last executing test programs:

1.662483087s ago: executing program 0 (id=1167):
r0 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r3}, 0x10)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001800dd8d000000ba7e9698ed1fbfa80e000000000002"], 0x3c}}, 0x0) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001800dd8d000000ba7e9698ed1fbfa80e000000000002"], 0x3c}}, 0x0)
r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
bind$bt_hci(r4, &(0x7f0000000000)={0x27}, 0x62) (async)
bind$bt_hci(r4, &(0x7f0000000000)={0x27}, 0x62)
listen(r4, 0x0)
accept4(r4, 0x0, 0x0, 0x80800)
bpf$PROG_LOAD(0x5, 0x0, 0x0) (async)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0x98, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x68, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1, 0x1], 0x0, [0x8, 0x6, 0x3c, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x463, 0x0, 0x0, 0x401]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}]}}]}, 0x98}}, 0x0)

843.982807ms ago: executing program 0 (id=1177):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000500), 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000580)={0x0, r3, 0x0, 0xb, &(0x7f0000000540)='veth0_vlan\x00'}, 0x30)
syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff)
r4 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r4, 0x89a2, &(0x7f0000000000)='bridge0\x00')
r5 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@mcast1, 0x4, 0x0, 0x1, 0x2, 0x8, 0x3}, 0x20)
listen(r5, 0x4)
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r6, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x33}}, 0x0, 0x0, 0x4, 0x2}}, 0x2e)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000040)={'wlan1\x00'})
r7 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), r4)
sendmsg$DEVLINK_CMD_PORT_SPLIT(r4, &(0x7f0000000440)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000300)={0xf8, r7, 0x100, 0x70bd27, 0x25dfdbfc, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x7}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0x9, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080000)
r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl(r8, 0x8b32, &(0x7f0000000040))
sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x38, r1, 0x6a98047402e98331, 0x0, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x5}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}]}]}, 0x38}}, 0x0)
r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000120000002400000008000000850000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94)
r10 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000005c0)='sched_switch\x00', r9}, 0x18)
bpf$BPF_PROG_QUERY(0x10, &(0x7f00000006c0)={@fallback=r10, 0x2, 0x1, 0x3, &(0x7f0000000480)=[0x0], 0x1, 0x0, &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0], <r11=>0x0}, 0x40)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001000)={r9, 0xe0, &(0x7f0000000f00)={0x0, <r12=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000780)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x6, &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000dc0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xd2, &(0x7f0000000e00)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000e40), &(0x7f0000000e80), 0x8, 0xc1, 0x8, 0x8, &(0x7f0000000ec0)}}, 0x10)
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000004c0)=ANY=[@ANYRES32=0x1, @ANYRES32=r9, @ANYBLOB="9c93fc690a55f9870000000001", @ANYRES32=r12, @ANYRES64=r11], 0x20)
r13 = socket$nl_generic(0x10, 0x3, 0x10)
r14 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r13, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x54, r14, 0x1, 0xfffffffc, 0x0, {0x1e}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3e}, {0xc}, {0xc}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000081}, 0x8010)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)={r12}, 0x4)

755.795936ms ago: executing program 0 (id=1179):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f"], 0x48) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
unshare(0x28000600) (async)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_int(r1, 0x0, 0xf, 0x0, 0x0)
r2 = socket$vsock_stream(0x28, 0x1, 0x0)
setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r2, 0x28, 0x6, &(0x7f0000000080), 0x10)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', <r4=>0x0}) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_PAUSE_GET(r5, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001940)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01dfffffff9a26000000210000000c00018008000100", @ANYRES32=r4], 0x20}, 0x1, 0x0, 0x0, 0x4000c00}, 0x0)
r7 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r7, &(0x7f00000025c0)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x0, @private1}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)='P', 0x1}], 0x1}}], 0x1, 0x0) (async)
r8 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r8, &(0x7f0000000200)={0x0, 0xef, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d0002847ea622fb564500004a23e3f58e76110165f450e71b0075e3002500028d459e37000f0000000000bf9367b47e51f60a64c9f4d4938037e786a6d0bdd700"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async, rerun: 32)
mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (rerun: 32)
select(0x300, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x0, 0x2, 0x300}, &(0x7f0000000440)={0x0, 0x2710})
bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8)

705.518879ms ago: executing program 2 (id=1180):
r0 = socket$netlink(0x10, 0x3, 0x0) (async)
r1 = socket(0x1, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) (async)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETCHAIN(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xd8, 0x4, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_CHAIN_USERDATA={0xae, 0xc, "4f44d093cd6d3682da708d53dfe7ca3d5f03d5d534ca4c078c7207aaee20d7c42e0db9336b5af032f39e8bc9388e2cbb712d29176007ab5af820347571db1f33fbc2f4ae4e12996460bc839633b84adf970ef34169fe45186c2d9fc5f0678ab0b088b1be58e6721b6cbd6184b8add8971aea85ea69d2b6817de431d00bdf8c64dcbf8d5eb32fd8d2a6c70d4e2f88357920f282639067de3c026510acf2d62edb722f936e7558594113bf"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0xd8}, 0x1, 0x0, 0x0, 0xc854}, 0x4000804) (async)
sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x2, 0x5, 0x63, 0x0, 0x4, 0x0, 0x70bd26, 0x25dfdbfc, [@sadb_spirange={0x2, 0x10, 0x4d5, 0x4d5}]}, 0x20}}, 0x20000000)
sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x11298}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x6}, @IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x2}]}}}]}, 0x44}}, 0x4000) (async)
socket$nl_netfilter(0x10, 0x3, 0xc)

704.810156ms ago: executing program 0 (id=1181):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000020000000000000003000000180000000300000000000000040000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc5c79a324b7d4b3d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000"], 0x7c}}, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x0, &(0x7f0000000180), &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
r2 = socket$phonet_pipe(0x23, 0x5, 0x2)
unshare(0x68040200)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f00000043c0)={'tunl0\x00', {0x2, 0x4e23, @empty}})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000)
socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000240)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14140e05251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b7800000000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=@ipv4_getnexthop={0x1c, 0x6a, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NHA_GROUPS={0x4}]}, 0x1c}}, 0x4c044)
socket$nl_netfilter(0x10, 0x3, 0xc)
listen(r2, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001ac0), 0xffffffffffffffff)
r8 = socket$kcm(0xa, 0x5, 0x0)
setsockopt$sock_attach_bpf(r2, 0x29, 0x6, &(0x7f0000000040)=r0, 0x4)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a98000000060a0b040000000000000000020000026c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000e08000340000000042c0001800a0001006c696d69740000001c0002800c00014000000000000000640c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0)
sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x3, @remote, 0x5, 0x4}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000080)='n', 0x1}], 0x1}, 0x2600c055)
sendmsg$NL80211_CMD_STOP_NAN(r6, &(0x7f0000001b80)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001b40)={&(0x7f0000001b00)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r7, @ANYBLOB="3a000227bd7000ffdbdf25740000000c00990007000000060000"], 0x20}, 0x1, 0x0, 0x0, 0x4044801}, 0x0)
sendto(r6, 0x0, 0x0, 0x0, 0x0, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a09040000000000000000020000000900020073797a32000000000900010073797a30000000fc43552a3f575381800b00010065787468647200002c681f39e53f95831692c1ab3cd422702c000280080007400000000c05000200000000000800034000000a4a"], 0x94}}, 0x0)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)

560.495747ms ago: executing program 2 (id=1182):
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0xb, &(0x7f0000005300)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x10) (async)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x10)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000004c0)='dctcp\x00', 0x6)
bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c)
setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4)
sendto$inet6(r4, &(0x7f0000000280)="32780f", 0x3, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000000c0)='htcp\x00', 0x5)
shutdown(r4, 0x1)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) (async)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002})
pipe(&(0x7f0000000800)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
write$tun(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="0000001801040700ff00c5"], 0x24e2) (async)
write$tun(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="0000001801040700ff00c5"], 0x24e2)
r6 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="1400000016000b63d25a80648c25940121", 0x11}, {&(0x7f0000000280)="e26248", 0x3}], 0x2}, 0x40050)
r7 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0)
socket$inet6_sctp(0xa, 0x1, 0x84) (async)
r8 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000002c0)={<r9=>0x0, 0x5, 0x30}, &(0x7f0000000300)=0xc)
getsockopt$inet_sctp6_SCTP_CONTEXT(r8, 0x84, 0x11, &(0x7f0000000380)={r9, 0x3}, &(0x7f00000003c0)=0x8)
splice(r0, 0x0, r7, 0x0, 0x47, 0x0) (async)
splice(r0, 0x0, r7, 0x0, 0x47, 0x0)
r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000080)='rpc_call_rpcerror\x00', r10, 0x0, 0xf69}, 0x18)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r11 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r12 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_DELETE(r12, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c001e0000af05000000000000000000010000080800034000001000319929e1084137251952827711255202e83bd9f8ee7a5f1f1fbef066604a68994fbfb870d492d125056c7bd170f570aae095e3da1965616e5c254abbfacd877af9c165b0b8b432b79f895535d355088deebac4dd3f4d01e5c33c6b9b7552287eec88b77c95a0bb61067f4b42ec988a27f3cc786e75e0275fc08f08e687b3255fdb39ee785d74ed944facca6f4139e2371ce1d04ab1014fdcab07aa5781f9774943b5fcb6560ba796796c32a382d4bd4920a3db32d68cdc73dc0537ad57dfd2e9270fec09e8e4cd982fca9aedd6ca9ac8a7f34e0f03e300adc16a4fb4b1387da61b9b543192d43e88608960db4a2fbce67a531548f07ef5b99e7400fed9d31f8c1925539c1cab80e116e98d0fe0769f3d7d0766c162980000000000000000000000001c000000fd72a52f361c0e4c38a33266f4c9b5c40f0093e0546e8aba82184cf702f85da3699dcc168c17700a7dddfffbca402d47c3d1e48a02db9d446176916cce8d34cbf827cbb82c9dad988a5c2c90abce6f15c59e086bc9b4aab99480a4d33f49c52f37c8a2ab44cab5696e7d73e88b7bbc915d7f4f35b73149c994a366fdac3de5bebcf5a9fda96e36328320", @ANYRES32=r5, @ANYRESDEC], 0x1c}, 0x1, 0x0, 0x0, 0x20000010}, 0x0)
sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="440000004a00000825bd7000fcdbd99125a3bd90", @ANYRES32=0x0, @ANYBLOB="04000000140001000000000000000000000000000000000114000100fe8000000000000000000000000000bb"], 0x44}, 0x1, 0x0, 0x0, 0x8098}, 0x48804) (async)
sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="440000004a00000825bd7000fcdbd99125a3bd90", @ANYRES32=0x0, @ANYBLOB="04000000140001000000000000000000000000000000000114000100fe8000000000000000000000000000bb"], 0x44}, 0x1, 0x0, 0x0, 0x8098}, 0x48804)

415.22611ms ago: executing program 2 (id=1183):
bind$l2tp(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local, 0x2}, 0x10)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x200000000000011, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r2=>0x0})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000001280)={0x2, [0x0, <r3=>0x0]}, &(0x7f00000012c0)=0xc)
getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000001300)={r3, 0x81, 0x30}, &(0x7f0000001340)=0xc)
getsockopt$bt_hci(r1, 0x0, 0x2, &(0x7f00000001c0), &(0x7f0000001240))
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r5 = socket$inet6(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'sit0\x00', <r6=>0x0})
ioctl$sock_inet6_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r6})
r7 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000440)={0x2, 0xfffffffc, 0x6}, 0x10)
sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r8 = socket(0x10, 0x803, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r8, 0x89f0, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x80, 0x8, 0x5, 0x400, {{0x5, 0x4, 0x0, 0x2b, 0x14, 0x66, 0x0, 0xfc, 0x2f, 0x0, @loopback, @multicast1}}}})
r9 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r4, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "fc0300", 0xf98, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x3a}], @pkt_toobig={0x2, 0x0, 0x0, 0xd93f, {0x4, 0x6, '\x00', 0xf08, 0x11, 0xb9e02c7ea3376920, @mcast2, @dev={0xfe, 0x80, '\x00', 0x12}, [@hopopts={0x4fb560df2bad385d, 0x2, '\x00', [@generic={0x7, 0xf, "55b5d747d5ce5853e308cdbcf10ddd"}]}, @dstopts={0x16, 0x1e3, '\x00', [@jumbo, @enc_lim, @jumbo={0xc2, 0x4, 0x40}, @calipso={0x7, 0x10, {0x4, 0x2, 0x4, 0x6c8, [0x0]}}, @generic={0x2, 0xef6, "471c193e445fffa682333b6ea5d9758e49d1f56a2cacf058c91036aa2a98b0af004e6f5acbbab33a8a5a9112f348b1a0089ddf5d100402cf846849a5c61cd7554140293b1191985ab08825ff716bc3ec7c318469d1e246d1c2b6f9ac2da9fa05bbc052fd2c1e07394a280e009667ed6f989d69942944973c6d558feda3d1c3358d50dff7bdd2c1fb8021ade354c814396f3fc7c17209d79e6c4952e91a6ec461a7cc945887c3bce662f5449d7b817758d7db37c9b2d74a1e7f0e05c28fce1ed8803f1e214667d299c1bd9653c497bea87774d74ebc16b76bee5c7e6ba19f460cafc8a531b56ea9d086e7f82153806b9840ec4fa711abb32a8728e81b51406040e0c274c260aa9b0b468d88f95b045258ddd448a48b987951e70d75bba7371694f1fb2b1957b4954fb807f86d7c7781697c2304a26e879a066a81d9b4f9ad82632a90632f737b44dc95d5b56a4acfdca287e039c5ebe808b5d585eda8c1543dbc5bf1b6bfc52c5ff2a947bce2327ccfeccfc2ba9df17ea126da5c4bbb54018d4f8277939acd67cd26ce4173968cfb747b74d61eb69503dea36f616de641ed0755b2e37f14dc9a8d86bab92acdfcbb93bed1d4344f2fd9c539d5fda77cbae2bedb79e05fc03e64e253b03bd8ac170e54ee380314727c60a3bc1d689b989710dd0f9a418f90637db3aae7034a9b83e8c843ba835c6a500ae43e840688d0801a882ffb94b7a77bd2314217aac52d296d169395c0b3dc7339a389354e1e4ff0746e6b2e3fc0149a36e75eafc20d51812e984faeecb52ad9b89288bacf21c152290ff2f6781dc761a3e50d88a8b4da3e65782fa959d583c718cf64d09d330c381ae123bea01e7d25eb8f8be911f3928237e3878e505be36bb6852903dff1e77be22ccf3b3e1c8658a5b92c816c6f3f0306a196ec62d5a39ecf36528f18e639b26351b6bc9d1230482e5d8e2c9561de5204d98487364c50f7236c503db3665876f6c04f7f23d1606d36120f62e3fd3de4a7525678e3748905d5a14fa840297c7dda43e13e18fad1453d5c24ddcb4bef61ab494d4f620201993b1b20f339ec6409474a6f104edbe42e0df14633c9a40352f773600b335e6a7ec6f0b0511c6d55fb484696d3b3e2fa4346d26446cba1e2e7ae1de5df058e7c2b52a1d6bb2d2daff1c73a4718541d6b9882891870b3f17442bdc250de45202f7314cd6c3670c3061b9ea658f21e1c362d622316f158968f118a72bef80745a9159f3c77985ecd9bca98ccd482b96ab39701053e30fb4d6d5efc4ba8f33fe18b0df2ab24ad5b2169ed8569cc264f91481fe3accc27448231088f05d996f562fd1950e43313193d23338fc134753ef5127d57161597f99598d546e290123ac1c3df0f5ded6cad9f523e71f7d5ce0b7d41f0d2fc6f911bd6b578f156b7b85dcf90d423e1cb854bb18ddc6801fc30ce76df9c27c1d5d91e06e9209d061b43449d0abdf346c644db465ee610d3ed406af49cce6119a1ec2ac9846350367f99e7255e5be602f0cce16439f3c5beb7276f96f2f9dffc88da05c8b197b90bf4ca75be6d767dc10d1ff883728fcaecbde596ed9b01a456e417fb9ded7431323b19a6fa8f6fd0ec596410a887037ff6a0feb81ce0dffdfdec39a5b04ec962e87bc038e4436b2a8ac00e51bca0976eef42211107422ff30034cc62355fcf65b51325fcd25861ee487c695b51ba4be9b3c47ab47388e9a8dcce4507acbf5b16164f85d12161c8038019f589e0117a02161dcf2fc01968983bde59dceda258e008e337a3af1c1127258b8877558918caa71355ca8d17be32b10d61e72a0391b6ed88327d1f6d030877fe893f777de0e0ec863f15a50b40d003a9a941182a0639674bd0b4f4f9716fb1c2e115a6465fa731759793b86a9bb70ae0bb18d0c5e53c120d192a71302d15fff0c2c76ad1f9e1281c42a659ed7b67c4f4d7c3fcd56a022bf8f043006c61f254a80184519935bbc805eefba13ed54234322506f28f362065d6a68c35473280d4b8196754a11604a901cfdea47dc6f442fa73ffc6fe5e59bece8741407a57fd5f36a5906951fe75bea732413200bb85053ad500ea6245bea8abccbf5e8927261f752c12a2765827ea9908f084b862ce41b11443f73f0ec6aa095db1bbce0b14bce8397b45da28c2ac2f33c8ecce00bdf34cd00aa95d181ea33e08b7c8a768a365c4279e0b5d9352eb62c628909cc4191e0ff81fd84cc4c371ffc000d8841a9ebe70574993579cfd0e35574ef6e4cc6edf42deb8cb1e38b55fead366238d8d7d83902c6da5ad2ee63843db90090d57eeebd90ec9b08a6ffffd6c60e0b017e0c22d08cf1e22e2e63df06b62e5e0cfcd7b9441d2ca09b4e96c3b61ed1459fc24d83301148940e554f4d78c453c7e2f262f09aebee218ec5a22f874768e4c1afa870262f2f67155c94b17a36475dd421eaee27632427ede8330b1d74d2cd1a2d0a7de694a7d87ede13b5ea664e89f3d872512581adc606cd841a2abd2ed34efe3ec8e4f03d1e38fadfd08cb1b65f4eac10c48894b6fda1440ddd5d22b06214dbd483a5da821c4f447cce31df27c40b14f4471abccd35e6673aaa17133e78a589f45331399d930534edae0402e811a411d557c184c44ebec37a4e146d8076a070cf1f967ba3341e4e8e0c8b4b4617ee2bf3e8ae478567137641b6f6bc1fafd0d15cfed74198646906b5b853c8206ebf1e7e46bd74ae848281c4d89c02057de523e7e3e75567811685c1be1d2f5a57ff5b32fb8ef19e44f25226701f1b6b66cac452620cb7529b411cd833e3b1ad07bc781be7cda26eeccdb57f44308e765e13f357356e3fb83dcb4994b369fd3ee6aa6e405da03703c0dbd0e47110533992fd2be5bde2cbf6f7e777082427189766afbe426e6014ec9d041e96bcc900d5bdf4be72142ed1ab4c1d88afe8408145e06ddd3c2820f5d928309b3ef77afdd500568d76eb99ebd6f4ab78d5e43aa61b8a0ec27e1f6475691183e19f9e43ef1e94f2656da3eb693921f13aee4d4140fc4d56ac5ff3ec97163915a028c1ed16c7d08e6862503b18283b30489507e35945197c22733dee593f1d20a53dc5a463d5b8a058fa555c220de3fe5252a83e10f163babc01ec11c2e2197491ebb06b43919320c7237c0e55cbf927e0b5aaadd81c0c4c49a30ff2f9426b32311cbf09e1bcbe75c89aec74cf848d1b2194760a6edc734aebac9b429ae0438c620d4ad23b42deb8f7f1806ee8db02261b1e6d35742b1c85602c8099c0ed85cd89969f7b9ffd5906483e788d9f8c01e998c000f3005ea9efef9ca977530999344093bd6d234e500d784b22ccc8de58065451196dc977d8e8c8deac7d47b1ddc23f82f09159796a883d8b530fa193a20c53c22c5ffa3e5d411329f6489266ea75ff184b7ff1b301293b3ff5de6eb3658d826e6aa114eac2e572bf7d0d085e1e927af2bc1b21d1eaa37075a4778bec44521e5341c89c7589ca85b0cbda1060bca778906705be8791e479cb9867b4f6f06802ae76fba15b8fbf14bfd1b393bcef6f7997ac66bd87fcdda9387a519b5dbb61f7f970772a406bdce40f48511344070ed00a20880fdcc19732df83f0ba1bf6c94e201a7a2c833239ebf380720d3ddd644c8b3d78a0eae5d0d7d22937fc5c3e9295cd7a412897b9c1123ffc1aec8c49c768ed008f795e62ad47250ad92f90d4d2c903fdba9c19f8ce5dd5eb69c099ba28eac5717c975c7504ce86b168744f9944ca63ba1938c02918ca9bfb77fc4e97c093108b3d35b8330bc32758c7f3ee746315e758ccb5e220de655350eba786e400bc89e958862541506c6e4958d3fd0987686f2d6236abd0bd118fea29e09d6025f1ac9730e72177ef28399c25134261f785b5e1b7f20bde4e347da83f8dfe0c9080d48b9dc371d9e81174faf9ebcefd3804718b05bbd6f41f40e726d390b87e60afbdadd45cd2f0c4d7495b6a6f074259518838317973877d991ef156d2d39098b50e8b6e1bbfb4096d5801d64e0655be19f7390594ad273f83e7c5128a579e6faf44c76bfdd70d726c0ea4cb9f69976b5beee76f5bec995e49d26795c9731d36d013d628fd7ac2f0bfde44c434d2bfc547480ae597b3e1e5214f108255fa0d22eb69df4a1691c6614743298af40e283090a4039b8bdf9822a86caeabd18d12c506d3448c1b15efa929881029ca0f8d4861d5f7a2d06f0e1a2f18db910ab1bf391a690086eb91341e38649f8bbd8299c3e81e0c816f34629b191e722e9bfdb8610fd135d36b0335198e2a4c06e2f37b9efeeb85a07896674c979e720347fa61782ac09cacd7967a7484e55ea2bfd50a9cb3e1863a59e6ad867593237bdb2baebaf9c88df6b91b5801393186a64dd33ba3472c0a3cb99b7ed8c93f1b95832d75df45c65df69d818ad0680e39606045c996691fcbf1bc69b3f171a46fc81fa66877758c76f73c1d83cc3dddd321b1c03c6b56fa9e02bc3fa4bef43050420202370c5074c0abd08d94c9b75a871cee948ca2e055ab07e1c062e8a1435e06073dc5911d91237ce9fe8cdf47a345de4ca65febc8f48de09603e44d7f14e1e0c37428680dd3428f0f4563dc90e0714fe0a40689acc472394704b9feba33ec9bca45533cd4635b3249a24025c271e6661d0060de48689debb58be19a6cef15f39dd6f42828d8440bc5b9e6d3aae0f745f05181c9d74832c358b8438bf46f0f4f302ffafc395b226d5bd1c5d5b011c846be3d133470db70800297699c8ee17104945a73cc77c2c9cdae9383904dc428f76480558a40c0dc19cd9190dbb78ed1da18eea6694406f428c4ad3e8b4add1ececf520fc9ffbdbde06ac39b2ceb2f24b6054268f179d258a9b260490216f6169e5867c050f3898a555907bd18b18c6d11748cf43bf7b7b1a8eeef32cee7560eed7faea9218ff4f08f69835cd6b1af390f4159ed300faf2d8b5b5904a42bb3e926b383496fb018c8da32e13a952bb172d749edc6e1e38c1e88db1d75f141d3bed099f275e3d0e7fed711d1c4e882612dc7f33fc567a19ce4a901a5350b128d08eff31b1f660e108b146ac3d415ec86820207bf9a9c32d7df1e648cc68bf093faccc1c9e3e31a45ec81a1ce6ceef43240543476ae1305a6beeb8337a0e7c6dae864081fe962b7fd63326415e01b2ebfc770f1c5f8704add7da3a0380625c1162191af137b6a5ada314e0f7233b41e6e58f9ea7e1cf9927da4770bc2d4c45e71d5728930f5a02d740f124521490231229b99cbce370627517017e6d3d82526faecdd573e135d5bc3b96e1292e0b473471e2e93e8162eadf6fc2caced5f9aa494d0eadf8dc5442a9da1d9caf007f8e47c05eb38fa8f99e480c49957c7bae1efb2ce516bd690b7379e83f0493df617449fd9c61e6f9393750464e8d59eb10c8bc84"}]}], "d53354e0f167b1d8f8ed2a0790c6f7186919d562ebcbf5ab"}}}}}}, 0xfce)
r10 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_BITWISE_XOR={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x10c}}, 0x40)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r2, @ANYBLOB="0000000003120100500012800b0001006272696467650000400002800800050001000000060027000000000008000100150008000500"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40)

290.058202ms ago: executing program 1 (id=1185):
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond0\x00', <r0=>0x0})
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000600)=ANY=[], 0x10448)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3)
sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01400010000600000000067400062c00070073797352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000e6ff05000700263a3a0914000600626f6e64300000000000000001000000080003"], 0x78}, 0x1, 0xffffffff00000003}, 0x4)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0)
setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r2, 0x111, 0x4, 0x0, 0x4)
r5 = openat$cgroup_ro(r2, &(0x7f0000000200)='blkio.bfq.io_wait_time_recursive\x00', 0x0, 0x0)
r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000380)={0xffffffffffffffff, 0xfffffffc, 0x18}, 0xc)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x17, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000e000000000000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000009500000000000000092081000100000018150000", @ANYRES32=r2, @ANYBLOB="000000000000000000000000266dfc4377b45ebe1bd7", @ANYRES32=r2, @ANYBLOB="0000000000000000b7020000000000008500000086000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x6f, 0xbe, &(0x7f0000000100)=""/190, 0x40f00, 0x1e, '\x00', 0x0, @fallback=0x1a, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x1, 0xe, 0x1, 0x237}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f00000003c0)=[r2, r2, r2, r6, r2, r2], &(0x7f0000000400)=[{0x3, 0x5, 0xf}], 0x10, 0x6}, 0x94)
sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0xa4, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x10], 0x0, [0x8, 0x6, 0x3c, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x401]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}]}]}}]}, 0xa4}}, 0x0)

213.422684ms ago: executing program 2 (id=1186):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000002000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a32000000008c000000060a010400000000080000000100000008000b400000000064000480340001800b000100657874686472000024000280080001400000000c0800034000000000080004400000002205000200070000002c0001800b0001007470726f787900001c0002800800024000000011080003400000001108000140000000020900010073797a30"], 0x100}}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14)
r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb010018000000000000004800000048000000040000000c00000002000004ee0000000d00000005000000040000000100000002000000070000000a0000000000001008000000090000000000000a030000000c0000000000000c0400000000615f0000"], &(0x7f0000000300)=""/72, 0x65, 0x48, 0x0, 0xff, 0x10000}, 0x28)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000004c0)=@bpf_ext={0x1c, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x5}, [@jmp={0x5, 0x0, 0x8, 0x0, 0x8, 0x40}]}, &(0x7f0000000080)='syzkaller\x00', 0xfffffe00, 0xc1, &(0x7f00000000c0)=""/193, 0x40f00, 0x38, '\x00', r2, 0x0, r3, 0x8, &(0x7f00000003c0)={0x5, 0x3}, 0x8, 0x10, &(0x7f0000000400)={0x4, 0xf, 0x2, 0x6}, 0x10, 0x12ebe, r1, 0x3, 0x0, &(0x7f0000000480)=[{0x2, 0x3, 0x9, 0xa}, {0x2, 0x2, 0x4, 0x6}, {0x5, 0x3, 0xc, 0xc}], 0x10, 0xfffffff9}, 0x94)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', <r5=>0x0})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_PAUSE_GET(r6, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001940)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01dfffffff9a26000000210000000c00018008000100", @ANYRES32=r5], 0x20}, 0x1, 0x0, 0x0, 0x4000c00}, 0x0)

212.727631ms ago: executing program 1 (id=1187):
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_RES_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x64044050}, 0x4804)
openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge0\x00'})
r3 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}}, 0x0)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r5 = openat$cgroup_ro(r4, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
preadv(r5, &(0x7f00000013c0)=[{&(0x7f0000000040)=""/20, 0x14}], 0x1, 0x1000000, 0x0)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, 0x0, 0x4040004)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000140)={'xfrm0\x00', 0x200})
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
bind$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e23}, 0x6e)
pipe(&(0x7f0000000000)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
unshare(0x24020400)
sendmmsg$inet(r9, 0x0, 0x0, 0x4000040)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r7, &(0x7f0000000180)={0x0, 0xffffffffffffff0f, &(0x7f0000000200)={&(0x7f0000000580)={0x14, r8, 0x6a98047402e98331, 0x70bd25}, 0xf}, 0x1, 0x0, 0x0, 0x20000040}, 0x2404c094)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r7)

212.169724ms ago: executing program 0 (id=1188):
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
socket$nl_route(0x10, 0x3, 0x0) (async)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001fc0)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_DEFAULT_PVID={0x6, 0x27, 0x7}, @IFLA_BR_VLAN_STATS_ENABLED={0x5, 0x29, 0x6}]}}}]}, 0x44}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_RES_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB], 0x50}, 0x1, 0x0, 0x0, 0x440008c0}, 0x4804)
openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001480)={&(0x7f00000012c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x9, [@fwd={0x7}, @func_proto, @var={0x4, 0x0, 0x0, 0xe, 0x4}, @func={0x6, 0x0, 0x0, 0xc, 0x2}]}, {0x0, [0x0, 0x0, 0x0, 0x2e, 0x0, 0x2e, 0x2e]}}, 0x0, 0x55}, 0x20) (async)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001480)={&(0x7f00000012c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x9, [@fwd={0x7}, @func_proto, @var={0x4, 0x0, 0x0, 0xe, 0x4}, @func={0x6, 0x0, 0x0, 0xc, 0x2}]}, {0x0, [0x0, 0x0, 0x0, 0x2e, 0x0, 0x2e, 0x2e]}}, 0x0, 0x55}, 0x20)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge0\x00'})
r4 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}}, 0x0) (async)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}}, 0x0)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, 0x0, 0x4040004) (async)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, 0x0, 0x4040004)
socket$netlink(0x10, 0x3, 0x10)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
socket$unix(0x1, 0x5, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async)
r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
bind$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e23}, 0x6e) (async)
bind$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e23}, 0x6e)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)={0x14, r6, 0x6a98047402e98331}, 0x14}, 0x1, 0x0, 0x0, 0x20000044}, 0x40)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r5)

142.510519ms ago: executing program 1 (id=1189):
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}) (async)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async, rerun: 32)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) (rerun: 32)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0xb, &(0x7f0000005300)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, r0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x10)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x4c4841, 0x0) (async)
pipe(&(0x7f0000000040)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$int_in(r4, 0x5421, &(0x7f00000000c0)=0x7) (async)
write$cgroup_int(r4, &(0x7f0000000140), 0xfffffdef)
write$cgroup_devices(r4, 0x0, 0x8) (async)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f00000004c0)='dctcp\x00', 0x6)
bind$inet6(r5, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c)
setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) (async, rerun: 32)
sendto$inet6(r5, &(0x7f0000000280)="32780f", 0x3, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) (async, rerun: 32)
setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f00000000c0)='htcp\x00', 0x5)
shutdown(r5, 0x1)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) (async)
write$tun(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="0000001801040700ff00c5"], 0x24e2) (async)
r6 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="1400000016000b63d25a80648c25940121", 0x11}, {&(0x7f0000000280)="e26248", 0x3}], 0x2}, 0x40050)
r7 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0)
r8 = socket$inet6_sctp(0xa, 0x1, 0x84) (async)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000002c0)={<r9=>0x0, 0x5, 0x30}, &(0x7f0000000300)=0xc)
getsockopt$inet_sctp6_SCTP_CONTEXT(r8, 0x84, 0x11, &(0x7f0000000380)={r9, 0x3}, &(0x7f00000003c0)=0x8) (async)
splice(r0, 0x0, r7, 0x0, 0x47, 0x2) (async, rerun: 32)
r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000400)=ANY=[@ANYBLOB="c3bdc672818edf14135fbad7adfda3476b8d00b6970924001b0add36a5c5206c111ae40c4952c64615455101f9ea553e146ff8ce4a21f8801eb9794a8aad65b0235d38a157d1d8f6ec0c683f4c2864b8302a844b2f"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2}, 0x94) (rerun: 32)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000080)='rpc_call_rpcerror\x00', r10, 0x0, 0xf69}, 0x18) (async)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)

142.060387ms ago: executing program 2 (id=1190):
r0 = accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14, 0x800)
setsockopt$packet_int(r0, 0x107, 0x11, &(0x7f0000000080)=0x6, 0x4)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) (async)
r3 = socket$l2tp(0x2, 0x2, 0x73)
connect$l2tp(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x39}, 0x4}, 0x10) (async)
r4 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
ioctl$sock_bt_bnep_BNEPGETCONNINFO(r4, 0x800442d3, &(0x7f0000000140)={0x1, 0xffff, 0x3, @local, 'ip6erspan0\x00'}) (async)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r2) (async)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000200)={'vxcan1\x00', &(0x7f00000001c0)=@ethtool_rxfh_indir={0x38, 0x9, [0x5, 0x0, 0x8001, 0x3, 0x4, 0x0, 0x0, 0x10, 0xd6]}}) (async)
bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e23, @multicast1}, 0x10) (async)
r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440), 0x4) (async)
r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000840)=@bpf_ext={0x1c, 0x14, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0xfffff801}, [@btf_id={0x18, 0xefa6e383344d0b1c, 0x3, 0x0, 0x4}, @call={0x85, 0x0, 0x0, 0xc0}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @exit]}, &(0x7f00000005c0)='syzkaller\x00', 0x0, 0xcd, &(0x7f0000000600)=""/205, 0x40f00, 0x0, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0xa, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x13c10, 0xffffffffffffffff, 0x9, &(0x7f0000000740)=[0x1, 0xffffffffffffffff, 0x1, 0x1], &(0x7f0000000780)=[{0x5, 0x2, 0x8, 0x3}, {0x5, 0x2, 0xb, 0x3}, {0x4, 0x2, 0x1, 0x8}, {0x4, 0x1, 0xd, 0x9}, {0x4, 0x2, 0x0, 0x7}, {0x4, 0x1, 0x9, 0x3}, {0x2, 0x1, 0x9, 0x4}, {0x4, 0x4, 0xe, 0x4}, {0x4, 0x3, 0xd, 0x2}], 0x10, 0x2}, 0x94)
r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@bloom_filter={0x1e, 0xfffffff9, 0x5, 0xfffffff8, 0x5242, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x3, 0xc}, 0x50) (async)
r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000980)={0x0, 0x9, 0x18}, 0xc)
r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000a00)=@generic={&(0x7f00000009c0)='./file0\x00'}, 0x18) (async)
r11 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000a80)=@o_path={&(0x7f0000000a40)='./file0\x00', 0x0, 0x18}, 0x18)
bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0xa, 0xc, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x7}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xe9000000}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f0000000300)='syzkaller\x00', 0x3, 0xd3, &(0x7f0000000340)=""/211, 0x8b2d613a4075dc45, 0x8, '\x00', 0x0, @fallback=0x20, r6, 0x8, &(0x7f0000000480)={0x2, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x9, 0xa, 0x6, 0x6d}, 0x10, 0x0, r7, 0x4, &(0x7f0000000ac0)=[0xffffffffffffffff, r8, r9, r10, r3, r11], &(0x7f0000000b00)=[{0x1, 0x3, 0x2, 0x5}, {0x3, 0x3, 0xf, 0x1}, {0x0, 0x2, 0x6, 0x4}, {0x5, 0x4, 0x5}], 0x10, 0xffff}, 0x94) (async)
r12 = syz_genetlink_get_family_id$batadv(&(0x7f0000000c40), r2)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r2, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x14, r12, 0x100, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x10)
ioctl$BTRFS_IOC_QGROUP_CREATE(r11, 0x4010942a, &(0x7f0000000d40)={0x1, 0x6}) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000d80), r2)
ioctl$FICLONERANGE(r7, 0x4020940d, &(0x7f0000000dc0)={{r6}, 0x100, 0xe94a, 0x1}) (async)
r13 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_ASSERT(r13, 0x0, 0xcf, &(0x7f0000000e00), 0x4) (async)
r14 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e80), r2) (async)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000ec0)={'wlan1\x00', <r16=>0x0})
sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r14, &(0x7f0000000f80)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000f40)={&(0x7f0000000f00)={0x28, r15, 0x4, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r16}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0xc0)

137.213124ms ago: executing program 1 (id=1191):
getsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f0000000000)=0xfff9, &(0x7f0000000040)=0x2)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x2d, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x1}, {}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}}, @alu={0x4, 0x0, 0x8, 0x4, 0x0, 0xfffffffffffffffe, 0x1}, @alu={0x4, 0x0, 0xc, 0x4, 0x8, 0x1, 0xffffffffffffffff}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @printk, @map_idx={0x18, 0x3, 0x5, 0x0, 0xb}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0xfe33}, @map_fd={0x18, 0xa}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0xab, &(0x7f0000000240)=""/171, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x1, 0x1}, 0x8, 0x10, &(0x7f0000000340)={0x2, 0x5, 0x9, 0x97}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000380)=[0x1, 0x1], &(0x7f00000003c0)=[{0x3, 0x4, 0x6, 0x6}], 0x10, 0x2a4}, 0x94)
ioctl$FS_IOC_GETFSSYSFSPATH(r0, 0x80811501, &(0x7f00000004c0)={0x80})
r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
setsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000580)={0x8, 0xe0}, 0x2)
r2 = socket$inet(0x2, 0x800, 0x8)
ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f00000005c0)={{0x2, 0x4e24, @multicast1}, {0x306, @broadcast}, 0x8, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x21}}, 'pim6reg\x00'})
setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000640)='dctcp-reno\x00', 0xb)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000680), &(0x7f00000006c0)=0x4)
r4 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_IMPORTANCE(r4, 0x10f, 0x7f, &(0x7f0000000700)=0x4, 0x4)
r5 = socket$inet6_udplite(0xa, 0x2, 0x88)
getsockopt$inet6_mreq(r3, 0x29, 0x15, &(0x7f0000000740)={@loopback, <r6=>0x0}, &(0x7f0000000780)=0x14)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000840)={'ip6gre0\x00', &(0x7f00000007c0)={'ip6_vti0\x00', r6, 0x29, 0x2e, 0x6, 0x0, 0x8, @remote, @private1, 0x80, 0x8000, 0x52, 0x80}})
getsockopt$inet_tcp_int(r2, 0x6, 0x19, &(0x7f0000000880), &(0x7f00000008c0)=0x4)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000940), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r7, &(0x7f0000000a80)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={0x90, r8, 0x2, 0x70bd27, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x1}, {0x8}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x7}, {0x8, 0x15, 0x5}}]}, 0x90}, 0x1, 0x0, 0x0, 0x4040884}, 0x8000)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000b00)={'wlan0\x00', <r9=>0x0})
sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r7, &(0x7f0000000bc0)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x34, 0x0, 0x2, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x1a866b94642bc4b0)
r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000c40), r7)
sendmsg$IPVS_CMD_GET_SERVICE(r7, &(0x7f0000000d80)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000c80)={0xac, r10, 0x800, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6b}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x43}]}, @IPVS_CMD_ATTR_DEST={0x38, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x80000000}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4000040}, 0x100)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000e80)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000e40)={&(0x7f0000000e00)=@ipv6_newroute={0x2c, 0x18, 0x200, 0x70bd26, 0x25dfdbfb, {0xa, 0x0, 0x4, 0xff, 0xfe, 0x0, 0xfe, 0xa, 0x1400}, [@RTA_MARK={0x8, 0x10, 0xa}, @RTA_MARK={0x8, 0x10, 0xf0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000)
r11 = epoll_create(0x131)
epoll_pwait(r11, &(0x7f0000000ec0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000f40)={[0x3]}, 0x8)
syz_genetlink_get_family_id$batadv(&(0x7f0000000f80), r7)
connect$inet6(r3, &(0x7f0000000fc0)={0xa, 0x4e22, 0x6, @private0, 0x7f}, 0x1c)
setsockopt$inet6_udp_int(r5, 0x11, 0x1, &(0x7f0000001000)=0x3, 0x4)
bpf$PROG_BIND_MAP(0x23, &(0x7f0000001080)={r0}, 0xc)

3.662386ms ago: executing program 2 (id=1192):
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_DETACH(0x9, &(0x7f000000ec40)={@fallback, 0xffffffffffffffff, 0x3, 0x34}, 0x20)
socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmsg$tipc(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="fb6bba8839fe8bc048c0cdafd1f8a9918bc4055eaaeb6db4ee9bcb25b1811dbf40b3a7da5a8a64db04ed6dd26eea2e3722", 0x31}], 0x1, 0x0, 0x0, 0x8000}, 0x0)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000006740)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000002c0)="851d8a90d516f218f839a7c48edfe734b2490c90a2fbf5be3383f1c9f5be8e55148723ac0258ef4f8af1f5e0b0a86885f018523d60072c7d9c1568700b3abe208fbd5dad2daf18b5150a530d816bf4cc6e43da4f2793611b38009e8c0970268cf5836926fd1223f4f8bec6a4a68b2aaff7af151a661793a04cd9b936da8f53eae22356781c580df817f3168269eaeeae014fa9b1878bd89e2acb4853ffd7b9a06d7f5ff090c605f5d343e6d93c80d747365d21acea", 0xb5}], 0x1}}], 0x1, 0x81)
r3 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000200)='syz1\x00', 0x200002, 0x0)
r4 = openat$cgroup_ro(r3, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600)
r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00'}, 0x10)
r6 = socket(0x200000000000011, 0x2, 0xd)
r7 = socket(0x200000000000011, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000280)={'syz_tun\x00', <r8=>0x0})
bind$packet(r7, &(0x7f0000000080)={0x11, 0x800, r8, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', <r9=>0x0})
bind$packet(r6, &(0x7f0000000080)={0x11, 0x800, r9, 0x1, 0x0, 0x6, @multicast}, 0x14)
setsockopt$packet_fanout(r6, 0x107, 0x12, 0x0, 0x0)
syz_emit_ethernet(0x32, &(0x7f0000000200)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x2, 0x10, 0x11, 0x0, @empty, @empty}, {0x4e22, 0x4e23, 0x10, 0x0, @gue={{0x2, 0x1, 0x3, 0x4, 0x0, @val=0x80}}}}}}}, 0x0)
pipe(&(0x7f0000000180)={<r10=>0xffffffffffffffff})
bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r5, 0xffffffffffffffff, 0x4, r10}, 0x10)
r11 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendmmsg(r11, &(0x7f0000000540)=[{{&(0x7f00000000c0)=@l2tp6={0xa, 0x0, 0x1000, @dev={0xfe, 0x80, '\x00', 0x11}, 0xa, 0x1}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000300)='>', 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="af9b00000000000084"], 0xfe61}}], 0x2, 0xc88c4)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0)
r12 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
ioctl$sock_netrom_SIOCADDRT(r12, 0x890b, &(0x7f0000000240)={0x1, @default, @bpq0, 0x0, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x4, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]})
recvmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000280)=""/48, 0x30}], 0x1}, 0x400060df)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'})
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff)

3.05449ms ago: executing program 1 (id=1193):
r0 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=@framed={{0x6a, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x41}}, &(0x7f0000000480)='GPL\x00'}, 0x80)
setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000000)=0xfffffffe, 0x4)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
socket$kcm(0xa, 0x922000000003, 0x11)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$kcm(0xa, 0x922000000003, 0x11)
setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f00000000c0), 0x4)
sendmsg$sock(r1, 0x0, 0x0)
socket$inet6_mptcp(0xa, 0x1, 0x106)
r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
syz_genetlink_get_family_id$wireguard(&(0x7f0000000080), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xe, 0x4, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1800000000000000000000000000000071100a000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, r2}, 0x94)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0xc0}}, 0x20004800)
r4 = socket$inet6(0xa, 0x2, 0x0)
r5 = socket(0x10, 0x803, 0x0)
getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newlink={0x38, 0x10, 0x437, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r6, 0x5120b}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010)
sendmmsg$inet(r4, 0x0, 0x0, 0x8000004)
writev(r4, 0x0, 0x0)
sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000800)
r7 = socket$isdn(0x22, 0x3, 0x1)
sendto$isdn(r7, &(0x7f00000004c0)={0x4, 0x3, "31992d3bc4c976f6adbc8e18cb017bdbbffdb1eeff138a9ecd6921a307a891283427f13c15adedf1459481c6ccb1355d9f7c1865122888aa26beeecdf8cf5546de6f132cb6329af825a987da5f48721bd4def402d0031b22f2f2edf00d2379bd7db3503917b50a65b432624ab5d9aa3887ba164d38dd9f6b30f1d9f679"}, 0x85, 0x44, &(0x7f0000000140)={0x22, 0x7, 0x10, 0x9, 0x28}, 0x6)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000100)=@ethtool_link_settings={0x4d, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4c, 0x20, 0x8, [0x0, 0x0, 0x0, 0xc, 0x5, 0x0, 0x0, 0x2], [0x5, 0xfffffffd, 0xb0a]}})

1.565302ms ago: executing program 0 (id=1194):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket(0x1, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000100)=@req3={0x24d4c445, 0x3, 0x1, 0x1, 0x80000001, 0x2, 0x2}, 0x1c)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$kcm(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1c0000004a008102e0", 0x9}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe", 0x13}], 0x2, 0x0, 0x0, 0x10}, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)="8724866f", 0x4}], 0x1)
poll(&(0x7f0000000000), 0x20000000000000b5, 0x9)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x8, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1a04"], 0x0, 0x2, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
close(r3)
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff6)
ioctl$TUNGETVNETLE(r3, 0x4010744d, &(0x7f0000000180))
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=ANY=[@ANYBLOB="500500003e000701feffffff00000000017c0000040042800c00018006000600800a00002c050280280514802405198020"], 0x550}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
r7 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r7, 0x1, 0x70bd26, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x80)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000ef29796085f480c96dbfa87f39c53bf92179bc2882b4bc96406db2431e62eeec48b7fc897b7b93093a91c7af1ec01c4ac4a8800a4b0cc1e337461042cc9378d63f99adcc7409f6e7f563d1d5de672c9ee902491962840f4eee54cc47c11404f6f8442c79060844ca2b4f050c1d0871f65d37715f86d88c86cd6962b62731f016e4571003400cc32f787dfb3bed480e5d5480487fcb3eb2996da98af79c7e1c829deca8c05ac7fe179d0988ab156cedd2fef8fe416d014dbe3619e2e4225fff63e3b09c48423ae7de10f47f5ccc578eebafe26cffc0046a4fdd87bc470fc63268a9075385676c5745a2d979d19abebd21bb0d31b914ea6913a2464e7ede43085c335e1d7b6bcbaba1fe52c51c4e678434b7971524722c60f5dfca00", @ANYRES16=r6, @ANYBLOB="31830000000000000000190000000c0001800800030007000000"], 0x20}}, 0x0)

0s ago: executing program 1 (id=1195):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xe, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0x81}]}, &(0x7f0000000c40)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r0}, 0x18)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="120000000f0000000800000002"], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000680)={r1, &(0x7f0000001040), 0x0}, 0x20)
r2 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x4b, &(0x7f0000000100)=0x4, 0x4)
bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2}, 0x1c)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x137b}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GENEVE_PORT={0x6, 0x5, 0x4e20}, @IFLA_GENEVE_COLLECT_METADATA={0x4}]}}}]}, 0x40}}, 0x40800)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:62592' (ED25519) to the list of known hosts.
syzkaller login: [   48.058053][ T5772] cgroup: Unknown subsys name 'net'
[   48.202220][ T5772] cgroup: Unknown subsys name 'cpuset'
[   48.205803][ T5772] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.079005][ T5772] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   54.236407][ T5843] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   54.244478][ T5851] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   54.247954][ T5851] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   54.251841][ T5851] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   54.255950][ T5852] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   54.259222][ T5851] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   54.266033][ T5847] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   54.268805][ T5847] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   54.272811][ T5847] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   54.275414][ T5847] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   54.297480][ T5852] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   54.302637][ T5847] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   54.305543][ T5852] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   54.309217][ T5852] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   54.312786][ T5847] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   54.596595][ T5840] chnl_net:caif_netlink_parms(): no params data found
[   54.636936][ T5844] chnl_net:caif_netlink_parms(): no params data found
[   54.693554][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.696744][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.699244][ T5840] bridge_slave_0: entered allmulticast mode
[   54.703839][ T5840] bridge_slave_0: entered promiscuous mode
[   54.707896][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.710698][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.713415][ T5840] bridge_slave_1: entered allmulticast mode
[   54.716606][ T5840] bridge_slave_1: entered promiscuous mode
[   54.720185][ T5845] chnl_net:caif_netlink_parms(): no params data found
[   54.763860][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.769133][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.821653][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.824563][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.827558][ T5844] bridge_slave_0: entered allmulticast mode
[   54.831944][ T5844] bridge_slave_0: entered promiscuous mode
[   54.836726][ T5840] team0: Port device team_slave_0 added
[   54.848683][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.851742][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.854719][ T5844] bridge_slave_1: entered allmulticast mode
[   54.858360][ T5844] bridge_slave_1: entered promiscuous mode
[   54.862845][ T5840] team0: Port device team_slave_1 added
[   54.918325][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.922322][ T5845] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.925430][ T5845] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.928471][ T5845] bridge_slave_0: entered allmulticast mode
[   54.932436][ T5845] bridge_slave_0: entered promiscuous mode
[   54.935869][ T5845] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.938586][ T5845] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.941684][ T5845] bridge_slave_1: entered allmulticast mode
[   54.944898][ T5845] bridge_slave_1: entered promiscuous mode
[   54.949204][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.951947][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.962213][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.968533][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.017885][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.021483][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.030659][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.042650][ T5844] team0: Port device team_slave_0 added
[   55.046994][ T5845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.052207][ T5844] team0: Port device team_slave_1 added
[   55.070716][ T5845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.079082][ T5840] hsr_slave_0: entered promiscuous mode
[   55.084772][ T5840] hsr_slave_1: entered promiscuous mode
[   55.134524][ T5845] team0: Port device team_slave_0 added
[   55.136958][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.140056][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.152213][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.178990][ T5845] team0: Port device team_slave_1 added
[   55.182851][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.185789][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.196992][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.275667][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.278533][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.287850][ T5845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.292820][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.295069][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.305217][ T5845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.356441][ T5844] hsr_slave_0: entered promiscuous mode
[   55.361063][ T5844] hsr_slave_1: entered promiscuous mode
[   55.363965][ T5844] debugfs: 'hsr0' already exists in 'hsr'
[   55.366308][ T5844] Cannot create hsr debugfs directory
[   55.408974][ T5845] hsr_slave_0: entered promiscuous mode
[   55.411571][ T5845] hsr_slave_1: entered promiscuous mode
[   55.413966][ T5845] debugfs: 'hsr0' already exists in 'hsr'
[   55.416046][ T5845] Cannot create hsr debugfs directory
[   55.565066][ T5840] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   55.571725][ T5840] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   55.586465][ T5840] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   55.593323][ T5840] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   55.661305][ T5844] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   55.682790][ T5844] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   55.702968][ T5844] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   55.710941][ T5844] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   55.739239][ T5845] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   55.745941][ T5845] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   55.752945][ T5845] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   55.757922][ T5845] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   55.790113][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.834859][ T5840] 8021q: adding VLAN 0 to HW filter on device team0
[   55.846743][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.849815][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.874391][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.877388][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.927201][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.950942][ T5844] 8021q: adding VLAN 0 to HW filter on device team0
[   55.957560][ T5845] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.974004][ T5845] 8021q: adding VLAN 0 to HW filter on device team0
[   55.982672][  T713] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.985108][  T713] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.989231][  T713] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.991891][  T713] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.999838][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.002636][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.031466][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.034392][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.114960][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.183477][ T5840] veth0_vlan: entered promiscuous mode
[   56.200831][ T5840] veth1_vlan: entered promiscuous mode
[   56.231820][ T5845] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.252304][ T5840] veth0_macvtap: entered promiscuous mode
[   56.263258][ T5840] veth1_macvtap: entered promiscuous mode
[   56.274678][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.293430][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.307588][ T5845] veth0_vlan: entered promiscuous mode
[   56.311058][ T5843] Bluetooth: hci0: command tx timeout
[   56.312176][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.327515][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.333734][ T5845] veth1_vlan: entered promiscuous mode
[   56.338022][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.348636][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.357042][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.389882][ T5843] Bluetooth: hci2: command tx timeout
[   56.392064][ T5843] Bluetooth: hci1: command tx timeout
[   56.395073][ T5844] veth0_vlan: entered promiscuous mode
[   56.406443][ T5844] veth1_vlan: entered promiscuous mode
[   56.424503][ T5845] veth0_macvtap: entered promiscuous mode
[   56.435273][ T5845] veth1_macvtap: entered promiscuous mode
[   56.460020][ T1092] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.464825][ T1092] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.465312][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.487848][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.502407][ T5844] veth0_macvtap: entered promiscuous mode
[   56.506578][ T5844] veth1_macvtap: entered promiscuous mode
[   56.514645][   T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.520323][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.524219][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.525047][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.526993][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.534877][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.549308][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.575515][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.576814][ T5840] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   56.585556][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.588787][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.606932][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.615456][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.651981][ T1092] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.655458][ T1092] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.674244][ T5909] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   56.727428][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.732594][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.755889][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.766849][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.799717][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.803239][ T5911] tipc: Started in network mode
[   56.805074][ T5911] tipc: Node identity 7262e1b2b25, cluster identity 4711
[   56.808131][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.812438][ T5911] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   56.816512][ T5911] syzkaller0: entered promiscuous mode
[   56.818438][ T5911] syzkaller0: entered allmulticast mode
[   56.845517][ T5911] tipc: Resetting bearer <eth:syzkaller0>
[   56.979963][ T5929] netlink: 92 bytes leftover after parsing attributes in process `syz.1.7'.
[   57.178435][ T5937] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10'.
[   57.182955][ T5937] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10'.
[   57.186953][ T5937] netlink: 'syz.2.10': attribute type 5 has an invalid length.
[   57.193358][ T5937] netlink: 'syz.2.10': attribute type 6 has an invalid length.
[   57.287509][ T5943] netlink: 44 bytes leftover after parsing attributes in process `syz.2.12'.
[   57.603579][ T5910] tipc: Resetting bearer <eth:syzkaller0>
[   57.613077][ T5910] tipc: Disabling bearer <eth:syzkaller0>
[   57.726288][ T5948] netlink: 40 bytes leftover after parsing attributes in process `syz.0.14'.
[   57.950457][ T5963] netlink: 28 bytes leftover after parsing attributes in process `syz.0.19'.
[   57.953996][ T5963] netlink: 44 bytes leftover after parsing attributes in process `syz.0.19'.
[   58.390801][ T5843] Bluetooth: hci0: command tx timeout
[   58.455282][ T6001] warning: `syz.1.29' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   58.469703][ T5843] Bluetooth: hci1: command tx timeout
[   58.470243][ T5852] Bluetooth: hci2: command tx timeout
[   58.474602][ T6001] syzkaller1: entered promiscuous mode
[   58.476975][ T6001] syzkaller1: entered allmulticast mode
[   58.483308][ T6001] netlink: 19 bytes leftover after parsing attributes in process `syz.1.29'.
[   59.279196][ T6015] netlink: 56 bytes leftover after parsing attributes in process `syz.2.33'.
[   59.460745][ T6033] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes.
[   59.555079][ T6038] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   59.693460][ T6038] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   59.734470][ T6038] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   59.807676][ T6038] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   59.932339][   T13] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.946225][   T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.958617][   T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.962328][   T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   60.469725][ T5852] Bluetooth: hci0: command tx timeout
[   60.552934][ T5852] Bluetooth: hci2: command tx timeout
[   60.561371][ T5852] Bluetooth: hci1: command tx timeout
[   60.632519][ T6082] netlink: 256 bytes leftover after parsing attributes in process `syz.0.50'.
[   60.826231][ T6094] gretap1: entered allmulticast mode
[   60.970553][ T6109] Zero length message leads to an empty skb
[   61.387693][ T6141] pimreg: entered allmulticast mode
[   61.599101][ T6152] netlink: 'syz.1.73': attribute type 1 has an invalid length.
[   61.699085][ T6152] gretap1: entered promiscuous mode
[   61.742241][ T6152] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   61.788452][ T6164] : entered promiscuous mode
[   62.302767][ T6190] openvswitch: netlink: IPv4 frag type 255 is out of range max 2
[   62.310282][ T6190] geneve2: entered promiscuous mode
[   62.392359][ T6196] sctp: [Deprecated]: syz.0.86 (pid 6196) Use of int in maxseg socket option.
[   62.392359][ T6196] Use struct sctp_assoc_value instead
[   62.629782][ T5852] Bluetooth: hci1: command tx timeout
[   62.630099][ T5843] Bluetooth: hci2: command tx timeout
[   62.635309][ T6200] netlink: 'syz.0.88': attribute type 1 has an invalid length.
[   62.701346][ T6200] 8021q: adding VLAN 0 to HW filter on device bond1
[   62.819556][ T6204] syz.0.89 uses obsolete (PF_INET,SOCK_PACKET)
[   63.094022][ T6212] __nla_validate_parse: 3 callbacks suppressed
[   63.094031][ T6212] netlink: 12 bytes leftover after parsing attributes in process `syz.0.92'.
[   63.377486][ T6242] netlink: 20 bytes leftover after parsing attributes in process `syz.0.99'.
[   63.385038][ T6244] netlink: 224 bytes leftover after parsing attributes in process `syz.2.101'.
[   63.473862][ T6247] trusted_key: syz.1.100 sent an empty control message without MSG_MORE.
[   63.484207][ T6242] netlink: 16 bytes leftover after parsing attributes in process `syz.0.99'.
[   63.535632][ T6249] netlink: 16 bytes leftover after parsing attributes in process `syz.2.102'.
[   63.539296][ T6249] netlink: 4 bytes leftover after parsing attributes in process `syz.2.102'.
[   63.572452][ T6249] netlink: 8 bytes leftover after parsing attributes in process `syz.2.102'.
[   63.635999][ T6260] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.653204][ T6264] netlink: 36 bytes leftover after parsing attributes in process `syz.2.105'.
[   63.675278][ T6267] netlink: 'syz.1.107': attribute type 1 has an invalid length.
[   63.678431][ T6269] netlink: 'syz.1.107': attribute type 1 has an invalid length.
[   63.731164][ T6260] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.805736][ T6260] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.841639][ T6283] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.852535][ T6260] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.905607][ T6283] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.946464][ T5874] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   63.954088][   T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   63.968801][   T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   63.997321][ T6283] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   64.004207][   T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.063565][ T6283] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   64.127477][   T13] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.136852][   T13] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.144932][   T13] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.156528][   T13] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.162397][ T6293] netlink: 12 bytes leftover after parsing attributes in process `syz.1.115'.
[   64.414538][ T6307] IPv6: addrconf: prefix option has invalid lifetime
[   64.456954][ T6309] netlink: 248 bytes leftover after parsing attributes in process `syz.1.122'.
[   64.611754][ T6318] ip6gretap0: entered promiscuous mode
[   64.614001][ T6318] macsec1: entered promiscuous mode
[   64.616305][ T6318] macsec1: entered allmulticast mode
[   64.618778][ T6318] ip6gretap0: entered allmulticast mode
[   64.858617][ T6333] ip6tnl1: entered promiscuous mode
[   64.861185][ T6333] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   65.087532][ T6355] netlink: 'syz.0.136': attribute type 1 has an invalid length.
[   65.104096][ T6350] syzkaller1: entered allmulticast mode
[   65.490153][ T6384] !: renamed from dummy0 (while UP)
[   65.844591][ T6417] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.923539][ T6417] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.993317][ T6417] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   66.054806][ T6417] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   66.155049][ T5874] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.158455][ T5874] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.180197][ T5874] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.190901][ T5874] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.729808][ T6499] netlink: 'syz.2.157': attribute type 1 has an invalid length.
[   66.757614][ T6499] bond1: entered promiscuous mode
[   66.760288][ T6499] 8021q: adding VLAN 0 to HW filter on device bond1
[   66.790470][ T6499] 8021q: adding VLAN 0 to HW filter on device bond1
[   66.793634][ T6499] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address
[   66.803383][ T6499] bond1: (slave vxcan3): Setting fail_over_mac to active for active-backup mode
[   66.812280][ T6499] bond1: (slave vxcan3): making interface the new active one
[   66.818618][ T6499] vxcan3: entered promiscuous mode
[   66.825637][ T6499] bond1: (slave vxcan3): Enslaving as an active interface with an up link
[   66.874935][ T6498] netlink: 'syz.1.158': attribute type 1 has an invalid length.
[   66.881793][ T6498] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   67.274554][ T6527] ip6erspan0: entered allmulticast mode
[   67.415939][ T6534] bridge1: port 1(veth0_to_bond) entered blocking state
[   67.419031][ T6534] bridge1: port 1(veth0_to_bond) entered disabled state
[   67.422943][ T6534] veth0_to_bond: entered allmulticast mode
[   67.427175][ T6534] veth0_to_bond: entered promiscuous mode
[   67.668676][ T6546] netlink: 'syz.1.171': attribute type 15 has an invalid length.
[   67.986046][ T6567] netlink: 'syz.1.178': attribute type 1 has an invalid length.
[   68.033609][ T6567] 8021q: adding VLAN 0 to HW filter on device bond2
[   68.052356][ T6567] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 4300
[   68.056777][ T6567] 8021q: VLANs not supported on gre0
[   68.383632][ T6591] netlink: 'syz.0.184': attribute type 1 has an invalid length.
[   68.406830][ T6591] bond2: entered promiscuous mode
[   68.410722][ T6591] 8021q: adding VLAN 0 to HW filter on device bond2
[   68.427039][ T6591] 8021q: adding VLAN 0 to HW filter on device bond2
[   68.438446][ T6591] bond2: (slave wireguard0): The slave device specified does not support setting the MAC address
[   68.442424][ T6591] bond2: (slave wireguard0): Setting fail_over_mac to active for active-backup mode
[   68.449821][ T6591] bond2: (slave wireguard0): making interface the new active one
[   68.452608][ T6591] wireguard0: entered promiscuous mode
[   68.455164][ T6591] bond2: (slave wireguard0): Enslaving as an active interface with an up link
[   68.463056][ T6591] netlink: 'syz.0.184': attribute type 13 has an invalid length.
[   68.466002][ T6591] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT
[   68.468469][ T6591] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   68.471006][ T6591] IPv6: NLM_F_CREATE should be set when creating new route
[   68.473704][ T6591] IPv6: NLM_F_CREATE should be set when creating new route
[   68.478708][ T6591] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   68.486862][ T6591] bond2: (slave wireguard1): The slave device specified does not support setting the MAC address
[   68.494592][ T6591] bond2: (slave wireguard1): Enslaving as a backup interface with an up link
[   68.604147][ T6610] __nla_validate_parse: 8 callbacks suppressed
[   68.604158][ T6610] netlink: 12 bytes leftover after parsing attributes in process `syz.0.188'.
[   68.614549][ T6610] netlink: 12 bytes leftover after parsing attributes in process `syz.0.188'.
[   68.633284][ T6610] netlink: 8 bytes leftover after parsing attributes in process `syz.0.188'.
[   68.795210][ T6621] netlink: 24 bytes leftover after parsing attributes in process `syz.0.192'.
[   68.908125][ T6630] netlink: 8 bytes leftover after parsing attributes in process `syz.0.196'.
[   69.308495][ T6653] netlink: 40 bytes leftover after parsing attributes in process `syz.2.204'.
[   69.314437][ T6653] netlink: 40 bytes leftover after parsing attributes in process `syz.2.204'.
[   69.327115][ T6653] netlink: 32 bytes leftover after parsing attributes in process `syz.2.204'.
[   69.380897][ T6654] netlink: 4 bytes leftover after parsing attributes in process `syz.0.202'.
[   69.385191][    C1] vcan0: j1939_tp_txtimer: 0xffff88810a9a4400: tx aborted with unknown reason: -2
[   69.389717][    C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88810a9a4800: 0x00000: (250) Any other reason (if a Connection Abort reason is identified that is not listed in the table use code 250)
[   70.144759][ T6695] netlink: 24 bytes leftover after parsing attributes in process `syz.1.211'.
[   70.257493][ T6707] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: invalid value (71)
[   70.263385][ T6707] Bluetooth: MGMT ver 1.23
[   70.437857][ T6721] 8021q: VLANs not supported on ip6tnl0
[   70.481101][ T6723] syzkaller0: entered promiscuous mode
[   70.483121][ T6723] syzkaller0: entered allmulticast mode
[   70.488683][ T6721] netlink: 'syz.2.218': attribute type 1 has an invalid length.
[   70.518171][ T6721] 8021q: adding VLAN 0 to HW filter on device bond3
[   70.617665][ T6721] bond3: (slave veth3): Enslaving as an active interface with a down link
[   70.628917][ T6732] 8021q: adding VLAN 0 to HW filter on device batadv1
[   70.639771][ T6732] bond3: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open
[   71.276670][ T1366] ieee802154 phy0 wpan0: encryption failed: -22
[   71.279124][ T1366] ieee802154 phy1 wpan1: encryption failed: -22
[   71.648509][ T6755] netlink: 'syz.1.229': attribute type 11 has an invalid length.
[   71.653936][ T6755] netlink: 'syz.1.229': attribute type 4 has an invalid length.
[   71.813040][ T6768] netlink: 'syz.1.233': attribute type 7 has an invalid length.
[   72.024441][ T6785] batadv1: entered promiscuous mode
[   72.034790][ T6787] netlink: 'syz.2.239': attribute type 12 has an invalid length.
[   72.136402][ T6785] IPVS: dh: UDP 224.0.0.2:0 - no destination available
[   72.140725][ T6513] IPVS: starting estimator thread 0...
[   72.229773][ T6791] IPVS: using max 45 ests per chain, 108000 per kthread
[   72.312165][ T5843] Bluetooth: hci2: Opcode 0x0401 failed: -110
[   72.315719][ T5843] Bluetooth: hci2: command 0x0401 tx timeout
[   75.337387][ T6807] syzkaller1: entered promiscuous mode
[   75.341978][ T6807] syzkaller1: entered allmulticast mode
[   75.573205][ T6826] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled
[   75.791593][ T6835] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   75.847969][ T6835] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   75.857493][ T6844] Bluetooth: MGMT ver 1.23
[   75.908344][ T6835] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   75.917192][ T6848] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[   75.959013][ T6835] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   76.034548][   T12] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   76.051809][   T12] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   76.054635][   T12] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   76.064655][ T6848] __nla_validate_parse: 8 callbacks suppressed
[   76.064667][ T6848] netlink: 8 bytes leftover after parsing attributes in process `syz.2.258'.
[   76.070089][   T12] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   76.073274][ T6848] netlink: 12 bytes leftover after parsing attributes in process `syz.2.258'.
[   76.077571][ T6848] netlink: 8 bytes leftover after parsing attributes in process `syz.2.258'.
[   76.080920][ T6848] netlink: 12 bytes leftover after parsing attributes in process `syz.2.258'.
[   76.208669][ T6869] syzkaller1: entered promiscuous mode
[   76.210702][ T6869] syzkaller1: entered allmulticast mode
[   76.231610][ T6869] bond0: entered promiscuous mode
[   76.233329][ T6869] bond_slave_0: entered promiscuous mode
[   76.235289][ T6869] bond_slave_1: entered promiscuous mode
[   76.239246][ T6869] batadv0: entered promiscuous mode
[   76.249476][ T6869] 8021q: adding VLAN 0 to HW filter on device hsr1
[   76.333596][ T6871] netlink: 24 bytes leftover after parsing attributes in process `syz.1.263'.
[   76.337200][ T6872] netlink: 24 bytes leftover after parsing attributes in process `syz.1.263'.
[   76.371333][ T6875] netlink: 20 bytes leftover after parsing attributes in process `syz.1.264'.
[   76.684847][ T6881] netlink: 172 bytes leftover after parsing attributes in process `syz.2.267'.
[   76.784899][ T6898] netlink: 8 bytes leftover after parsing attributes in process `syz.0.272'.
[   76.799155][ T6900] netlink: 'syz.1.273': attribute type 1 has an invalid length.
[   76.805733][ T6898] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   76.832151][ T6900] bond3: (slave vcan1): The slave device specified does not support setting the MAC address
[   76.836426][ T6900] bond3: (slave vcan1): Setting fail_over_mac to active for active-backup mode
[   76.844311][ T6900] bond3: (slave vcan1): making interface the new active one
[   76.847851][ T6900] bond3: (slave vcan1): Enslaving as an active interface with an up link
[   76.858949][ T6900] bond3: (slave vcan2): The slave device specified does not support setting the MAC address
[   76.866311][ T6900] bond3: (slave vcan2): Enslaving as a backup interface with an up link
[   76.876537][ T6898] tipc: Resetting bearer <eth:syzkaller0>
[   76.880969][ T6900] 8021q: adding VLAN 0 to HW filter on device bond3
[   76.899667][ T6897] tipc: Disabling bearer <eth:syzkaller0>
[   76.989141][ T6905] netlink: 36 bytes leftover after parsing attributes in process `syz.0.275'.
[   77.348927][ T6924] _Z`Ԁ@: entered promiscuous mode
[   78.064545][ T6954] netlink: 'syz.2.293': attribute type 10 has an invalid length.
[   78.273792][ T6964] netlink: 'syz.0.298': attribute type 2 has an invalid length.
[   78.280106][ T6964] k*]: entered promiscuous mode
[   78.308661][ T6964] bond_slave_1: entered promiscuous mode
[   78.311630][ T6964] bond_slave_1: entered allmulticast mode
[   78.643945][ T6987] delete_channel: no stack
[   78.907292][ T6996] macvlan2: entered promiscuous mode
[   78.947376][ T6999] netlink: 'syz.2.310': attribute type 14 has an invalid length.
[   79.226411][ T7012] bond4: entered promiscuous mode
[   79.230386][ T7012] 8021q: adding VLAN 0 to HW filter on device bond4
[   79.240638][ T7012] 8021q: adding VLAN 0 to HW filter on device bond4
[   79.243196][ T7012] bond4: (slave vcan1): The slave device specified does not support setting the MAC address
[   79.247726][ T7012] bond4: (slave vcan1): Error -95 calling set_mac_address
[   79.577414][ T7037] 8021q: adding VLAN 0 to HW filter on device bond5
[   79.581928][ T7037] bond5: entered promiscuous mode
[   79.584528][ T7037] bond0: (slave bond5): Enslaving as an active interface with an up link
[   79.812215][ T7052] Driver unsupported XDP return value 0 on prog  (id 206) dev N/A, expect packet loss!
[   80.009318][ T7066] can: request_module (can-proto-0) failed.
[   80.623801][ T7097] netlink: 'syz.1.344': attribute type 1 has an invalid length.
[   80.688568][ T7102] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   80.733605][ T7102] vlan2: entered promiscuous mode
[   80.735724][ T7102] team0: entered promiscuous mode
[   80.737781][ T7102] team_slave_0: entered promiscuous mode
[   80.742202][ T7102] team_slave_1: entered promiscuous mode
[   80.747180][ T7102] team0: Device vlan2 is already an upper device of the team interface
[   80.907288][ T7114] bridge0: port 2(bridge_slave_1) entered disabled state
[   80.910308][ T7114] bridge0: port 1(bridge_slave_0) entered disabled state
[   80.945817][ T7114] bond_slave_1: left promiscuous mode
[   80.947611][ T7114] bond_slave_1: left allmulticast mode
[   80.965095][ T7114] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   80.976617][ T7114] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   81.068118][ T7114] ip6erspan0: left allmulticast mode
[   81.073872][ T7114] bond2: left promiscuous mode
[   81.075605][ T7114] wireguard0: left promiscuous mode
[   81.085226][ T7114] macvlan2: left promiscuous mode
[   81.098806][ T7119] hsr_slave_0: left promiscuous mode
[   81.103518][ T7119] hsr_slave_1: left promiscuous mode
[   81.129105][   T13] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[   81.138885][   T13] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[   81.152321][   T13] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[   81.159328][   T13] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[   81.170142][ T7118] syzkaller1: entered promiscuous mode
[   81.183392][ T7118] syzkaller1: entered allmulticast mode
[   81.191406][ T7118] __nla_validate_parse: 11 callbacks suppressed
[   81.191415][ T7118] netlink: 4 bytes leftover after parsing attributes in process `syz.2.351'.
[   81.523784][   T47] cfg80211: failed to load regulatory.db
[   81.550753][ T7141] netlink: 24 bytes leftover after parsing attributes in process `syz.2.355'.
[   81.670545][ T7147] netlink: 'syz.1.358': attribute type 4 has an invalid length.
[   81.760692][ T7152] netlink: 4208 bytes leftover after parsing attributes in process `syz.1.360'.
[   81.932397][ T7160] bond0: option xmit_hash_policy: invalid value (8)
[   82.021725][ T7167] netlink: 'syz.1.365': attribute type 10 has an invalid length.
[   82.024847][ T7167] bridge0: port 2(bridge_slave_1) entered disabled state
[   82.028315][ T7167] bridge0: port 1(bridge_slave_0) entered disabled state
[   82.035443][ T7162] netlink: 'syz.2.364': attribute type 10 has an invalid length.
[   82.037057][ T7167] bridge0: port 2(bridge_slave_1) entered blocking state
[   82.041144][ T7163] netlink: 'syz.2.364': attribute type 10 has an invalid length.
[   82.041549][ T7167] bridge0: port 2(bridge_slave_1) entered forwarding state
[   82.048601][ T7167] bridge0: port 1(bridge_slave_0) entered blocking state
[   82.051904][ T7167] bridge0: port 1(bridge_slave_0) entered forwarding state
[   82.062137][ T7167] bond0: (slave bridge0): Enslaving as an active interface with an up link
[   82.069152][ T7167] netlink: 4 bytes leftover after parsing attributes in process `syz.1.365'.
[   82.079343][ T7163] team0: Device veth0_vlan failed to register rx_handler
[   82.091459][ T7162] team0: Device veth0_vlan failed to register rx_handler
[   82.102009][ T7167] bridge_slave_1: left allmulticast mode
[   82.104119][ T7167] bridge_slave_1: left promiscuous mode
[   82.106150][ T7167] bridge0: port 2(bridge_slave_1) entered disabled state
[   82.110769][ T7167] bridge_slave_0: left allmulticast mode
[   82.112923][ T7167] bridge_slave_0: left promiscuous mode
[   82.115452][ T7167] bridge0: port 1(bridge_slave_0) entered disabled state
[   82.130316][ T7167] bond0: (slave bridge0): Releasing backup interface
[   82.173582][ T7171] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551607)
[   82.177778][ T7171] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647
[   82.196949][ T7171] netlink: 36 bytes leftover after parsing attributes in process `syz.2.366'.
[   82.231674][ T7173] IPVS: set_ctl: invalid protocol: 0 172.30.0.3:20001
[   82.399141][ T7182] netlink: 'syz.1.369': attribute type 7 has an invalid length.
[   82.599141][ T7204] netlink: 228 bytes leftover after parsing attributes in process `syz.1.373'.
[   82.826182][ T7217] netlink: 12 bytes leftover after parsing attributes in process `syz.2.379'.
[   83.607854][ T7256] netlink: 96 bytes leftover after parsing attributes in process `syz.2.392'.
[   84.032525][ T7300] netlink: 12 bytes leftover after parsing attributes in process `syz.2.403'.
[   84.426279][ T7324] bridge4: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms)
[   84.440220][ T7324] netlink: 4 bytes leftover after parsing attributes in process `syz.2.409'.
[   84.497164][ T7328] netlink: 'syz.2.412': attribute type 10 has an invalid length.
[   84.577784][ T7326] team_slave_0: left promiscuous mode
[   84.585040][ T7326] team0 (unregistering): Port device team_slave_0 removed
[   84.588267][ T7326] team_slave_1: left promiscuous mode
[   84.595437][ T7326] team0 (unregistering): Port device team_slave_1 removed
[   84.666091][ T7341] openvswitch: netlink: Flow actions attr not present in new flow.
[   84.671986][ T7341] openvswitch: netlink: Flow actions attr not present in new flow.
[   86.128196][ T7429] netlink: 'syz.1.441': attribute type 1 has an invalid length.
[   86.155863][ T7429] vlan2: entered allmulticast mode
[   86.157721][ T7429] veth1: entered allmulticast mode
[   86.384676][ T7444] (unnamed net_device) (uninitialized): option use_carrier: invalid value (9)
[   86.415030][ T7446] netlink: 'syz.2.447': attribute type 11 has an invalid length.
[   86.418278][ T7446] netlink: 'syz.2.447': attribute type 4 has an invalid length.
[   86.421834][ T7446] __nla_validate_parse: 8 callbacks suppressed
[   86.421845][ T7446] netlink: 224 bytes leftover after parsing attributes in process `syz.2.447'.
[   97.412052][ T7468] openvswitch: netlink: IP tunnel dst address not specified
[   97.412978][ T7470] netlink: 52 bytes leftover after parsing attributes in process `syz.1.452'.
[   97.417049][ T7464] can: request_module (can-proto-0) failed.
[   97.482749][ T7475] netlink: 'syz.0.454': attribute type 3 has an invalid length.
[   97.525129][ T7470] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   97.530833][ T7470] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   97.624658][ T7470] ip6gretap0: left allmulticast mode
[   97.626551][ T7470] macsec1: left promiscuous mode
[   97.628550][ T7470] macsec1: left allmulticast mode
[   97.637151][ T7470] ip6tnl1: left promiscuous mode
[   97.643052][ T5857] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[   97.646063][ T5857] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[   97.649024][ T5857] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[   97.654113][ T5857] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[   97.744521][ T7496] netlink: 4 bytes leftover after parsing attributes in process `syz.2.459'.
[   97.754438][ T7496] erspan0: entered promiscuous mode
[   97.756593][ T7496] macvtap1: entered promiscuous mode
[   97.759116][ T7496] macvtap1: entered allmulticast mode
[   97.763440][ T7496] erspan0: entered allmulticast mode
[   97.803557][ T7501] netlink: 'syz.0.460': attribute type 30 has an invalid length.
[   97.931875][ T7504] netlink: 'syz.2.461': attribute type 10 has an invalid length.
[   97.935056][ T5297] udevd[5297]: worker [7484] terminated by signal 33 (Unknown signal 33)
[   97.937882][ T5297] udevd[5297]: worker [7484] failed while handling '/devices/virtual/block/loop1'
[   98.128916][ T7539] netlink: 10 bytes leftover after parsing attributes in process `syz.0.472'.
[   98.404592][ T7559] netlink: 8 bytes leftover after parsing attributes in process `syz.1.479'.
[   98.408200][ T7559] netlink: 4 bytes leftover after parsing attributes in process `syz.1.479'.
[   98.997933][ T7608] netlink: 'syz.2.488': attribute type 1 has an invalid length.
[   99.023536][ T7608] 8021q: adding VLAN 0 to HW filter on device bond6
[   99.036838][ T7608] bond6: (slave gretap3): making interface the new active one
[   99.041181][ T7608] bond6: (slave gretap3): Enslaving as an active interface with an up link
[   99.358547][ T7633] netlink: 8 bytes leftover after parsing attributes in process `syz.2.494'.
[   99.468681][ T7638] netlink: 24 bytes leftover after parsing attributes in process `syz.0.496'.
[   99.648372][ T7647] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   99.652420][ T7647] syzkaller0: entered promiscuous mode
[   99.654225][ T7647] syzkaller0: entered allmulticast mode
[   99.658247][ T7647] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) !
[   99.668004][ T7649] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.500'.
[   99.673317][ T7647] tipc: Resetting bearer <eth:syzkaller0>
[   99.676701][ T7646] tipc: Resetting bearer <eth:syzkaller0>
[   99.701279][ T7646] tipc: Disabling bearer <eth:syzkaller0>
[  100.105296][ T7660] infiniband syz0: set down
[  100.118350][ T7663] sctp: [Deprecated]: syz.0.504 (pid 7663) Use of struct sctp_assoc_value in delayed_ack socket option.
[  100.118350][ T7663] Use struct sctp_sack_info instead
[  100.138787][ T7660] infiniband syz0: added veth1_to_hsr
[  100.203878][ T7660] RDS/IB: syz0: added
[  100.207515][ T7660] smc: adding ib device syz0 with port count 1
[  100.214427][ T7660] smc:    ib device syz0 port 1 has pnetid 
[  100.559158][ T7688] netlink: 248 bytes leftover after parsing attributes in process `syz.1.513'.
[  100.616995][ T7691] netlink: 28 bytes leftover after parsing attributes in process `syz.2.514'.
[  100.696691][ T7691] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  101.510291][ T7748] bridge3: entered allmulticast mode
[  101.748875][ T7760] syzkaller0: entered allmulticast mode
[  101.810211][ T7776] 8021q: adding VLAN 0 to HW filter on device bond7
[  101.817828][ T7782] netlink: 'syz.1.531': attribute type 9 has an invalid length.
[  101.829951][ T7782] netlink: 'syz.1.531': attribute type 7 has an invalid length.
[  101.833092][ T7782] netlink: 'syz.1.531': attribute type 8 has an invalid length.
[  101.877538][ T7758] syzkaller0: left allmulticast mode
[  102.063871][ T7806] vlan2: entered promiscuous mode
[  102.070866][ T7806] gretap0: entered promiscuous mode
[  102.072783][ T7806] vlan2: entered allmulticast mode
[  102.074668][ T7806] gretap0: entered allmulticast mode
[  102.318996][ T7822] vlan3: entered promiscuous mode
[  102.323169][ T7822] bridge0: entered promiscuous mode
[  102.503952][ T7840] bond0: entered promiscuous mode
[  102.506269][ T7840] bond_slave_0: entered promiscuous mode
[  102.508967][ T7840] bond_slave_1: entered promiscuous mode
[  102.512946][ T7840] batadv0: entered promiscuous mode
[  102.516137][ T7840] hsr0: Slave A (bond0) is not up; please bring it up to get a fully working HSR network
[  102.520586][ T7840] hsr0: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network
[  102.525116][ T7840] hsr0: entered allmulticast mode
[  102.527277][ T7840] bond0: entered allmulticast mode
[  102.529197][ T7840] bond_slave_0: entered allmulticast mode
[  102.532631][ T7840] bond_slave_1: entered allmulticast mode
[  102.533233][   T13] nci: nci_ntf_packet: unknown ntf opcode 0x127
[  102.535643][ T7840] batadv0: entered allmulticast mode
[  102.541132][ T7840] 8021q: adding VLAN 0 to HW filter on device hsr0
[  102.544563][ T7840] bond0: left promiscuous mode
[  102.546320][ T7840] bond_slave_0: left promiscuous mode
[  102.548998][ T7840] bond_slave_1: left promiscuous mode
[  102.552020][ T7840] batadv0: left promiscuous mode
[  102.617934][ T7840] syzkaller0: entered promiscuous mode
[  102.620574][ T7840] syzkaller0: entered allmulticast mode
[  103.275243][ T7833] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  103.476830][ T7859] vlan3: entered promiscuous mode
[  103.479253][ T7859] macvtap0: entered promiscuous mode
[  103.514901][ T7859] __nla_validate_parse: 8 callbacks suppressed
[  103.514918][ T7859] netlink: 104 bytes leftover after parsing attributes in process `syz.0.550'.
[  104.013467][ T7894] netlink: 4 bytes leftover after parsing attributes in process `syz.0.557'.
[  104.065925][ T7897] netlink: 'syz.1.558': attribute type 1 has an invalid length.
[  104.080512][ T7897] 8021q: adding VLAN 0 to HW filter on device bond5
[  105.266574][ T7961] netlink: 'syz.1.572': attribute type 21 has an invalid length.
[  105.427508][ T7968] netlink: 40 bytes leftover after parsing attributes in process `syz.1.573'.
[  105.640214][ T7980] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[  105.644816][ T7980] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  105.661758][ T7983] netlink: 8 bytes leftover after parsing attributes in process `syz.0.579'.
[  105.668920][   T33] audit: type=1107 audit(1757438042.917:2): pid=7979 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='tŶv_BI_,5V*4cf'J&J]5:
[  105.668920][   T33] *OM7Ż027m˚(~zG7
[  105.668920][   T33] Jm	 -cQN'
[  105.674301][ T7985] netlink: 8 bytes leftover after parsing attributes in process `syz.1.580'.
[  105.682301][ T7985] netlink: 20 bytes leftover after parsing attributes in process `syz.1.580'.
[  105.696248][ T7985] geneve2: entered promiscuous mode
[  105.698552][ T7985] geneve2: entered allmulticast mode
[  105.731812][ T5857] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  105.735079][ T5857] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  105.737737][ T5857] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  105.741155][ T5857] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  105.807230][ T7996] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.585'.
[  105.841965][ T7999] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.585'.
[  105.918634][ T8009] netlink: 16 bytes leftover after parsing attributes in process `syz.1.588'.
[  106.274368][ T8033] netlink: 8 bytes leftover after parsing attributes in process `syz.1.596'.
[  106.339108][ T8037] bond0: entered promiscuous mode
[  106.341327][ T8037] bond_slave_0: entered promiscuous mode
[  106.343730][ T8037] bond_slave_1: entered promiscuous mode
[  106.346589][ T8037] batadv0: entered promiscuous mode
[  106.349027][ T8037] debugfs: 'hsr1' already exists in 'hsr'
[  106.351305][ T8037] Cannot create hsr debugfs directory
[  106.353395][ T8037] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network
[  106.356828][ T8037] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network
[  106.363537][ T8037] 8021q: adding VLAN 0 to HW filter on device hsr1
[  107.983760][ T8150] netlink: 'syz.1.638': attribute type 1 has an invalid length.
[  108.008967][ T8150] bond6: (slave ip6gretap1): Enslaving as a backup interface with an up link
[  108.021868][ T5874] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  108.022438][ T8150] 8021q: adding VLAN 0 to HW filter on device bond6
[  108.033590][ T8152] bridge0: port 2(bridge_slave_1) entered disabled state
[  108.036428][ T8152] bridge0: port 1(bridge_slave_0) entered disabled state
[  108.057171][ T8150] veth3: entered promiscuous mode
[  108.061852][ T8150] bond6: (slave veth3): Enslaving as a backup interface with a down link
[  108.071535][ T8150] bond0: (slave bond_slave_0): Releasing backup interface
[  108.074826][ T8150] bond_slave_0: left promiscuous mode
[  108.078382][ T8150] bond0: (slave bond_slave_1): Releasing backup interface
[  108.085642][ T8150] bond_slave_1: left promiscuous mode
[  108.088212][ T8150] batman_adv: batadv0: Removing interface: batadv_slave_0
[  108.092257][ T8150] batman_adv: batadv0: Removing interface: batadv_slave_1
[  108.095990][ T8150] bond3: (slave vcan1): Releasing backup interface
[  108.098326][ T8150] bond3: (slave vcan2): making interface the new active one
[  108.103826][ T8150] bond3: (slave vcan2): Releasing backup interface
[  108.108355][ T8150] bond6: (slave ip6gretap1): Removing an active aggregator
[  108.114047][ T8150] bond6: (slave ip6gretap1): Releasing backup interface
[  108.116803][ T8150] bond6: (slave ip6gretap1): the permanent HWaddr of slave - 62:58:90:d7:99:d8 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  108.126685][ T8150] bond6: (slave veth3): Releasing backup interface
[  108.333677][ T8171] macsec2: entered promiscuous mode
[  108.335411][ T8171] macsec2: entered allmulticast mode
[  108.451602][ T8179] openvswitch: netlink: Key 6 has unexpected len 4096 expected 2
[  108.496319][ T8184] netlink: 'syz.0.649': attribute type 1 has an invalid length.
[  108.508686][ T8193] netlink: 'syz.2.650': attribute type 1 has an invalid length.
[  108.508719][ T8187] netlink: 'syz.2.650': attribute type 1 has an invalid length.
[  108.526686][ T8184] bond5: entered promiscuous mode
[  108.528988][ T8184] 8021q: adding VLAN 0 to HW filter on device bond5
[  108.546946][ T8184] 8021q: adding VLAN 0 to HW filter on device bond5
[  108.551254][ T8184] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address
[  108.555266][ T8184] bond5: (slave vxcan3): Setting fail_over_mac to active for active-backup mode
[  108.561918][ T8184] bond5: (slave vxcan3): making interface the new active one
[  108.564558][ T8184] vxcan3: entered promiscuous mode
[  108.566867][ T8184] bond5: (slave vxcan3): Enslaving as an active interface with an up link
[  108.698709][ T8213] __nla_validate_parse: 8 callbacks suppressed
[  108.698719][ T8213] netlink: 88 bytes leftover after parsing attributes in process `syz.2.654'.
[  108.913535][ T8232] netlink: 28 bytes leftover after parsing attributes in process `syz.2.659'.
[  109.155308][ T8242] netlink: 24 bytes leftover after parsing attributes in process `syz.2.662'.
[  109.400102][ T8253] netlink: 12 bytes leftover after parsing attributes in process `syz.0.666'.
[  109.482455][ T8260] openvswitch: netlink: Multiple metadata blocks provided
[  109.521765][ T8263] netlink: 'syz.0.669': attribute type 1 has an invalid length.
[  109.550998][ T8263] bond6: (slave vxcan5): The slave device specified does not support setting the MAC address
[  109.556009][ T8263] bond6: (slave vxcan5): Error -95 calling set_mac_address
[  109.949807][ T8294] netlink: 'syz.1.677': attribute type 3 has an invalid length.
[  110.063983][ T8306] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms)
[  110.164012][ T8306] batadv_slave_1: entered promiscuous mode
[  110.167245][ T8306] netlink: 12 bytes leftover after parsing attributes in process `syz.0.681'.
[  110.179797][ T8306] netlink: 428 bytes leftover after parsing attributes in process `syz.0.681'.
[  110.184512][ T8306] netlink: 32 bytes leftover after parsing attributes in process `syz.0.681'.
[  110.235618][ T8317] netlink: 8 bytes leftover after parsing attributes in process `syz.1.685'.
[  110.244213][ T8317] netlink: 12 bytes leftover after parsing attributes in process `syz.1.685'.
[  110.309737][ T8326] netlink: 16 bytes leftover after parsing attributes in process `syz.0.687'.
[  110.324953][ T8326] netlink: 'syz.0.687': attribute type 2 has an invalid length.
[  110.478247][ T8350] tap0: tun_chr_ioctl cmd 2147767507
[  111.292957][ T8413] tipc: Can't bind to reserved service type 1
[  111.423617][ T8425] netlink: 'syz.2.718': attribute type 14 has an invalid length.
[  111.433992][ T8425] netlink: 'syz.2.718': attribute type 14 has an invalid length.
[  111.578237][ T8436] sit1: entered promiscuous mode
[  111.605212][ T8438] netlink: 'syz.0.719': attribute type 1 has an invalid length.
[  111.621726][ T8438] 8021q: adding VLAN 0 to HW filter on device bond7
[  111.631020][ T8440] batadv1: entered promiscuous mode
[  111.644797][ T8439] batadv1: entered promiscuous mode
[  111.663442][ T8438] vlan4: entered allmulticast mode
[  111.674238][ T8438] veth1: entered allmulticast mode
[  111.676765][ T8438] bond7: (slave vlan4): Opening slave failed
[  111.764017][ T8447] netlink: 'syz.1.725': attribute type 5 has an invalid length.
[  111.766455][ T8447] netlink: 'syz.1.725': attribute type 7 has an invalid length.
[  111.775597][ T8447] : entered promiscuous mode
[  111.875629][ T8460] netlink: 'syz.0.729': attribute type 14 has an invalid length.
[  111.879153][ T8460] netlink: 'syz.0.729': attribute type 13 has an invalid length.
[  112.063975][ T8465] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[  112.489906][ T8477] 8021q: adding VLAN 0 to HW filter on device bond8
[  112.863481][ T8509] 8021q: adding VLAN 0 to HW filter on device bond3
[  112.974870][ T8527] vlan2: entered promiscuous mode
[  112.976802][ T8527] bridge0: entered promiscuous mode
[  113.973718][ T8596] __nla_validate_parse: 22 callbacks suppressed
[  113.973729][ T8596] netlink: 48 bytes leftover after parsing attributes in process `syz.2.766'.
[  114.007394][ T8599] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.767'.
[  114.018186][ T8599] netlink: 8 bytes leftover after parsing attributes in process `syz.2.767'.
[  114.130744][ T8604] vlan4: entered promiscuous mode
[  114.175229][ T8608] netlink: 104 bytes leftover after parsing attributes in process `syz.0.768'.
[  114.262014][ T8616] netlink: 248 bytes leftover after parsing attributes in process `syz.0.771'.
[  114.286612][ T8620] netlink: 28 bytes leftover after parsing attributes in process `syz.2.772'.
[  114.305798][ T8620] netlink: 8 bytes leftover after parsing attributes in process `syz.2.772'.
[  114.312274][ T8620] netlink: 24 bytes leftover after parsing attributes in process `syz.2.772'.
[  114.440570][ T8622] netlink: 20 bytes leftover after parsing attributes in process `syz.2.773'.
[  115.061847][ T8641] validate_nla: 5 callbacks suppressed
[  115.061857][ T8641] netlink: 'syz.1.776': attribute type 10 has an invalid length.
[  115.066942][ T8639] netlink: 'syz.2.775': attribute type 1 has an invalid length.
[  115.093661][ T8639] 8021q: adding VLAN 0 to HW filter on device bond9
[  115.588281][ T8681] netlink: 20 bytes leftover after parsing attributes in process `syz.2.786'.
[  116.006605][ T8721] netlink: 'syz.0.795': attribute type 1 has an invalid length.
[  116.068248][ T8722] bond9: (slave gretap1): making interface the new active one
[  116.075748][ T8722] bond9: (slave gretap1): Enslaving as an active interface with an up link
[  116.139002][ T8726] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  116.264924][ T8748] team_slave_0: entered promiscuous mode
[  116.267194][ T8748] team_slave_1: entered promiscuous mode
[  116.279931][ T8748] macsec1: entered promiscuous mode
[  116.282160][ T8748] team0: entered promiscuous mode
[  116.426771][ T8753] mac80211_hwsim hwsim6 wlan0: left promiscuous mode
[  116.916087][   T12] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  116.918987][   T12] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  116.929061][   T12] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  116.935885][   T12] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  117.381371][ T8816] netlink: 'syz.2.819': attribute type 6 has an invalid length.
[  117.443045][ T8820] netlink: 'syz.0.820': attribute type 1 has an invalid length.
[  117.446549][ T8816] netlink: 'syz.2.819': attribute type 12 has an invalid length.
[  117.759220][ T8838] veth4: entered allmulticast mode
[  117.946960][ T8856] xt_policy: neither incoming nor outgoing policy selected
[  117.968843][ T8856] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  118.054745][ T8856] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  118.097702][ T8856] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  118.145403][ T8856] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  118.205152][   T12] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  118.216865][   T12] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  118.225629][   T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  118.236542][   T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  118.501650][ T8876] netlink: 'syz.2.833': attribute type 1 has an invalid length.
[  118.958006][ T5852] Bluetooth: hci2: command 0x0401 tx timeout
[  119.582595][ T8925] __nla_validate_parse: 13 callbacks suppressed
[  119.582604][ T8925] netlink: 88 bytes leftover after parsing attributes in process `syz.1.844'.
[  119.718319][ T8932] netlink: 76 bytes leftover after parsing attributes in process `syz.1.846'.
[  119.729788][ T8932] netlink: 76 bytes leftover after parsing attributes in process `syz.1.846'.
[  120.067132][ T8948] netlink: 'syz.0.853': attribute type 1 has an invalid length.
[  120.360236][ T8990] netlink: 504 bytes leftover after parsing attributes in process `syz.1.864'.
[  120.632794][ T9007] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  120.643940][ T9007] netlink: 8 bytes leftover after parsing attributes in process `syz.1.870'.
[  120.828064][ T9020] netlink: 20 bytes leftover after parsing attributes in process `syz.0.873'.
[  121.772356][ T9065] netlink: 20 bytes leftover after parsing attributes in process `syz.2.884'.
[  121.931852][ T9070] nbd0: detected capacity change from 0 to 127
[  121.961129][   T56] block nbd0: Receive control failed (result -104)
[  122.011857][ T9079] netlink: 12 bytes leftover after parsing attributes in process `syz.1.889'.
[  122.154213][ T9085] netlink: 44 bytes leftover after parsing attributes in process `syz.1.890'.
[  122.304520][ T9097] netlink: 'syz.1.893': attribute type 1 has an invalid length.
[  122.320217][ T9087] netlink: 'syz.0.892': attribute type 1 has an invalid length.
[  122.325957][ T9087] nbd: error processing sock list
[  122.333090][ T9087] block nbd1: shutting down sockets
[  122.342935][ T9097] 8021q: adding VLAN 0 to HW filter on device bond7
[  122.357817][ T9097] bond7: (slave gretap2): making interface the new active one
[  122.361697][ T9097] bond7: (slave gretap2): Enslaving as an active interface with an up link
[  122.492790][ T9114] netlink: 4 bytes leftover after parsing attributes in process `syz.2.899'.
[  122.887354][ T9138] netlink: 'syz.1.905': attribute type 2 has an invalid length.
[  123.920094][ T9153] netlink: 'syz.2.909': attribute type 2 has an invalid length.
[  123.923470][ T9153] netlink: 'syz.2.909': attribute type 1 has an invalid length.
[  123.968226][ T9153] bond12 (unregistering): Released all slaves
[  124.514109][ T9189] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  124.574311][ T9189] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  124.624369][ T9189] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  124.674103][ T9189] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  124.762412][ T5873] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  124.784439][   T13] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  124.792656][   T13] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  124.807171][   T13] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  125.058636][ T9202] netlink: 'syz.1.922': attribute type 1 has an invalid length.
[  125.136552][ T9202] bond8: (slave bridge4): making interface the new active one
[  125.143510][ T9202] bond8: (slave bridge4): Enslaving as an active interface with an up link
[  125.151090][ T9205] vlan5: entered promiscuous mode
[  125.193053][ T9205] __nla_validate_parse: 7 callbacks suppressed
[  125.193062][ T9205] netlink: 104 bytes leftover after parsing attributes in process `syz.0.923'.
[  125.449556][ T9221] netlink: 'syz.1.927': attribute type 1 has an invalid length.
[  125.478581][ T9221] 8021q: adding VLAN 0 to HW filter on device bond9
[  125.514331][ T9221] bond9: (slave geneve3): making interface the new active one
[  125.520770][ T9221] bond9: (slave geneve3): Enslaving as an active interface with an up link
[  125.619074][ T9230] ip6gre1: entered allmulticast mode
[  125.697777][ T9242] netlink: 104 bytes leftover after parsing attributes in process `syz.2.934'.
[  125.755488][ T9247] netlink: 'syz.0.935': attribute type 1 has an invalid length.
[  125.758193][ T9249] tipc: Started in network mode
[  125.764467][ T9249] tipc: Node identity 8286975e3bcb, cluster identity 4711
[  125.767543][ T9249] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  125.771669][ T9249] syzkaller0: entered promiscuous mode
[  125.774572][ T9249] syzkaller0: entered allmulticast mode
[  125.809002][ T9247] bond12: (slave vxcan5): The slave device specified does not support setting the MAC address
[  125.814865][ T9247] bond12: (slave vxcan5): Error -95 calling set_mac_address
[  125.824784][ T9254] netlink: 'syz.2.938': attribute type 10 has an invalid length.
[  125.834875][ T9254] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode
[  125.838309][ T9254] bond0: (slave wlan1): Enslaving as an active interface with an up link
[  125.844710][ T9249] tipc: Resetting bearer <eth:syzkaller0>
[  125.852771][ T9254] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode
[  125.857012][ T9248] tipc: Resetting bearer <eth:syzkaller0>
[  125.866860][ T9248] tipc: Disabling bearer <eth:syzkaller0>
[  126.171493][ T9288] netlink: 36 bytes leftover after parsing attributes in process `syz.0.948'.
[  126.232186][ T9298] netlink: 8 bytes leftover after parsing attributes in process `syz.0.951'.
[  126.242656][ T9301] tipc: Started in network mode
[  126.244348][ T9301] tipc: Node identity 080211000001, cluster identity 4711
[  126.246978][ T9301] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  126.252664][ T9301] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode
[  126.257790][ T9298] netlink: 132 bytes leftover after parsing attributes in process `syz.0.951'.
[  126.265696][ T9304] netlink: 8 bytes leftover after parsing attributes in process `syz.0.951'.
[  126.306221][ T9309] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  126.329210][ T9313] netlink: 60 bytes leftover after parsing attributes in process `syz.2.956'.
[  126.358951][ T9309] tipc: Resetting bearer <eth:syzkaller0>
[  126.368694][ T9309] netlink: 12 bytes leftover after parsing attributes in process `syz.0.954'.
[  126.389045][ T9320] nbd: must specify at least one socket
[  126.573185][ T9343] netlink: 826 bytes leftover after parsing attributes in process `syz.1.966'.
[  126.724560][ T9350] netlink: 32 bytes leftover after parsing attributes in process `syz.1.968'.
[  126.979774][ T9372] macvtap1: entered promiscuous mode
[  126.982105][ T9372] erspan0: entered promiscuous mode
[  126.984545][ T9372] macvtap1: entered allmulticast mode
[  126.987029][ T9372] erspan0: entered allmulticast mode
[  127.032536][ T9380] sctp: [Deprecated]: syz.1.975 (pid 9380) Use of int in maxseg socket option.
[  127.032536][ T9380] Use struct sctp_assoc_value instead
[  127.361122][   T47] tipc: Node number set to 134418688
[  127.362862][   T10] tipc: Node number set to 3224560050
[  127.618946][ T9419] openvswitch: netlink: Unknown VXLAN extension attribute 0
[  128.760672][ T9455] bond10: (slave vxcan3): The slave device specified does not support setting the MAC address
[  128.765889][ T9455] bond10: (slave vxcan3): Error -95 calling set_mac_address
[  128.808427][ T9461] macvlan2: entered promiscuous mode
[  128.813922][ T9461] macvlan2: entered allmulticast mode
[  128.815985][ T9461] bond10: (slave macvlan2): Error -98 calling set_mac_address
[  128.849062][ T9465] openvswitch: netlink: nsh attr 20 is out of range max 3
[  128.852289][ T9465] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  128.898477][ T9470] netlink: 'syz.0.1000': attribute type 1 has an invalid length.
[  129.015371][ T9475] tipc: Resetting bearer <eth:syzkaller0>
[  129.017540][ T9475] tipc: Resetting bearer <eth:syzkaller0>
[  130.447871][ T9510] __nla_validate_parse: 11 callbacks suppressed
[  130.447884][ T9510] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1016'.
[  130.508853][ T9511] netlink: 124 bytes leftover after parsing attributes in process `syz.1.1016'.
[  130.563027][ T9513] wg2: entered allmulticast mode
[  130.622314][ T9520] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1019'.
[  130.625474][ T9520] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1019'.
[  130.817955][ T9531] netlink: 'syz.1.1022': attribute type 21 has an invalid length.
[  130.822199][ T9531] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1022'.
[  130.965271][ T9546] ip6gre2: entered allmulticast mode
[  131.059961][ T9561] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1031'.
[  131.238238][ T9579] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1038'.
[  131.341984][ T9581] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1039'.
[  132.128323][ T9597] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1045'.
[  132.175364][ T9600] netlink: 'syz.0.1046': attribute type 1 has an invalid length.
[  132.178994][ T9600] NCSI netlink: No device for ifindex 0
[  132.255155][ T9604] ieee802154 phy0 wpan0: encryption failed: -22
[  132.508633][ T9617] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1051'.
[  132.546559][ T9617] bond11: (slave vxcan3): The slave device specified does not support setting the MAC address
[  132.552683][ T9617] bond11: (slave vxcan3): Error -95 calling set_mac_address
[  132.692830][ T9654] netlink: 'syz.1.1061': attribute type 10 has an invalid length.
[  132.700377][ T9654] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode
[  132.704506][ T9654] bond0: (slave wlan1): Enslaving as an active interface with an up link
[  132.713896][ T1366] ieee802154 phy0 wpan0: encryption failed: -22
[  133.192157][ T9686] bond3: entered allmulticast mode
[  133.213781][ T9686] bond0: (slave wlan1): Releasing backup interface
[  133.240871][ T9686] mac80211_hwsim hwsim5 wlan1: left promiscuous mode
[  133.275191][ T9686] bond7: (slave gretap2): Releasing active interface
[  133.286905][ T9686] bond8: (slave bridge4): Releasing active interface
[  133.307084][ T9686] bond9: (slave geneve3): Releasing active interface
[  133.384078][ T9691] netlink: 'syz.0.1071': attribute type 2 has an invalid length.
[  133.388988][ T9691] netlink: 'syz.0.1071': attribute type 11 has an invalid length.
[  133.415031][ T9691] 8021q: adding VLAN 0 to HW filter on device bond0
[  133.429800][ T9691] 8021q: adding VLAN 0 to HW filter on device team0
[  133.436220][ T9691] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  133.924030][ T9734] netlink: 'syz.2.1086': attribute type 7 has an invalid length.
[  133.950037][ T9734] 8021q: adding VLAN 0 to HW filter on device bond12
[  133.952705][ T9734] bridge7: port 1(bond12) entered blocking state
[  133.955129][ T9734] bridge7: port 1(bond12) entered disabled state
[  133.958029][ T9734] bond12: entered allmulticast mode
[  133.964092][ T9734] bridge7: port 1(bond12) entered blocking state
[  133.966296][ T9734] bridge7: port 1(bond12) entered forwarding state
[  134.068359][ T9743] netlink: 'syz.2.1087': attribute type 1 has an invalid length.
[  134.122563][ T9743] 8021q: adding VLAN 0 to HW filter on device bond13
[  134.159584][   T64] bridge7: port 1(bond12) entered disabled state
[  134.323054][ T9764] netlink: 'syz.2.1094': attribute type 2 has an invalid length.
[  134.503102][ T9772] netlink: 'syz.2.1097': attribute type 9 has an invalid length.
[  134.892527][ T9804] netlink: 'syz.1.1106': attribute type 1 has an invalid length.
[  134.935372][ T9804] netlink: 'syz.1.1106': attribute type 1 has an invalid length.
[  135.508291][ T9862] __nla_validate_parse: 13 callbacks suppressed
[  135.508304][ T9862] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1124'.
[  135.582541][ T9877] openvswitch: netlink: Message has 4 unknown bytes.
[  135.629942][ T9883] bond3: option mode: unable to set because the bond device is up
[  135.632719][ T9884] bond3: option mode: unable to set because the bond device is up
[  135.766907][ T9897] siw: device registration error -23
[  135.789887][ T9897] gtp1: entered promiscuous mode
[  135.796976][ T9897] gtp1: entered allmulticast mode
[  135.830432][ T9902] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1137'.
[  135.833527][ T9902] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1137'.
[  135.944719][ T9914] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  135.947674][ T9913] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  135.962099][ T9913] tipc: Resetting bearer <eth:syzkaller0>
[  136.036824][ T9923] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1144'.
[  136.078188][ T9923] 8021q: adding VLAN 0 to HW filter on device bond13
[  136.083209][ T9923] bond12: (slave bond13): Enslaving as an active interface with an up link
[  136.102002][ T9923] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1144'.
[  136.105695][ T9923] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1144'.
[  136.114884][ T9923] bond12 (unregistering): (slave bond13): Releasing backup interface
[  136.124049][ T9923] bond12 (unregistering): Released all slaves
[  136.222183][ T9934] bridge6: the hash_elasticity option has been deprecated and is always 16
[  136.225913][ T9934] bridge6: entered allmulticast mode
[  136.424051][ T9947] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  136.709576][ T5852] Bluetooth: hci2: command 0x0401 tx timeout
[  137.064822][ T9950] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1152'.
[  137.067845][ T9950] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1152'.
[  138.224158][ T9990] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1160'.
[  138.357869][ T9995] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1162'.
[  138.708314][T10012] vlan2: entered allmulticast mode
[  138.711637][T10012] bridge_slave_0: entered allmulticast mode
[  138.721064][T10010] vlan2: entered allmulticast mode
[  139.574030][T10057] netlink: 'syz.0.1177': attribute type 62 has an invalid length.
[  139.950783][T10074] netlink: 'syz.1.1184': attribute type 1 has an invalid length.
[  139.966391][T10068] netlink: 'syz.0.1181': attribute type 2 has an invalid length.
[  139.977248][T10074] bond12: (slave vxcan3): The slave device specified does not support setting the MAC address
[  139.981653][T10074] bond12: (slave vxcan3): Error -95 calling set_mac_address
[  139.999804][T10075] gretap3: entered promiscuous mode
[  140.004564][T10075] bond12: (slave gretap3): making interface the new active one
[  140.008203][T10075] bond12: (slave gretap3): Enslaving as an active interface with an up link
[  140.358794][T10109] ip6gre3: entered allmulticast mode
[  140.385250][T10111] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  140.411065][T10113] geneve4: entered promiscuous mode
[  140.413026][T10113] geneve4: entered allmulticast mode
[  140.487049][T10117] netlink: 'syz.0.1197': attribute type 4 has an invalid length.
Connection to localhost closed by remote host.
[  140.732793][ T8468] ==================================================================
[  140.735898][ T8468] BUG: KASAN: slab-use-after-free in __mutex_lock+0x801/0x1350
[  140.738650][ T8468] Read of size 8 at addr ffff88801ee900a0 by task khidpd_15c25886/8468
[  140.742593][ T8468] 
[  140.743523][ T8468] CPU: 0 UID: 0 PID: 8468 Comm: khidpd_15c25886 Not tainted syzkaller #0 PREEMPT(full) 
[  140.743533][ T8468] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  140.743537][ T8468] Call Trace:
[  140.743541][ T8468]  <TASK>
[  140.743545][ T8468]  dump_stack_lvl+0x189/0x250
[  140.743556][ T8468]  ? __kasan_check_byte+0x12/0x40
[  140.743566][ T8468]  ? __pfx_dump_stack_lvl+0x10/0x10
[  140.743573][ T8468]  ? lock_release+0x4b/0x3e0
[  140.743584][ T8468]  ? __virt_addr_valid+0x4a5/0x5c0
[  140.743593][ T8468]  print_report+0xca/0x240
[  140.743599][ T8468]  ? __mutex_lock+0x801/0x1350
[  140.743605][ T8468]  kasan_report+0x118/0x150
[  140.743614][ T8468]  ? __mutex_lock+0x801/0x1350
[  140.743621][ T8468]  __mutex_lock+0x801/0x1350
[  140.743627][ T8468]  ? __mutex_lock+0x5bb/0x1350
[  140.743633][ T8468]  ? l2cap_unregister_user+0x6a/0x1b0
[  140.743642][ T8468]  ? __pfx___mutex_lock+0x10/0x10
[  140.743648][ T8468]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  140.743659][ T8468]  l2cap_unregister_user+0x6a/0x1b0
[  140.743668][ T8468]  hidp_session_thread+0x3c9/0x410
[  140.743677][ T8468]  ? __pfx_hidp_session_thread+0x10/0x10
[  140.743685][ T8468]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  140.743693][ T8468]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  140.743702][ T8468]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  140.743710][ T8468]  ? __kthread_parkme+0x7b/0x200
[  140.743717][ T8468]  ? __kthread_parkme+0x1a1/0x200
[  140.743724][ T8468]  kthread+0x711/0x8a0
[  140.743732][ T8468]  ? __pfx_hidp_session_thread+0x10/0x10
[  140.743740][ T8468]  ? __pfx_kthread+0x10/0x10
[  140.743748][ T8468]  ? _raw_spin_unlock_irq+0x23/0x50
[  140.743756][ T8468]  ? lockdep_hardirqs_on+0x9c/0x150
[  140.743765][ T8468]  ? __pfx_kthread+0x10/0x10
[  140.743772][ T8468]  ret_from_fork+0x3fc/0x770
[  140.743780][ T8468]  ? __pfx_ret_from_fork+0x10/0x10
[  140.743787][ T8468]  ? __switch_to_asm+0x39/0x70
[  140.743795][ T8468]  ? __switch_to_asm+0x33/0x70
[  140.743803][ T8468]  ? __pfx_kthread+0x10/0x10
[  140.743810][ T8468]  ret_from_fork_asm+0x1a/0x30
[  140.743821][ T8468]  </TASK>
[  140.743823][ T8468] 
[  140.813940][ T8468] Allocated by task 5845:
[  140.815347][ T8468]  kasan_save_track+0x3e/0x80
[  140.817056][ T8468]  __kasan_kmalloc+0x93/0xb0
[  140.818644][ T8468]  __kmalloc_noprof+0x27a/0x4f0
[  140.820193][ T8468]  hci_alloc_dev_priv+0x28/0x2060
[  140.821910][ T8468]  vhci_create_device+0x120/0x650
[  140.823550][ T8468]  vhci_write+0x3ce/0x4a0
[  140.825038][ T8468]  vfs_write+0x5c9/0xb30
[  140.826445][ T8468]  ksys_write+0x145/0x250
[  140.827923][ T8468]  do_syscall_64+0xfa/0x3b0
[  140.829603][ T8468]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  140.831884][ T8468] 
[  140.832879][ T8468] Freed by task 10113:
[  140.834465][ T8468]  kasan_save_track+0x3e/0x80
[  140.836428][ T8468]  kasan_save_free_info+0x46/0x50
[  140.838488][ T8468]  __kasan_slab_free+0x5b/0x80
[  140.840499][ T8468]  kfree+0x18e/0x440
[  140.842100][ T8468]  bt_host_release+0x82/0x90
[  140.843845][ T8468]  device_release+0x9c/0x1c0
[  140.845367][ T8468]  kobject_put+0x22b/0x480
[  140.846836][ T8468]  vhci_release+0x15a/0x1a0
[  140.848334][ T8468]  __fput+0x44c/0xa70
[  140.849633][ T8468]  task_work_run+0x1d4/0x260
[  140.851133][ T8468]  do_exit+0x6b5/0x2300
[  140.852508][ T8468]  do_group_exit+0x21c/0x2d0
[  140.853976][ T8468]  get_signal+0x1286/0x1340
[  140.855686][ T8468]  arch_do_signal_or_restart+0x9a/0x750
[  140.857422][ T8468]  exit_to_user_mode_loop+0x75/0x110
[  140.859086][ T8468]  do_syscall_64+0x2bd/0x3b0
[  140.860611][ T8468]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  140.862607][ T8468] 
[  140.863371][ T8468] Last potentially related work creation:
[  140.865230][ T8468]  kasan_save_stack+0x3e/0x60
[  140.866711][ T8468]  kasan_record_aux_stack+0xbd/0xd0
[  140.868352][ T8468]  insert_work+0x3d/0x330
[  140.869712][ T8468]  __queue_work+0xbaf/0xfb0
[  140.871261][ T8468]  queue_work_on+0x181/0x270
[  140.872777][ T8468]  process_scheduled_works+0xae1/0x17b0
[  140.874826][ T8468]  worker_thread+0x8a0/0xda0
[  140.876661][ T8468]  kthread+0x711/0x8a0
[  140.878122][ T8468]  ret_from_fork+0x3fc/0x770
[  140.879756][ T8468]  ret_from_fork_asm+0x1a/0x30
[  140.881669][ T8468] 
[  140.882722][ T8468] Second to last potentially related work creation:
[  140.884931][ T8468]  kasan_save_stack+0x3e/0x60
[  140.886658][ T8468]  kasan_record_aux_stack+0xbd/0xd0
[  140.888411][ T8468]  insert_work+0x3d/0x330
[  140.889819][ T8468]  __queue_work+0xcd2/0xfb0
[  140.891349][ T8468]  call_timer_fn+0x17e/0x5f0
[  140.892891][ T8468]  __run_timer_base+0x646/0x860
[  140.894499][ T8468]  run_timer_softirq+0xb7/0x180
[  140.896051][ T8468]  handle_softirqs+0x286/0x870
[  140.897646][ T8468]  __irq_exit_rcu+0xca/0x1f0
[  140.899187][ T8468]  irq_exit_rcu+0x9/0x30
[  140.900619][ T8468]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  140.902495][ T8468]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  140.904481][ T8468] 
[  140.905292][ T8468] The buggy address belongs to the object at ffff88801ee90000
[  140.905292][ T8468]  which belongs to the cache kmalloc-8k of size 8192
[  140.909799][ T8468] The buggy address is located 160 bytes inside of
[  140.909799][ T8468]  freed 8192-byte region [ffff88801ee90000, ffff88801ee92000)
[  140.914308][ T8468] 
[  140.915117][ T8468] The buggy address belongs to the physical page:
[  140.917240][ T8468] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ee90
[  140.920043][ T8468] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  140.922809][ T8468] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  140.925554][ T8468] page_type: f5(slab)
[  140.926856][ T8468] raw: 00fff00000000040 ffff88801a442280 dead000000000122 0000000000000000
[  140.929596][ T8468] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  140.932332][ T8468] head: 00fff00000000040 ffff88801a442280 dead000000000122 0000000000000000
[  140.935108][ T8468] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  140.937827][ T8468] head: 00fff00000000003 ffffea00007ba401 00000000ffffffff 00000000ffffffff
[  140.940714][ T8468] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  140.943531][ T8468] page dumped because: kasan: bad access detected
[  140.945594][ T8468] page_owner tracks the page as allocated
[  140.947454][ T8468] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5593, tgid 5593 (dhcpcd), ts 48425953733, free_ts 44438902977
[  140.953913][ T8468]  post_alloc_hook+0x240/0x2a0
[  140.955441][ T8468]  get_page_from_freelist+0x21e4/0x22c0
[  140.957172][ T8468]  __alloc_frozen_pages_noprof+0x181/0x370
[  140.959104][ T8468]  alloc_pages_mpol+0x232/0x4a0
[  140.960727][ T8468]  allocate_slab+0x8a/0x370
[  140.962612][ T8468]  ___slab_alloc+0xbeb/0x1410
[  140.964600][ T8468]  __kmalloc_node_track_caller_noprof+0x2f8/0x4e0
[  140.966905][ T8468]  kmalloc_reserve+0x136/0x290
[  140.968455][ T8468]  __alloc_skb+0x142/0x2d0
[  140.969863][ T8468]  netlink_dump+0x167/0xe90
[  140.971363][ T8468]  netlink_recvmsg+0x676/0xa30
[  140.972866][ T8468]  sock_recvmsg+0x22c/0x270
[  140.974335][ T8468]  ____sys_recvmsg+0x1c9/0x460
[  140.975823][ T8468]  ___sys_recvmsg+0x1b5/0x510
[  140.977325][ T8468]  __x64_sys_recvmsg+0x198/0x260
[  140.978866][ T8468]  do_syscall_64+0xfa/0x3b0
[  140.980370][ T8468] page last free pid 5756 tgid 5756 stack trace:
[  140.982425][ T8468]  __free_frozen_pages+0xbc4/0xd30
[  140.984072][ T8468]  __put_partials+0x156/0x1a0
[  140.985619][ T8468]  put_cpu_partial+0x17c/0x250
[  140.987166][ T8468]  __slab_free+0x2d5/0x3c0
[  140.988576][ T8468]  qlist_free_all+0x97/0x140
[  140.990059][ T8468]  kasan_quarantine_reduce+0x148/0x160
[  140.991816][ T8468]  __kasan_slab_alloc+0x22/0x80
[  140.993358][ T8468]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  140.995128][ T8468]  vm_area_alloc+0x24/0x140
[  140.996572][ T8468]  mmap_region+0xdc7/0x20c0
[  140.998089][ T8468]  do_mmap+0xc45/0x10d0
[  140.999571][ T8468]  vm_mmap_pgoff+0x2a6/0x4d0
[  141.001168][ T8468]  ksys_mmap_pgoff+0x51f/0x760
[  141.003087][ T8468]  do_syscall_64+0xfa/0x3b0
[  141.005037][ T8468]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  141.007109][ T8468] 
[  141.007922][ T8468] Memory state around the buggy address:
[  141.009774][ T8468]  ffff88801ee8ff80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[  141.012785][ T8468]  ffff88801ee90000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  141.015593][ T8468] >ffff88801ee90080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  141.018119][ T8468]                                ^
[  141.019786][ T8468]  ffff88801ee90100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  141.022469][ T8468]  ffff88801ee90180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  141.025017][ T8468] ==================================================================
[  141.027992][ T8468] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  141.030373][ T8468] CPU: 0 UID: 0 PID: 8468 Comm: khidpd_15c25886 Not tainted syzkaller #0 PREEMPT(full) 
[  141.034002][ T8468] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  141.038058][ T8468] Call Trace:
[  141.039210][ T8468]  <TASK>
[  141.040275][ T8468]  dump_stack_lvl+0x99/0x250
[  141.041827][ T8468]  ? __asan_memcpy+0x40/0x70
[  141.043347][ T8468]  ? __pfx_dump_stack_lvl+0x10/0x10
[  141.044976][ T8468]  ? __pfx__printk+0x10/0x10
[  141.046576][ T8468]  vpanic+0x281/0x750
[  141.048030][ T8468]  ? __pfx_vpanic+0x10/0x10
[  141.049976][ T8468]  ? irqentry_exit+0x74/0x90
[  141.051948][ T8468]  panic+0xb9/0xc0
[  141.053547][ T8468]  ? __pfx_panic+0x10/0x10
[  141.055481][ T8468]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  141.057930][ T8468]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  141.060480][ T8468]  ? __mutex_lock+0x801/0x1350
[  141.062486][ T8468]  check_panic_on_warn+0x89/0xb0
[  141.064624][ T8468]  ? __mutex_lock+0x801/0x1350
[  141.066640][ T8468]  end_report+0x78/0x160
[  141.068454][ T8468]  kasan_report+0x129/0x150
[  141.070302][ T8468]  ? __mutex_lock+0x801/0x1350
[  141.071855][ T8468]  __mutex_lock+0x801/0x1350
[  141.073346][ T8468]  ? __mutex_lock+0x5bb/0x1350
[  141.074887][ T8468]  ? l2cap_unregister_user+0x6a/0x1b0
[  141.076691][ T8468]  ? __pfx___mutex_lock+0x10/0x10
[  141.078342][ T8468]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  141.080306][ T8468]  l2cap_unregister_user+0x6a/0x1b0
[  141.082076][ T8468]  hidp_session_thread+0x3c9/0x410
[  141.083784][ T8468]  ? __pfx_hidp_session_thread+0x10/0x10
[  141.085632][ T8468]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  141.087691][ T8468]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  141.089925][ T8468]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  141.092114][ T8468]  ? __kthread_parkme+0x7b/0x200
[  141.093769][ T8468]  ? __kthread_parkme+0x1a1/0x200
[  141.095455][ T8468]  kthread+0x711/0x8a0
[  141.096817][ T8468]  ? __pfx_hidp_session_thread+0x10/0x10
[  141.098631][ T8468]  ? __pfx_kthread+0x10/0x10
[  141.100167][ T8468]  ? _raw_spin_unlock_irq+0x23/0x50
[  141.101913][ T8468]  ? lockdep_hardirqs_on+0x9c/0x150
[  141.103635][ T8468]  ? __pfx_kthread+0x10/0x10
[  141.105237][ T8468]  ret_from_fork+0x3fc/0x770
[  141.106789][ T8468]  ? __pfx_ret_from_fork+0x10/0x10
[  141.108506][ T8468]  ? __switch_to_asm+0x39/0x70
[  141.110135][ T8468]  ? __switch_to_asm+0x33/0x70
[  141.111744][ T8468]  ? __pfx_kthread+0x10/0x10
[  141.113255][ T8468]  ret_from_fork_asm+0x1a/0x30
[  141.114841][ T8468]  </TASK>
[  141.116606][ T8468] Kernel Offset: disabled
[  141.118077][ T8468] Rebooting in 86400 seconds..

VM DIAGNOSIS:
17:14:38  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000038 RBX=0000000000000038 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000259f370
R8 =ffff88801f558237 R9 =1ffff11003eab046 R10=dffffc0000000000 R11=ffffffff854f38c0
R12=dffffc0000000000 R13=ffffffff99afd8e5 R14=ffffffff99df2420 R15=0000000000000000
RIP=ffffffff854f393c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8618000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f417aaf7d60 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f2ae9212e53
XMM06=0000000000000000 00007f2ae9212e4d XMM07=0000000000000000 00007f2ae9212e61
XMM08=0000000000000000 00007f2ae9212ee7 XMM09=0000000000000000 00007f2ae9212fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff81b44cfb RBX=1ffff11009608341 RCX=ffff88801caf9cc0 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc9000061f7e0 RSP=ffffc9000061f660
R8 =ffffffff8fa38f37 R9 =1ffffffff1f471e6 R10=dffffc0000000000 R11=fffffbfff1f471e7
R12=ffff88804b041a08 R13=dffffc0000000000 R14=ffff88813663b1c0 R15=0000000000000000
RIP=ffffffff81b44ce3 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c18000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00002000000099c0 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00000008000003b7 fffffff800000207 XMM03=0000000100000085 00000000000004b7
XMM04=9500000023000000 8500000001000000 XMM05=8500000000000004 b700000008000003
XMM06=b7fffffff8000002 07000000000000a2 XMM07=bf00000000fff88a 7b00000000000008
XMM08=b16f5c381ccbadb1 2f7ac8ea4622d6cd XMM09=0000000000000000 00007f1e0f812fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
