0)
perf_event_open(&(0x7f0000000680)={0x1, 0xb0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d2d, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x352, 0x1, @perf_config_ext={0x9, 0xfffffffffffffff1}, 0x100e64, 0xc78, 0x0, 0x0, 0x1, 0x0, 0x10, 0x0, 0xb, 0x0, 0x1fffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f40)={0xe, 0x3, &(0x7f0000000000)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x99}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94)
bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
r2 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$kcm(0xa, 0x922000000003, 0x11)
setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f00000000c0), 0x4)
perf_event_open(0x0, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000001e40)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000640)={&(0x7f0000000580)='percpu_alloc_percpu\x00', r4}, 0x10)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x890b, &(0x7f0000000000))
sendmsg$sock(r3, &(0x7f0000000740)={&(0x7f0000000100)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000700)}, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000100730109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xb}, 0x90)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x0)
r5 = socket$kcm(0x1e, 0x5, 0x0)
sendmsg$kcm(r5, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000300)="80", 0xfdef}], 0x1}, 0x0)
recvmsg(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000dc0)=""/243, 0xf3}], 0x1, &(0x7f0000000080)=""/18, 0x12}, 0x40000010)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x9, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a40)={r6, 0xe0, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000005c0)=[0x0, 0x0], ""/16, <r7=>0x0, 0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000900), 0x0, 0xcc, &(0x7f0000000940)=[{}], 0x8, 0x10, &(0x7f0000000980), &(0x7f00000009c0), 0x8, 0xb4, 0x8, 0x0, 0x0}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000e00)={0xf, 0x12, &(0x7f0000000640)=ANY=[@ANYBLOB="180000002c0e0000000ef738570800009500200000000000181c0000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000c8040c00ff0000001850000002000000000000000000000018400000fcffffff000000000000000018280000", @ANYRES32=r1, @ANYBLOB="000000000400000018210000", @ANYRES32, @ANYBLOB="00000000030000009500000000000000"], &(0x7f00000004c0)='GPL\x00', 0x7, 0xa1, &(0x7f0000000800)=""/161, 0x40f00, 0x1c, '\x00', r7, @cgroup_device=0x6, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000a80)={0x0, 0x9, 0x7, 0x4}, 0x10, 0x0, r6, 0x5, &(0x7f0000000d40)=[r1, r1, r1, r1], &(0x7f0000000d80)=[{0x2, 0x4, 0x4, 0xc}, {0x3, 0x1, 0x7, 0x2}, {0x5, 0x4, 0xc}, {0x0, 0x5, 0x7, 0x8}, {0x4, 0x3, 0xa}], 0x10, 0x100}, 0x94)
sendmsg$inet(r0, &(0x7f0000000380)={&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000140)="12e0bb305ff9c397f76cad60defb94bfa3527d4f94570023d267c9a2dc2b5153926146b5b7f1c1ad568e52aa691c825e34b2d6a56dde1b5edbf17bc8d702bedefc2173f107d63f0694328df62533b3d6cce6e9f7c0ba330c5cd8a77e61c429b9f7906aa653a3d3b992b55cb100d825c697f2656c047837f31bac341970c2df002c16cf7bd39a3501f1165b83ca25b2fd7f5866d2e244e6ecc2ffb4f89b10bc91bb6ccdd9d0babbcea5b38a39a41bf6a10a7a0337ca0e1d399b18780a2a6c8a3573a2d40219143536a06902dd28b9c2377bdf8dcb83df6ed38a59eb2bbf92b7f547287b2ca17eca7a5580ad3ef3ebfe", 0xef}, {&(0x7f0000000080)="6d6c04134bee31fe", 0x8}], 0x2, &(0x7f0000000300)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x6}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @multicast2}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x81}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @multicast2, @rand_addr=0x64010101}}}], 0x70}, 0x4000000)
sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000040)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010511000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x80)

44.419010222s ago: executing program 0 (id=4):
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x9a)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(r1)
bpf$MAP_DELETE_ELEM(0x2, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x20000000}, 0x20)
recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r2=>0xffffffffffffffff]}}], 0x18}, 0x40010040)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
r3 = socket$kcm(0x2c, 0x3, 0x0)
setsockopt$sock_attach_bpf(r3, 0x11b, 0x2, &(0x7f0000000900)=r2, 0x4)

44.241938221s ago: executing program 1 (id=5):
socket$kcm(0x2b, 0x1, 0x0)

44.241583261s ago: executing program 1 (id=6):
r0 = socket$kcm(0x2, 0x5, 0x84)
bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x4, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000843200000000000000000000007912"], 0x0, 0x8, 0x0, 0x0, 0x41000, 0x19, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7f}, 0x94)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
close(r2)
recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r3=>0xffffffffffffffff]}}], 0x18}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0x76, &(0x7f0000000000)=r3, 0x8)

44.24145355s ago: executing program 1 (id=7):
perf_event_open$cgroup(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0xb}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

44.112030302s ago: executing program 1 (id=8):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000800000000000000000000850000007d000000850000000700000095"], &(0x7f00000000c0)='GPL\x00', 0x4}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000280)='i2c_write\x00', r0}, 0x10)

44.10005022s ago: executing program 2 (id=9):
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
close(0xffffffffffffffff)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000081"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$kcm(0x11, 0xa, 0x300)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2688634c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

44.021003023s ago: executing program 1 (id=10):
r0 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYBLOB], 0xc)
openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2681, 0x0)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={<r2=>0xffffffffffffffff})
recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r3)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0xb, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407eff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x5}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2505, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000900)}, 0xff0f000000004080)
bpf$ITER_CREATE(0xb, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1e, 0xb, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r5, 0x8923, &(0x7f0000000040)={'wlan1\x00', @random="2e33e363a4b1"})

43.800972711s ago: executing program 0 (id=11):
r0 = socket$kcm(0x10, 0x2, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
socket$kcm(0xa, 0x5, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_config_ext={0x3, 0x8001}, 0x0, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0xa4706, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x320, 0x0, 0x0, 0x2}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0)
r2 = gettid()
perf_event_open(0x0, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0x0, 0x3, 0x1, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(0x0, r2, 0x7, r1, 0xb)
r3 = socket$kcm(0x10, 0x2, 0x0)
recvmsg(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000ec0)=""/4060, 0xfdc}, {&(0x7f00000037c0)=""/4069, 0xfe5}], 0x2}, 0x2000)
sendmsg$inet(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000d40)="5c00000052006bab9a3fe3d86e17aa0a046b4877c4aaf68187bae53dca2ba35bda6a876c1d0048007ea608649e7524765f0ef884c9f4d4938037e70e4509c5bb00000000e513aeac9bf2bee150d5fe8600"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20000004)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
sendmsg$unix(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000180)="2f03", 0x2}], 0x1}, 0x4895)
recvmsg$unix(r4, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002)
recvmsg$unix(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40010143)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000380)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cfce1e090000001fb791643a5ee4ce1b14d6d930ede1d9d322fe7c9f8775730d165ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3f09ad809d5e1cace81ed0bffece0b42a9ecbee5dd6e4edef3d93452a92954b4337000000008af26c8b7b55f4d2cb1df0966736a1dfe444c65ac5b348eac7c2ea475327557ba566236ceb0000000000", 0xd8}], 0x1}, 0x4000)

28.541003089s ago: executing program 32 (id=11):
r0 = socket$kcm(0x10, 0x2, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
socket$kcm(0xa, 0x5, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_config_ext={0x3, 0x8001}, 0x0, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0xa4706, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x320, 0x0, 0x0, 0x2}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0)
r2 = gettid()
perf_event_open(0x0, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0x0, 0x3, 0x1, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(0x0, r2, 0x7, r1, 0xb)
r3 = socket$kcm(0x10, 0x2, 0x0)
recvmsg(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000ec0)=""/4060, 0xfdc}, {&(0x7f00000037c0)=""/4069, 0xfe5}], 0x2}, 0x2000)
sendmsg$inet(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000d40)="5c00000052006bab9a3fe3d86e17aa0a046b4877c4aaf68187bae53dca2ba35bda6a876c1d0048007ea608649e7524765f0ef884c9f4d4938037e70e4509c5bb00000000e513aeac9bf2bee150d5fe8600"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20000004)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
sendmsg$unix(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000180)="2f03", 0x2}], 0x1}, 0x4895)
recvmsg$unix(r4, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002)
recvmsg$unix(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40010143)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000380)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cfce1e090000001fb791643a5ee4ce1b14d6d930ede1d9d322fe7c9f8775730d165ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3f09ad809d5e1cace81ed0bffece0b42a9ecbee5dd6e4edef3d93452a92954b4337000000008af26c8b7b55f4d2cb1df0966736a1dfe444c65ac5b348eac7c2ea475327557ba566236ceb0000000000", 0xd8}], 0x1}, 0x4000)

28.523884845s ago: executing program 33 (id=10):
r0 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYBLOB], 0xc)
openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2681, 0x0)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={<r2=>0xffffffffffffffff})
recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r3)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0xb, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407eff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x5}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2505, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000900)}, 0xff0f000000004080)
bpf$ITER_CREATE(0xb, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1e, 0xb, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r5, 0x8923, &(0x7f0000000040)={'wlan1\x00', @random="2e33e363a4b1"})

0s ago: executing program 34 (id=9):
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
close(0xffffffffffffffff)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000081"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$kcm(0x11, 0xa, 0x300)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2688634c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:28810' (ED25519) to the list of known hosts.
syzkaller login: [   50.152512][ T5790] cgroup: Unknown subsys name 'net'
[   50.331900][ T5790] cgroup: Unknown subsys name 'cpuset'
[   50.336872][ T5790] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   52.146574][ T5790] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   56.643071][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   56.650687][ T5832] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   56.653405][ T5832] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   56.656696][ T5832] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   56.659552][ T5832] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   56.663595][ T5832] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   56.666786][ T5832] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   56.701977][ T5838] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   56.710814][ T5222] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   56.714078][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   56.718476][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   56.725833][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   56.728554][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   56.732517][   T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   56.737723][   T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   56.954596][ T5830] chnl_net:caif_netlink_parms(): no params data found
[   57.033623][ T5834] chnl_net:caif_netlink_parms(): no params data found
[   57.099525][ T5839] chnl_net:caif_netlink_parms(): no params data found
[   57.125879][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.130960][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.134085][ T5830] bridge_slave_0: entered allmulticast mode
[   57.138256][ T5830] bridge_slave_0: entered promiscuous mode
[   57.172748][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.175544][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.178809][ T5830] bridge_slave_1: entered allmulticast mode
[   57.182572][ T5830] bridge_slave_1: entered promiscuous mode
[   57.202510][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.204732][ T5834] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.206874][ T5834] bridge_slave_0: entered allmulticast mode
[   57.211061][ T5834] bridge_slave_0: entered promiscuous mode
[   57.214359][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.216905][ T5834] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.220445][ T5834] bridge_slave_1: entered allmulticast mode
[   57.223624][ T5834] bridge_slave_1: entered promiscuous mode
[   57.279143][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   57.285086][ T5834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   57.291878][ T5834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   57.329951][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   57.343204][ T5834] team0: Port device team_slave_0 added
[   57.347329][ T5834] team0: Port device team_slave_1 added
[   57.408528][ T5839] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.411162][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.413595][ T5839] bridge_slave_0: entered allmulticast mode
[   57.416580][ T5839] bridge_slave_0: entered promiscuous mode
[   57.420741][ T5839] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.423110][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.425577][ T5839] bridge_slave_1: entered allmulticast mode
[   57.430122][ T5839] bridge_slave_1: entered promiscuous mode
[   57.436348][ T5830] team0: Port device team_slave_0 added
[   57.442666][ T5830] team0: Port device team_slave_1 added
[   57.445291][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_0
[   57.448235][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.457000][ T5834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   57.462389][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_1
[   57.464869][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.473373][ T5834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   57.522172][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0
[   57.524284][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.533432][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   57.541378][ T5839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   57.548962][ T5839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   57.552501][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1
[   57.554973][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.563976][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   57.614359][ T5830] hsr_slave_0: entered promiscuous mode
[   57.617125][ T5830] hsr_slave_1: entered promiscuous mode
[   57.647778][ T5839] team0: Port device team_slave_0 added
[   57.654475][ T5834] hsr_slave_0: entered promiscuous mode
[   57.656752][ T5834] hsr_slave_1: entered promiscuous mode
[   57.660043][ T5834] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   57.662737][ T5834] Cannot create hsr debugfs directory
[   57.665798][ T5839] team0: Port device team_slave_1 added
[   57.710688][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_0
[   57.713331][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.721200][ T5839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   57.736600][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_1
[   57.738886][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.746401][ T5839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   57.802323][ T5839] hsr_slave_0: entered promiscuous mode
[   57.804550][ T5839] hsr_slave_1: entered promiscuous mode
[   57.806538][ T5839] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   57.809395][ T5839] Cannot create hsr debugfs directory
[   58.017914][ T5830] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   58.033946][ T5830] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   58.049372][ T5830] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   58.061464][ T5830] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   58.101294][ T5834] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   58.121697][ T5834] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   58.134751][ T5834] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   58.151965][ T5834] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   58.176771][ T5839] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   58.185534][ T5839] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   58.201717][ T5839] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   58.208815][ T5839] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   58.322108][ T5834] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.336222][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.364627][ T5834] 8021q: adding VLAN 0 to HW filter on device team0
[   58.375432][ T5830] 8021q: adding VLAN 0 to HW filter on device team0
[   58.382206][ T1091] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.385049][ T1091] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.407034][ T1091] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.409831][ T1091] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.415739][ T1091] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.418776][ T1091] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.425846][ T1091] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.428649][ T1091] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.473383][ T5839] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.526473][ T5839] 8021q: adding VLAN 0 to HW filter on device team0
[   58.546439][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.548876][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.559748][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.562093][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.714744][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0
[   58.749536][ T5834] 8021q: adding VLAN 0 to HW filter on device batadv0
[   58.776228][ T5839] 8021q: adding VLAN 0 to HW filter on device batadv0
[   58.779689][ T5838] Bluetooth: hci1: command tx timeout
[   58.780107][   T54] Bluetooth: hci2: command tx timeout
[   58.781597][ T5838] Bluetooth: hci0: command tx timeout
[   58.821198][ T5834] veth0_vlan: entered promiscuous mode
[   58.841022][ T5830] veth0_vlan: entered promiscuous mode
[   58.843787][ T5834] veth1_vlan: entered promiscuous mode
[   58.869639][ T5830] veth1_vlan: entered promiscuous mode
[   58.890497][ T5839] veth0_vlan: entered promiscuous mode
[   58.912666][ T5839] veth1_vlan: entered promiscuous mode
[   58.916750][ T5834] veth0_macvtap: entered promiscuous mode
[   58.925954][ T5834] veth1_macvtap: entered promiscuous mode
[   58.948295][ T5830] veth0_macvtap: entered promiscuous mode
[   58.956878][ T5830] veth1_macvtap: entered promiscuous mode
[   58.963180][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_0
[   58.973804][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_1
[   58.982292][ T5834] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   58.984971][ T5834] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   58.989394][ T5834] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   58.992409][ T5834] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.006262][ T5839] veth0_macvtap: entered promiscuous mode
[   59.013371][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0
[   59.026350][ T5839] veth1_macvtap: entered promiscuous mode
[   59.039382][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1
[   59.063831][ T5830] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.066772][ T5830] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.072652][ T5830] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.076030][ T5830] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.089339][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_0
[   59.126925][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_1
[   59.132158][ T1089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.137899][ T1089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.140964][ T5839] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.143545][ T5839] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.146132][ T5839] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.150178][ T5839] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.194350][  T215] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.197370][  T215] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.239409][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.241960][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.275873][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.281937][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.285939][ T5834] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   59.291314][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.294971][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.329665][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.332094][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.428856][ T5838] Bluetooth: hci0: unexpected subevent 0x01 length: 14 < 18
[   59.432475][ T5905] syz.0.4: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[   59.437118][ T5905] CPU: 0 UID: 0 PID: 5905 Comm: syz.0.4 Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0 PREEMPT(full) 
[   59.437130][ T5905] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   59.437136][ T5905] Call Trace:
[   59.437140][ T5905]  <TASK>
[   59.437144][ T5905]  dump_stack_lvl+0x189/0x250
[   59.437160][ T5905]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.437169][ T5905]  ? __pfx__printk+0x10/0x10
[   59.437181][ T5905]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   59.437191][ T5905]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   59.437203][ T5905]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[   59.437214][ T5905]  warn_alloc+0x214/0x310
[   59.437224][ T5905]  ? stack_depot_save_flags+0x429/0x900
[   59.437236][ T5905]  ? __pfx_warn_alloc+0x10/0x10
[   59.437246][ T5905]  ? kasan_save_track+0x4f/0x80
[   59.437254][ T5905]  ? xskq_create+0x56/0x170
[   59.437264][ T5905]  ? xsk_init_queue+0xb0/0x110
[   59.437272][ T5905]  ? xsk_setsockopt+0x4de/0x710
[   59.437281][ T5905]  ? do_sock_setsockopt+0x17c/0x1b0
[   59.437289][ T5905]  ? __x64_sys_setsockopt+0x13f/0x1b0
[   59.437297][ T5905]  ? do_syscall_64+0xfa/0x3b0
[   59.437308][ T5905]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.437319][ T5905]  __vmalloc_node_range_noprof+0x125/0x12f0
[   59.437342][ T5905]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[   59.437353][ T5905]  ? __kasan_kmalloc+0x93/0xb0
[   59.437364][ T5905]  vmalloc_user_noprof+0xad/0xf0
[   59.437373][ T5905]  ? xskq_create+0xbf/0x170
[   59.437384][ T5905]  xskq_create+0xbf/0x170
[   59.437399][ T5905]  xsk_init_queue+0xb0/0x110
[   59.437410][ T5905]  xsk_setsockopt+0x4de/0x710
[   59.437421][ T5905]  ? __pfx_xsk_setsockopt+0x10/0x10
[   59.437454][ T5905]  ? __fget_files+0x2a/0x420
[   59.437464][ T5905]  ? aa_sock_opt_perm+0x74/0x110
[   59.437513][ T5905]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[   59.437524][ T5905]  ? __pfx_xsk_setsockopt+0x10/0x10
[   59.437534][ T5905]  do_sock_setsockopt+0x17c/0x1b0
[   59.437546][ T5905]  __x64_sys_setsockopt+0x13f/0x1b0
[   59.437557][ T5905]  do_syscall_64+0xfa/0x3b0
[   59.437568][ T5905]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.437575][ T5905]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   59.437586][ T5905]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.437593][ T5905] RIP: 0033:0x7ff03e98e9a9
[   59.437601][ T5905] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   59.437608][ T5905] RSP: 002b:00007ff03f805038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[   59.437617][ T5905] RAX: ffffffffffffffda RBX: 00007ff03ebb5fa0 RCX: 00007ff03e98e9a9
[   59.437623][ T5905] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000005
[   59.437627][ T5905] RBP: 00007ff03ea10d69 R08: 0000000000000004 R09: 0000000000000000
[   59.437632][ T5905] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000
[   59.437636][ T5905] R13: 0000000000000000 R14: 00007ff03ebb5fa0 R15: 00007ffe91b9e1d8
[   59.437649][ T5905]  </TASK>
[   59.540968][ T5906] netlink: 'syz.2.3': attribute type 10 has an invalid length.
[   59.543339][ T5906] netlink: 2 bytes leftover after parsing attributes in process `syz.2.3'.
[   59.546359][ T5906] team0: entered promiscuous mode
[   59.556599][ T5906] team_slave_0: entered promiscuous mode
[   59.559661][ T5906] team_slave_1: entered promiscuous mode
[   59.566620][ T5906] bridge0: port 3(team0) entered blocking state
[   59.574557][ T5906] bridge0: port 3(team0) entered disabled state
[   59.576781][ T5906] team0: entered allmulticast mode
[   59.582868][ T5906] team_slave_0: entered allmulticast mode
[   59.586378][ T5906] team_slave_1: entered allmulticast mode
[   59.599346][ T5905] Mem-Info:
[   59.600496][ T5905] active_anon:5133 inactive_anon:0 isolated_anon:0
[   59.600496][ T5905]  active_file:743 inactive_file:38206 isolated_file:0
[   59.600496][ T5905]  unevictable:1768 dirty:1343 writeback:0
[   59.600496][ T5905]  slab_reclaimable:9081 slab_unreclaimable:51139
[   59.600496][ T5905]  mapped:17958 shmem:2433 pagetables:943
[   59.600496][ T5905]  sec_pagetables:0 bounce:0
[   59.600496][ T5905]  kernel_misc_reclaimable:0
[   59.600496][ T5905]  free:298620 free_pcp:25946 free_cma:0
[   59.614654][ T5905] Node 0 active_anon:10912kB inactive_anon:0kB active_file:2732kB inactive_file:7680kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:33068kB dirty:1944kB writeback:0kB shmem:4652kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:8076kB pagetables:2028kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   59.615806][ T5906] bridge0: port 3(team0) entered blocking state
[   59.624375][ T5905] Node 1 active_anon:9620kB inactive_anon:0kB active_file:240kB inactive_file:145144kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:38764kB dirty:3428kB writeback:0kB shmem:5080kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:3504kB pagetables:1744kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   59.626288][ T5906] bridge0: port 3(team0) entered forwarding state
[   59.638276][ T5905] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[   59.659911][ T5905] lowmem_reserve[]: 0 812 812 812 812
[   59.661601][ T5905] Node 0 DMA32 free:411508kB boost:0kB min:33656kB low:42068kB high:50480kB reserved_highatomic:0KB free_highatomic:0KB active_anon:10912kB inactive_anon:0kB active_file:2732kB inactive_file:7680kB unevictable:3536kB writepending:1944kB present:1556484kB managed:831912kB mlocked:0kB bounce:0kB free_pcp:41500kB local_pcp:23676kB free_cma:0kB
[   59.681393][ T5905] lowmem_reserve[]: 0 0 0 0 0
[   59.682886][ T5905] Node 1 DMA32 free:458492kB boost:0kB min:19192kB low:23988kB high:28784kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:116kB local_pcp:0kB free_cma:0kB
[   59.692496][ T5905] lowmem_reserve[]: 0 0 854 854 854
[   59.694176][ T5905] Node 1 Normal free:308448kB boost:0kB min:36616kB low:45768kB high:54920kB reserved_highatomic:0KB free_highatomic:0KB active_anon:9620kB inactive_anon:0kB active_file:240kB inactive_file:145144kB unevictable:3536kB writepending:3428kB present:1048576kB managed:875016kB mlocked:0kB bounce:0kB free_pcp:62156kB local_pcp:21300kB free_cma:0kB
[   59.704900][ T5905] lowmem_reserve[]: 0 0 0 0 0
[   59.706385][ T5905] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[   59.710627][ T5905] Node 0 DMA32: 263*4kB (UME) 189*8kB (ME) 95*16kB (M) 38*32kB (M) 19*64kB (UME) 8*128kB (M) 4*256kB (UME) 3*512kB (ME) 2*1024kB (UM) 1*2048kB (U) 97*4096kB (M) = 411508kB
[   59.715915][ T5905] Node 1 DMA32: 3*4kB (UM) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 3*2048kB (UM) 109*4096kB (M) = 458492kB
[   59.736300][ T5905] Node 1 Normal: 28*4kB (ME) 170*8kB (UM) 178*16kB (UM) 10*32kB (M) 4*64kB (M) 1*128kB (M) 1*256kB (M) 2*512kB (M) 3*1024kB (UME) 2*2048kB (ME) 72*4096kB (M) = 308384kB
[   59.754357][ T5905] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   59.758520][ T5905] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   59.761271][ T5905] 41396 total pagecache pages
[   59.762969][ T5905] 0 pages in swap cache
[   59.764228][ T5905] Free swap  = 124996kB
[   59.765494][ T5905] Total swap = 124996kB
[   59.766720][ T5905] 786301 pages RAM
[   59.768784][ T5905] 0 pages HighMem/MovableOnly
[   59.770331][ T5905] 241075 pages reserved
[   59.771621][ T5905] 0 pages cma reserved
[   60.129834][ T5922] Zero length message leads to an empty skb
[   60.132281][ T5922] mac80211_hwsim hwsim6 .3c: renamed from wlan1 (while UP)
[   60.182379][    C0] hrtimer: interrupt took 38972 ns
[   60.344276][ T5926] netlink: 'syz.0.11': attribute type 11 has an invalid length.
[   60.859696][ T5840] Bluetooth: hci1: command tx timeout
[   60.862092][ T5838] Bluetooth: hci2: command tx timeout
[   60.864510][ T5840] Bluetooth: hci0: command tx timeout
[   62.938171][ T5840] Bluetooth: hci0: command tx timeout
[   62.940248][ T5840] Bluetooth: hci1: command tx timeout
[   62.942334][ T5838] Bluetooth: hci2: command tx timeout
[   65.017861][   T54] Bluetooth: hci1: command tx timeout
[   65.020183][   T54] Bluetooth: hci0: command tx timeout
[   65.022390][ T5838] Bluetooth: hci2: command tx timeout
[   75.488868][ T5840] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   75.493318][ T5840] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   75.495894][ T5840] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   75.499196][ T5840] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   75.502081][ T5840] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   75.803481][   T54] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   75.806864][   T54] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   75.810200][   T54] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   75.813625][   T54] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   75.816118][   T54] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   75.840730][   T54] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   75.844641][   T54] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   75.848412][   T54] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   75.853046][   T54] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   75.857003][   T54] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   77.577789][   T54] Bluetooth: hci3: command tx timeout
[   77.897882][ T5840] Bluetooth: hci4: command tx timeout
[   77.901365][   T54] Bluetooth: hci5: command tx timeout
[   79.658455][   T54] Bluetooth: hci3: command tx timeout
[   79.978408][ T5840] Bluetooth: hci4: command tx timeout
[   79.980425][   T54] Bluetooth: hci5: command tx timeout
[   81.737714][   T54] Bluetooth: hci3: command tx timeout
[   82.060485][ T5840] Bluetooth: hci4: command tx timeout
[   82.063184][   T54] Bluetooth: hci5: command tx timeout
[   83.818216][   T54] Bluetooth: hci3: command tx timeout
[   84.137840][ T5840] Bluetooth: hci4: command tx timeout
[   84.140057][   T54] Bluetooth: hci5: command tx timeout
[  103.808243][    C1] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 42860721316 wd_nsec: 42860721053
[  103.838035][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  103.840083][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  103.846287][   T47] cfg80211: failed to load regulatory.db
[  104.353104][ T5929] chnl_net:caif_netlink_parms(): no params data found
[  104.362266][ T5934] chnl_net:caif_netlink_parms(): no params data found
[  136.921170][ T5840] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  136.930749][ T5838] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  136.934249][ T5838] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  136.939341][ T5838] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  136.942835][ T5838] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  136.972079][   T54] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  136.975090][   T54] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  136.978315][   T54] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  136.981293][   T54] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  136.984898][   T54] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  137.031630][ T5840] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1
[  137.034731][ T5840] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9
[  137.037424][ T5840] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9
[  137.041594][ T5840] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4
[  137.044194][ T5840] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2
[  139.017943][ T5840] Bluetooth: hci6: command tx timeout
[  139.021684][   T54] Bluetooth: hci7: command tx timeout
[  139.097782][   T54] Bluetooth: hci8: command tx timeout
[  141.097756][ T5840] Bluetooth: hci6: command tx timeout
[  141.100119][   T54] Bluetooth: hci7: command tx timeout
[  141.177717][   T54] Bluetooth: hci8: command tx timeout
[  143.177874][   T54] Bluetooth: hci7: command tx timeout
[  143.180199][   T54] Bluetooth: hci6: command tx timeout
[  143.257754][ T5840] Bluetooth: hci8: command tx timeout
[  145.257951][ T5840] Bluetooth: hci6: command tx timeout
[  145.260311][ T5840] Bluetooth: hci7: command tx timeout
[  145.337803][   T54] Bluetooth: hci8: command tx timeout
[  180.623429][ T5840] Bluetooth: hci1: command 0x0406 tx timeout
[  196.902789][ T5838] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1
[  196.924020][ T5838] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9
[  196.927068][ T5838] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9
[  196.930016][ T5838] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4
[  196.934893][ T5838] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2
[  196.987972][ T5222] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1
[  196.992181][ T5222] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9
[  196.994968][ T5222] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9
[  196.998272][ T5222] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4
[  197.001049][ T5222] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2
[  197.076442][ T5832] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1
[  197.080034][ T5832] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9
[  197.082810][ T5832] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9
[  197.085559][ T5832] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4
[  197.088646][ T5832] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2
[  201.100339][ T5984] Bluetooth: hci3: command 0x0406 tx timeout
[  201.102752][ T5984] Bluetooth: hci4: command 0x0406 tx timeout
[  201.104631][ T5984] Bluetooth: hci5: command 0x0406 tx timeout
[  208.897481][    C1] rcu: INFO: rcu_preempt self-detected stall on CPU
[  208.900158][    C1] rcu: 	1-....: (10500 ticks this GP) idle=ed0c/1/0x4000000000000000 softirq=14211/14225 fqs=5247
[  208.905830][    C1] rcu: 	         hardirqs   softirqs   csw/system
[  208.908302][    C1] rcu: 	 number:  1055490          0            0
[  208.910732][    C1] rcu: 	cputime:    25476      27023          110   ==> 52510(ms)
[  208.913653][    C1] rcu: 	(t=10502 jiffies g=6917 q=11955 ncpus=2)
[  208.916129][    C1] CPU: 1 UID: 0 PID: 5921 Comm: syz.0.11 Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0 PREEMPT(full) 
[  208.916146][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  208.916156][    C1] RIP: 0010:rcu_read_unlock_special+0x87/0x4c0
[  208.916185][    C1] Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 62 2c f8 10 41 f7 c6 00 00 f0 00 74 49 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
[  208.916197][    C1] RSP: 0018:ffffc900001e0560 EFLAGS: 00000206
[  208.916210][    C1] RAX: a99392ee51692800 RBX: 1ffff9200003c0b4 RCX: a99392ee51692800
[  208.916220][    C1] RDX: 0000000000000003 RSI: ffffffff8d99883e RDI: ffffffff8be29f40
[  208.916229][    C1] RBP: ffffc900001e0658 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  208.916239][    C1] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: ffffffff8e144400
[  208.916249][    C1] R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000002
[  208.916257][    C1] FS:  00007ff03f8056c0(0000) GS:ffff8881a3c1f000(0000) knlGS:0000000000000000
[  208.916268][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  208.916277][    C1] CR2: 0000000000000004 CR3: 000000012167e000 CR4: 00000000000006f0
[  208.916306][    C1] Call Trace:
[  208.916316][    C1]  <IRQ>
[  208.916321][    C1]  ? __lock_acquire+0xab9/0xd20
[  208.916345][    C1]  ? __pfx_rcu_read_unlock_special+0x10/0x10
[  208.916377][    C1]  ? unwind_next_frame+0xa5/0x2390
[  208.916400][    C1]  __rcu_read_unlock+0x84/0xe0
[  208.916422][    C1]  ? unwind_next_frame+0xa5/0x2390
[  208.916435][    C1]  unwind_next_frame+0x19ae/0x2390
[  208.916457][    C1]  ? unwind_next_frame+0xa5/0x2390
[  208.916473][    C1]  ? get_signal+0x11ed/0x1340
[  208.916492][    C1]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  208.916511][    C1]  arch_stack_walk+0x11c/0x150
[  208.916533][    C1]  ? arch_do_signal_or_restart+0x9a/0x750
[  208.916559][    C1]  stack_trace_save+0x9c/0xe0
[  208.916577][    C1]  ? __pfx_stack_trace_save+0x10/0x10
[  208.916596][    C1]  ? __irq_exit_rcu+0xd8/0x1f0
[  208.916611][    C1]  ? __pfx___irq_exit_rcu+0x10/0x10
[  208.916630][    C1]  kasan_save_track+0x3e/0x80
[  208.916642][    C1]  ? kasan_save_track+0x3e/0x80
[  208.916653][    C1]  ? kasan_save_free_info+0x46/0x50
[  208.916669][    C1]  ? __kasan_slab_free+0x62/0x70
[  208.916681][    C1]  ? kfree+0x18e/0x440
[  208.916691][    C1]  ? ip6_dst_destroy+0x9b/0x3b0
[  208.916707][    C1]  ? dst_destroy+0xd7/0x350
[  208.916723][    C1]  ? rcu_core+0xca8/0x1710
[  208.916735][    C1]  ? handle_softirqs+0x286/0x870
[  208.916748][    C1]  ? __irq_exit_rcu+0xca/0x1f0
[  208.916761][    C1]  ? irq_exit_rcu+0x9/0x30
[  208.916773][    C1]  ? sysvec_apic_timer_interrupt+0xa6/0xc0
[  208.916790][    C1]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  208.916803][    C1]  ? preempt_schedule_irq+0xb0/0x150
[  208.916819][    C1]  ? irqentry_exit+0x6f/0x90
[  208.916834][    C1]  ? asm_sysvec_call_function_single+0x1a/0x20
[  208.916847][    C1]  ? mac80211_hwsim_netlink_notify+0x5ef/0x8b0
[  208.916862][    C1]  ? notifier_call_chain+0x1b6/0x3e0
[  208.916882][    C1]  ? blocking_notifier_call_chain+0x6a/0x90
[  208.916897][    C1]  ? netlink_release+0x1259/0x1b10
[  208.916910][    C1]  ? sock_close+0xc3/0x240
[  208.916925][    C1]  ? __fput+0x44c/0xa70
[  208.916940][    C1]  ? task_work_run+0x1d4/0x260
[  208.916992][    C1]  ? get_signal+0x11ed/0x1340
[  208.917044][    C1]  kasan_save_free_info+0x46/0x50
[  208.917061][    C1]  __kasan_slab_free+0x62/0x70
[  208.917074][    C1]  ? ip6_dst_destroy+0x9b/0x3b0
[  208.917089][    C1]  kfree+0x18e/0x440
[  208.917100][    C1]  ? rcu_core+0xc34/0x1710
[  208.917114][    C1]  ? __pfx_dst_destroy_rcu+0x10/0x10
[  208.917132][    C1]  ip6_dst_destroy+0x9b/0x3b0
[  208.917148][    C1]  ? dst_destroy+0xcb/0x350
[  208.917163][    C1]  ? __pfx_dst_destroy_rcu+0x10/0x10
[  208.917180][    C1]  ? __pfx_ip6_dst_destroy+0x10/0x10
[  208.917195][    C1]  dst_destroy+0xd7/0x350
[  208.917213][    C1]  ? __pfx_dst_destroy_rcu+0x10/0x10
[  208.917228][    C1]  ? rcu_core+0xc34/0x1710
[  208.917242][    C1]  rcu_core+0xca8/0x1710
[  208.917275][    C1]  ? __pfx_rcu_core+0x10/0x10
[  208.917288][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  208.917321][    C1]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  208.917339][    C1]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  208.917359][    C1]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  208.917387][    C1]  handle_softirqs+0x286/0x870
[  208.917406][    C1]  ? __irq_exit_rcu+0xca/0x1f0
[  208.917427][    C1]  ? __pfx_handle_softirqs+0x10/0x10
[  208.917448][    C1]  ? irqtime_account_irq+0xb6/0x1c0
[  208.917471][    C1]  __irq_exit_rcu+0xca/0x1f0
[  208.917486][    C1]  ? __pfx___irq_exit_rcu+0x10/0x10
[  208.917511][    C1]  irq_exit_rcu+0x9/0x30
[  208.917524][    C1]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  208.917541][    C1]  </IRQ>
[  208.917546][    C1]  <TASK>
[  208.917552][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  208.917566][    C1] RIP: 0010:preempt_schedule_irq+0xb0/0x150
[  208.917583][    C1] Code: 24 20 f6 44 24 21 02 74 0c 90 0f 0b 48 f7 03 08 00 00 00 74 64 bf 01 00 00 00 e8 8b 2d 21 f6 e8 c6 00 58 f6 fb bf 01 00 00 00 <e8> 1b ab ff ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24
[  208.917593][    C1] RSP: 0018:ffffc900039af6a0 EFLAGS: 00000286
[  208.917605][    C1] RAX: a99392ee51692800 RBX: ffff88801f0c5640 RCX: a99392ee51692800
[  208.917614][    C1] RDX: 0000000000000007 RSI: ffffffff8d99883e RDI: 0000000000000001
[  208.917622][    C1] RBP: ffffc900039af740 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  208.917632][    C1] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: 0000000000000000
[  208.917641][    C1] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000735ed4
[  208.917668][    C1]  ? __pfx_preempt_schedule_irq+0x10/0x10
[  208.917694][    C1]  ? rcu_irq_exit_check_preempt+0xdf/0x210
[  208.917711][    C1]  irqentry_exit+0x6f/0x90
[  208.917727][    C1]  asm_sysvec_call_function_single+0x1a/0x20
[  208.917741][    C1] RIP: 0010:mac80211_hwsim_netlink_notify+0x5ef/0x8b0
[  208.917756][    C1] Code: 85 7c 02 00 00 45 8b 74 24 08 4d 89 e7 49 c1 ef 03 41 80 3c 1f 00 74 08 4c 89 e7 e8 2b 31 30 fb 49 8b 3c 24 8b 35 d1 14 ef 12 <e8> 3c b1 ff ff 48 83 c0 04 48 89 c1 48 c1 e9 03 48 ba 00 00 00 00
[  208.917767][    C1] RSP: 0018:ffffc900039af800 EFLAGS: 00000246
[  208.917777][    C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000080000
[  208.917785][    C1] RDX: ffffc90003fb1000 RSI: 0000000000000015 RDI: ffff88810da08000
[  208.917794][    C1] RBP: ffffc900039af8d8 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  208.917804][    C1] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: ffffc900039afa60
[  208.917813][    C1] R13: ffff88810cceb0a0 R14: 0000000000000007 R15: 1ffff92000735f4c
[  208.917847][    C1]  ? __pfx_mac80211_hwsim_netlink_notify+0x10/0x10
[  208.917867][    C1]  ? __pfx_skb_queue_purge_reason+0x10/0x10
[  208.917892][    C1]  notifier_call_chain+0x1b6/0x3e0
[  208.917916][    C1]  blocking_notifier_call_chain+0x6a/0x90
[  208.917936][    C1]  netlink_release+0x1259/0x1b10
[  208.917980][    C1]  ? netlink_release+0x108/0x1b10
[  208.917999][    C1]  ? __pfx_netlink_release+0x10/0x10
[  208.918013][    C1]  ? down_write+0x162/0x1f0
[  208.918032][    C1]  ? __pfx_down_write+0x10/0x10
[  208.918058][    C1]  ? __pfx_sock_close+0x10/0x10
[  208.918078][    C1]  sock_close+0xc3/0x240
[  208.918097][    C1]  ? __pfx_sock_close+0x10/0x10
[  208.918114][    C1]  __fput+0x44c/0xa70
[  208.918143][    C1]  task_work_run+0x1d4/0x260
[  208.918166][    C1]  ? __pfx_task_work_run+0x10/0x10
[  208.918186][    C1]  ? __pfx_trace_call_bpf+0x10/0x10
[  208.918210][    C1]  get_signal+0x11ed/0x1340
[  208.918223][    C1]  ? perf_trace_run_bpf_submit+0xee/0x170
[  208.918247][    C1]  ? perf_trace_preemptirq_template+0x280/0x340
[  208.918268][    C1]  ? irqentry_enter+0x3d/0x60
[  208.918294][    C1]  arch_do_signal_or_restart+0x9a/0x750
[  208.918321][    C1]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  208.918340][    C1]  ? irqentry_exit+0x74/0x90
[  208.918382][    C1]  exit_to_user_mode_loop+0x75/0x110
[  208.918398][    C1]  do_syscall_64+0x2bd/0x3b0
[  208.918418][    C1]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  208.918431][    C1]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  208.918449][    C1]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  208.918462][    C1] RIP: 0033:0x7ff03e98e9a9
[  208.918476][    C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  208.918486][    C1] RSP: 002b:00007ff03f805038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  208.918500][    C1] RAX: 000000000000005c RBX: 00007ff03ebb5fa0 RCX: 00007ff03e98e9a9
[  208.918508][    C1] RDX: 0000000020000004 RSI: 0000200000000280 RDI: 0000000000000008
[  208.918517][    C1] RBP: 00007ff03ea10d69 R08: 0000000000000000 R09: 0000000000000000
[  208.918525][    C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  208.918532][    C1] R13: 0000000000000000 R14: 00007ff03ebb5fa0 R15: 00007ffe91b9e1d8
[  208.918557][    C1]  </TASK>
[  209.247959][    C1] sched: DL replenish lagged too much
[  213.738130][   T34] INFO: task syz.0.11:5920 blocked for more than 143 seconds.
[  213.741385][   T34]       Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0
[  213.744746][   T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  213.772653][   T34] task:syz.0.11        state:D stack:25096 pid:5920  tgid:5920  ppid:5834   task_flags:0x400040 flags:0x00004004
[  213.779638][   T34] Call Trace:
[  213.781071][   T34]  <TASK>
[  213.782317][   T34]  __schedule+0x16f5/0x4d00
[  213.785281][   T34]  ? __lock_acquire+0xab9/0xd20
[  213.787344][   T34]  ? schedule+0x165/0x360
[  213.792254][   T34]  ? __pfx___schedule+0x10/0x10
[  213.794346][   T34]  ? schedule+0x91/0x360
[  213.796143][   T34]  schedule+0x165/0x360
[  213.800343][   T34]  schedule_preempt_disabled+0x13/0x30
[  213.802634][   T34]  __mutex_lock+0x724/0xe80
[  213.804549][   T34]  ? __mutex_lock+0x51b/0xe80
[  213.806531][   T34]  ? perf_trace_destroy+0x2e/0x150
[  213.811726][   T34]  ? __pfx___mutex_lock+0x10/0x10
[  213.813892][   T34]  ? security_perf_event_free+0x40/0x70
[  213.816210][   T34]  ? rcu_is_watching+0x15/0xb0
[  213.820006][   T34]  ? rcu_is_watching+0x15/0xb0
[  213.821616][   T34]  ? __pfx_tp_perf_event_destroy+0x10/0x10
[  213.823515][   T34]  perf_trace_destroy+0x2e/0x150
[  213.825077][   T34]  ? __pfx_tp_perf_event_destroy+0x10/0x10
[  213.826867][   T34]  __free_event+0x316/0x7b0
[  213.830301][   T34]  ? __pfx_perf_release+0x10/0x10
[  213.832141][   T34]  perf_event_release_kernel+0x45b/0x510
[  213.834205][   T34]  ? __pfx_perf_release+0x10/0x10
[  213.835787][   T34]  perf_release+0x38/0x50
[  213.837138][   T34]  __fput+0x44c/0xa70
[  213.839930][   T34]  task_work_run+0x1d4/0x260
[  213.841387][   T34]  ? __pfx_task_work_run+0x10/0x10
[  213.842976][   T34]  ? exit_to_user_mode_loop+0x40/0x110
[  213.844736][   T34]  exit_to_user_mode_loop+0xec/0x110
[  213.846640][   T34]  do_syscall_64+0x2bd/0x3b0
[  213.850237][   T34]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  213.852393][   T34]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  213.854541][   T34]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  213.856296][   T34] RIP: 0033:0x7ff03e98e9a9
[  213.859278][   T34] RSP: 002b:00007ffe91b9e338 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[  213.861834][   T34] RAX: 0000000000000000 RBX: 00007ff03ebb7ba0 RCX: 00007ff03e98e9a9
[  213.864345][   T34] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[  213.866768][   T34] RBP: 00007ff03ebb7ba0 R08: 0000000000000144 R09: 0000001291b9e62f
[  213.871130][   T34] R10: 00007ff03ebb7ac0 R11: 0000000000000246 R12: 000000000000ec8a
[  213.873578][   T34] R13: 00007ff03ebb6240 R14: ffffffffffffffff R15: 00007ffe91b9e450
[  213.876011][   T34]  </TASK>
[  213.877013][   T34] 
[  213.877013][   T34] Showing all locks held in the system:
[  213.883194][   T34] 3 locks held by kworker/u9:0/26:
[  213.884792][   T34]  #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  213.891572][   T34]  #1: ffffc900001efbc0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  213.895330][   T34]  #2: ffff888108d08768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xc4/0x460
[  213.899828][   T34] 1 lock held by khungtaskd/34:
[  213.901789][   T34]  #0: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
[  213.905368][   T34] 3 locks held by kworker/1:1/47:
[  213.906984][   T34] 6 locks held by kworker/u11:0/54:
[  213.911342][   T34]  #0: ffff8881132ad148 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  213.914757][   T34]  #1: ffffc900007cfbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  213.919947][   T34]  #2: ffff888106c94dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d4/0x3a0
[  213.922977][   T34]  #3: ffff888106c940b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x1eb/0xdf0
[  213.925917][   T34]  #4: ffffffff8f684f48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x310
[  213.931411][   T34]  #5: ffff888022066338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680
[  213.934327][   T34] 3 locks held by kworker/u9:2/215:
[  213.935937][   T34]  #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  213.940950][   T34]  #1: ffffc9000268fbc0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  213.944714][   T34]  #2: ffff888113580768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xc4/0x460
[  213.950319][   T34] 3 locks held by kworker/1:2/792:
[  213.952432][   T34] 3 locks held by kworker/u9:4/1089:
[  213.954504][   T34]  #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  213.960216][   T34]  #1: ffffc90007087bc0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  213.963957][   T34]  #2: ffff888108dc8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xc4/0x460
[  213.967006][   T34] 3 locks held by kworker/u9:8/1103:
[  213.971322][   T34]  #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  213.974925][   T34]  #1: ffffc90007127bc0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  213.980502][   T34]  #2: ffff88810cce8768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xc4/0x460
[  213.983837][   T34] 3 locks held by kworker/u9:9/1130:
[  213.985415][   T34]  #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  213.994523][   T34]  #1: ffffc900072e7bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  213.999330][   T34]  #2: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60
[  214.002094][   T34] 5 locks held by kworker/u11:1/5222:
[  214.003809][   T34]  #0: ffff888031d68948 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  214.007063][   T34]  #1: ffffc90009367bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  214.013335][   T34]  #2: ffff8881126bcdc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d4/0x3a0
[  214.016510][   T34]  #3: ffff8881126bc0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x1eb/0xdf0
[  214.020951][   T34]  #4: ffffffff8f684f48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x310
[  214.024078][   T34] 2 locks held by getty/5662:
[  214.025587][   T34]  #0: ffff888108fe10a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
[  214.031531][   T34]  #1: ffffc900029032f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400
[  214.034681][   T34] 4 locks held by kworker/u11:2/5832:
[  214.036357][   T34]  #0: ffff888049356948 ((wq_completion)hci11#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  214.043004][   T34]  #1: ffffc900033dfbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  214.046742][   T34]  #2: ffff888041d4c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x8e0
[  214.052006][   T34]  #3: ffffffff8f684f48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x516/0x8e0
[  214.055197][   T34] 5 locks held by kworker/u11:3/5835:
[  214.056982][   T34]  #0: ffff888039466948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  214.066082][   T34]  #1: ffffc9000353fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  214.071492][   T34]  #2: ffff8881126b8dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d4/0x3a0
[  214.074594][   T34]  #3: ffff8881126b80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x1eb/0xdf0
[  214.078964][   T34]  #4: ffffffff8f684f48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x310
[  214.082019][   T34] 4 locks held by kworker/u11:4/5838:
[  214.083715][   T34]  #0: ffff8880492e8948 ((wq_completion)hci10#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  214.087100][   T34]  #1: ffffc9000356fbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  214.093247][   T34]  #2: ffff888041e340b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x8e0
[  214.096332][   T34]  #3: ffffffff8f684f48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x516/0x8e0
[  214.103177][   T34] 4 locks held by kworker/u11:5/5840:
[  214.104895][   T34]  #0: ffff8880492ed148 ((wq_completion)hci9#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  214.109919][   T34]  #1: ffffc9000351fbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  214.113620][   T34]  #2: ffff88803ff640b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x8e0
[  214.116625][   T34]  #3: ffffffff8f684f48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x516/0x8e0
[  214.121314][   T34] 3 locks held by kworker/u8:4/5864:
[  214.122940][   T34]  #0: ffff888108a3d148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  214.126499][   T34]  #1: ffffc9000372fbc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  214.132613][   T34]  #2: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30
[  214.135478][   T34] 2 locks held by kworker/0:3/5871:
[  214.137041][   T34]  #0: ffff88801a482148 ((wq_completion)events_freezable_pwr_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  214.142300][   T34]  #1: ffffc9000381fbc0 ((work_completion)(&(&ev->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  214.146323][   T34] 3 locks held by kworker/1:4/5885:
[  214.149655][   T34] 1 lock held by syz.2.9/5916:
[  214.151136][   T34]  #0: ffffffff8e1a2ca8 (event_mutex){+.+.}-{4:4}, at: perf_trace_destroy+0x2e/0x150
[  214.154142][   T34] 2 locks held by syz.1.10/5918:
[  214.155677][   T34]  #0: ffffffff8e1a2ca8 (event_mutex){+.+.}-{4:4}, at: perf_trace_destroy+0x2e/0x150
[  214.159997][   T34]  #1: ffffffff8e144bf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730
[  214.163282][   T34] 1 lock held by syz.0.11/5920:
[  214.164903][   T34]  #0: ffffffff8e1a2ca8 (event_mutex){+.+.}-{4:4}, at: perf_trace_destroy+0x2e/0x150
[  214.170774][   T34] 3 locks held by syz.0.11/5921:
[  214.172749][   T34] 3 locks held by syz-executor/5929:
[  214.174508][   T34]  #0: ffffffff8eca43a0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250
[  214.177414][   T34]  #1: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70
[  214.181641][   T34]  #2: ffffffff8e144bf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730
[  214.185048][   T34] 2 locks held by syz-executor/5934:
[  214.186962][   T34]  #0: ffffffff8ecb14c0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250
[  214.192336][   T34]  #1: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70
[  214.195767][   T34] 1 lock held by syz-executor/5936:
[  214.197361][   T34]  #0: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70
[  214.202806][   T34] 1 lock held by dhcpcd/5940:
[  214.204338][   T34]  #0: ffff8881143bee08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240
[  214.207397][   T34] 1 lock held by dhcpcd/5941:
[  214.213803][   T34]  #0: ffff8881143bdc08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240
[  214.216898][   T34] 1 lock held by dhcpcd/5942:
[  214.219941][   T34]  #0: ffff8881143bb208 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240
[  214.223006][   T34] 1 lock held by dhcpcd/5943:
[  214.224488][   T34]  #0: ffff8881143ba008 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240
[  214.230482][   T34] 1 lock held by dhcpcd/5944:
[  214.232017][   T34]  #0: ffff8881143b8e08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240
[  214.235062][   T34] 1 lock held by dhcpcd/5945:
[  214.236499][   T34]  #0: ffff888122847a08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240
[  214.241158][   T34] 1 lock held by syz-executor/5960:
[  214.242772][   T34]  #0: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0
[  214.245668][   T34] 1 lock held by syz-executor/5961:
[  214.247274][   T34]  #0: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0
[  214.253301][   T34] 1 lock held by syz-executor/5966:
[  214.254912][   T34]  #0: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0
[  214.259197][   T34] 1 lock held by syz-executor/5973:
[  214.260889][   T34]  #0: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0
[  214.264075][   T34] 1 lock held by syz-executor/5975:
[  214.265648][   T34]  #0: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0
[  214.271005][   T34] 1 lock held by syz-executor/5979:
[  214.272606][   T34]  #0: ffffffff8f51cdc8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0
[  214.275385][   T34] 5 locks held by kworker/u11:6/5982:
[  214.276995][   T34]  #0: ffff888031bc0148 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  214.281789][   T34]  #1: ffffc900044cfbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  214.285620][   T34]  #2: ffff8881075d0dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d4/0x3a0
[  214.290340][   T34]  #3: ffff8881075d00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x1eb/0xdf0
[  214.293308][   T34]  #4: ffffffff8f684f48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x310
[  214.297126][   T34] 
[  214.299376][   T34] =============================================
[  214.299376][   T34] 
[  214.301921][   T34] NMI backtrace for cpu 0
[  214.301930][   T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0 PREEMPT(full) 
[  214.301940][   T34] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  214.301945][   T34] Call Trace:
[  214.301949][   T34]  <TASK>
[  214.301954][   T34]  dump_stack_lvl+0x189/0x250
[  214.301969][   T34]  ? __pfx_dump_stack_lvl+0x10/0x10
[  214.301978][   T34]  ? __pfx__printk+0x10/0x10
[  214.302001][   T34]  nmi_cpu_backtrace+0x39e/0x3d0
[  214.302013][   T34]  ? __pfx_nmi_cpu_backtrace+0x10/0x10
[  214.302021][   T34]  ? _printk+0xcf/0x120
[  214.302032][   T34]  ? __pfx__printk+0x10/0x10
[  214.302042][   T34]  ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10
[  214.302052][   T34]  nmi_trigger_cpumask_backtrace+0x17a/0x300
[  214.302061][   T34]  watchdog+0xfee/0x1030
[  214.302071][   T34]  ? watchdog+0x1de/0x1030
[  214.302081][   T34]  kthread+0x711/0x8a0
[  214.302094][   T34]  ? __pfx_watchdog+0x10/0x10
[  214.302101][   T34]  ? __pfx_kthread+0x10/0x10
[  214.302111][   T34]  ? _raw_spin_unlock_irq+0x23/0x50
[  214.302122][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  214.302132][   T34]  ? __pfx_kthread+0x10/0x10
[  214.302142][   T34]  ret_from_fork+0x3fc/0x770
[  214.302152][   T34]  ? __pfx_ret_from_fork+0x10/0x10
[  214.302162][   T34]  ? __switch_to_asm+0x39/0x70
[  214.302172][   T34]  ? __switch_to_asm+0x33/0x70
[  214.302181][   T34]  ? __pfx_kthread+0x10/0x10
[  214.302191][   T34]  ret_from_fork_asm+0x1a/0x30
[  214.302207][   T34]  </TASK>
[  214.302211][   T34] Sending NMI from CPU 0 to CPUs 1:
[  214.349278][    C1] NMI backtrace for cpu 1
[  214.349293][    C1] CPU: 1 UID: 0 PID: 5921 Comm: syz.0.11 Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0 PREEMPT(full) 
[  214.349304][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  214.349310][    C1] RIP: 0010:native_apic_msr_eoi+0xf/0x20
[  214.349327][    C1] Code: f8 c3 cc cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa b9 0b 08 00 00 31 c0 31 d2 0f 30 <e9> 8c 14 00 0a cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
[  214.349334][    C1] RSP: 0018:ffffc900001e04c0 EFLAGS: 00000046
[  214.349342][    C1] RAX: 0000000000000000 RBX: ffffc900001e04f8 RCX: 000000000000080b
[  214.349347][    C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[  214.349352][    C1] RBP: 0000000000000000 R08: ffff888136623b0f R09: 1ffff11026cc4761
[  214.349357][    C1] R10: dffffc0000000000 R11: ffffed1026cc4762 R12: 0000000000000000
[  214.349361][    C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  214.349365][    C1] FS:  00007ff03f8056c0(0000) GS:ffff8881a3c1f000(0000) knlGS:0000000000000000
[  214.349372][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  214.349376][    C1] CR2: 0000000000000004 CR3: 000000012167e000 CR4: 00000000000006f0
[  214.349398][    C1] Call Trace:
[  214.349404][    C1]  <IRQ>
[  214.349407][    C1]  __sysvec_irq_work+0x11/0x3d0
[  214.349418][    C1]  sysvec_irq_work+0x4f/0xc0
[  214.349456][    C1]  asm_sysvec_irq_work+0x1a/0x20
[  214.349466][    C1] RIP: 0010:rcu_read_unlock_special+0x87/0x4c0
[  214.349479][    C1] Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 62 2c f8 10 41 f7 c6 00 00 f0 00 74 49 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
[  214.349486][    C1] RSP: 0018:ffffc900001e05a0 EFLAGS: 00000206
[  214.349492][    C1] RAX: a99392ee51692800 RBX: 1ffff9200003c0bc RCX: a99392ee51692800
[  214.349498][    C1] RDX: 0000000000000003 RSI: ffffffff8d99883e RDI: ffffffff8be29f40
[  214.349502][    C1] RBP: ffffc900001e0690 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  214.349507][    C1] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: ffffffff8e144400
[  214.349512][    C1] R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000002
[  214.349523][    C1]  ? __pfx_rcu_read_unlock_special+0x10/0x10
[  214.349533][    C1]  ? is_bpf_text_address+0x26/0x2b0
[  214.349544][    C1]  __rcu_read_unlock+0x84/0xe0
[  214.349554][    C1]  is_bpf_text_address+0x292/0x2b0
[  214.349562][    C1]  ? is_bpf_text_address+0x26/0x2b0
[  214.349570][    C1]  kernel_text_address+0xa5/0xe0
[  214.349578][    C1]  __kernel_text_address+0xd/0x40
[  214.349584][    C1]  unwind_get_return_address+0x4d/0x90
[  214.349593][    C1]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  214.349603][    C1]  arch_stack_walk+0xfc/0x150
[  214.349615][    C1]  stack_trace_save+0x9c/0xe0
[  214.349624][    C1]  ? __pfx_stack_trace_save+0x10/0x10
[  214.349633][    C1]  ? __irq_exit_rcu+0xd8/0x1f0
[  214.349642][    C1]  ? __pfx___irq_exit_rcu+0x10/0x10
[  214.349651][    C1]  kasan_save_track+0x3e/0x80
[  214.349658][    C1]  ? kasan_save_track+0x3e/0x80
[  214.349664][    C1]  ? kasan_save_free_info+0x46/0x50
[  214.349673][    C1]  ? __kasan_slab_free+0x62/0x70
[  214.349679][    C1]  ? kfree+0x18e/0x440
[  214.349685][    C1]  ? ip6_dst_destroy+0x9b/0x3b0
[  214.349695][    C1]  ? dst_destroy+0xd7/0x350
[  214.349704][    C1]  ? rcu_core+0xca8/0x1710
[  214.349711][    C1]  ? handle_softirqs+0x286/0x870
[  214.349718][    C1]  ? __irq_exit_rcu+0xca/0x1f0
[  214.349725][    C1]  ? irq_exit_rcu+0x9/0x30
[  214.349732][    C1]  ? sysvec_apic_timer_interrupt+0xa6/0xc0
[  214.349740][    C1]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  214.349748][    C1]  ? preempt_schedule_irq+0xb0/0x150
[  214.349757][    C1]  ? irqentry_exit+0x6f/0x90
[  214.349765][    C1]  ? asm_sysvec_call_function_single+0x1a/0x20
[  214.349772][    C1]  ? mac80211_hwsim_netlink_notify+0x5ef/0x8b0
[  214.349781][    C1]  ? notifier_call_chain+0x1b6/0x3e0
[  214.349789][    C1]  ? blocking_notifier_call_chain+0x6a/0x90
[  214.349797][    C1]  ? netlink_release+0x1259/0x1b10
[  214.349805][    C1]  ? sock_close+0xc3/0x240
[  214.349815][    C1]  ? __fput+0x44c/0xa70
[  214.349824][    C1]  ? task_work_run+0x1d4/0x260
[  214.349835][    C1]  ? get_signal+0x11ed/0x1340
[  214.349843][    C1]  ? arch_do_signal_or_restart+0x9a/0x750
[  214.349853][    C1]  ? exit_to_user_mode_loop+0x75/0x110
[  214.349861][    C1]  ? do_syscall_64+0x2bd/0x3b0
[  214.349877][    C1]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  214.349891][    C1]  kasan_save_free_info+0x46/0x50
[  214.349900][    C1]  __kasan_slab_free+0x62/0x70
[  214.349907][    C1]  ? ip6_dst_destroy+0x9b/0x3b0
[  214.349915][    C1]  kfree+0x18e/0x440
[  214.349921][    C1]  ? rcu_core+0xc34/0x1710
[  214.349928][    C1]  ? __pfx_dst_destroy_rcu+0x10/0x10
[  214.349937][    C1]  ip6_dst_destroy+0x9b/0x3b0
[  214.349945][    C1]  ? dst_destroy+0xcb/0x350
[  214.349953][    C1]  ? __pfx_dst_destroy_rcu+0x10/0x10
[  214.349962][    C1]  ? __pfx_ip6_dst_destroy+0x10/0x10
[  214.349970][    C1]  dst_destroy+0xd7/0x350
[  214.349978][    C1]  ? __pfx_dst_destroy_rcu+0x10/0x10
[  214.349986][    C1]  ? rcu_core+0xc34/0x1710
[  214.349993][    C1]  rcu_core+0xca8/0x1710
[  214.350004][    C1]  ? __pfx_rcu_core+0x10/0x10
[  214.350011][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  214.350023][    C1]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  214.350033][    C1]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  214.350041][    C1]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  214.350052][    C1]  handle_softirqs+0x286/0x870
[  214.350061][    C1]  ? __irq_exit_rcu+0xca/0x1f0
[  214.350070][    C1]  ? __pfx_handle_softirqs+0x10/0x10
[  214.350078][    C1]  ? irqtime_account_irq+0xb6/0x1c0
[  214.350090][    C1]  __irq_exit_rcu+0xca/0x1f0
[  214.350097][    C1]  ? __pfx___irq_exit_rcu+0x10/0x10
[  214.350107][    C1]  irq_exit_rcu+0x9/0x30
[  214.350113][    C1]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  214.350123][    C1]  </IRQ>
[  214.350125][    C1]  <TASK>
[  214.350128][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  214.350135][    C1] RIP: 0010:preempt_schedule_irq+0xb0/0x150
[  214.350144][    C1] Code: 24 20 f6 44 24 21 02 74 0c 90 0f 0b 48 f7 03 08 00 00 00 74 64 bf 01 00 00 00 e8 8b 2d 21 f6 e8 c6 00 58 f6 fb bf 01 00 00 00 <e8> 1b ab ff ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24
[  214.350150][    C1] RSP: 0018:ffffc900039af6a0 EFLAGS: 00000286
[  214.350156][    C1] RAX: a99392ee51692800 RBX: ffff88801f0c5640 RCX: a99392ee51692800
[  214.350161][    C1] RDX: 0000000000000007 RSI: ffffffff8d99883e RDI: 0000000000000001
[  214.350166][    C1] RBP: ffffc900039af740 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  214.350171][    C1] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: 0000000000000000
[  214.350175][    C1] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000735ed4
[  214.350184][    C1]  ? __pfx_preempt_schedule_irq+0x10/0x10
[  214.350195][    C1]  ? rcu_irq_exit_check_preempt+0xdf/0x210
[  214.350203][    C1]  irqentry_exit+0x6f/0x90
[  214.350212][    C1]  asm_sysvec_call_function_single+0x1a/0x20
[  214.350219][    C1] RIP: 0010:mac80211_hwsim_netlink_notify+0x5ef/0x8b0
[  214.350228][    C1] Code: 85 7c 02 00 00 45 8b 74 24 08 4d 89 e7 49 c1 ef 03 41 80 3c 1f 00 74 08 4c 89 e7 e8 2b 31 30 fb 49 8b 3c 24 8b 35 d1 14 ef 12 <e8> 3c b1 ff ff 48 83 c0 04 48 89 c1 48 c1 e9 03 48 ba 00 00 00 00
[  214.350234][    C1] RSP: 0018:ffffc900039af800 EFLAGS: 00000246
[  214.350239][    C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000080000
[  214.350244][    C1] RDX: ffffc90003fb1000 RSI: 0000000000000015 RDI: ffff88810da08000
[  214.350248][    C1] RBP: ffffc900039af8d8 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  214.350254][    C1] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: ffffc900039afa60
[  214.350259][    C1] R13: ffff88810cceb0a0 R14: 0000000000000007 R15: 1ffff92000735f4c
[  214.350269][    C1]  ? __pfx_mac80211_hwsim_netlink_notify+0x10/0x10
[  214.350278][    C1]  ? __pfx_skb_queue_purge_reason+0x10/0x10
[  214.350291][    C1]  notifier_call_chain+0x1b6/0x3e0
[  214.350301][    C1]  blocking_notifier_call_chain+0x6a/0x90
[  214.350310][    C1]  netlink_release+0x1259/0x1b10
[  214.350319][    C1]  ? netlink_release+0x108/0x1b10
[  214.350327][    C1]  ? __pfx_netlink_release+0x10/0x10
[  214.350334][    C1]  ? down_write+0x162/0x1f0
[  214.350345][    C1]  ? __pfx_down_write+0x10/0x10
[  214.350355][    C1]  ? __pfx_sock_close+0x10/0x10
[  214.350365][    C1]  sock_close+0xc3/0x240
[  214.350374][    C1]  ? __pfx_sock_close+0x10/0x10
[  214.350382][    C1]  __fput+0x44c/0xa70
[  214.350393][    C1]  task_work_run+0x1d4/0x260
[  214.350404][    C1]  ? __pfx_task_work_run+0x10/0x10
[  214.350414][    C1]  ? __pfx_trace_call_bpf+0x10/0x10
[  214.350442][    C1]  get_signal+0x11ed/0x1340
[  214.350450][    C1]  ? perf_trace_run_bpf_submit+0xee/0x170
[  214.350461][    C1]  ? perf_trace_preemptirq_template+0x280/0x340
[  214.350472][    C1]  ? irqentry_enter+0x3d/0x60
[  214.350482][    C1]  arch_do_signal_or_restart+0x9a/0x750
[  214.350495][    C1]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  214.350505][    C1]  ? irqentry_exit+0x74/0x90
[  214.350518][    C1]  exit_to_user_mode_loop+0x75/0x110
[  214.350525][    C1]  do_syscall_64+0x2bd/0x3b0
[  214.350535][    C1]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  214.350541][    C1]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  214.350550][    C1]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  214.350557][    C1] RIP: 0033:0x7ff03e98e9a9
[  214.350564][    C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  214.350570][    C1] RSP: 002b:00007ff03f805038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  214.350577][    C1] RAX: 000000000000005c RBX: 00007ff03ebb5fa0 RCX: 00007ff03e98e9a9
[  214.350582][    C1] RDX: 0000000020000004 RSI: 0000200000000280 RDI: 0000000000000008
[  214.350586][    C1] RBP: 00007ff03ea10d69 R08: 0000000000000000 R09: 0000000000000000
[  214.350590][    C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  214.350594][    C1] R13: 0000000000000000 R14: 00007ff03ebb5fa0 R15: 00007ffe91b9e1d8
[  214.350602][    C1]  </TASK>
[  214.657578][   T34] Kernel panic - not syncing: hung_task: blocked tasks
[  214.659672][   T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0 PREEMPT(full) 
[  214.663236][   T34] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  214.666289][   T34] Call Trace:
[  214.667298][   T34]  <TASK>
[  214.668204][   T34]  dump_stack_lvl+0x99/0x250
[  214.669611][   T34]  ? __asan_memcpy+0x40/0x70
[  214.671006][   T34]  ? __pfx_dump_stack_lvl+0x10/0x10
[  214.672558][   T34]  ? __pfx__printk+0x10/0x10
[  214.673963][   T34]  panic+0x2db/0x790
[  214.675145][   T34]  ? __pfx_panic+0x10/0x10
[  214.676498][   T34]  ? nmi_backtrace_stall_check+0x433/0x440
[  214.678237][   T34]  ? preempt_schedule_thunk+0x16/0x30
[  214.679892][   T34]  ? nmi_trigger_cpumask_backtrace+0x2b6/0x300
[  214.681731][   T34]  watchdog+0x102d/0x1030
[  214.683023][   T34]  ? watchdog+0x1de/0x1030
[  214.684418][   T34]  kthread+0x711/0x8a0
[  214.685646][   T34]  ? __pfx_watchdog+0x10/0x10
[  214.687070][   T34]  ? __pfx_kthread+0x10/0x10
[  214.688456][   T34]  ? _raw_spin_unlock_irq+0x23/0x50
[  214.690027][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  214.691639][   T34]  ? __pfx_kthread+0x10/0x10
[  214.693039][   T34]  ret_from_fork+0x3fc/0x770
[  214.694437][   T34]  ? __pfx_ret_from_fork+0x10/0x10
[  214.696117][   T34]  ? __switch_to_asm+0x39/0x70
[  214.697683][   T34]  ? __switch_to_asm+0x33/0x70
[  214.699325][   T34]  ? __pfx_kthread+0x10/0x10
[  214.700800][   T34]  ret_from_fork_asm+0x1a/0x30
[  214.702246][   T34]  </TASK>
[  214.703809][   T34] Kernel Offset: disabled
[  214.705098][   T34] Rebooting in 86400 seconds..

VM DIAGNOSIS:
11:42:10  Registers:
info registers vcpu 0

CPU#0
RAX=888cc4ea9d06eb00 RBX=ffffffff81976a48 RCX=888cc4ea9d06eb00 RDX=0000000000000001
RSI=ffffffff8d99883e RDI=ffffffff8be29f40 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4
R12=ffffffff8fa1e8f0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6e84f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f2af88a5130 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 00000000000000ff XMM01=0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a
XMM02=ffff000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000030 RBX=0000000000000030 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900001df890
R8 =ffff888107b38237 R9 =1ffff11020f67046 R10=dffffc0000000000 R11=ffffffff85472aa0
R12=dffffc0000000000 R13=ffffffff99af58cd R14=ffffffff99dfa1e0 R15=0000000000000000
RIP=ffffffff85472b1c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007ff03f8056c0 ffffffff 00c00000
GS =0000 ffff8881a3c1f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000000000000004 CR3=000000012167e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffff00 ffffffffffffffff
XMM02=ffffffffffffffff ffffffffffff0000 XMM03=ffffffffffffff00 ffffffffffff0000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f5955411ec1
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
