last executing test programs:

1.019323992s ago: executing program 0 (id=191):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)="d80000001c0081044e81f782db44b904021d080201000000400000a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0)

955.653008ms ago: executing program 0 (id=195):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0))
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0)
recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x100}, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080))
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xe, 0x0, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3a, '\x00', 0x0, @fallback=0xd}, 0x94)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
socket$kcm(0xa, 0x2, 0x0)
socket$kcm(0x10, 0x3, 0x10)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000))
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0))
socket$kcm(0x10, 0x400000002, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'netdevsim0\x00'})
socketpair(0x1, 0x1, 0x1, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000080))

903.783664ms ago: executing program 0 (id=196):
r0 = socket$kcm(0x10, 0x2, 0x0)
recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000002c0)=""/105, 0x69}, {&(0x7f0000000ec0)=""/4071, 0xfe7}, {&(0x7f00000027c0)=""/4065, 0xfe1}, {&(0x7f0000000700)=""/231, 0xe7}, {&(0x7f0000000500)=""/42, 0x2a}, {&(0x7f0000000080)=""/171, 0xab}, {&(0x7f00000001c0)=""/42, 0x2a}], 0x7}, 0x40000100)
sendmsg$inet(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000900)="5c00000012006bab9a3fe3d86e17aa0a046b4877c4aaf68187bae53dca2ba35bda6a876c1d0048007ea608649e7524765f0ef82e3c0000a705259a3651f60a84c9f4d4938037e70e4509c5bb00000000e513aeac9bf2bee150d5fe86", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20000000)
recvmsg$kcm(r0, &(0x7f0000000e80)={0x0, 0x0, 0x0}, 0x40000002)

825.563546ms ago: executing program 1 (id=197):
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @fallback=0x6}, 0x94)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bridge0\x00', 0x100})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
perf_event_open(&(0x7f00000000c0)={0x6, 0x80, 0xeb, 0x3, 0x40, 0x3, 0x0, 0x7fffffff, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x101, 0x1, @perf_config_ext={0x4, 0x5}, 0xb24, 0x7ff, 0x7, 0x8, 0x81, 0x40004, 0x5, 0x0, 0x4000000, 0x0, 0x2}, 0x0, 0xc, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000080))

825.351642ms ago: executing program 2 (id=198):
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="1400", 0x2}], 0x1}, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f0000000280), &(0x7f0000000000)=""/3, 0x2}, 0x20)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000100), &(0x7f0000000000), 0x2}, 0x20)

824.46805ms ago: executing program 0 (id=199):
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
setsockopt$sock_attach_bpf(r0, 0x0, 0x6, 0x0, 0x0)

824.255855ms ago: executing program 1 (id=200):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r0, 0x1, 0x10, &(0x7f0000000000), 0x4)
sendmsg$inet(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x8004)
close(r0)
close(0x3)

765.109438ms ago: executing program 2 (id=201):
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[{0x10, 0x29, 0xfff}, {0x10, 0x110, 0xb}], 0x20}, 0x40)

764.848328ms ago: executing program 1 (id=202):
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_ext={0x1c, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}}, 0x0, 0x95, 0x0, 0x0, 0x40f00, 0x4a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x9365, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xba}, 0x94)
r0 = socket$kcm(0x11, 0x2, 0x0)
setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f00000003c0)=@caif, 0x80, 0x0}, 0x4008050)

764.71038ms ago: executing program 0 (id=203):
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0)
close(r0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
sendmsg$inet(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x4000000)
recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0)

695.067238ms ago: executing program 2 (id=204):
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x202, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b28, &(0x7f0000000000)={'wlan1\x00', @random="1f00"})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a6c52d922ba2a05dd42"], 0xfdef)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

694.610759ms ago: executing program 0 (id=205):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2505, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000004"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x4c}, 0x94)
r0 = socket$kcm(0x2, 0x5, 0x84)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
close(r2)
recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r3=>0xffffffffffffffff]}}], 0x18}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0x7b, &(0x7f0000000000)=r3, 0x8)
sendmsg$inet(r0, &(0x7f0000000380)={&(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000a00)=[{&(0x7f0000000140)="1ab1bc76", 0x4}], 0x1}, 0x8804)

694.318372ms ago: executing program 1 (id=206):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(r1)
r2 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x400000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x24}, 0x0, 0xfffffbffffffffff, 0xffffffffffffffff, 0x2)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3)
perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10}, 0x0, 0xca, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r4=>0xffffffffffffffff]}}], 0x18}, 0x0)
write$cgroup_subtree(r4, &(0x7f0000000180)=ANY=[@ANYRES8=r1], 0x9a)

164.710262ms ago: executing program 1 (id=207):
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d71, 0x10004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x2}, 0x2de, 0xfffffffffffffffd, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, <r1=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)
r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x5, @perf_config_ext={0x9, 0x2}, 0x1000, 0x4, 0x0, 0x8, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x3, &(0x7f0000003540)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x0, '\x00', r1, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94)

164.203004ms ago: executing program 2 (id=208):
r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_config_ext={0x3, 0x8001}, 0x0, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0)
r2 = socket$kcm(0xa, 0x2, 0x3a)
sendmsg$kcm(r2, &(0x7f00000005c0)={&(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x0, @dev}, 0xd7, &(0x7f0000000080), 0x1}, 0x0)

84.829885ms ago: executing program 1 (id=209):
bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
perf_event_open(&(0x7f0000000480)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100480, 0x9, 0x0, 0x0, 0x0, 0x40000009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00')
sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040))
sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
close(r3)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500))
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000100)="b9ff03316844268cb89e14f086dd", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60}, 0x50)
write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x36)

207.619µs ago: executing program 2 (id=210):
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_tracing={0x1a, 0x10, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, [@tail_call, @btf_id={0x18, 0x1, 0x3, 0x0, 0x4}, @alu={0x4, 0x0, 0x3, 0x8, 0xb, 0xfffffffffffffff0, 0x4}, @tail_call]}, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xf475, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94)
r0 = socket$kcm(0x11, 0x2, 0x0)
setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f00000003c0)=@caif, 0x80, 0x0}, 0x0)

0s ago: executing program 2 (id=211):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="9feb01001800000000000000bc000000bc00000003000000060000000000000700000000070000000000000e01000000010000f40b00000000000008030000000a00000001cc0400"], 0x0, 0xd7, 0x0, 0x0, 0x7, 0x10000}, 0x28)
r0 = socket$kcm(0x11, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000001340)=@hci={0x1f, 0xc00, 0xe}, 0x80, &(0x7f0000002540)=[{&(0x7f00000006c0)='b', 0x10}], 0x1}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:45955' (ED25519) to the list of known hosts.
syzkaller login: [   47.657888][ T5816] cgroup: Unknown subsys name 'net'
[   47.830733][ T5816] cgroup: Unknown subsys name 'cpuset'
[   47.834643][ T5816] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   49.514680][ T5816] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   57.989884][ T5844] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   57.992986][ T5844] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   57.995671][ T5844] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   58.006623][ T5844] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   58.009080][ T5844] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   58.085243][ T5841] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   60.056834][ T5844] Bluetooth: hci0: command tx timeout
[   60.373245][   T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   60.376846][   T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   60.379557][   T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   60.382513][   T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   60.384957][   T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   60.462889][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   60.466052][   T55] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   60.471511][   T55] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   60.477174][   T55] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   60.483437][   T55] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   60.507976][   T55] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   60.513394][   T55] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   60.516876][   T55] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   60.527053][   T55] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   60.531939][   T55] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   60.615665][ T5855] chnl_net:caif_netlink_parms(): no params data found
[   60.735734][ T5855] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.739919][ T5855] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.742135][ T5855] bridge_slave_0: entered allmulticast mode
[   60.744887][ T5855] bridge_slave_0: entered promiscuous mode
[   60.757005][ T5855] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.759145][ T5855] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.761261][ T5855] bridge_slave_1: entered allmulticast mode
[   60.763829][ T5855] bridge_slave_1: entered promiscuous mode
[   60.827097][ T5855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.843950][ T5855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   60.897092][ T5861] chnl_net:caif_netlink_parms(): no params data found
[   60.907788][ T5855] team0: Port device team_slave_0 added
[   60.911339][ T5855] team0: Port device team_slave_1 added
[   60.962993][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_0
[   60.965078][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.973693][ T5855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   60.979483][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_1
[   60.981530][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.989267][ T5855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.003294][ T5858] chnl_net:caif_netlink_parms(): no params data found
[   61.066463][ T5861] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.068685][ T5861] bridge0: port 1(bridge_slave_0) entered disabled state
[   61.070837][ T5861] bridge_slave_0: entered allmulticast mode
[   61.073421][ T5861] bridge_slave_0: entered promiscuous mode
[   61.078265][ T5861] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.080410][ T5861] bridge0: port 2(bridge_slave_1) entered disabled state
[   61.082512][ T5861] bridge_slave_1: entered allmulticast mode
[   61.085225][ T5861] bridge_slave_1: entered promiscuous mode
[   61.109741][ T5855] hsr_slave_0: entered promiscuous mode
[   61.112308][ T5855] hsr_slave_1: entered promiscuous mode
[   61.172389][ T5861] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   61.182150][ T5861] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   61.238206][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.240447][ T5858] bridge0: port 1(bridge_slave_0) entered disabled state
[   61.242546][ T5858] bridge_slave_0: entered allmulticast mode
[   61.246508][ T5858] bridge_slave_0: entered promiscuous mode
[   61.249995][ T5858] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.252078][ T5858] bridge0: port 2(bridge_slave_1) entered disabled state
[   61.254172][ T5858] bridge_slave_1: entered allmulticast mode
[   61.257323][ T5858] bridge_slave_1: entered promiscuous mode
[   61.261221][ T5861] team0: Port device team_slave_0 added
[   61.275577][ T5861] team0: Port device team_slave_1 added
[   61.312590][ T5858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   61.319034][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.321281][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.329223][ T5861] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.334127][ T5858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   61.346440][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.348486][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.355801][ T5861] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.389516][ T5858] team0: Port device team_slave_0 added
[   61.392862][ T5858] team0: Port device team_slave_1 added
[   61.445687][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.448367][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.455638][ T5858] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.472153][ T5861] hsr_slave_0: entered promiscuous mode
[   61.474400][ T5861] hsr_slave_1: entered promiscuous mode
[   61.477144][ T5861] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   61.479929][ T5861] Cannot create hsr debugfs directory
[   61.482310][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.484744][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.493658][ T5858] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.560275][ T5858] hsr_slave_0: entered promiscuous mode
[   61.563844][ T5858] hsr_slave_1: entered promiscuous mode
[   61.566808][ T5858] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   61.569702][ T5858] Cannot create hsr debugfs directory
[   61.624527][ T5855] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   61.641468][ T5855] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   61.661550][ T5855] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   61.676661][ T5855] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   61.833950][ T5861] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   61.853401][ T5861] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   61.865391][ T5861] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   61.870579][ T5861] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   61.899451][ T5858] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   61.908813][ T5858] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   61.914921][ T5858] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   61.923081][ T5858] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   61.941301][ T5855] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.979967][ T5855] 8021q: adding VLAN 0 to HW filter on device team0
[   61.999193][   T53] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.001460][   T53] bridge0: port 1(bridge_slave_0) entered forwarding state
[   62.018448][   T53] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.020622][   T53] bridge0: port 2(bridge_slave_1) entered forwarding state
[   62.044697][ T5858] 8021q: adding VLAN 0 to HW filter on device bond0
[   62.057990][ T5861] 8021q: adding VLAN 0 to HW filter on device bond0
[   62.069571][ T5858] 8021q: adding VLAN 0 to HW filter on device team0
[   62.084948][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.087179][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   62.099942][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.102503][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   62.123079][ T5861] 8021q: adding VLAN 0 to HW filter on device team0
[   62.151371][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.153553][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   62.164679][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.166887][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   62.282278][ T5855] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.305586][ T5858] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.349573][ T5858] veth0_vlan: entered promiscuous mode
[   62.355333][ T5858] veth1_vlan: entered promiscuous mode
[   62.363095][ T5855] veth0_vlan: entered promiscuous mode
[   62.379781][ T5855] veth1_vlan: entered promiscuous mode
[   62.408793][ T5861] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.415772][ T5855] veth0_macvtap: entered promiscuous mode
[   62.421975][ T5858] veth0_macvtap: entered promiscuous mode
[   62.425883][ T5855] veth1_macvtap: entered promiscuous mode
[   62.431929][ T5858] veth1_macvtap: entered promiscuous mode
[   62.453669][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.457342][   T55] Bluetooth: hci0: command tx timeout
[   62.465523][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.471119][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.480600][ T5855] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.483255][ T5855] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.485781][ T5855] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.490631][ T5855] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.500156][ T5861] veth0_vlan: entered promiscuous mode
[   62.504058][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.513157][ T5858] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.517141][ T5858] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.519718][ T5858] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.522193][ T5858] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.537092][   T55] Bluetooth: hci1: command tx timeout
[   62.537875][ T5861] veth1_vlan: entered promiscuous mode
[   62.611788][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.615151][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.618708][   T55] Bluetooth: hci2: command tx timeout
[   62.651637][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.653290][ T3805] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.654395][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.662106][ T3805] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.670636][ T5861] veth0_macvtap: entered promiscuous mode
[   62.680687][ T5861] veth1_macvtap: entered promiscuous mode
[   62.705647][   T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.713600][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.715854][   T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.728578][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.732503][ T5861] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.744652][ T5861] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.747373][ T5861] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.750672][ T5861] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.851701][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.854164][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.898848][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.903632][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   63.040625][ T5931] netlink: 'syz.2.14': attribute type 4 has an invalid length.
[   63.043187][ T5931] netlink: 14345 bytes leftover after parsing attributes in process `syz.2.14'.
[   63.177735][ T5941] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.18'.
[   63.251835][ T5950] netlink: 'syz.1.23': attribute type 21 has an invalid length.
[   63.254252][ T5950] netlink: 164 bytes leftover after parsing attributes in process `syz.1.23'.
[   63.295185][ T5948] netlink: 14568 bytes leftover after parsing attributes in process `syz.0.21'.
[   63.468287][ T5966] netlink: 16410 bytes leftover after parsing attributes in process `syz.1.31'.
[   63.534110][ T5971] bridge0: port 1(bridge_slave_0) entered forwarding state
[   63.640180][ T5983] netlink: 'syz.2.40': attribute type 21 has an invalid length.
[   63.641395][ T5984] warning: `syz.1.39' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   63.642543][ T5983] netlink: 164 bytes leftover after parsing attributes in process `syz.2.40'.
[   63.838838][ T5997] netlink: 'syz.0.46': attribute type 21 has an invalid length.
[   63.939551][ T6003] syz.1.49 uses obsolete (PF_INET,SOCK_PACKET)
[   63.970941][ T6003] netlink: 'syz.1.49': attribute type 10 has an invalid length.
[   63.997228][ T6003] team0: Device ipvlan1 failed to register rx_handler
[   64.203700][ T6017] Illegal XDP return value 4294967282 on prog  (id 16) dev N/A, expect packet loss!
[   64.225845][ T6019] netlink: 'syz.0.56': attribute type 6 has an invalid length.
[   64.229556][ T6019] netlink: 'syz.0.56': attribute type 1 has an invalid length.
[   64.232573][ T6019] netlink: 181400 bytes leftover after parsing attributes in process `syz.0.56'.
[   64.374019][ T6029] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   64.437756][ T6032] netlink: 40 bytes leftover after parsing attributes in process `syz.1.62'.
[   64.491456][ T6032] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.530559][ T6032] bridge_slave_0 (unregistering): left allmulticast mode
[   64.532865][ T6032] bridge_slave_0 (unregistering): left promiscuous mode
[   64.535089][ T6032] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.539147][   T55] Bluetooth: hci0: command tx timeout
[   64.617624][   T55] Bluetooth: hci1: command tx timeout
[   64.697337][   T55] Bluetooth: hci2: command tx timeout
[   64.852552][ T6047] netlink: 'syz.2.69': attribute type 29 has an invalid length.
[   65.042324][    C1] hrtimer: interrupt took 60269 ns
[   65.044629][ T6055] netlink: 40 bytes leftover after parsing attributes in process `syz.0.72'.
[   65.050796][ T6055] netlink: 4 bytes leftover after parsing attributes in process `syz.0.72'.
[   65.270178][ T6060] netlink: 'syz.0.74': attribute type 21 has an invalid length.
[   65.869402][ T6100] netlink: 'syz.1.93': attribute type 21 has an invalid length.
[   65.944872][ T6108] vcan0: entered promiscuous mode
[   65.951760][ T6108] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check.
[   65.957060][ T6104] delete_channel: no stack
[   66.622702][   T55] Bluetooth: hci0: command tx timeout
[   66.702486][   T55] Bluetooth: hci1: command tx timeout
[   66.782724][   T55] Bluetooth: hci2: command tx timeout
[   68.087256][ T6186] validate_nla: 3 callbacks suppressed
[   68.087287][ T6186] netlink: 'syz.1.133': attribute type 4 has an invalid length.
[   68.092360][ T6186] __nla_validate_parse: 8 callbacks suppressed
[   68.092367][ T6186] netlink: 209028 bytes leftover after parsing attributes in process `syz.1.133'.
[   68.302119][ T6204] netlink: 'syz.1.141': attribute type 6 has an invalid length.
[   68.304562][ T6204] netlink: 'syz.1.141': attribute type 22 has an invalid length.
[   68.322251][ T6204] netlink: 'syz.1.141': attribute type 23 has an invalid length.
[   68.324578][ T6204] netlink: 'syz.1.141': attribute type 26 has an invalid length.
[   68.340380][ T6204] netlink: 'syz.1.141': attribute type 28 has an invalid length.
[   68.342719][ T6204] netlink: 'syz.1.141': attribute type 29 has an invalid length.
[   68.348916][ T6204] netlink: 'syz.1.141': attribute type 31 has an invalid length.
[   68.696311][   T55] Bluetooth: hci0: command tx timeout
[   68.798027][   T55] Bluetooth: hci1: command tx timeout
[   68.856151][   T55] Bluetooth: hci2: command tx timeout
[   69.074264][   T55] Bluetooth: hci1: ISO packet too small
[   70.588953][ T6279] netlink: 1057 bytes leftover after parsing attributes in process `syz.2.176'.
[   71.020096][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   71.026061][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   73.583440][ T6312] netlink: 132 bytes leftover after parsing attributes in process `syz.0.191'.
[   73.731614][ T6321] netlink: 60 bytes leftover after parsing attributes in process `syz.0.196'.
[   73.734624][ T6320] netlink: 60 bytes leftover after parsing attributes in process `syz.0.196'.
[   73.738180][ T6321] netlink: 60 bytes leftover after parsing attributes in process `syz.0.196'.
[   73.922762][   T55] Bluetooth: hci1: Received unexpected HCI Event 0x00
[   74.483835][    C0] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[   74.523712][ T6348] syzkaller0: entered promiscuous mode
[   74.525504][ T6348] syzkaller0: entered allmulticast mode
[   81.261401][   T10] cfg80211: failed to load regulatory.db
[  179.656001][    C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
[  179.658202][    C0] rcu: 	1-....: (0 ticks this GP) idle=c0ec/1/0x4000000000000000 softirq=15592/15592 fqs=5250
[  179.662650][    C0] rcu: 	         hardirqs   softirqs   csw/system
[  179.664622][    C0] rcu: 	 number:  1410207          0            0
[  179.666879][    C0] rcu: 	cputime:    16760      35745            0   ==> 52500(ms)
[  179.669715][    C0] rcu: 	(detected by 0, t=10502 jiffies, g=7693, q=699 ncpus=2)
[  179.672040][    C0] Sending NMI from CPU 0 to CPUs 1:
[  179.672104][    C1] NMI backtrace for cpu 1
[  179.672131][    C1] CPU: 1 UID: 0 PID: 6354 Comm: syz.2.212 Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0 PREEMPT(full) 
[  179.672141][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  179.672148][    C1] RIP: 0010:native_apic_msr_write+0x39/0x50
[  179.672168][    C1] Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 c3 cc cc cc cc cc f3 0f 1e fa 89 f6 31 d2 e9 e2 db 86 03 66
[  179.672179][    C1] RSP: 0018:ffffc900001e0028 EFLAGS: 00000046
[  179.672187][    C1] RAX: 00000000000000f6 RBX: 0000000000000200 RCX: 000000000000083f
[  179.672192][    C1] RDX: 0000000000000000 RSI: 00000000000000f6 RDI: 000000000000083f
[  179.672197][    C1] RBP: ffffc900001e00f8 R08: ffffc900001e0087 R09: 1ffff9200003c010
[  179.672202][    C1] R10: dffffc0000000000 R11: fffff5200003c011 R12: ffff88813663af01
[  179.672207][    C1] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8881366314f0
[  179.672212][    C1] FS:  00007f8d27eba6c0(0000) GS:ffff8881a3c1f000(0000) knlGS:0000000000000000
[  179.672218][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  179.672223][    C1] CR2: 000000110c2d4921 CR3: 000000010abd0000 CR4: 00000000000006f0
[  179.672246][    C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  179.672251][    C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
[  179.672255][    C1] Call Trace:
[  179.672261][    C1]  <IRQ>
[  179.672265][    C1]  arch_irq_work_raise+0x6d/0x80
[  179.672276][    C1]  __irq_work_queue_local+0x1d7/0x550
[  179.672286][    C1]  ? __pfx___irq_work_queue_local+0x10/0x10
[  179.672294][    C1]  ? __virt_addr_valid+0x4a5/0x5c0
[  179.672304][    C1]  ? __phys_addr+0xd3/0x180
[  179.672313][    C1]  irq_work_queue_on+0x122/0x230
[  179.672321][    C1]  rcu_read_unlock_special+0x3ab/0x4c0
[  179.672334][    C1]  ? __lock_acquire+0xab9/0xd20
[  179.672343][    C1]  ? __pfx_rcu_read_unlock_special+0x10/0x10
[  179.672354][    C1]  ? trace_call_bpf+0xb7/0x850
[  179.672365][    C1]  __rcu_read_unlock+0x84/0xe0
[  179.672375][    C1]  ? trace_call_bpf+0xb7/0x850
[  179.672382][    C1]  trace_call_bpf+0x5ae/0x850
[  179.672390][    C1]  ? trace_call_bpf+0xb7/0x850
[  179.672398][    C1]  ? __pfx_trace_call_bpf+0x10/0x10
[  179.672405][    C1]  ? kvm_sched_clock_read+0x11/0x20
[  179.672416][    C1]  ? sched_clock_cpu+0x74/0x430
[  179.672424][    C1]  ? rcu_iw_handler+0x44/0x160
[  179.672435][    C1]  perf_trace_run_bpf_submit+0x78/0x170
[  179.672446][    C1]  perf_trace_preemptirq_template+0x280/0x340
[  179.672459][    C1]  ? irqentry_exit+0x74/0x90
[  179.672467][    C1]  ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[  179.672478][    C1]  ? __irq_exit_rcu+0xd8/0x1f0
[  179.672488][    C1]  ? __pfx___irq_exit_rcu+0x10/0x10
[  179.672497][    C1]  ? irqentry_exit+0x74/0x90
[  179.672506][    C1]  trace_irq_enable+0xee/0x110
[  179.672516][    C1]  trace_hardirqs_on+0x18/0x40
[  179.672525][    C1]  irqentry_exit+0x74/0x90
[  179.672534][    C1]  asm_sysvec_irq_work+0x1a/0x20
[  179.672543][    C1] RIP: 0010:rcu_read_unlock_special+0x87/0x4c0
[  179.672554][    C1] Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 62 2c f8 10 41 f7 c6 00 00 f0 00 74 49 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
[  179.672559][    C1] RSP: 0018:ffffc900001e05a0 EFLAGS: 00000206
[  179.672566][    C1] RAX: 80da349792bb0900 RBX: 1ffff9200003c0bc RCX: 80da349792bb0900
[  179.672598][    C1] RDX: 0000000000000002 RSI: ffffffff8d99883e RDI: ffffffff8be29f40
[  179.672603][    C1] RBP: ffffc900001e0698 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  179.672608][    C1] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: ffffffff8e144400
[  179.672613][    C1] R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000002
[  179.672623][    C1]  ? __pfx_perf_trace_lock+0x10/0x10
[  179.672633][    C1]  ? irqentry_exit+0x74/0x90
[  179.672642][    C1]  ? __pfx_rcu_read_unlock_special+0x10/0x10
[  179.672653][    C1]  ? unwind_next_frame+0xa5/0x2390
[  179.672664][    C1]  __rcu_read_unlock+0x84/0xe0
[  179.672674][    C1]  ? unwind_next_frame+0xa5/0x2390
[  179.672682][    C1]  unwind_next_frame+0x19ae/0x2390
[  179.672691][    C1]  ? unwind_next_frame+0xa5/0x2390
[  179.672699][    C1]  ? rcu_core+0xca8/0x1710
[  179.672708][    C1]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  179.672718][    C1]  arch_stack_walk+0x11c/0x150
[  179.672729][    C1]  ? handle_softirqs+0x286/0x870
[  179.672738][    C1]  stack_trace_save+0x9c/0xe0
[  179.672747][    C1]  ? __pfx_stack_trace_save+0x10/0x10
[  179.672757][    C1]  ? perf_trace_run_bpf_submit+0x100/0x170
[  179.672767][    C1]  kasan_save_track+0x3e/0x80
[  179.672774][    C1]  ? kasan_save_track+0x3e/0x80
[  179.672780][    C1]  ? kasan_save_free_info+0x46/0x50
[  179.672789][    C1]  ? __kasan_slab_free+0x62/0x70
[  179.672795][    C1]  ? kfree+0x18e/0x440
[  179.672802][    C1]  ? slab_free_after_rcu_debug+0x60/0x2a0
[  179.672813][    C1]  ? rcu_core+0xca8/0x1710
[  179.672831][    C1]  kasan_save_free_info+0x46/0x50
[  179.672841][    C1]  __kasan_slab_free+0x62/0x70
[  179.672848][    C1]  ? slab_free_after_rcu_debug+0x60/0x2a0
[  179.672857][    C1]  kfree+0x18e/0x440
[  179.672864][    C1]  ? rcu_core+0xc34/0x1710
[  179.672871][    C1]  slab_free_after_rcu_debug+0x60/0x2a0
[  179.672880][    C1]  ? __pfx_slab_free_after_rcu_debug+0x10/0x10
[  179.672889][    C1]  ? rcu_core+0xc34/0x1710
[  179.672896][    C1]  rcu_core+0xca8/0x1710
[  179.672908][    C1]  ? __pfx_rcu_core+0x10/0x10
[  179.672915][    C1]  ? sched_balance_domains+0x121/0x9e0
[  179.672925][    C1]  ? sched_balance_domains+0x121/0x9e0
[  179.672933][    C1]  ? sched_balance_domains+0x8be/0x9e0
[  179.672942][    C1]  ? sched_balance_domains+0x121/0x9e0
[  179.672950][    C1]  handle_softirqs+0x286/0x870
[  179.672959][    C1]  ? __irq_exit_rcu+0xca/0x1f0
[  179.672968][    C1]  ? __pfx_handle_softirqs+0x10/0x10
[  179.672978][    C1]  __irq_exit_rcu+0xca/0x1f0
[  179.672986][    C1]  ? __pfx___irq_exit_rcu+0x10/0x10
[  179.672995][    C1]  irq_exit_rcu+0x9/0x30
[  179.673002][    C1]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  179.673012][    C1]  </IRQ>
[  179.673014][    C1]  <TASK>
[  179.673018][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  179.673025][    C1] RIP: 0010:lock_acquire+0x175/0x360
[  179.673032][    C1] Code: 00 00 00 00 9c 8f 44 24 30 f7 44 24 30 00 02 00 00 0f 85 cd 00 00 00 f7 44 24 08 00 02 00 00 74 01 fb 65 48 8b 05 9b d3 01 11 <48> 3b 44 24 58 0f 85 f2 00 00 00 48 83 c4 60 5b 41 5c 41 5d 41 5e
[  179.673038][    C1] RSP: 0018:ffffc90002f6f930 EFLAGS: 00000206
[  179.673044][    C1] RAX: 80da349792bb0900 RBX: 0000000000000000 RCX: 80da349792bb0900
[  179.673049][    C1] RDX: 0000000000030000 RSI: ffffffff8db8655b RDI: ffffffff8be29f40
[  179.673054][    C1] RBP: ffffffff82187c91 R08: ffffc90002f6f750 R09: 0000000000000020
[  179.673059][    C1] R10: dffffc0000000000 R11: ffffffff819eacb0 R12: 0000000000000000
[  179.673063][    C1] R13: ffffffff8e2469a0 R14: 0000000000000001 R15: 0000000000000246
[  179.673070][    C1]  ? __kmalloc_cache_noprof+0x41/0x3d0
[  179.673077][    C1]  ? __pfx_hlock_conflict+0x10/0x10
[  179.673091][    C1]  ? bpf_prog_dev_bound_init+0x224/0x380
[  179.673103][    C1]  fs_reclaim_acquire+0x72/0x100
[  179.673113][    C1]  ? __kmalloc_cache_noprof+0x41/0x3d0
[  179.673120][    C1]  __kmalloc_cache_noprof+0x41/0x3d0
[  179.673128][    C1]  ? __bpf_prog_dev_bound_init+0xb6/0x5d0
[  179.673138][    C1]  __bpf_prog_dev_bound_init+0xb6/0x5d0
[  179.673149][    C1]  ? __pfx___bpf_prog_dev_bound_init+0x10/0x10
[  179.673157][    C1]  ? down_write+0x162/0x1f0
[  179.673169][    C1]  ? __pfx_down_write+0x10/0x10
[  179.673183][    C1]  ? dev_get_by_index+0x22/0x2e0
[  179.673195][    C1]  bpf_prog_dev_bound_init+0x22f/0x380
[  179.673205][    C1]  bpf_prog_load+0xd4b/0x1930
[  179.673216][    C1]  ? __pfx_bpf_prog_load+0x10/0x10
[  179.673223][    C1]  ? __pfx_perf_trace_lock+0x10/0x10
[  179.673235][    C1]  ? bpf_lsm_bpf+0x9/0x20
[  179.673242][    C1]  ? security_bpf+0x7e/0x300
[  179.673253][    C1]  __sys_bpf+0x528/0x870
[  179.673260][    C1]  ? __pfx___sys_bpf+0x10/0x10
[  179.673270][    C1]  ? __fget_files+0x2a/0x420
[  179.673279][    C1]  ? rcu_is_watching+0x15/0xb0
[  179.673289][    C1]  __x64_sys_bpf+0x7c/0x90
[  179.673301][    C1]  do_syscall_64+0xfa/0x3b0
[  179.673311][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  179.673320][    C1]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  179.673326][    C1]  ? exc_page_fault+0x9f/0xf0
[  179.673336][    C1]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  179.673345][    C1] RIP: 0033:0x7f8d26f8e9a9
[  179.673353][    C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  179.673359][    C1] RSP: 002b:00007f8d27eba038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  179.673366][    C1] RAX: ffffffffffffffda RBX: 00007f8d271b5fa0 RCX: 00007f8d26f8e9a9
[  179.673371][    C1] RDX: 0000000000000094 RSI: 0000200000000a80 RDI: 0000000000000005
[  179.673376][    C1] RBP: 00007f8d27010d69 R08: 0000000000000000 R09: 0000000000000000
[  179.673380][    C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  179.673384][    C1] R13: 0000000000000000 R14: 00007f8d271b5fa0 R15: 00007ffc051a7e38
[  179.673393][    C1]  </TASK>

VM DIAGNOSIS:
10:43:52  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000030 RBX=0000000000000030 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900000072b0
R8 =ffff888020f10237 R9 =1ffff110041e2046 R10=dffffc0000000000 R11=ffffffff85472aa0
R12=dffffc0000000000 R13=ffffffff99af58cb R14=ffffffff99dfa1e0 R15=0000000000000000
RIP=ffffffff85472b1c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055f1e93c9e08 CR3=0000000109ad2000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000010000000000
XMM02=0000000000000000 657261776d726966 XMM03=ffffffffffffff00 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000062 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffffffffff XMM09=0000000000000062 642e79726f74616c
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000000 RBX=ffffc900001e04f8 RCX=000000000000080b RDX=0000000000000000
RSI=0000000000000000 RDI=0000000000000002 RBP=0000000000000000 RSP=ffffc900001e04c0
R8 =ffff888136623b0f R9 =1ffff11026cc4761 R10=dffffc0000000000 R11=ffffed1026cc4762
R12=0000000000000000 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000
RIP=ffffffff81714f0f RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f8d27eba6c0 ffffffff 00c00000
GS =0000 ffff8881a3c1f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c2d4921 CR3=000000010abd0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f8f89386478 00007f8f89386450 XMM03=00007f8f89386488 00007f8f89386480
XMM04=00007f8f89eed100 00007f8f89386440 XMM05=00007f8f89386458 00007f8f893864a0
XMM06=00007f8f89386498 00007f8f89386490 XMM07=00007f8f89386488 00007f8f89386480
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f8f89211ec1
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
