last executing test programs:

4.348395931s ago: executing program 0 (id=323):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x9, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000680)={0x2c, 0x2e, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd}, @typed={0xffffffffffffff10, 0x0, 0x0, 0x0, @uid=0xee00}, @nested={0xc, 0x0, 0x0, 0x1, [@typed={0x5, 0x1, 0x0, 0x0, @binary="98"}]}]}, 0x2c}], 0x1}, 0x0)

3.745807507s ago: executing program 0 (id=327):
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180000003f000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000400)={0x1c, 0x1, 0x4, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x21000}, 0x800)
sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000001280)={&(0x7f0000000580)=ANY=[@ANYBLOB="20000000010401010000000000000000050000010a000200"], 0x20}, 0x1, 0x0, 0x0, 0x4000001}, 0x4008054)

2.724404666s ago: executing program 0 (id=332):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x18, 0x1412, 0x1, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000840}, 0x4800c)

2.664248233s ago: executing program 0 (id=334):
socket$kcm(0x2, 0x922000000001, 0x106)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8000001946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xc, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e000000850000002a00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000080)=r2, 0x4)
sendmsg$NFT_MSG_GETGEN(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x10, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x400889c}, 0x10)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0xa, [@struct={0x8, 0x2, 0x0, 0xf, 0x0, 0x5, [{0x1, 0x0, 0x3}, {0x4, 0x4, 0x3}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x46, 0x0, 0x6}, 0x28)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}}, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e99900000000fedbdf25fc000000000000000000000000000000ac1414bb00000000000000000000000000000400000000000a0060", @ANYBLOB], 0xb8}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
sendmsg$sock(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x1}, 0x0, 0x2, 0xffffdffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xc, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x28, &(0x7f0000000000), 0x4)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
socket$kcm(0x10, 0x3, 0x10)

2.664052786s ago: executing program 1 (id=335):
r0 = socket$nl_crypto(0x10, 0x3, 0x15)
sendmsg$nl_crypto(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000780)=@alg={0xe0, 0x10, 0x129, 0x70bd26, 0x25dfdbfe, {{'drbg_nopr_ctr_aes256\x00'}, '\x00', '\x00', 0x400, 0x400}}, 0xe0}, 0x1, 0x0, 0x0, 0x48804}, 0x240440c0)

2.537162245s ago: executing program 1 (id=336):
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x894a, &(0x7f0000000cc0)='lo:\x96o8\x14d\xa1\xba\xda\xd1\xa0J\x12tQ\xb16\xe3\xd7\\b\x8b\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00l \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x02\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xeb\xe1\xde\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xfc\xfa 6(%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc5<J\x1f\xba\xfc\x90(\x985\x93\xa8\xd4\xf0\xbdTy\x18\xc8\xa0\xbb\x99\x8c\xe0Q\xffCl\xbdX~3\xa1\xa2\xf4\xd9\xf7\xc7\xfb\xce\x959x\xfeW\r\xf0{\xcaT\xecp)=\x9d\xdfG8\xa1\xe3=\xa6\x00\x98\xc1\xb3\x91-\xab\'W\x8al?d<JN\xcb\xd4H\xb0_jO\xf3\x90\xe8/l\xdfg)\x8d#\xfdo\xa9L\xdeA*\xec\xa1\x14,\xe8\x8d^\xb9r=\xc0\x18\xd4\x11dU[Ry\xed\xd6\x97\x8a\xe8\xca\x99\x10\x8e\xc8P\xa3\xae/\xdaof\x06\x7f\xf7\x80$f\b\x92\xae\xeb\xdd\"\x89\xb8\xf0\xc3\b\x00\x00\x00\x00\a\xf6\xfc\x1d\xd4\x893\xeb)\xc1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00O!\xd2q\xda}\xe2\xa2\xfe\xfd)\\\xdf\x9aN\\\xaeyc\xe4g\xc0\x8a\n\v{\xa9H\\\xd1\x9d')

2.476625877s ago: executing program 1 (id=337):
r0 = socket$kcm(0x10, 0x400000002, 0x0)
setsockopt$sock_attach_bpf(r0, 0x10e, 0xb, &(0x7f00000001c0), 0x4)
write$cgroup_subtree(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="33fe0000660091ef"], 0xfe33)

2.406248334s ago: executing program 2 (id=338):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000e00)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="12000000030000000800000002"], 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r1}, &(0x7f0000000280), &(0x7f0000000040)=r0}, 0x20)

2.405863986s ago: executing program 1 (id=339):
r0 = socket$kcm(0x11, 0x2, 0x0)
r1 = socket$kcm(0x11, 0x200000000000002, 0x300)
setsockopt$sock_attach_bpf(r1, 0x107, 0x12, &(0x7f00000000c0)=r0, 0x8)
socket$kcm(0x11, 0x200000000000002, 0x300)
r2 = socket$kcm(0x11, 0x3, 0x0)
setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000000), 0x4)
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf4a31accbe1", 0x27}], 0x1}, 0x0)

2.326939995s ago: executing program 2 (id=340):
r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080))
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000070000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10)
syz_clone(0x160480, 0x0, 0x0, 0x0, 0x0, 0x0)
openat$cgroup_ro(r0, &(0x7f0000001280)='memory.current\x00', 0x0, 0x0)

2.326340509s ago: executing program 1 (id=341):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000007c0)={<r0=>0xffffffffffffffff})
r1 = gettid()
sendmsg$unix(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@cred={{0x1c, 0x1, 0x2, {r1, 0xee01, 0xee01}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x38}, 0x0)

2.310041999s ago: executing program 0 (id=342):
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_deliver\x00', r1}, 0x10)
syz_open_procfs$namespace(0x0, 0xfffffffffffffffe)

1.986201848s ago: executing program 0 (id=343):
r0 = socket$kcm(0x2, 0x922000000001, 0x106)
ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000001c0)={'dummy0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})

1.985906245s ago: executing program 1 (id=344):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0xa0b41, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x6f4, 0x1, 0x1}, 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000600), 0x5, r1}, 0x38)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008bd6000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x18)
write$cgroup_subtree(r0, 0x0, 0xfdef)

1.813987017s ago: executing program 32 (id=343):
r0 = socket$kcm(0x2, 0x922000000001, 0x106)
ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000001c0)={'dummy0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})

1.761837157s ago: executing program 33 (id=344):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0xa0b41, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x6f4, 0x1, 0x1}, 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000600), 0x5, r1}, 0x38)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008bd6000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x18)
write$cgroup_subtree(r0, 0x0, 0xfdef)

743.092037ms ago: executing program 2 (id=347):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x30, 0x3, 0x8, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED={0x8, 0x9, 0x1, 0x0, 0x8}, @CTA_TIMEOUT_SCTP_HEARTBEAT_SENT={0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x24008000)

626.229575ms ago: executing program 2 (id=348):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x4, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
perf_event_open(&(0x7f0000000380)={0x3, 0x80, 0x2, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x6a613, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0xc5, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x2, 0x0, 0x403}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$kcm(0x10, 0x400000002, 0x0)
sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1b0000001a007f029e", 0x9}, {&(0x7f0000000200)="68cabf2dfb58fc0a01008888ffff0200258f", 0x12}], 0x2}, 0x4000000)
close(r1)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
r2 = socket$kcm(0x11, 0x2, 0x0)
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000001340)=@hci={0x1f, 0xc00, 0xe}, 0x80, &(0x7f0000002540)=[{&(0x7f00000006c0)='b', 0x10}], 0x1}, 0x0)
mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)={[{0x2b, 'rdma'}, {0x2d, 'pids'}, {0x2d, 'cpu'}, {0x2b, 'cpuset'}, {0x2b, 'pids'}]}, 0x62)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
r3 = socket$kcm(0xa, 0x5, 0x0)
setsockopt$sock_attach_bpf(r3, 0x29, 0x42, &(0x7f0000000040), 0xcf)
close(r0)
r4 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000940)="2e00000010008188e6b62aa73772cc9f1ba1f848310000005e140602000000000e000a001000000002800000128c", 0x2e}], 0x1}, 0x0)

88.570846ms ago: executing program 2 (id=349):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x18}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x20020800}, 0x0)

0s ago: executing program 2 (id=350):
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803003a000b12d25a80648c2594f90324fc60100c034002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:51995' (ED25519) to the list of known hosts.
syzkaller login: [   56.181047][ T5830] cgroup: Unknown subsys name 'net'
[   56.281264][ T5830] cgroup: Unknown subsys name 'cpuset'
[   56.285941][ T5830] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   57.655620][ T5830] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   62.262542][ T5235] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   62.268142][ T5235] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   62.271265][ T5235] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   62.277686][ T5235] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   62.281472][ T5235] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   62.306594][ T5235] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   62.310953][ T5235] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   62.314286][ T5235] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   62.318372][ T5235] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   62.321997][ T5235] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   62.415083][ T5235] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   62.418888][ T5235] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   62.428404][ T5235] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   62.432395][ T5235] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   62.436179][ T5235] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   62.509101][ T5844] chnl_net:caif_netlink_parms(): no params data found
[   62.639276][ T5848] chnl_net:caif_netlink_parms(): no params data found
[   62.656294][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.659751][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.662876][ T5844] bridge_slave_0: entered allmulticast mode
[   62.666190][ T5844] bridge_slave_0: entered promiscuous mode
[   62.674328][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.676669][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.679424][ T5844] bridge_slave_1: entered allmulticast mode
[   62.682085][ T5844] bridge_slave_1: entered promiscuous mode
[   62.736124][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.747422][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   62.799276][ T5844] team0: Port device team_slave_0 added
[   62.808935][ T5844] team0: Port device team_slave_1 added
[   62.811146][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.814499][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.817645][ T5848] bridge_slave_0: entered allmulticast mode
[   62.821834][ T5848] bridge_slave_0: entered promiscuous mode
[   62.857104][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0
[   62.861268][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.871231][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   62.875534][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.878904][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.881963][ T5848] bridge_slave_1: entered allmulticast mode
[   62.885842][ T5848] bridge_slave_1: entered promiscuous mode
[   62.932335][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1
[   62.935175][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.946044][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   62.963145][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.978536][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.032566][ T5848] team0: Port device team_slave_0 added
[   63.035525][ T5853] chnl_net:caif_netlink_parms(): no params data found
[   63.049001][ T5844] hsr_slave_0: entered promiscuous mode
[   63.052895][ T5844] hsr_slave_1: entered promiscuous mode
[   63.058266][ T5848] team0: Port device team_slave_1 added
[   63.120184][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.123196][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.135805][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.146481][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.151271][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.163112][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.250863][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.254124][ T5853] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.257769][ T5853] bridge_slave_0: entered allmulticast mode
[   63.262304][ T5853] bridge_slave_0: entered promiscuous mode
[   63.281552][ T5848] hsr_slave_0: entered promiscuous mode
[   63.284441][ T5848] hsr_slave_1: entered promiscuous mode
[   63.287150][ T5848] debugfs: 'hsr0' already exists in 'hsr'
[   63.290097][ T5848] Cannot create hsr debugfs directory
[   63.292469][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.295214][ T5853] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.298275][ T5853] bridge_slave_1: entered allmulticast mode
[   63.301486][ T5853] bridge_slave_1: entered promiscuous mode
[   63.331485][ T5853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.355500][ T5853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.409390][ T5853] team0: Port device team_slave_0 added
[   63.426835][ T5853] team0: Port device team_slave_1 added
[   63.485692][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.489456][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.500632][ T5853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.518599][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.521646][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.534489][ T5853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.640019][ T5853] hsr_slave_0: entered promiscuous mode
[   63.643211][ T5853] hsr_slave_1: entered promiscuous mode
[   63.646206][ T5853] debugfs: 'hsr0' already exists in 'hsr'
[   63.650945][ T5853] Cannot create hsr debugfs directory
[   63.654146][ T5844] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   63.662102][ T5844] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   63.669817][ T5844] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   63.676124][ T5844] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   63.747428][ T5848] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   63.752411][ T5848] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   63.772873][ T5848] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   63.780248][ T5848] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   63.901324][ T5853] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   63.909601][ T5853] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   63.920417][ T5853] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   63.926044][ T5853] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   63.937159][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0
[   63.977426][ T5844] 8021q: adding VLAN 0 to HW filter on device team0
[   63.991419][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.006052][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.009274][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.017200][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.020400][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.053529][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[   64.087092][  T163] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.090374][  T163] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.110887][  T163] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.114073][  T163] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.122789][ T5844] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   64.194240][ T5853] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.223400][ T5853] 8021q: adding VLAN 0 to HW filter on device team0
[   64.261688][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.264712][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.269931][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.272981][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.360083][ T5235] Bluetooth: hci1: command tx timeout
[   64.362678][ T5235] Bluetooth: hci0: command tx timeout
[   64.375449][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.432186][ T5844] veth0_vlan: entered promiscuous mode
[   64.451355][ T5844] veth1_vlan: entered promiscuous mode
[   64.457680][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.480628][ T5853] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.489009][ T5844] veth0_macvtap: entered promiscuous mode
[   64.497364][ T5844] veth1_macvtap: entered promiscuous mode
[   64.519406][   T54] Bluetooth: hci2: command tx timeout
[   64.521067][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.532371][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.549742][   T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.555285][ T5848] veth0_vlan: entered promiscuous mode
[   64.565086][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.570057][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.579422][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.601118][ T5848] veth1_vlan: entered promiscuous mode
[   64.607539][ T5853] veth0_vlan: entered promiscuous mode
[   64.619001][ T5853] veth1_vlan: entered promiscuous mode
[   64.638711][ T1089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.645793][ T1089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.661405][ T5853] veth0_macvtap: entered promiscuous mode
[   64.665866][ T5853] veth1_macvtap: entered promiscuous mode
[   64.677684][ T5848] veth0_macvtap: entered promiscuous mode
[   64.699405][ T5848] veth1_macvtap: entered promiscuous mode
[   64.709719][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.713122][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.716740][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.721278][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.731718][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.738897][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.743646][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.746779][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.754646][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.759906][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.775262][ T5844] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   64.782130][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.794903][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.799302][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.802832][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.885456][  T163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.890357][  T163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.928657][ T1089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.931671][ T1089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.961431][ T1089] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.964078][ T1089] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.967632][ T1089] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.971327][ T1089] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.227801][    C1] hrtimer: interrupt took 43774 ns
[   65.267559][ T5933] netlink: 824 bytes leftover after parsing attributes in process `syz.1.12'.
[   65.402819][ T5928] netlink: 'syz.2.10': attribute type 9 has an invalid length.
[   65.406980][ T5928] netlink: 211924 bytes leftover after parsing attributes in process `syz.2.10'.
[   66.451821][   T54] Bluetooth: hci0: command tx timeout
[   66.454142][   T54] Bluetooth: hci1: command tx timeout
[   66.598096][ T5235] Bluetooth: hci2: command tx timeout
[   68.029796][ T6027] netlink: 8 bytes leftover after parsing attributes in process `syz.2.54'.
[   68.062089][ T6027] netlink: 'syz.2.54': attribute type 21 has an invalid length.
[   68.537284][ T5235] Bluetooth: hci1: command tx timeout
[   68.539096][   T54] Bluetooth: hci0: command tx timeout
[   68.541592][ T6027] netlink: 156 bytes leftover after parsing attributes in process `syz.2.54'.
[   68.685128][   T54] Bluetooth: hci2: command tx timeout
[   69.622450][ T6049] tap0: tun_chr_ioctl cmd 1074025677
[   69.625086][ T6049] tap0: linktype set to 825
[   69.807350][ T6056] warning: `syz.0.67' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   69.860175][ T6061] netlink: 'syz.0.67': attribute type 4 has an invalid length.
[   69.863606][ T6061] netlink: 152 bytes leftover after parsing attributes in process `syz.0.67'.
[   70.605950][   T54] Bluetooth: hci0: command tx timeout
[   70.608799][   T54] Bluetooth: hci1: command tx timeout
[   70.663005][ T6061] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check.
[   70.775153][ T5235] Bluetooth: hci2: command tx timeout
[   71.212938][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   71.215241][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   71.414568][ T6087] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   72.489988][ T6120] netlink: 'syz.2.92': attribute type 6 has an invalid length.
[   72.492559][ T6120] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.92'.
[   73.243271][ T6133] sit0: entered promiscuous mode
[   73.264410][ T6133] sit0: entered allmulticast mode
[   73.413728][ T6130] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   73.418033][ T6130] IPv6: NLM_F_CREATE should be set when creating new route
[   73.422897][ T6130] IPv6: NLM_F_CREATE should be set when creating new route
[   73.755034][ T6141] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.100'.
[   73.833335][ T6141] netlink: 60 bytes leftover after parsing attributes in process `syz.2.100'.
[   74.461090][ T6161] netlink: 40 bytes leftover after parsing attributes in process `syz.0.108'.
[   74.581339][ T6169] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue
[   74.594406][ T6169] syzkaller0: entered promiscuous mode
[   74.596875][ T6169] syzkaller0: entered allmulticast mode
[   75.702052][ T6199] netlink: 16 bytes leftover after parsing attributes in process `syz.0.124'.
[   75.920907][ T6221] netlink: 'syz.2.135': attribute type 11 has an invalid length.
[   75.923567][ T6221] netlink: 148 bytes leftover after parsing attributes in process `syz.2.135'.
[   75.964497][ T6224] netlink: 10 bytes leftover after parsing attributes in process `syz.2.136'.
[   77.074658][ T6238] syzkaller0: entered promiscuous mode
[   77.076727][ T6238] syzkaller0: entered allmulticast mode
[   77.990903][ T6247] netlink: 4 bytes leftover after parsing attributes in process `syz.1.146'.
[   81.353773][ T6253] netlink: 132 bytes leftover after parsing attributes in process `syz.2.149'.
[   81.407554][ T1271] cfg80211: failed to load regulatory.db
[   81.458225][ T6260] C: renamed from team_slave_0 (while UP)
[   81.464299][ T6260] netlink: 'syz.1.151': attribute type 3 has an invalid length.
[   81.481782][ T6260] netlink: 'syz.1.151': attribute type 1 has an invalid length.
[   81.488080][ T6260] netlink: 116 bytes leftover after parsing attributes in process `syz.1.151'.
[   81.495927][ T6260] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[   81.571537][ T6264] netlink: 8 bytes leftover after parsing attributes in process `syz.1.153'.
[   81.603503][ T6266] netlink: 'syz.0.154': attribute type 21 has an invalid length.
[   81.607090][ T6266] netlink: 128 bytes leftover after parsing attributes in process `syz.0.154'.
[   81.612819][ T6266] netlink: 'syz.0.154': attribute type 6 has an invalid length.
[   81.616240][ T6266] netlink: 3 bytes leftover after parsing attributes in process `syz.0.154'.
[   81.712875][ T6276] netlink: 127868 bytes leftover after parsing attributes in process `syz.2.156'.
[   81.774057][ T6273] netdevsim netdevsim0: Direct firmware load for  failed with error -2
[   81.781021][ T6273] netdevsim netdevsim0: Falling back to sysfs fallback for: 
[   81.978805][ T6284] netlink: 'syz.2.162': attribute type 39 has an invalid length.
[   82.579165][ T6300] netlink: 184 bytes leftover after parsing attributes in process `syz.1.169'.
[   82.608085][ T6301] netlink: 4 bytes leftover after parsing attributes in process `syz.2.168'.
[   83.057452][ T6324] sctp: [Deprecated]: syz.2.178 (pid 6324) Use of int in maxseg socket option.
[   83.057452][ T6324] Use struct sctp_assoc_value instead
[   83.513069][ T6343] netlink: 'syz.0.189': attribute type 21 has an invalid length.
[   83.516947][ T6343] netlink: 132 bytes leftover after parsing attributes in process `syz.0.189'.
[   83.601075][ T6349] syzkaller0: entered promiscuous mode
[   83.617435][ T6349] syzkaller0: entered allmulticast mode
[   83.624071][ T6352] netlink: 'syz.0.192': attribute type 10 has an invalid length.
[   83.699912][ T6352] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   83.863211][ T6359] hsr_slave_0: hsr_addr_subst_dest: Unknown node
[   83.865999][ T6359] hsr_slave_1: hsr_addr_subst_dest: Unknown node
[   84.165691][ T6368] netlink: 60 bytes leftover after parsing attributes in process `syz.1.200'.
[   84.179307][ T6368] netlink: 60 bytes leftover after parsing attributes in process `syz.1.200'.
[   84.573863][ T6386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.208'.
[   84.958347][ T6386] netlink: 84 bytes leftover after parsing attributes in process `syz.2.208'.
[   85.044609][ T6392] netlink: 'syz.2.210': attribute type 21 has an invalid length.
[   85.047392][ T6392] netlink: 152 bytes leftover after parsing attributes in process `syz.2.210'.
[   85.390701][ T6403] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.216'.
[   85.394753][ T6403] netlink: zone id is out of range
[   85.397210][ T6403] netlink: get zone limit has 8 unknown bytes
[   85.682040][ T6424] netlink: 'syz.2.225': attribute type 16 has an invalid length.
[   85.684733][ T6424] netlink: 156 bytes leftover after parsing attributes in process `syz.2.225'.
[   85.833152][ T6442] netlink: 44 bytes leftover after parsing attributes in process `syz.1.229'.
[   85.839972][ T6442] netlink: 24 bytes leftover after parsing attributes in process `syz.1.229'.
[   86.106425][ T6448] bond_slave_0: entered promiscuous mode
[   86.109391][ T6448] bond_slave_1: entered promiscuous mode
[   86.465006][ T6459] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   87.388977][ T6481] netlink: 'syz.1.244': attribute type 21 has an invalid length.
[   87.539723][ T6488] syz.1.246 uses obsolete (PF_INET,SOCK_PACKET)
[   87.631990][ T6494] netlink: 'syz.1.250': attribute type 2 has an invalid length.
[   89.146113][ T6527] veth0_vlan: entered allmulticast mode
[   89.336515][ T6539] netlink: 'syz.2.267': attribute type 25 has an invalid length.
[   89.341279][ T6539] __nla_validate_parse: 4 callbacks suppressed
[   89.341287][ T6539] netlink: 2418 bytes leftover after parsing attributes in process `syz.2.267'.
[   89.974455][ T6527] veth0_vlan: left promiscuous mode
[   89.984000][ T6527] veth0_vlan: entered promiscuous mode
[   90.247509][ T6571] netlink: 8 bytes leftover after parsing attributes in process `syz.0.282'.
[   90.452341][ T6580] : renamed from team_slave_1 (while UP)
[   90.720749][ T6592] netlink: 'syz.2.291': attribute type 14 has an invalid length.
[   91.312358][ T6597] netlink: 'syz.0.293': attribute type 4 has an invalid length.
[   91.360685][ T6601] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.294'.
[   91.771152][ T6618] syzkaller0: entered promiscuous mode
[   91.773563][ T6618] syzkaller0: entered allmulticast mode
[   92.155528][ T6629] netlink: 104 bytes leftover after parsing attributes in process `syz.2.305'.
[   92.324982][ T6633] netlink: 'syz.0.306': attribute type 6 has an invalid length.
[   92.327548][ T6633] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.306'.
[   92.981263][ T6684] openvswitch: netlink: Key 0 has unexpected len 4 expected 0
[   93.136403][ T6664] netlink: 220 bytes leftover after parsing attributes in process `syz.1.319'.
[   94.418742][ T6703] netlink: 'syz.1.333': attribute type 11 has an invalid length.
[   94.422413][ T6703] netlink: 140 bytes leftover after parsing attributes in process `syz.1.333'.
[   94.681336][ T6713] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.337'.
[   95.158831][ T5870] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   95.251023][ T5870] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   95.336541][ T5870] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   95.396575][ T5870] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   95.517484][ T5870] bridge_slave_1: left allmulticast mode
[   95.521279][ T5870] bridge_slave_1: left promiscuous mode
[   95.524772][ T5870] bridge0: port 2(bridge_slave_1) entered disabled state
[   95.533724][ T5870] bridge_slave_0: left allmulticast mode
[   95.536591][ T5870] bridge_slave_0: left promiscuous mode
[   95.540555][ T5870] bridge0: port 1(bridge_slave_0) entered disabled state
[   95.786692][ T5870] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   95.793848][ T5870] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   95.801021][ T5870] bond0 (unregistering): Released all slaves
[   96.011147][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   96.016248][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   96.024650][   T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   96.029604][   T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   96.032564][   T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   96.125066][ T5870] hsr_slave_0: left promiscuous mode
[   96.131590][ T5870] hsr_slave_1: left promiscuous mode
[   96.134179][ T5870] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   96.136854][ T5870] batman_adv: batadv0: Removing interface: batadv_slave_0
[   96.141815][ T5870] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   96.144621][ T5870] batman_adv: batadv0: Removing interface: batadv_slave_1
[   96.154010][ T5870] veth1_macvtap: left promiscuous mode
[   96.156377][ T5870] veth0_macvtap: left promiscuous mode
[   96.158617][ T5870] veth1_vlan: left promiscuous mode
[   96.160596][ T5870] veth0_vlan: left promiscuous mode
[   96.420561][ T5870] team0 (unregistering): Port device team_slave_1 removed
[   96.472090][ T5870] team0 (unregistering): Port device C removed
[   96.562697][ T6753] netlink: 'syz.2.348': attribute type 10 has an invalid length.
[   96.630811][ T5235] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   96.634689][ T5235] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   96.641607][ T5235] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   96.645232][ T5235] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   96.648834][ T5235] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   96.923537][ T6753] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets).
[   97.130903][    T3] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[   97.171359][ T6766] netlink: 'syz.2.350': attribute type 3 has an invalid length.
[   97.174122][ T6766] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.350'.
[   97.213891][ T6754] chnl_net:caif_netlink_parms(): no params data found
[   97.277574][ T5870] ------------[ cut here ]------------
[   97.277636][ T6744] chnl_net:caif_netlink_parms(): no params data found
[   97.279816][ T5870] WARNING: CPU: 1 PID: 5870 at net/xfrm/xfrm_state.c:3303 xfrm_state_fini+0x270/0x2f0
[   97.279844][ T5870] Modules linked in:
[   97.279863][ T5870] CPU: 1 UID: 0 PID: 5870 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) 
[   97.279871][ T5870] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   97.279877][ T5870] Workqueue: netns cleanup_net
[   97.279886][ T5870] RIP: 0010:xfrm_state_fini+0x270/0x2f0
[   97.279896][ T5870] Code: c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 a8 3d 01 f8 48 8b 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 86 fa e1 f7 e8 81 60 9d f7 90 <0f> 0b 90 e9 fd fd ff ff e8 73 60 9d f7 90 0f 0b 90 e9 60 fe ff ff
[   97.279902][ T5870] RSP: 0018:ffffc90003f6f898 EFLAGS: 00010293
[   97.279910][ T5870] RAX: ffffffff8a224bcf RBX: ffff8880295d0000 RCX: ffff888108143980
[   97.279916][ T5870] RDX: 0000000000000000 RSI: ffffffff8dba65a5 RDI: ffff888108143980
[   97.279922][ T5870] RBP: ffffc90003f6f9b0 R08: ffffffff8fa38937 R09: 1ffffffff1f47126
[   97.279927][ T5870] R10: dffffc0000000000 R11: fffffbfff1f47127 R12: ffffffff8f631560
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   97.279932][ T5870] R13: 1ffff920007edf40 R14: ffff8880295d1480 R15: dffffc0000000000
[   97.279938][ T5870] FS:  0000000000000000(0000) GS:ffff8881a3c19000(0000) knlGS:0000000000000000
[   97.279944][ T5870] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   97.279950][ T5870] CR2: 0000564fea531131 CR3: 000000000df36000 CR4: 00000000000006f0
[   97.279978][ T5870] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   97.341950][ T5870] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
[   97.344979][ T5870] Call Trace:
[   97.346374][ T5870]  <TASK>
[   97.347661][ T5870]  xfrm_net_exit+0x2d/0x70
[   97.349633][ T5870]  ops_undo_list+0x49a/0x990
[   97.351611][ T5870]  ? __pfx_ops_undo_list+0x10/0x10
[   97.353794][ T5870]  ? do_raw_spin_unlock+0x4d/0x240
[   97.355951][ T5870]  cleanup_net+0x4c5/0x800
[   97.357597][ T5870]  ? __pfx_cleanup_net+0x10/0x10
[   97.359382][ T5870]  ? _raw_spin_unlock_irq+0x23/0x50
[   97.361194][ T5870]  ? process_scheduled_works+0x9ef/0x17b0
[   97.363278][ T5870]  ? process_scheduled_works+0x9ef/0x17b0
[   97.365245][ T5870]  process_scheduled_works+0xae1/0x17b0
[   97.367157][ T5870]  ? __pfx_process_scheduled_works+0x10/0x10
[   97.369309][ T5870]  worker_thread+0x8a0/0xda0
[   97.370917][ T5870]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   97.373085][ T5870]  ? __kthread_parkme+0x7b/0x200
[   97.375170][ T5870]  kthread+0x711/0x8a0
[   97.376916][ T5870]  ? __pfx_worker_thread+0x10/0x10
[   97.379014][ T5870]  ? __pfx_kthread+0x10/0x10
[   97.380877][ T5870]  ? _raw_spin_unlock_irq+0x23/0x50
[   97.383090][ T5870]  ? lockdep_hardirqs_on+0x9c/0x150
[   97.385330][ T5870]  ? __pfx_kthread+0x10/0x10
[   97.387281][ T5870]  ret_from_fork+0x3fc/0x770
[   97.389650][ T5870]  ? __pfx_ret_from_fork+0x10/0x10
[   97.391842][ T5870]  ? __switch_to_asm+0x39/0x70
[   97.393783][ T5870]  ? __switch_to_asm+0x33/0x70
[   97.395592][ T5870]  ? __pfx_kthread+0x10/0x10
[   97.397175][ T5870]  ret_from_fork_asm+0x1a/0x30
[   97.399102][ T5870]  </TASK>
[   97.400189][ T5870] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   97.402671][ T5870] CPU: 1 UID: 0 PID: 5870 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) 
[   97.405848][ T5870] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   97.409608][ T5870] Workqueue: netns cleanup_net
[   97.411233][ T5870] Call Trace:
[   97.412573][ T5870]  <TASK>
[   97.413740][ T5870]  dump_stack_lvl+0x99/0x250
[   97.415477][ T5870]  ? __asan_memcpy+0x40/0x70
[   97.417113][ T5870]  ? __pfx_dump_stack_lvl+0x10/0x10
[   97.418890][ T5870]  ? __pfx__printk+0x10/0x10
[   97.420469][ T5870]  vpanic+0x281/0x750
[   97.421835][ T5870]  ? __pfx__printk+0x10/0x10
[   97.423553][ T5870]  ? __pfx_vpanic+0x10/0x10
[   97.425530][ T5870]  ? is_bpf_text_address+0x292/0x2b0
[   97.427809][ T5870]  panic+0xb9/0xc0
[   97.429471][ T5870]  ? __pfx_panic+0x10/0x10
[   97.431472][ T5870]  __warn+0x31b/0x4b0
[   97.433237][ T5870]  ? xfrm_state_fini+0x270/0x2f0
[   97.435437][ T5870]  ? xfrm_state_fini+0x270/0x2f0
[   97.437597][ T5870]  report_bug+0x2be/0x4f0
[   97.439463][ T5870]  ? xfrm_state_fini+0x270/0x2f0
[   97.441633][ T5870]  ? xfrm_state_fini+0x270/0x2f0
[   97.443733][ T5870]  ? xfrm_state_fini+0x272/0x2f0
[   97.445733][ T5870]  handle_bug+0x84/0x160
[   97.447312][ T5870]  exc_invalid_op+0x1a/0x50
[   97.449314][ T5870]  asm_exc_invalid_op+0x1a/0x20
[   97.451469][ T5870] RIP: 0010:xfrm_state_fini+0x270/0x2f0
[   97.453886][ T5870] Code: c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 a8 3d 01 f8 48 8b 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 86 fa e1 f7 e8 81 60 9d f7 90 <0f> 0b 90 e9 fd fd ff ff e8 73 60 9d f7 90 0f 0b 90 e9 60 fe ff ff
[   97.462063][ T5870] RSP: 0018:ffffc90003f6f898 EFLAGS: 00010293
[   97.464707][ T5870] RAX: ffffffff8a224bcf RBX: ffff8880295d0000 RCX: ffff888108143980
[   97.468115][ T5870] RDX: 0000000000000000 RSI: ffffffff8dba65a5 RDI: ffff888108143980
[   97.471510][ T5870] RBP: ffffc90003f6f9b0 R08: ffffffff8fa38937 R09: 1ffffffff1f47126
[   97.474705][ T5870] R10: dffffc0000000000 R11: fffffbfff1f47127 R12: ffffffff8f631560
[   97.477999][ T5870] R13: 1ffff920007edf40 R14: ffff8880295d1480 R15: dffffc0000000000
[   97.481364][ T5870]  ? xfrm_state_fini+0x26f/0x2f0
[   97.483596][ T5870]  ? xfrm_state_fini+0x26f/0x2f0
[   97.485781][ T5870]  xfrm_net_exit+0x2d/0x70
[   97.487758][ T5870]  ops_undo_list+0x49a/0x990
[   97.489751][ T5870]  ? __pfx_ops_undo_list+0x10/0x10
[   97.491951][ T5870]  ? do_raw_spin_unlock+0x4d/0x240
[   97.494127][ T5870]  cleanup_net+0x4c5/0x800
[   97.496103][ T5870]  ? __pfx_cleanup_net+0x10/0x10
[   97.498275][ T5870]  ? _raw_spin_unlock_irq+0x23/0x50
[   97.500579][ T5870]  ? process_scheduled_works+0x9ef/0x17b0
[   97.503057][ T5870]  ? process_scheduled_works+0x9ef/0x17b0
[   97.505310][ T5870]  process_scheduled_works+0xae1/0x17b0
[   97.507525][ T5870]  ? __pfx_process_scheduled_works+0x10/0x10
[   97.510114][ T5870]  worker_thread+0x8a0/0xda0
[   97.512166][ T5870]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   97.514868][ T5870]  ? __kthread_parkme+0x7b/0x200
[   97.517028][ T5870]  kthread+0x711/0x8a0
[   97.518860][ T5870]  ? __pfx_worker_thread+0x10/0x10
[   97.521022][ T5870]  ? __pfx_kthread+0x10/0x10
[   97.523032][ T5870]  ? _raw_spin_unlock_irq+0x23/0x50
[   97.525292][ T5870]  ? lockdep_hardirqs_on+0x9c/0x150
[   97.527576][ T5870]  ? __pfx_kthread+0x10/0x10
[   97.529619][ T5870]  ret_from_fork+0x3fc/0x770
[   97.531668][ T5870]  ? __pfx_ret_from_fork+0x10/0x10
[   97.533900][ T5870]  ? __switch_to_asm+0x39/0x70
[   97.536019][ T5870]  ? __switch_to_asm+0x33/0x70
[   97.538157][ T5870]  ? __pfx_kthread+0x10/0x10
[   97.540196][ T5870]  ret_from_fork_asm+0x1a/0x30
[   97.542330][ T5870]  </TASK>
[   97.544517][ T5870] Kernel Offset: disabled
[   97.546462][ T5870] Rebooting in 86400 seconds..

VM DIAGNOSIS:
01:46:06  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000000 RBX=0000000000000202 RCX=0000000080000000 RDX=0000000000000002
RSI=ffffffff8dba65a5 RDI=ffffffff8be33700 RBP=ffff88801ffb8b40 RSP=ffffc90003e1e7b8
R8 =ffffc90003e1e978 R9 =0000000000000000 R10=ffffc90003e1e9d8 R11=fffff520007c3d3d
R12=0000000000000002 R13=0000000000000002 R14=ffffffff8e139ea0 R15=ffff88801ffb8000
RIP=ffffffff8b79c1ac RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555562385500 ffffffff 00c00000
GS =0000 ffff8880b8619000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f7c8f5ca440 CR3=00000000276ea000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007fc896e12e53
XMM06=0000000000000000 00007fc896e12e4d XMM07=0000000000000000 00007fc896e12e61
XMM08=0000000000000000 00007fc896e12ee7 XMM09=0000000000000000 00007fc896e12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000080080783 RBX=1ffff110210a225a RCX=000000000000009d RDX=ffff8881085112d0
RSI=0000000000000000 RDI=0000000000000000 RBP=ffffc900001e0b88 RSP=ffffc900001e09e0
R8 =ffff8881085116bf R9 =1ffff110210a22d7 R10=dffffc0000000000 R11=ffffed10210a22d8
R12=dffffc0000000000 R13=0000000000004e20 R14=0000000000000001 R15=0000000000000000
RIP=ffffffff8698d817 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c19000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000564fea531131 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f XMM01=0000000000000000 0000000000000000
XMM02=ffffffffffffffff ffffffffffffff00 XMM03=00000000000000ff 000000000000ff00
XMM04=0000000000ff0000 0000ff0000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
