last executing test programs:

3m26.370423897s ago: executing program 2 (id=440):
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1837000000000000000000000800000085550c00000000009500000000000000e95a7f0fda1bc47138b7c53358451a9fa55742722f2d891fcf50e9d9ba8c18740091e294f5e3f6919d2e8a39d6119fbbbca9d0a4fe148f638347e08636ba40af31364908adfd64cafc4f7275fce536a74435dced0929185cb17ff57535ea870a2c0b60fcbf5c929988527d6c39b38e250e3af4a548f228bb66cd2ef0b591cf5da93825149d1a981f2bab3882c5b390aa251aa5c81ea7e1ab578306ec55ed304fb348d866586e62ad91d210f5c3df337b0ad85f7505ece06e1317d2d70bd3f24cf881d1a7f08249f3575d8e2729e72fc73c3c6a9107557d4d73c6a16098fad638dd05006ac2496ff16198b05b4eb885824518b5ebe1c5279595486b387fca4d682a8ae38bed86da508891ffb168899ace398b787f37b3a0390059d733be5fd0"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0x5e, 0xffffffffffffffff, 0x41100, 0x0, '\x00', 0x0, 0x38, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff60, 0x0, 0x0, 0x10, 0x100}, 0x94)

3m26.213355426s ago: executing program 2 (id=441):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x2, 0x3, 0x0, 0x2, 0x10, 0x0, 0x0, 0x0, [@sadb_key={0x2, 0x8, 0x8, 0x0, "a3"}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private2}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x40000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @empty}}]}, 0x80}, 0x1, 0x7}, 0x0)

3m26.049929393s ago: executing program 2 (id=442):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e000000020013000200000000000000ff0800ed05000600200000000a0006000000000026b900000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0)

3m25.731615611s ago: executing program 2 (id=446):
socket$nl_netfilter(0x10, 0x3, 0xc)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
r0 = perf_event_open(&(0x7f0000000440)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, @perf_config_ext={0x8, 0x100000830d}, 0x4500, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
socket$kcm(0x10, 0x2, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_mpls={0x5c, 0x1, 0x0, 0x0, {{0x9}, {0x30, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x9d, 0x9, 0x7, 0x8, 0x4e19}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x809b}, @TCA_MPLS_TC={0x5, 0x6, 0x3}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000"], 0x48)
r2 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x7fff, 0x7fffffff}, 0x0, 0xffffffffffffffff, r0, 0xa)
r3 = socket$kcm(0xa, 0x5, 0x0)
recvmsg$kcm(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x40000000)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = bpf$MAP_CREATE(0x0, 0x0, 0x48)
syz_open_procfs$namespace(0x0, &(0x7f0000000380)='ns/user\x00')
r5 = socket$kcm(0xa, 0x5, 0x0)
setsockopt$sock_attach_bpf(r5, 0x29, 0x38, 0x0, 0x0)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x800, r4}, 0x38)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, 0xffffffffffffffff)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$kcm(0x2b, 0x1, 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0x3100, 0x0, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))

3m25.653012307s ago: executing program 0 (id=449):
r0 = socket$kcm(0x10, 0x2, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="364000001a00910006000000000000000a"], 0xfe33)
r1 = gettid()
socket$kcm(0x2, 0x922000000001, 0x106)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x201, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000012000000000000000000"], &(0x7f0000000c00)='GPL\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0xc010)
r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='rxrpc_timer\x00', r3}, 0x18)
r4 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, 0x0, 0x20000050)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8946, 0x0)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x1411, 0x1, 0x70bd27, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x13}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x48810}, 0x4000)
r5 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x5, @perf_bp={&(0x7f00000006c0), 0x2}, 0x1000, 0x4, 0x0, 0x8, 0x0, 0x40000, 0x2}, r1, 0x0, 0xffffffffffffffff, 0x2)
r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6)
perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_bp={0x0}, 0x0, 0xca}, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
close(r8)
recvmsg$unix(r7, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x42)

3m25.447720374s ago: executing program 0 (id=453):
r0 = socket$inet6(0xa, 0x1, 0x100)
recvmsg(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x82)

3m25.394227399s ago: executing program 0 (id=454):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='pids.events\x00', 0x26e1, 0x0)
ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x401c5820, &(0x7f0000000000)=0x129)

3m25.39390529s ago: executing program 0 (id=455):
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x7, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0xa2c0739963b0e8f1, '\x00', 0x0, @fallback=0x31}, 0x94)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bridge0\x00', 0x100})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
perf_event_open(&(0x7f00000000c0)={0x5, 0x80, 0xec, 0x4, 0xff, 0x7, 0x0, 0x1, 0x917d5, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0xffffffff, 0x0, @perf_bp={0x0, 0xd}, 0xb3d8c41eb80db927, 0x1, 0x8007, 0x0, 0x81, 0x5, 0x5, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xa, 0xffffffffffffffff, 0xb)
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000080))

3m25.366229584s ago: executing program 0 (id=456):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2, <r3=>0xffffffffffffffff}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20)
r4 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r6=>0xffffffffffffffff})
recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40)
ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5)
recvmsg$unix(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000002480)=""/195, 0xc3}], 0x1}, 0x2000)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r3}, &(0x7f0000000280), &(0x7f0000000140)=r0}, 0x22)
close(0x3)

3m25.356757881s ago: executing program 2 (id=457):
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000080)=[{&(0x7f00000000c0)='#', 0x1}], 0x1}, 0x4000040)
recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x102)
setsockopt$sock_attach_bpf(r0, 0x1, 0x7, &(0x7f0000000180), 0x43)

3m25.242577829s ago: executing program 1 (id=458):
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x100840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socketpair(0x18, 0x0, 0x10001, &(0x7f00000001c0))
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
setsockopt$sock_attach_bpf(r0, 0x6, 0xd, 0x0, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = socket$nl_rdma(0x10, 0x3, 0x14)
r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={r4, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
sendmsg$RDMA_NLDEV_CMD_SYS_SET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB], 0x18}}, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
ioctl$TUNGETDEVNETNS(r1, 0xff05, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)

3m25.085840046s ago: executing program 1 (id=459):
bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50)
r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_lsm={0x18, 0x7, &(0x7f0000000000)=ANY=[@ANYBLOB="8510000004000000950080000000000018000000000000000000000000000002950000000000000085100000fcffffff95"], &(0x7f00000000c0)='GPL\x00'}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r0, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10)

3m24.984586088s ago: executing program 1 (id=460):
bpf$LINK_GET_NEXT_ID(0x1f, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10)
perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0x0, 0x10, 0xfc, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, @perf_config_ext={0x6531aa1a, 0xeb}, 0x0, 0xc8, 0x9, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x4, 0x0, 0x200000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(r1)
recvmsg$unix(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r2=>0xffffffffffffffff]}}], 0x18}, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa88"], 0xfdef)
write$cgroup_subtree(r2, &(0x7f0000000000), 0xfdef)

3m24.890777958s ago: executing program 1 (id=461):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x1c, 0x24, 0x301, 0x70bd25, 0xfffffffc, {0x1}, [@typed={0x8, 0x7e, 0x0, 0x0, @fd}]}, 0x1c}, 0x1, 0x0, 0x0, 0x448d3}, 0x4000040)

3m24.798912162s ago: executing program 1 (id=462):
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x800c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000040), 0x2}, 0x10008, 0x9, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x7, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x40)
socket$kcm(0x2b, 0x1, 0x0)
r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_ro(r0, &(0x7f00000000c0)='freezer.self_freezing\x00', 0x26e1, 0x0)
perf_event_open(&(0x7f0000000280)={0x3, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x5d34, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x7}, 0x102812, 0x0, 0x0, 0x1, 0x8000000, 0xa9, 0x803}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x2, 0x16, 0x2, 0x3, 0x4, 0x0, 0x0, 0x25dfdbfc, [@sadb_sa={0x1, 0x1, 0x0, 0xb, 0x80, 0x61, 0x2, 0x60000001}]}, 0x20}}, 0x0)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001200)='./cgroup/syz0\x00', 0x200002, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000044000900fffffffffddbdf250400000004001f00100001"], 0x28}, 0x1, 0x0, 0x0, 0x4044004}, 0x0)
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff6)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb01001800000000040000000000000000000002000000000029d94f0664acda6067df662b750af3958d92d7b23cdfbbd86611cba6159d4baafcd6d4788affdd9e8aef3bbd9d6c8a083845d5e168ae8e6a78d630bea01e2ac807aa3dc96a4c50d112d4905bc343965629"], 0x0, 0x1a, 0x0, 0x1}, 0x28)
ioctl$TUNGETVNETLE(r2, 0x40047459, &(0x7f0000001200))
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)

3m24.450941548s ago: executing program 2 (id=463):
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="d8000000190081054e81f782db4cb9040220080000000000000000070a0005000900142603600e1208001e0000050401a8430400027c035c0461c1d67f6f94007134cf6efb8001a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c3f5aeb4edbb57a5025ccca9e008026f6e6ddba61f5fad95667e006dcdf639500bfeb789d00000000000000d5e1cace81ed6c117ab5d6d69bda4039e81f86f60f0bffece0b42a9ecbee5de6ccd40dd6e4edef", 0xcb}], 0x1}, 0x0)
r0 = perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd7a, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4c081)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, 0x0, &(0x7f00000002c0)}, 0x20)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'gre0\x00', 0x10})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f0, &(0x7f0000000080))
sendmsg(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000040)="efa84c21442ebb447a5b323c99841ba328aaa6b56c3b39f7a33bbe19184d55aa789c70b289e7da", 0x27}], 0x1, &(0x7f0000000c40)=ANY=[], 0x1208}, 0x40000)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080))
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94)

3m24.44506615s ago: executing program 1 (id=464):
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x6, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180))
perf_event_open(&(0x7f0000000180)={0x5, 0x80, 0x0, 0x72, 0x8, 0x5, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x8}, 0x8100, 0x7f, 0x0, 0x9, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8000001946}, 0x0, 0x0, 0x0, 0x8, 0x2fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x56, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7b, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000240)='ns/user\x00')
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x200000000000000}, 0x0, 0x400, 0x0, 0x0, 0x0, 0x10000000, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmsg$inet(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0)
recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[@cred={{0x1c}}, @rights={{0x10}}], 0x30}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1d, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x4}, 0x94)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x200})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000080))
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4080000400000006110540000000000a600000000000000950000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94)
r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r5 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x4, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x10eba, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x24}, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x5, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r7 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x1400, &(0x7f0000000080)=[{&(0x7f0000000040)="140000001d000b63d25a80648c2594f90524fc60", 0x14}], 0x1, 0x0, 0x0, 0x4000}, 0x0)
socket(0x10, 0x803, 0x0)
perf_event_open$cgroup(&(0x7f0000000200)={0x4, 0x80, 0x6, 0x4b, 0x3, 0x4, 0x0, 0x6, 0x52915, 0x6, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x7, 0x9}, 0x10000, 0x16d, 0x0, 0x7, 0x1, 0x7, 0x9, 0x0, 0x800, 0x0, 0x9}, 0xffffffffffffffff, 0x0, r0, 0x8)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="9feb01001800000000000000100000001000000007000000010000000000000100000000"], 0x0, 0x2f, 0x0, 0x1, 0x8}, 0x28)

1m30.20571798s ago: executing program 0 (id=465):
r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1f, 0x0, 0x0, 0x2000}, 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100030000009500000000000000bf71000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x8, 0xf7, &(0x7f0000001e40)=""/4093, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x42}, 0x21)

1m30.205108971s ago: executing program 32 (id=464):
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x6, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180))
perf_event_open(&(0x7f0000000180)={0x5, 0x80, 0x0, 0x72, 0x8, 0x5, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x8}, 0x8100, 0x7f, 0x0, 0x9, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8000001946}, 0x0, 0x0, 0x0, 0x8, 0x2fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x56, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7b, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000240)='ns/user\x00')
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x200000000000000}, 0x0, 0x400, 0x0, 0x0, 0x0, 0x10000000, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmsg$inet(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0)
recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[@cred={{0x1c}}, @rights={{0x10}}], 0x30}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1d, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x4}, 0x94)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x200})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000080))
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4080000400000006110540000000000a600000000000000950000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94)
r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r5 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x4, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x10eba, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x24}, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x5, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r7 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x1400, &(0x7f0000000080)=[{&(0x7f0000000040)="140000001d000b63d25a80648c2594f90524fc60", 0x14}], 0x1, 0x0, 0x0, 0x4000}, 0x0)
socket(0x10, 0x803, 0x0)
perf_event_open$cgroup(&(0x7f0000000200)={0x4, 0x80, 0x6, 0x4b, 0x3, 0x4, 0x0, 0x6, 0x52915, 0x6, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x7, 0x9}, 0x10000, 0x16d, 0x0, 0x7, 0x1, 0x7, 0x9, 0x0, 0x800, 0x0, 0x9}, 0xffffffffffffffff, 0x0, r0, 0x8)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="9feb01001800000000000000100000001000000007000000010000000000000100000000"], 0x0, 0x2f, 0x0, 0x1, 0x8}, 0x28)

1m26.033512969s ago: executing program 33 (id=463):
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="d8000000190081054e81f782db4cb9040220080000000000000000070a0005000900142603600e1208001e0000050401a8430400027c035c0461c1d67f6f94007134cf6efb8001a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c3f5aeb4edbb57a5025ccca9e008026f6e6ddba61f5fad95667e006dcdf639500bfeb789d00000000000000d5e1cace81ed6c117ab5d6d69bda4039e81f86f60f0bffece0b42a9ecbee5de6ccd40dd6e4edef", 0xcb}], 0x1}, 0x0)
r0 = perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd7a, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4c081)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, 0x0, &(0x7f00000002c0)}, 0x20)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'gre0\x00', 0x10})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f0, &(0x7f0000000080))
sendmsg(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000040)="efa84c21442ebb447a5b323c99841ba328aaa6b56c3b39f7a33bbe19184d55aa789c70b289e7da", 0x27}], 0x1, &(0x7f0000000c40)=ANY=[], 0x1208}, 0x40000)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080))
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94)

1m25.950756181s ago: executing program 34 (id=465):
r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1f, 0x0, 0x0, 0x2000}, 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100030000009500000000000000bf71000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x8, 0xf7, &(0x7f0000001e40)=""/4093, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x42}, 0x21)

24.193227939s ago: executing program 4 (id=1200):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair(0x3, 0x1, 0x1ff, &(0x7f00000000c0))

24.073308863s ago: executing program 4 (id=1205):
r0 = socket$kcm(0x25, 0x1, 0x0)
recvmsg(r0, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x40010040)

24.014070159s ago: executing program 4 (id=1208):
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x19, 0xf, &(0x7f0000000000)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b70200001400009e219999dcade5b2c9f000b703000000000d008500000031"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000028000000280000000200000000000000000000030000000000000000000000000000000000000000000000010502"], 0x0, 0x42}, 0x20)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22000000"], 0xfdef)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2040, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x2, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

23.834023298s ago: executing program 4 (id=1216):
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="180200000070780000000000000000001801000020207025000000001fbf20207baaf8ff0000496bf7d91b93bdad1b70e30e17e30000bda10600000000004701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x94)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d80000001e0081054e81f782db4cb9040a1d080006007c095dd2086518000a800d00000003600e1208000f0000000406a80016c008", 0x35}], 0x1}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0)

23.711056396s ago: executing program 4 (id=1218):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.avg_queue_size\x00', 0x26e1, 0x0)
close(r0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
socket$kcm(0x10, 0x2, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000080))
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$kcm(0x10, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff)
write$cgroup_int(r2, &(0x7f00000000c0), 0x12)
write$cgroup_pid(r0, &(0x7f00000005c0), 0x12)

23.035375514s ago: executing program 4 (id=1219):
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/user\x00')
ioctl$TUNSETFILTEREBPF(r0, 0xb704, 0x0)

22.885629613s ago: executing program 35 (id=1219):
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/user\x00')
ioctl$TUNSETFILTEREBPF(r0, 0xb704, 0x0)

933.312328ms ago: executing program 6 (id=1577):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x48)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000dd0000000a"], 0x50)
r1 = socket$kcm(0x10, 0x2, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0xfe33)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b703000000000000850000007000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00', r2}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610424000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48)

793.966633ms ago: executing program 6 (id=1578):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
recvmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000140)=""/159, 0x9f}, {&(0x7f0000000600)=""/210, 0xd2}, {&(0x7f0000004000)=""/4073, 0xfe9}, {&(0x7f0000002940)=""/4112, 0x1010}, {&(0x7f0000001380)=""/61, 0x3d}, {&(0x7f0000000940)=""/158, 0x9e}, {&(0x7f0000002680)=""/199, 0xc7}, {&(0x7f0000000240)=""/107, 0x6b}], 0x8}, 0x40012100)
recvmsg$kcm(r0, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x0)

643.284972ms ago: executing program 6 (id=1579):
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x5, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61128c030000000061138c8800000000bf30000000000000150007000009240b2d03010000000000950000a7000000006916700000000000bf67000000000000b5070000fcff0304670600001f000000370300000ef90060"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a32000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000040000000000a40000000160a01080000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000170a0103000000000000000002"], 0x20}, 0x1, 0x0, 0x0, 0x44000}, 0x8094)

642.865938ms ago: executing program 6 (id=1580):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
recvmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/172, 0xac}, {&(0x7f0000001140)=""/4058, 0xfda}, {&(0x7f0000002940)=""/4106, 0x100a}, {&(0x7f00000007c0)=""/174, 0xae}, {&(0x7f0000004d40)=""/208, 0xd0}, {&(0x7f0000000580)=""/111, 0x6f}], 0x6}, 0x10100)
recvmsg$kcm(r0, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x0)

627.540506ms ago: executing program 6 (id=1581):
socket(0x10, 0x3, 0x0)
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0xa}, 0x1108d5, 0x4, 0x0, 0x3, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
r2 = socket$kcm(0x10, 0x3, 0x10)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r3}, 0x10)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="140000002a000beb2800000000000000000f5ddf", 0x14}], 0x1}, 0x40040)

438.017803ms ago: executing program 6 (id=1585):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[], 0x50)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r2=>0xffffffffffffffff})
recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r4 = socket$kcm(0x2a, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x890b, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r3)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x2000, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0)
r6 = socket$kcm(0x2, 0x1000000000000002, 0x0)
setsockopt$sock_attach_bpf(r6, 0x1, 0x3e, &(0x7f00000002c0)=r5, 0x161)
sendmsg$inet(r6, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000380), 0xb80b}], 0x1}, 0xd000000)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={&(0x7f0000000040)='percpu_alloc_percpu\x00', r7}, 0x10)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000001c0)={r0, 0x0, &(0x7f0000000180)=""/40}, 0x20)

282.96144ms ago: executing program 3 (id=1587):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000004c0)={r0, &(0x7f0000000300), 0x0}, 0x20)

231.461741ms ago: executing program 5 (id=1588):
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000880)=ANY=[@ANYBLOB="7a0af8ff7525736cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000019000000b700000000000000950000f700000000b2595285fa97ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5956fc4a33ca263e2b5d47b2b00000000b1a297cfddd73f30f2382f6c2d3ffdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000010000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e3841bef895c5a637b0bf2eac3cb07b74a72291a1a2b523dd81b6651b1ee29e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c92cdfbea882b0b18914781ceb10814cf4ee23ddb79fff5eb156e0a000000000000f2bd164a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8fdf3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c66200349e62d4d0ab1a1dc51907c980000cfb215af2c1a3c22243cce23b00000a857d61b0d66c3f6da8aed31027c33204ea0fa0620111920d3f24980e9995a510bd87b06440a0a26130098b901c53a02cfbfd8bcbdec9f34542c3c9652adefde555ecd28ebc88082bab431ee3e1adb5b0ad14c79dd4411ecc96c512f3b72a9b3a0c3e07ec6b427bdc0bf3963e9f802a5feab82a989db62d8d1339f842b3f593d6c24fe015ec63c658ba7c4fae17514f802709ab4fa5caa932d4b65a5ecfc422899513ddde6ec04974f9981a8c155c26e2e3b8f2d0da70e524832ab04dec9ce66a62ceffbb15b1857c93666fe043a266a451f9a1e1f054211b9ae566b58f4f356c7a4"], &(0x7f0000000100)='GPL\x00'}, 0x48)

231.165934ms ago: executing program 3 (id=1589):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000710429000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)

181.998701ms ago: executing program 5 (id=1590):
bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000006c0)={@fallback, 0xffffffffffffffff, 0x31, 0x7}, 0x20)

181.704504ms ago: executing program 3 (id=1591):
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x108b84, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETSET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14, 0xa, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x44}, 0x20004000)

99.919408ms ago: executing program 3 (id=1592):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x20, 0x1, 0x2, 0x3, 0x0, 0x0, {0x7, 0x0, 0x2}, [@CTA_EXPECT_TUPLE={0x4}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x4040}, 0x0)

98.582566ms ago: executing program 5 (id=1598):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000090000000000000000000000850000002a000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000040)='sys_exit\x00', r0}, 0x10)

24.297744ms ago: executing program 3 (id=1593):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="50000000270001000000000006000000ac1e01"], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x0)

24.113624ms ago: executing program 5 (id=1594):
socket$kcm(0x22, 0x3, 0x11)

23.958601ms ago: executing program 5 (id=1595):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x4, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x2}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$kcm(0xa, 0x2, 0x3a)
sendmsg$kcm(r0, &(0x7f00000005c0)={&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f0000000080), 0x1}, 0x0)

23.759238ms ago: executing program 3 (id=1596):
r0 = socket$kcm(0x10, 0x3, 0x10)
r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x1}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800"/29], &(0x7f0000000280)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803003a000b12d25a80648c2594f90224fc60640c034002a10100feff000037153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0)

0s ago: executing program 5 (id=1597):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/209, 0xd1}], 0x1}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025bd7000000000000000000000000000000000000300000006"], 0x34c}}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:40780' (ED25519) to the list of known hosts.
syzkaller login: [   48.656923][ T5774] cgroup: Unknown subsys name 'net'
[   48.717450][ T5774] cgroup: Unknown subsys name 'cpuset'
[   48.722699][ T5774] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.148244][ T5774] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   57.780764][ T5870] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   59.555807][ T5883] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   59.567920][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   59.607673][ T5886] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   59.611598][ T5886] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   59.612782][ T5889] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   59.615045][ T5886] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   59.622788][ T5890] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   59.622801][ T5886] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   59.626702][ T5890] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   59.633043][ T5889] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   59.638353][ T5886] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   59.642798][ T5890] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   59.676468][ T5889] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   59.691876][ T5889] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   59.697376][ T5889] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   59.984362][ T5885] chnl_net:caif_netlink_parms(): no params data found
[   60.017468][ T5882] chnl_net:caif_netlink_parms(): no params data found
[   60.058818][ T5888] chnl_net:caif_netlink_parms(): no params data found
[   60.131334][ T5885] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.134436][ T5885] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.137797][ T5885] bridge_slave_0: entered allmulticast mode
[   60.141695][ T5885] bridge_slave_0: entered promiscuous mode
[   60.147232][ T5882] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.149907][ T5882] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.152696][ T5882] bridge_slave_0: entered allmulticast mode
[   60.157791][ T5882] bridge_slave_0: entered promiscuous mode
[   60.171723][ T5885] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.174850][ T5885] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.177878][ T5885] bridge_slave_1: entered allmulticast mode
[   60.181609][ T5885] bridge_slave_1: entered promiscuous mode
[   60.185200][ T5882] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.187494][ T5882] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.190067][ T5882] bridge_slave_1: entered allmulticast mode
[   60.192673][ T5882] bridge_slave_1: entered promiscuous mode
[   60.240828][ T5885] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.245868][ T5882] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.263475][ T5882] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   60.267834][ T5885] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   60.271069][ T5888] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.277187][ T5888] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.280365][ T5888] bridge_slave_0: entered allmulticast mode
[   60.284112][ T5888] bridge_slave_0: entered promiscuous mode
[   60.327985][ T5888] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.331187][ T5888] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.334344][ T5888] bridge_slave_1: entered allmulticast mode
[   60.338530][ T5888] bridge_slave_1: entered promiscuous mode
[   60.355851][ T5885] team0: Port device team_slave_0 added
[   60.376706][ T5882] team0: Port device team_slave_0 added
[   60.380736][ T5882] team0: Port device team_slave_1 added
[   60.396522][ T5885] team0: Port device team_slave_1 added
[   60.401139][ T5888] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.430553][ T5888] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   60.434891][ T5882] batman_adv: batadv0: Adding interface: batadv_slave_0
[   60.437856][ T5882] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.448791][ T5882] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   60.478917][ T5882] batman_adv: batadv0: Adding interface: batadv_slave_1
[   60.481683][ T5882] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.491411][ T5882] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   60.506946][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_0
[   60.509122][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.517588][ T5885] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   60.545373][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_1
[   60.547662][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.557410][ T5885] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   60.562705][ T5888] team0: Port device team_slave_0 added
[   60.570188][ T5882] hsr_slave_0: entered promiscuous mode
[   60.573261][ T5882] hsr_slave_1: entered promiscuous mode
[   60.582837][ T5888] team0: Port device team_slave_1 added
[   60.618650][ T5888] batman_adv: batadv0: Adding interface: batadv_slave_0
[   60.621414][ T5888] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.631967][ T5888] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   60.649439][ T5888] batman_adv: batadv0: Adding interface: batadv_slave_1
[   60.651835][ T5888] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.661935][ T5888] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   60.710953][ T5885] hsr_slave_0: entered promiscuous mode
[   60.713511][ T5885] hsr_slave_1: entered promiscuous mode
[   60.716315][ T5885] debugfs: 'hsr0' already exists in 'hsr'
[   60.718635][ T5885] Cannot create hsr debugfs directory
[   60.736606][ T5888] hsr_slave_0: entered promiscuous mode
[   60.739890][ T5888] hsr_slave_1: entered promiscuous mode
[   60.742851][ T5888] debugfs: 'hsr0' already exists in 'hsr'
[   60.746037][ T5888] Cannot create hsr debugfs directory
[   61.022558][ T5882] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   61.037703][ T5882] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   61.042686][ T5882] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   61.061621][ T5882] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   61.100556][ T5885] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   61.106670][ T5885] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   61.113265][ T5885] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   61.120401][ T5885] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   61.193465][ T5888] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   61.206366][ T5888] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   61.220486][ T5888] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   61.232746][ T5888] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   61.299908][ T5882] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.308012][ T5885] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.330961][ T5882] 8021q: adding VLAN 0 to HW filter on device team0
[   61.354902][ T1853] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.357906][ T1853] bridge0: port 1(bridge_slave_0) entered forwarding state
[   61.363928][ T5885] 8021q: adding VLAN 0 to HW filter on device team0
[   61.384379][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.387310][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   61.392880][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.396018][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   61.417001][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.419916][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   61.455623][ T5888] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.488190][ T5888] 8021q: adding VLAN 0 to HW filter on device team0
[   61.510603][ T1853] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.513320][ T1853] bridge0: port 1(bridge_slave_0) entered forwarding state
[   61.528072][ T1853] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.530972][ T1853] bridge0: port 2(bridge_slave_1) entered forwarding state
[   61.595563][ T5888] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   61.685056][ T5889] Bluetooth: hci1: command tx timeout
[   61.687396][ T5889] Bluetooth: hci0: command tx timeout
[   61.696452][ T5882] 8021q: adding VLAN 0 to HW filter on device batadv0
[   61.719806][ T5885] 8021q: adding VLAN 0 to HW filter on device batadv0
[   61.723115][ T5888] 8021q: adding VLAN 0 to HW filter on device batadv0
[   61.753515][ T5882] veth0_vlan: entered promiscuous mode
[   61.770876][ T5885] veth0_vlan: entered promiscuous mode
[   61.776492][ T5889] Bluetooth: hci2: command tx timeout
[   61.779931][ T5882] veth1_vlan: entered promiscuous mode
[   61.793044][ T5885] veth1_vlan: entered promiscuous mode
[   61.810454][ T5888] veth0_vlan: entered promiscuous mode
[   61.822623][ T5888] veth1_vlan: entered promiscuous mode
[   61.833951][ T5885] veth0_macvtap: entered promiscuous mode
[   61.841068][ T5882] veth0_macvtap: entered promiscuous mode
[   61.848504][ T5885] veth1_macvtap: entered promiscuous mode
[   61.851467][ T5882] veth1_macvtap: entered promiscuous mode
[   61.875901][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_0
[   61.888513][ T5882] batman_adv: batadv0: Interface activated: batadv_slave_0
[   61.897040][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_1
[   61.904362][ T5882] batman_adv: batadv0: Interface activated: batadv_slave_1
[   61.908919][ T5888] veth0_macvtap: entered promiscuous mode
[   61.924380][ T5888] veth1_macvtap: entered promiscuous mode
[   61.928770][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   61.946674][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   61.960392][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   61.964329][ T5888] batman_adv: batadv0: Interface activated: batadv_slave_0
[   61.977818][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   61.993835][ T5888] batman_adv: batadv0: Interface activated: batadv_slave_1
[   61.997408][   T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.027440][   T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.030829][   T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.042902][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.065891][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.082759][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.086911][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.089834][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.103579][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.112604][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.146312][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.152005][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.174067][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.179604][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.224923][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.235514][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.245988][ T5950] netlink: 'syz.1.18': attribute type 19 has an invalid length.
[   62.322576][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.330768][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.403875][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.416335][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.823583][ T5976] netlink: 60 bytes leftover after parsing attributes in process `syz.1.30'.
[   62.839164][ T5976] netlink: 60 bytes leftover after parsing attributes in process `syz.1.30'.
[   62.851496][ T5976] netlink: 60 bytes leftover after parsing attributes in process `syz.1.30'.
[   63.023131][ T5990] netlink: 12 bytes leftover after parsing attributes in process `syz.2.37'.
[   63.397915][ T6014] openvswitch: netlink: Duplicate or invalid key (type 0).
[   63.402119][ T6014] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   63.700598][ T6030] netlink: 'syz.1.55': attribute type 1 has an invalid length.
[   63.764810][ T5889] Bluetooth: hci0: command tx timeout
[   63.765056][   T54] Bluetooth: hci1: command tx timeout
[   63.854991][   T54] Bluetooth: hci2: command tx timeout
[   64.324532][    C0] hrtimer: interrupt took 37552 ns
[   64.365478][ T6052] netlink: 14 bytes leftover after parsing attributes in process `syz.2.64'.
[   64.599822][ T6058] netlink: 'syz.0.67': attribute type 13 has an invalid length.
[   64.603471][ T6058] netlink: 'syz.0.67': attribute type 17 has an invalid length.
[   64.649738][ T6060] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   64.747792][ T6060] netlink: 'syz.1.68': attribute type 21 has an invalid length.
[   65.032508][ T6058] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   65.039912][ T6060] netlink: 156 bytes leftover after parsing attributes in process `syz.1.68'.
[   65.056570][ T6060] netlink: 4 bytes leftover after parsing attributes in process `syz.1.68'.
[   65.157409][ T6063] : entered promiscuous mode
[   65.222895][ T6065] pim6reg1: entered allmulticast mode
[   65.437717][ T6077] netlink: 8 bytes leftover after parsing attributes in process `syz.1.76'.
[   65.847037][   T54] Bluetooth: hci0: command tx timeout
[   65.847074][ T5889] Bluetooth: hci1: command tx timeout
[   65.924825][ T5889] Bluetooth: hci2: command tx timeout
[   66.173412][ T6102] team0: Port device team_slave_0 removed
[   66.201199][ T6102] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check.
[   66.314788][ T6115] netlink: 'syz.1.92': attribute type 25 has an invalid length.
[   66.436238][ T6123] netlink: 830 bytes leftover after parsing attributes in process `syz.2.97'.
[   66.971660][ T6129] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   67.004422][ T6129] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[   67.009634][ T6135] Zero length message leads to an empty skb
[   67.765631][ T6160] netlink: 'syz.0.108': attribute type 1 has an invalid length.
[   67.826715][ T6163] openvswitch: netlink: Tunnel attr 7 has unexpected len 12 expected 0
[   67.884024][ T6169] netlink: 'syz.0.113': attribute type 29 has an invalid length.
[   67.917324][ T6169] netlink: 'syz.0.113': attribute type 29 has an invalid length.
[   67.930324][ T5889] Bluetooth: hci0: command tx timeout
[   67.939168][ T5889] Bluetooth: hci1: command tx timeout
[   67.949552][ T6171] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   68.004977][ T5889] Bluetooth: hci2: command tx timeout
[   68.106396][ T6179] netlink: 40 bytes leftover after parsing attributes in process `syz.1.117'.
[   68.166348][ T6179] bridge0: port 1(bridge_slave_0) entered disabled state
[   68.276329][ T6179] bridge_slave_0 (unregistering): left allmulticast mode
[   68.279420][ T6179] bridge_slave_0 (unregistering): left promiscuous mode
[   68.282412][ T6179] bridge0: port 1(bridge_slave_0) entered disabled state
[   68.343527][   T33] audit: type=1107 audit(1757434250.378:2): pid=6183 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''
[   68.773748][ T6198] @: renamed from bond_slave_0 (while UP)
[   68.879362][ T6199] netlink: 'syz.0.125': attribute type 21 has an invalid length.
[   68.883189][ T6199] netlink: 128 bytes leftover after parsing attributes in process `syz.0.125'.
[   69.304314][ T6199] netlink: 'syz.0.125': attribute type 4 has an invalid length.
[   70.449657][ T6246] netlink: 128124 bytes leftover after parsing attributes in process `syz.1.138'.
[   70.975634][   T24] cfg80211: failed to load regulatory.db
[   71.307849][ T6277] netlink: 'syz.1.146': attribute type 10 has an invalid length.
[   71.310492][ T6277] netlink: 55 bytes leftover after parsing attributes in process `syz.1.146'.
[   71.461680][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   71.468540][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   71.774703][ T6262] delete_channel: no stack
[   71.923167][ T6302] netlink: 'syz.1.161': attribute type 12 has an invalid length.
[   71.926944][ T6302] netlink: 132 bytes leftover after parsing attributes in process `syz.1.161'.
[   73.523216][ T6347] netlink: 28 bytes leftover after parsing attributes in process `syz.2.178'.
[   73.527949][ T6347] netlink: 28 bytes leftover after parsing attributes in process `syz.2.178'.
[   73.598855][ T6353] netlink: 12 bytes leftover after parsing attributes in process `syz.1.183'.
[   73.602522][ T6353] netlink: 152 bytes leftover after parsing attributes in process `syz.1.183'.
[   73.788721][ T6363] netlink: 830 bytes leftover after parsing attributes in process `syz.1.185'.
[   73.868989][ T6367] netlink: 'syz.0.189': attribute type 11 has an invalid length.
[   73.872284][ T6367] netlink: 168 bytes leftover after parsing attributes in process `syz.0.189'.
[   74.095802][ T6373] netlink: 12 bytes leftover after parsing attributes in process `syz.1.191'.
[   74.240778][ T6384] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check.
[   75.527267][ T6431] netlink: 32 bytes leftover after parsing attributes in process `syz.1.219'.
[   75.531058][ T6431] netlink: 32 bytes leftover after parsing attributes in process `syz.1.219'.
[   75.598643][ T6433] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes.
[   75.602027][ T5889] Bluetooth: hci0: unknown advertising packet type: 0x5f
[   76.574877][ T6492] netlink: 'syz.0.246': attribute type 6 has an invalid length.
[   76.581651][ T6492] netlink: 144448 bytes leftover after parsing attributes in process `syz.0.246'.
[   76.598390][ T6488] Driver unsupported XDP return value 0 on prog  (id 100) dev N/A, expect packet loss!
[   77.188736][ T6515] unsupported nlmsg_type 40
[   78.427016][ T6537] netlink: 'syz.0.262': attribute type 10 has an invalid length.
[   80.746940][ T6537] ipvlan1: entered promiscuous mode
[   80.749320][ T6537] ipvlan1: entered allmulticast mode
[   80.751581][ T6537] veth0_vlan: entered allmulticast mode
[   80.769562][ T6537] bridge0: port 3(ipvlan1) entered blocking state
[   80.772729][ T6537] bridge0: port 3(ipvlan1) entered disabled state
[   80.793677][ T6537] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check.
[   80.970150][ T6547] sit0: entered allmulticast mode
[   80.978305][ T6547] sit0: entered promiscuous mode
[   81.123129][ T6555] C: renamed from team_slave_0
[   81.674441][ T6555] __nla_validate_parse: 3 callbacks suppressed
[   81.674457][ T6555] netlink: 164 bytes leftover after parsing attributes in process `syz.1.269'.
[   81.698393][ T6554] netlink: 60 bytes leftover after parsing attributes in process `syz.2.271'.
[   81.719956][ T6557] netlink: 60 bytes leftover after parsing attributes in process `syz.2.271'.
[   81.738378][ T6559] netlink: 60 bytes leftover after parsing attributes in process `syz.2.271'.
[   81.928062][ T6568] warning: `syz.1.275' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   82.169781][ T6596] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[   82.173031][ T6596] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[   83.035035][ T6597] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[   83.053664][ T6618] netlink: 24 bytes leftover after parsing attributes in process `syz.0.290'.
[   83.058529][ T6618] netlink: 24 bytes leftover after parsing attributes in process `syz.0.290'.
[   83.293099][ T6631] syzkaller0: entered promiscuous mode
[   83.296905][ T6631] syzkaller0: entered allmulticast mode
[   84.940050][ T6659] netlink: 'syz.2.306': attribute type 1 has an invalid length.
[   84.943577][ T6659] netlink: 'syz.2.306': attribute type 4 has an invalid length.
[   84.947132][ T6659] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.306'.
[   85.267768][ T6663] netlink: 92 bytes leftover after parsing attributes in process `syz.2.308'.
[   85.563498][ T6676] netlink: 'syz.2.314': attribute type 2 has an invalid length.
[   85.567562][ T6676] netlink: 164 bytes leftover after parsing attributes in process `syz.2.314'.
[   86.290630][ T6682] netlink: 'syz.2.316': attribute type 2 has an invalid length.
[   86.368796][ T6688] netlink: 12 bytes leftover after parsing attributes in process `syz.1.320'.
[   86.687373][ T6712] netlink: 'syz.1.331': attribute type 16 has an invalid length.
[   86.692857][ T6712] __nla_validate_parse: 3 callbacks suppressed
[   86.692870][ T6712] netlink: 168 bytes leftover after parsing attributes in process `syz.1.331'.
[   87.792767][ T6728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.338'.
[   88.034315][ T6739] openvswitch: netlink: Message has 4 unknown bytes.
[   88.602458][ T6767] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.355'.
[   88.857997][ T6774] netlink: 60 bytes leftover after parsing attributes in process `syz.1.358'.
[   89.014716][ T6783] netlink: 12 bytes leftover after parsing attributes in process `syz.0.360'.
[   89.627590][ T6815] netlink: 7 bytes leftover after parsing attributes in process `syz.1.376'.
[   89.632952][ T6815] netlink: 7 bytes leftover after parsing attributes in process `syz.1.376'.
[   89.735744][ T6818] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[   90.049796][ T6832] sock: sock_timestamping_bind_phc: sock not bind to device
[   90.573622][ T6850] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[   94.379551][    C0] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 1140248051 wd_nsec: 1140248034
[   96.208576][ T6846] sched: DL replenish lagged too much
[   98.530458][ T6902] veth0_vlan: entered allmulticast mode
[   99.139840][ T6911] netlink: 294 bytes leftover after parsing attributes in process `syz.2.415'.
[   99.812135][ T5889] Bluetooth: hci1: unexpected event 0x0b length: 15 > 11
[   99.986411][ T6930] netlink: 104 bytes leftover after parsing attributes in process `syz.2.422'.
[  100.536010][ T6939] netlink: 'syz.2.425': attribute type 22 has an invalid length.
[  100.540437][ T6939] netlink: 4 bytes leftover after parsing attributes in process `syz.2.425'.
[  101.532313][ T6955] netlink: 798 bytes leftover after parsing attributes in process `syz.1.430'.
[  101.713692][ T6959] syz.1.431: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  101.730466][ T6959] CPU: 0 UID: 0 PID: 6959 Comm: syz.1.431 Not tainted syzkaller #0 PREEMPT(full) 
[  101.730485][ T6959] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  101.730492][ T6959] Call Trace:
[  101.730499][ T6959]  <TASK>
[  101.730505][ T6959]  dump_stack_lvl+0x189/0x250
[  101.730523][ T6959]  ? __pfx_rcu_read_unlock_special+0x10/0x10
[  101.730541][ T6959]  ? __pfx_dump_stack_lvl+0x10/0x10
[  101.730555][ T6959]  ? __pfx__printk+0x10/0x10
[  101.730573][ T6959]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  101.730588][ T6959]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  101.730607][ T6959]  warn_alloc+0x214/0x310
[  101.730624][ T6959]  ? stack_depot_save_flags+0x41b/0x860
[  101.730647][ T6959]  ? __pfx_warn_alloc+0x10/0x10
[  101.730664][ T6959]  ? kasan_save_track+0x4f/0x80
[  101.730679][ T6959]  ? xskq_create+0x56/0x170
[  101.730692][ T6959]  ? xsk_init_queue+0xb0/0x110
[  101.730706][ T6959]  ? xsk_setsockopt+0x57b/0x8d0
[  101.730718][ T6959]  ? do_sock_setsockopt+0x17c/0x1b0
[  101.730729][ T6959]  ? __x64_sys_setsockopt+0x13f/0x1b0
[  101.730740][ T6959]  ? do_syscall_64+0xfa/0x3b0
[  101.730753][ T6959]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  101.730769][ T6959]  __vmalloc_node_range_noprof+0x125/0x12f0
[  101.730808][ T6959]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  101.730828][ T6959]  ? __kasan_kmalloc+0x93/0xb0
[  101.730845][ T6959]  vmalloc_user_noprof+0xad/0xf0
[  101.730862][ T6959]  ? xskq_create+0xbf/0x170
[  101.730876][ T6959]  xskq_create+0xbf/0x170
[  101.730893][ T6959]  xsk_init_queue+0xb0/0x110
[  101.730910][ T6959]  xsk_setsockopt+0x57b/0x8d0
[  101.730926][ T6959]  ? __pfx_xsk_setsockopt+0x10/0x10
[  101.730940][ T6959]  ? __pfx_aa_sk_perm+0x10/0x10
[  101.730958][ T6959]  ? __fget_files+0x2a/0x420
[  101.730968][ T6959]  ? aa_sock_opt_perm+0xff/0x1b0
[  101.730981][ T6959]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  101.730994][ T6959]  ? __pfx_xsk_setsockopt+0x10/0x10
[  101.731009][ T6959]  do_sock_setsockopt+0x17c/0x1b0
[  101.731022][ T6959]  __x64_sys_setsockopt+0x13f/0x1b0
[  101.731036][ T6959]  do_syscall_64+0xfa/0x3b0
[  101.731052][ T6959]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  101.731062][ T6959]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  101.731076][ T6959]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  101.731087][ T6959] RIP: 0033:0x7fa8b618ebe9
[  101.731098][ T6959] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  101.731107][ T6959] RSP: 002b:00007fa8b43b4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  101.731120][ T6959] RAX: ffffffffffffffda RBX: 00007fa8b63c6180 RCX: 00007fa8b618ebe9
[  101.731128][ T6959] RDX: 0000000000000002 RSI: 000000000000011b RDI: 000000000000000b
[  101.731135][ T6959] RBP: 00007fa8b6211e19 R08: 0000000000000004 R09: 0000000000000000
[  101.731141][ T6959] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000
[  101.731148][ T6959] R13: 00007fa8b63c6218 R14: 00007fa8b63c6180 R15: 00007fff96598f98
[  101.731200][ T6959]  </TASK>
[  101.731251][ T6959] Mem-Info:
[  101.926894][ T6959] active_anon:7305 inactive_anon:0 isolated_anon:0
[  101.926894][ T6959]  active_file:14338 inactive_file:38250 isolated_file:0
[  101.926894][ T6959]  unevictable:1768 dirty:331 writeback:0
[  101.926894][ T6959]  slab_reclaimable:9449 slab_unreclaimable:67130
[  101.926894][ T6959]  mapped:17996 shmem:2432 pagetables:983
[  101.926894][ T6959]  sec_pagetables:0 bounce:0
[  101.926894][ T6959]  kernel_misc_reclaimable:0
[  101.926894][ T6959]  free:269409 free_pcp:16800 free_cma:0
[  101.947230][ T6959] Node 0 active_anon:18108kB inactive_anon:0kB active_file:46816kB inactive_file:113300kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:44104kB dirty:304kB writeback:0kB shmem:5036kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6576kB pagetables:2660kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  101.959902][ T6959] Node 1 active_anon:11112kB inactive_anon:0kB active_file:10536kB inactive_file:39700kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:27880kB dirty:1020kB writeback:0kB shmem:4692kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4964kB pagetables:1272kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  101.973466][ T6959] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  101.986057][ T6959] lowmem_reserve[]: 0 811 811 811 811
[  101.992363][ T6959] Node 0 DMA32 free:235140kB boost:0kB min:33660kB low:42072kB high:50484kB reserved_highatomic:0KB free_highatomic:0KB active_anon:18108kB inactive_anon:0kB active_file:46816kB inactive_file:113300kB unevictable:3536kB writepending:304kB present:1556484kB managed:830956kB mlocked:0kB bounce:0kB free_pcp:42568kB local_pcp:26376kB free_cma:0kB
[  102.006608][ T6959] lowmem_reserve[]: 0 0 0 0 0
[  102.008960][ T6959] Node 1 DMA32 free:458492kB boost:0kB min:19192kB low:23988kB high:28784kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:116kB local_pcp:0kB free_cma:0kB
[  102.020582][ T6959] lowmem_reserve[]: 0 0 854 854 854
[  102.023048][ T6959] Node 1 Normal free:368644kB boost:0kB min:36612kB low:45764kB high:54916kB reserved_highatomic:0KB free_highatomic:0KB active_anon:11112kB inactive_anon:0kB active_file:10536kB inactive_file:39700kB unevictable:3536kB writepending:1020kB present:1048576kB managed:874952kB mlocked:0kB bounce:0kB free_pcp:24512kB local_pcp:18680kB free_cma:0kB
[  102.039476][ T6959] lowmem_reserve[]: 0 0 0 0 0
[  102.041984][ T6959] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  102.048252][ T6959] Node 0 DMA32: 576*4kB (UM) 634*8kB (UME) 530*16kB (UME) 666*32kB (UME) 256*64kB (UME) 55*128kB (UME) 10*256kB (UM) 10*512kB (UM) 3*1024kB (M) 2*2048kB (UE) 39*4096kB (M) = 235184kB
[  102.057808][ T6959] Node 1 DMA32: 3*4kB (UM) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 3*2048kB (UM) 109*4096kB (M) = 458492kB
[  102.065899][ T6959] Node 1 Normal: 211*4kB (UM) 99*8kB (UME) 12*16kB (UME) 146*32kB (UME) 76*64kB (UME) 57*128kB (UME) 7*256kB (UME) 4*512kB (UME) 2*1024kB (M) 2*2048kB (UE) 83*4096kB (M) = 368612kB
[  102.074822][ T6959] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  102.079070][ T6959] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  102.083464][ T6959] 55020 total pagecache pages
[  102.087945][ T6959] 0 pages in swap cache
[  102.089710][ T6959] Free swap  = 124996kB
[  102.094977][ T6959] Total swap = 124996kB
[  102.097013][ T6959] 786301 pages RAM
[  102.098885][ T6959] 0 pages HighMem/MovableOnly
[  102.101329][ T6959] 241330 pages reserved
[  102.103554][ T6959] 0 pages cma reserved
[  102.494849][ T6961] =======================================================
[  102.494849][ T6961] WARNING: The mand mount option has been deprecated and
[  102.494849][ T6961]          and is ignored by this kernel. Remove the mand
[  102.494849][ T6961]          option from the mount to silence this warning.
[  102.494849][ T6961] =======================================================
[  102.580212][ T6961] option changes via remount are deprecated (pid=6960 comm=syz.2.432)
[  102.635296][ T6969] delete_channel: no stack
[  102.639462][ T6968] delete_channel: no stack
[  103.553905][ T7000] netlink: 16410 bytes leftover after parsing attributes in process `syz.0.449'.
[  103.900150][ T7011] netlink: 152 bytes leftover after parsing attributes in process `syz.1.452'.
[  104.545821][ T7032] netlink: 'syz.1.462': attribute type 1 has an invalid length.
[  113.489557][    C0] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 4011923604 wd_nsec: 4011907381
[  152.988528][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[  152.994966][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[  191.275020][ T5890] Bluetooth: hci1: command 0x0406 tx timeout
[  191.278307][ T5890] Bluetooth: hci0: command 0x0406 tx timeout
[  191.311978][ T5883] Bluetooth: hci2: command 0x0406 tx timeout
[  194.631013][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[  195.235054][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[  223.718247][ T5889] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  223.722919][ T5889] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  223.728627][ T5889] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  223.731543][ T5889] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  223.734382][ T5889] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  223.866295][ T5886] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  223.869426][ T5886] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  223.872110][ T5886] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  223.876182][ T5886] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  223.878772][ T5886] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  223.936269][ T5889] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  223.944121][ T5889] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  223.949562][ T5889] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  223.952798][ T5889] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  223.959715][ T5889] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  224.139381][   T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  224.396422][   T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  224.484357][   T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  224.522239][ T7049] chnl_net:caif_netlink_parms(): no params data found
[  224.613338][   T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  224.627293][ T7053] chnl_net:caif_netlink_parms(): no params data found
[  224.864181][ T7051] chnl_net:caif_netlink_parms(): no params data found
[  224.937005][ T7049] bridge0: port 1(bridge_slave_0) entered blocking state
[  224.941715][ T7049] bridge0: port 1(bridge_slave_0) entered disabled state
[  224.948721][ T7049] bridge_slave_0: entered allmulticast mode
[  224.953097][ T7049] bridge_slave_0: entered promiscuous mode
[  225.009009][ T7049] bridge0: port 2(bridge_slave_1) entered blocking state
[  225.012040][ T7049] bridge0: port 2(bridge_slave_1) entered disabled state
[  225.020923][ T7049] bridge_slave_1: entered allmulticast mode
[  225.025202][ T7049] bridge_slave_1: entered promiscuous mode
[  225.114402][ T7049] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  225.189793][ T7049] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  225.195381][ T7053] bridge0: port 1(bridge_slave_0) entered blocking state
[  225.199492][ T7053] bridge0: port 1(bridge_slave_0) entered disabled state
[  225.202747][ T7053] bridge_slave_0: entered allmulticast mode
[  225.212520][ T7053] bridge_slave_0: entered promiscuous mode
[  225.361574][ T7053] bridge0: port 2(bridge_slave_1) entered blocking state
[  225.367273][ T7053] bridge0: port 2(bridge_slave_1) entered disabled state
[  225.370297][ T7053] bridge_slave_1: entered allmulticast mode
[  225.373517][ T7053] bridge_slave_1: entered promiscuous mode
[  225.411882][ T7049] team0: Port device team_slave_0 added
[  225.473426][ T7049] team0: Port device team_slave_1 added
[  225.483545][   T13] bridge_slave_1: left allmulticast mode
[  225.486780][   T13] bridge_slave_1: left promiscuous mode
[  225.490255][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  225.768655][ T5886] Bluetooth: hci0: command tx timeout
[  225.877140][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  225.891226][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  225.901542][   T13] bond0 (unregistering): Released all slaves
[  225.919980][ T7053] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  225.924885][ T5886] Bluetooth: hci1: command tx timeout
[  225.932699][ T7051] bridge0: port 1(bridge_slave_0) entered blocking state
[  225.936990][ T7051] bridge0: port 1(bridge_slave_0) entered disabled state
[  225.940332][ T7051] bridge_slave_0: entered allmulticast mode
[  225.944861][ T7051] bridge_slave_0: entered promiscuous mode
[  226.005462][ T5886] Bluetooth: hci2: command tx timeout
[  226.021132][ T7053] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  226.025868][ T7051] bridge0: port 2(bridge_slave_1) entered blocking state
[  226.029376][ T7051] bridge0: port 2(bridge_slave_1) entered disabled state
[  226.032510][ T7051] bridge_slave_1: entered allmulticast mode
[  226.038241][ T7051] bridge_slave_1: entered promiscuous mode
[  226.057884][   T13] : left promiscuous mode
[  226.181427][ T7051] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  226.187302][ T7049] batman_adv: batadv0: Adding interface: batadv_slave_0
[  226.190501][ T7049] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  226.205109][ T7049] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  226.282937][ T7053] team0: Port device team_slave_0 added
[  226.288721][ T7051] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  226.324963][ T7049] batman_adv: batadv0: Adding interface: batadv_slave_1
[  226.327457][ T7049] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  226.342922][ T7049] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  226.360653][ T7053] team0: Port device team_slave_1 added
[  226.393970][ T7051] team0: Port device team_slave_0 added
[  226.589277][ T7051] team0: Port device team_slave_1 added
[  226.626535][ T7053] batman_adv: batadv0: Adding interface: batadv_slave_0
[  226.629822][ T7053] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  226.650826][ T7053] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  226.747327][   T13] hsr_slave_0: left promiscuous mode
[  226.751559][   T13] hsr_slave_1: left promiscuous mode
[  226.753707][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  226.761395][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  226.769607][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  226.772585][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  226.794483][   T13] veth1_macvtap: left promiscuous mode
[  226.796556][   T13] veth0_macvtap: left promiscuous mode
[  227.188625][   T13] team0 (unregistering): Port device team_slave_1 removed
[  227.697645][ T7053] batman_adv: batadv0: Adding interface: batadv_slave_1
[  227.700645][ T7053] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  227.720269][ T7053] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  227.729515][ T7051] batman_adv: batadv0: Adding interface: batadv_slave_0
[  227.732509][ T7051] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  227.762667][ T7051] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  227.773601][ T7051] batman_adv: batadv0: Adding interface: batadv_slave_1
[  227.780295][ T7051] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  227.791098][ T7051] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  227.815556][ T7049] hsr_slave_0: entered promiscuous mode
[  227.818979][ T7049] hsr_slave_1: entered promiscuous mode
[  227.844819][ T5886] Bluetooth: hci0: command tx timeout
[  227.945248][ T7053] hsr_slave_0: entered promiscuous mode
[  227.948689][ T7053] hsr_slave_1: entered promiscuous mode
[  227.960372][ T7053] debugfs: 'hsr0' already exists in 'hsr'
[  227.963014][ T7053] Cannot create hsr debugfs directory
[  228.005061][ T5886] Bluetooth: hci1: command tx timeout
[  228.085091][ T5886] Bluetooth: hci2: command tx timeout
[  228.100012][ T7051] hsr_slave_0: entered promiscuous mode
[  228.104296][ T7051] hsr_slave_1: entered promiscuous mode
[  228.108571][ T7051] debugfs: 'hsr0' already exists in 'hsr'
[  228.111046][ T7051] Cannot create hsr debugfs directory
[  228.593734][ T7049] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  228.626085][ T7049] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  228.638947][ T7049] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  228.687578][ T7049] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  228.744282][ T5873] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  228.791163][ T7051] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  228.796436][ T7051] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  228.814054][ T5873] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  228.828784][ T7051] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  228.833455][ T7051] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  228.866816][ T5873] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  228.925477][ T5873] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  228.936864][ T7053] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  228.943736][ T7053] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  228.949690][ T7053] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  228.962203][ T7053] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  229.052059][ T7049] 8021q: adding VLAN 0 to HW filter on device bond0
[  229.105225][ T5873] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  229.130787][ T7049] 8021q: adding VLAN 0 to HW filter on device team0
[  229.157456][ T7051] 8021q: adding VLAN 0 to HW filter on device bond0
[  229.161565][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[  229.164781][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[  229.173276][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[  229.176884][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[  229.201651][ T5873] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  229.230600][ T7053] 8021q: adding VLAN 0 to HW filter on device bond0
[  229.239385][ T7051] 8021q: adding VLAN 0 to HW filter on device team0
[  229.267018][ T5873] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  229.283414][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[  229.286659][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[  229.301217][ T1863] bridge0: port 2(bridge_slave_1) entered blocking state
[  229.304322][ T1863] bridge0: port 2(bridge_slave_1) entered forwarding state
[  229.318764][ T5873] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  229.333239][ T7053] 8021q: adding VLAN 0 to HW filter on device team0
[  229.374426][ T1863] bridge0: port 1(bridge_slave_0) entered blocking state
[  229.377571][ T1863] bridge0: port 1(bridge_slave_0) entered forwarding state
[  229.386145][ T1863] bridge0: port 2(bridge_slave_1) entered blocking state
[  229.389214][ T1863] bridge0: port 2(bridge_slave_1) entered forwarding state
[  229.508423][ T5873] bridge_slave_1: left allmulticast mode
[  229.510937][ T5873] bridge_slave_1: left promiscuous mode
[  229.513480][ T5873] bridge0: port 2(bridge_slave_1) entered disabled state
[  229.526550][ T5873] bridge_slave_0: left allmulticast mode
[  229.528420][ T5873] bridge_slave_0: left promiscuous mode
[  229.535870][ T5873] bridge0: port 1(bridge_slave_0) entered disabled state
[  229.549296][ T5873] bridge_slave_1: left allmulticast mode
[  229.551725][ T5873] bridge_slave_1: left promiscuous mode
[  229.554273][ T5873] bridge0: port 2(bridge_slave_1) entered disabled state
[  229.561345][ T5873] bridge_slave_0: left allmulticast mode
[  229.563803][ T5873] bridge_slave_0: left promiscuous mode
[  229.568875][ T5873] bridge0: port 1(bridge_slave_0) entered disabled state
[  229.828999][ T5873] bond0 (unregistering): (slave 5@): Releasing backup interface
[  229.833816][ T5873] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  229.839428][ T5873] bond0 (unregistering): Released all slaves
[  229.924992][ T5886] Bluetooth: hci0: command tx timeout
[  230.084769][ T5886] Bluetooth: hci1: command tx timeout
[  230.089764][ T5873] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  230.096237][ T5873] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  230.101222][ T5873] bond0 (unregistering): Released all slaves
[  230.166111][ T5886] Bluetooth: hci2: command tx timeout
[  230.171404][ T7049] 8021q: adding VLAN 0 to HW filter on device batadv0
[  230.220918][ T7051] 8021q: adding VLAN 0 to HW filter on device batadv0
[  230.320779][ T7049] veth0_vlan: entered promiscuous mode
[  230.347377][ T7049] veth1_vlan: entered promiscuous mode
[  230.389159][ T7053] 8021q: adding VLAN 0 to HW filter on device batadv0
[  230.414422][ T7049] veth0_macvtap: entered promiscuous mode
[  230.485890][ T7049] veth1_macvtap: entered promiscuous mode
[  230.513811][ T7049] batman_adv: batadv0: Interface activated: batadv_slave_0
[  230.541307][ T7049] batman_adv: batadv0: Interface activated: batadv_slave_1
[  230.638522][   T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  230.644370][ T7051] veth0_vlan: entered promiscuous mode
[  230.659014][   T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  230.675881][   T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  230.700728][ T7051] veth1_vlan: entered promiscuous mode
[  230.707681][   T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  230.792603][ T7051] veth0_macvtap: entered promiscuous mode
[  230.795643][ T7053] veth0_vlan: entered promiscuous mode
[  230.813161][ T7051] veth1_macvtap: entered promiscuous mode
[  230.814745][ T1101] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  230.818256][ T1101] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  230.822766][ T7051] batman_adv: batadv0: Interface activated: batadv_slave_0
[  230.860480][ T7053] veth1_vlan: entered promiscuous mode
[  230.869592][ T7051] batman_adv: batadv0: Interface activated: batadv_slave_1
[  230.888929][ T5873] hsr_slave_0: left promiscuous mode
[  230.891811][ T5873] hsr_slave_1: left promiscuous mode
[  230.898657][ T5873] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  230.901692][ T5873] batman_adv: batadv0: Removing interface: batadv_slave_0
[  230.907023][ T5873] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  230.909942][ T5873] batman_adv: batadv0: Removing interface: batadv_slave_1
[  230.920248][ T5873] hsr_slave_0: left promiscuous mode
[  230.922973][ T5873] hsr_slave_1: left promiscuous mode
[  230.925641][ T5873] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  230.928049][ T5873] batman_adv: batadv0: Removing interface: batadv_slave_0
[  230.931070][ T5873] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  230.934140][ T5873] batman_adv: batadv0: Removing interface: batadv_slave_1
[  230.951049][ T5873] veth1_macvtap: left promiscuous mode
[  230.953530][ T5873] veth0_macvtap: left promiscuous mode
[  230.960767][ T5873] veth1_vlan: left promiscuous mode
[  230.964114][ T5873] veth0_vlan: left promiscuous mode
[  230.969162][ T5873] veth1_macvtap: left promiscuous mode
[  230.971653][ T5873] veth0_macvtap: left promiscuous mode
[  230.974271][ T5873] veth1_vlan: left promiscuous mode
[  231.382698][ T5873] team0 (unregistering): Port device team_slave_1 removed
[  231.410272][ T5873] team0 (unregistering): Port device team_slave_0 removed
[  231.962759][ T5873] team0 (unregistering): Port device team_slave_1 removed
[  231.997307][ T5873] team0 (unregistering): Port device team_slave_0 removed
[  232.007127][ T5886] Bluetooth: hci0: command tx timeout
[  232.167051][ T5886] Bluetooth: hci1: command tx timeout
[  232.245720][ T5886] Bluetooth: hci2: command tx timeout
[  232.298708][   T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  232.312348][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  232.317277][ T5920] infiniband syz0: ib_query_port failed (-19)
[  232.321959][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  232.326681][   T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  232.331612][   T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  232.353695][   T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  232.461076][ T7053] veth0_macvtap: entered promiscuous mode
[  232.489155][ T7053] veth1_macvtap: entered promiscuous mode
[  232.530098][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  232.533368][ T7053] batman_adv: batadv0: Interface activated: batadv_slave_0
[  232.537122][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  232.566529][ T7053] batman_adv: batadv0: Interface activated: batadv_slave_1
[  232.601999][ T7073] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  232.608128][ T7073] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  232.629367][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  232.638459][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  232.641413][ T7073] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  232.650116][ T7073] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  232.740663][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  232.745660][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  232.805221][ T1863] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  232.815648][ T1863] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  232.942605][ T7131] netlink: 'syz.3.473': attribute type 10 has an invalid length.
[  233.163991][ T7139] syz.4.472 uses obsolete (PF_INET,SOCK_PACKET)
[  233.847469][ T7156] netlink: 'syz.3.480': attribute type 1 has an invalid length.
[  233.896983][ T7154] netlink: 60 bytes leftover after parsing attributes in process `syz.4.481'.
[  233.902654][ T7154] netlink: 60 bytes leftover after parsing attributes in process `syz.4.481'.
[  234.002094][ T7159] netlink: 60 bytes leftover after parsing attributes in process `syz.3.482'.
[  234.282682][ T7169] netlink: 'syz.5.486': attribute type 10 has an invalid length.
[  234.296393][ T7169] netlink: 40 bytes leftover after parsing attributes in process `syz.5.486'.
[  234.946228][ T7169] batman_adv: batadv0: Adding interface: virt_wifi0
[  234.949187][ T7169] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  234.990252][ T7169] batman_adv: batadv0: Interface activated: virt_wifi0
[  235.135368][ T7184] netlink: 'syz.3.491': attribute type 1 has an invalid length.
[  235.214414][ T7190] netlink: 'syz.5.492': attribute type 9 has an invalid length.
[  235.222078][ T7190] netlink: 61951 bytes leftover after parsing attributes in process `syz.5.492'.
[  235.387225][ T7205] syzkaller0: entered promiscuous mode
[  235.389038][ T7205] syzkaller0: entered allmulticast mode
[  237.909879][   T33] audit: type=1107 audit(1757434419.938:3): pid=7237 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''
[  238.010698][ T7244] netlink: 28 bytes leftover after parsing attributes in process `syz.5.514'.
[  238.017998][ T7244] netlink: 28 bytes leftover after parsing attributes in process `syz.5.514'.
[  238.312654][ T7264] netlink: 'syz.4.522': attribute type 11 has an invalid length.
[  238.724313][ T7285] netlink: 160 bytes leftover after parsing attributes in process `syz.5.532'.
[  238.849298][ T7291] netlink: 4 bytes leftover after parsing attributes in process `syz.3.534'.
[  238.852757][ T7291] netlink: 4 bytes leftover after parsing attributes in process `syz.3.534'.
[  238.964075][ T7299] GPL: port 1(gretap0) entered blocking state
[  238.966902][ T7301] netlink: 17 bytes leftover after parsing attributes in process `syz.5.539'.
[  238.967038][ T7301] netlink: zone id is out of range
[  238.972882][ T7301] netlink: zone id is out of range
[  238.984892][ T7299] GPL: port 1(gretap0) entered disabled state
[  238.987688][ T7299] gretap0: entered allmulticast mode
[  238.995852][ T7301] netlink: zone id is out of range
[  238.998234][ T7299] gretap0: entered promiscuous mode
[  238.998395][ T7301] netlink: zone id is out of range
[  239.003906][ T7301] netlink: zone id is out of range
[  239.012622][ T7301] netlink: zone id is out of range
[  239.016531][ T7301] netlink: zone id is out of range
[  239.018969][ T7301] netlink: zone id is out of range
[  239.021323][ T7301] netlink: zone id is out of range
[  239.024152][ T7301] netlink: zone id is out of range
[  239.237474][ T7322] netlink: 'syz.5.548': attribute type 10 has an invalid length.
[  239.240009][ T7322] netlink: 40 bytes leftover after parsing attributes in process `syz.5.548'.
[  243.319424][ T7364] netlink: 12 bytes leftover after parsing attributes in process `syz.3.564'.
[  243.451046][ T7373] netlink: 12 bytes leftover after parsing attributes in process `syz.4.566'.
[  243.454973][ T7373] netlink: 48 bytes leftover after parsing attributes in process `syz.4.566'.
[  243.995891][ T7404] netlink: 36 bytes leftover after parsing attributes in process `syz.3.582'.
[  244.220624][ T7417] netlink: 12 bytes leftover after parsing attributes in process `syz.5.587'.
[  244.227825][ T7417] netlink: 20 bytes leftover after parsing attributes in process `syz.5.587'.
[  244.311010][ T7421] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  244.742884][ T7434] cgroup: fork rejected by pids controller in /syz5
[  244.956417][ T7444] netlink: 'syz.4.599': attribute type 41 has an invalid length.
[  245.057758][ T7450] netlink: 64 bytes leftover after parsing attributes in process `syz.4.602'.
[  245.061812][ T7450] netlink: 64 bytes leftover after parsing attributes in process `syz.4.602'.
[  245.157755][ T7452] net_ratelimit: 12 callbacks suppressed
[  245.157772][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.164412][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.168298][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.172177][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.176321][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.180149][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.183935][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.187857][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.191908][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.195907][ T7452] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31
[  245.343767][ T7455] netlink: 132 bytes leftover after parsing attributes in process `syz.3.605'.
[  245.360610][ T7073] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  245.446416][ T7073] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  245.511503][ T7073] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  245.549340][ T5889] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  245.554447][ T5889] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  245.558625][ T5889] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  245.562700][ T5889] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  245.566601][ T5889] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  245.620088][ T7073] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  245.686966][ T7467] mac80211_hwsim hwsim14 wlan1: entered promiscuous mode
[  245.690019][ T7467] mac80211_hwsim hwsim14 wlan1: entered allmulticast mode
[  245.913964][ T7462] chnl_net:caif_netlink_parms(): no params data found
[  246.263770][ T7073] bridge_slave_1: left allmulticast mode
[  246.266531][ T7073] bridge_slave_1: left promiscuous mode
[  246.269670][ T7073] bridge0: port 2(bridge_slave_1) entered disabled state
[  246.277920][ T7073] bridge_slave_0: left allmulticast mode
[  246.280305][ T7073] bridge_slave_0: left promiscuous mode
[  246.282809][ T7073] bridge0: port 1(bridge_slave_0) entered disabled state
[  246.474441][ T7488] netlink: 104 bytes leftover after parsing attributes in process `syz.3.618'.
[  246.638299][ T7073] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  246.648271][ T7073] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  246.652135][ T7073] bond0 (unregistering): Released all slaves
[  246.668494][ T7499] netlink: 10 bytes leftover after parsing attributes in process `syz.4.623'.
[  246.734093][ T7462] bridge0: port 1(bridge_slave_0) entered blocking state
[  246.737679][ T7462] bridge0: port 1(bridge_slave_0) entered disabled state
[  246.740348][ T7462] bridge_slave_0: entered allmulticast mode
[  246.743291][ T7462] bridge_slave_0: entered promiscuous mode
[  246.797495][ T7462] bridge0: port 2(bridge_slave_1) entered blocking state
[  246.799968][ T7462] bridge0: port 2(bridge_slave_1) entered disabled state
[  246.805514][ T7462] bridge_slave_1: entered allmulticast mode
[  246.808646][ T7462] bridge_slave_1: entered promiscuous mode
[  246.820534][ T7507] netlink: 10 bytes leftover after parsing attributes in process `syz.4.626'.
[  246.856493][ T7462] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  246.861645][ T7462] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  246.922463][ T7462] team0: Port device team_slave_0 added
[  246.930546][ T7516] delete_channel: no stack
[  246.931408][ T7462] team0: Port device team_slave_1 added
[  246.932545][ T7516] delete_channel: no stack
[  247.028856][ T7462] batman_adv: batadv0: Adding interface: batadv_slave_0
[  247.031872][ T7462] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  247.043609][ T7462] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  247.056362][ T7462] batman_adv: batadv0: Adding interface: batadv_slave_1
[  247.060707][ T7462] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  247.071602][ T7462] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  247.104465][ T7073] hsr_slave_0: left promiscuous mode
[  247.110189][ T7073] hsr_slave_1: left promiscuous mode
[  247.115524][ T7073] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  247.118604][ T7073] batman_adv: batadv0: Removing interface: batadv_slave_0
[  247.141553][ T7073] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  247.144156][ T7073] batman_adv: batadv0: Removing interface: batadv_slave_1
[  247.157370][ T7073] batman_adv: batadv0: Interface deactivated: virt_wifi0
[  247.160439][ T7073] batman_adv: batadv0: Removing interface: virt_wifi0
[  247.181149][ T7073] veth1_macvtap: left promiscuous mode
[  247.183220][ T7073] veth0_macvtap: left promiscuous mode
[  247.185759][ T7073] veth1_vlan: left promiscuous mode
[  247.187659][ T7073] veth0_vlan: left promiscuous mode
[  247.604828][ T5889] Bluetooth: hci2: command tx timeout
[  247.613155][ T7073] team0 (unregistering): Port device team_slave_1 removed
[  247.636222][ T7073] team0 (unregistering): Port device team_slave_0 removed
[  248.039954][ T7462] hsr_slave_0: entered promiscuous mode
[  248.043388][ T7462] hsr_slave_1: entered promiscuous mode
[  248.050523][ T7462] debugfs: 'hsr0' already exists in 'hsr'
[  248.053257][ T7462] Cannot create hsr debugfs directory
[  248.296762][ T7549] netlink: 8 bytes leftover after parsing attributes in process `syz.3.642'.
[  248.313017][ T7551] C: renamed from team_slave_0 (while UP)
[  248.322518][ T7551] netlink: 'syz.4.643': attribute type 3 has an invalid length.
[  248.449583][ T7567] netlink: 'syz.3.651': attribute type 3 has an invalid length.
[  248.511945][ T7575] netlink: 'syz.3.655': attribute type 21 has an invalid length.
[  248.591855][ T7462] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  249.388886][ T7462] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  249.396949][ T7462] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  249.403295][ T7462] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  249.490733][ T7462] 8021q: adding VLAN 0 to HW filter on device bond0
[  249.508998][ T7462] 8021q: adding VLAN 0 to HW filter on device team0
[  249.513698][ T3609] bridge0: port 1(bridge_slave_0) entered blocking state
[  249.516323][ T3609] bridge0: port 1(bridge_slave_0) entered forwarding state
[  249.529041][ T3609] bridge0: port 2(bridge_slave_1) entered blocking state
[  249.532167][ T3609] bridge0: port 2(bridge_slave_1) entered forwarding state
[  249.618149][ T7598] __nla_validate_parse: 5 callbacks suppressed
[  249.618164][ T7598] netlink: 80 bytes leftover after parsing attributes in process `syz.4.662'.
[  249.623961][ T7598] netlink: 80 bytes leftover after parsing attributes in process `syz.4.662'.
[  249.685650][ T5889] Bluetooth: hci2: command tx timeout
[  249.860645][ T7462] 8021q: adding VLAN 0 to HW filter on device batadv0
[  249.956028][ T7619] netlink: 'syz.4.668': attribute type 5 has an invalid length.
[  250.052243][ T7462] veth0_vlan: entered promiscuous mode
[  250.077420][ T7462] veth1_vlan: entered promiscuous mode
[  250.107407][ T5889] Bluetooth: hci0: unexpected event 0x2c length: 82 > 17
[  250.123889][ T7462] veth0_macvtap: entered promiscuous mode
[  250.132147][ T7462] veth1_macvtap: entered promiscuous mode
[  250.141728][ T7462] batman_adv: batadv0: Interface activated: batadv_slave_0
[  250.149500][ T7462] batman_adv: batadv0: Interface activated: batadv_slave_1
[  250.160729][ T7073] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  250.169590][ T7073] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  250.179658][ T7073] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  250.189572][ T7073] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  250.238600][   T32] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  250.241250][   T32] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  250.274466][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  250.277917][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  250.449968][ T7653] netlink: 132 bytes leftover after parsing attributes in process `syz.3.683'.
[  250.525416][ T7644] netlink: 'syz.4.676': attribute type 21 has an invalid length.
[  250.528664][ T7644] netlink: 132 bytes leftover after parsing attributes in process `syz.4.676'.
[  251.683178][ T7711] netlink: 'syz.5.708': attribute type 1 has an invalid length.
[  251.765219][ T5889] Bluetooth: hci2: command tx timeout
[  252.455644][ T7745] netlink: 'syz.5.723': attribute type 2 has an invalid length.
[  252.556174][ T7744] netlink: 22 bytes leftover after parsing attributes in process `syz.5.723'.
[  253.168310][ T7767] netlink: 60 bytes leftover after parsing attributes in process `syz.4.733'.
[  253.399329][ T7772] netlink: 160 bytes leftover after parsing attributes in process `syz.5.734'.
[  253.888487][ T5889] Bluetooth: hci2: command tx timeout
[  256.068281][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[  256.071086][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[  259.593324][ T7781] netlink: 4 bytes leftover after parsing attributes in process `syz.5.738'.
[  259.595211][ T7783] netlink: 12 bytes leftover after parsing attributes in process `syz.4.739'.
[  259.719458][ T7781] ksmbd: Daemon and kernel module version mismatch. ksmbd: 36, kernel module: 1. User-space ksmbd should terminate.
[  260.320505][ T7834] netlink: 'syz.3.752': attribute type 11 has an invalid length.
[  260.396081][ T7840] netlink: 12 bytes leftover after parsing attributes in process `syz.4.755'.
[  261.247827][ T7872] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.769'.
[  261.666737][ T7890] netlink: 14568 bytes leftover after parsing attributes in process `syz.4.775'.
[  261.970921][ T7901] netlink: 'syz.5.781': attribute type 11 has an invalid length.
[  261.973945][ T7901] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.781'.
[  262.074660][ T7900] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  262.140144][ T7911] netlink: 32 bytes leftover after parsing attributes in process `syz.4.786'.
[  262.145887][ T7911] net_ratelimit: 3320 callbacks suppressed
[  262.145902][ T7911] openvswitch: netlink: Missing key (keys=40, expected=80)
[  262.591398][ T7934] netlink: 'syz.3.796': attribute type 21 has an invalid length.
[  262.618322][ T7936] netlink: 16 bytes leftover after parsing attributes in process `syz.5.793'.
[  263.032895][ T7967] netlink: 'syz.3.812': attribute type 1 has an invalid length.
[  263.228992][ T7981] netlink: 'syz.3.819': attribute type 17 has an invalid length.
[  263.231785][ T7981] netlink: 'syz.3.819': attribute type 16 has an invalid length.
[  263.234318][ T7981] netlink: 152 bytes leftover after parsing attributes in process `syz.3.819'.
[  263.532070][ T8001] netlink: 4268 bytes leftover after parsing attributes in process `syz.5.828'.
[  263.566449][ T8003] netlink: 'syz.5.829': attribute type 10 has an invalid length.
[  263.569094][ T8003] team0: entered promiscuous mode
[  263.570786][ T8003] team_slave_0: entered promiscuous mode
[  263.573097][ T8003] team_slave_1: entered promiscuous mode
[  263.579188][ T8003] team0: entered allmulticast mode
[  263.581082][ T8003] team_slave_0: entered allmulticast mode
[  263.583310][ T8003] team_slave_1: entered allmulticast mode
[  263.587255][ T8003] bridge0: port 3(team0) entered blocking state
[  263.593730][ T8003] bridge0: port 3(team0) entered disabled state
[  263.600938][ T8003] bridge0: port 3(team0) entered blocking state
[  263.603356][ T8003] bridge0: port 3(team0) entered forwarding state
[  264.571611][ T8010] netlink: 'syz.4.831': attribute type 10 has an invalid length.
[  264.636752][ T8010] macvlan0: entered promiscuous mode
[  264.639781][ T8010] macvlan0: entered allmulticast mode
[  264.891479][ T8010] veth1_vlan: entered allmulticast mode
[  264.919397][ T8010] bond0: (slave macvlan0): Enslaving as an active interface with an up link
[  264.922704][ T8021] __nla_validate_parse: 3 callbacks suppressed
[  264.922715][ T8021] netlink: 15478 bytes leftover after parsing attributes in process `syz.5.837'.
[  264.991560][ T8030] netlink: 60 bytes leftover after parsing attributes in process `syz.5.841'.
[  264.996416][ T8030] netlink: 60 bytes leftover after parsing attributes in process `syz.5.841'.
[  265.037240][ T8036] netlink: 8 bytes leftover after parsing attributes in process `syz.3.839'.
[  265.613456][ T8045] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  265.617497][ T8045] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  265.976874][ T8058] netlink: 64 bytes leftover after parsing attributes in process `syz.4.850'.
[  266.427175][ T8084] netlink: 60 bytes leftover after parsing attributes in process `syz.3.862'.
[  266.431164][ T8084] netlink: 60 bytes leftover after parsing attributes in process `syz.3.862'.
[  266.434421][ T8084] netlink: 60 bytes leftover after parsing attributes in process `syz.3.862'.
[  266.486249][ T8092] netlink: 24 bytes leftover after parsing attributes in process `syz.4.866'.
[  266.489311][ T8092] netlink: 24 bytes leftover after parsing attributes in process `syz.4.866'.
[  266.498685][ T8094] netlink: 'syz.3.867': attribute type 23 has an invalid length.
[  266.501320][ T8094] netlink: 'syz.3.867': attribute type 6 has an invalid length.
[  266.531531][ T8096] openvswitch: netlink: IP tunnel dst address not specified
[  267.953680][ T8146] sctp: [Deprecated]: syz.5.890 (pid 8146) Use of int in maxseg socket option.
[  267.953680][ T8146] Use struct sctp_assoc_value instead
[  268.366014][ T8154] netlink: 'syz.5.894': attribute type 1 has an invalid length.
[  268.446051][ T8158] netlink: 'syz.5.896': attribute type 28 has an invalid length.
[  268.448912][ T8158] netlink: 'syz.5.896': attribute type 3 has an invalid length.
[  269.389775][ T8174] veth1_macvtap: left promiscuous mode
[  269.391632][ T8174] macsec0: entered promiscuous mode
[  270.260072][ T8226] netlink: 'syz.5.926': attribute type 2 has an invalid length.
[  270.262577][ T8226] __nla_validate_parse: 4 callbacks suppressed
[  270.262583][ T8226] netlink: 1041 bytes leftover after parsing attributes in process `syz.5.926'.
[  270.289967][ T8228] IPv6: Can't replace route, no match found
[  270.448123][ T8240] netlink: 8 bytes leftover after parsing attributes in process `syz.3.932'.
[  270.495752][ T8245] netlink: 'syz.5.935': attribute type 21 has an invalid length.
[  270.562710][ T8253] netlink: 92 bytes leftover after parsing attributes in process `syz.5.938'.
[  270.571993][ T8253] netlink: 92 bytes leftover after parsing attributes in process `syz.5.938'.
[  270.650444][ T8265] netlink: 'syz.3.945': attribute type 46 has an invalid length.
[  270.703096][ T8267] netlink: set zone limit has 8 unknown bytes
[  271.477123][ T8279] netlink: 'syz.3.951': attribute type 22 has an invalid length.
[  271.479597][ T8279] netlink: 4 bytes leftover after parsing attributes in process `syz.3.951'.
[  271.590061][ T8287] netlink: 60 bytes leftover after parsing attributes in process `syz.5.953'.
[  271.604976][ T8287] netlink: 60 bytes leftover after parsing attributes in process `syz.5.953'.
[  271.614692][ T8287] netlink: 60 bytes leftover after parsing attributes in process `syz.5.953'.
[  271.783091][ T8313] netlink: 'syz.4.964': attribute type 1 has an invalid length.
[  271.786974][ T8313] netlink: 199820 bytes leftover after parsing attributes in process `syz.4.964'.
[  272.010937][ T8324] netlink: 8 bytes leftover after parsing attributes in process `syz.4.971'.
[  272.197962][ T8337] sit0: entered allmulticast mode
[  272.328043][ T8346] netlink: 'syz.4.978': attribute type 6 has an invalid length.
[  273.432706][ T8373] netlink: 'syz.5.989': attribute type 16 has an invalid length.
[  273.580213][ T8380] netlink: 'syz.5.991': attribute type 21 has an invalid length.
[  273.668851][ T8388] netlink: 'syz.3.995': attribute type 1 has an invalid length.
[  274.232515][ T8409] netlink: 'syz.3.1004': attribute type 21 has an invalid length.
[  274.391986][ T8412] C: renamed from team_slave_0 (while UP)
[  274.757242][ T8422] netlink: 'syz.5.1010': attribute type 1 has an invalid length.
[  275.228068][ T8446] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  275.230763][ T8446] batman_adv: batadv0: Removing interface: batadv_slave_0
[  275.244762][ T8446] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  275.247315][ T8446] batman_adv: batadv0: Removing interface: batadv_slave_1
[  276.173960][ T8477] __nla_validate_parse: 9 callbacks suppressed
[  276.173969][ T8477] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1033'.
[  276.331937][ T8483] netlink: 'syz.3.1037': attribute type 21 has an invalid length.
[  276.335131][ T8483] netlink: 16166 bytes leftover after parsing attributes in process `syz.3.1037'.
[  276.782761][ T8519] proc: Unknown parameter 'u'
[  276.816164][ T8521] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1053'.
[  276.819825][ T8521] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1053'.
[  276.823375][ T8521] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1053'.
[  276.857326][ T8523] netlink: 802 bytes leftover after parsing attributes in process `syz.5.1054'.
[  280.199494][ T8599] dvmrp1: tun_chr_ioctl cmd 35108
[  280.599871][ T8637] netlink: 'syz.5.1106': attribute type 29 has an invalid length.
[  280.602551][ T8637] netlink: 'syz.5.1106': attribute type 3 has an invalid length.
[  280.610652][ T8637] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1106'.
[  280.740369][ T8646] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  280.743775][ T8646] IPv6: NLM_F_CREATE should be set when creating new route
[  280.750021][ T8646] IPv6: NLM_F_CREATE should be set when creating new route
[  280.864203][ T8658] netlink: 'syz.3.1114': attribute type 1 has an invalid length.
[  280.883872][ T8659] netlink: 11318 bytes leftover after parsing attributes in process `syz.5.1115'.
[  280.974291][ T8669] netlink: 11382 bytes leftover after parsing attributes in process `syz.3.1120'.
[  281.121246][ T8676] netlink: 'syz.3.1123': attribute type 10 has an invalid length.
[  281.125003][ T8676] netlink: 55 bytes leftover after parsing attributes in process `syz.3.1123'.
[  281.178633][ T8681] delete_channel: no stack
[  281.340017][ T8685] netlink: 'syz.5.1127': attribute type 23 has an invalid length.
[  281.779123][ T8700] __nla_validate_parse: 1 callbacks suppressed
[  281.779132][ T8700] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1134'.
[  281.909729][ T8706] dummy0: entered promiscuous mode
[  282.256658][ T8715] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1141'.
[  282.260253][ T8715] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1141'.
[  282.318222][ T8723] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1145'.
[  282.321106][ T8723] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1145'.
[  282.610292][ T8747] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  283.297980][ T8788] netlink: 4400 bytes leftover after parsing attributes in process `syz.4.1171'.
[  283.301554][ T8788] workqueue: name exceeds WQ_NAME_LEN. Truncating to: `]Iq!>s*!)\S
[  283.416063][ T8797] netlink: 'syz.5.1175': attribute type 3 has an invalid length.
[  284.854472][ T8835] openvswitch: netlink: Flow actions attr not present in new flow.
[  285.382268][ T8880] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1215'.
[  285.451390][ T8885] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1216'.
[  286.223234][   T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  286.305388][   T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  286.417933][   T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  286.527920][   T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  286.781243][   T13] bridge_slave_1: left allmulticast mode
[  286.789480][   T13] bridge_slave_1: left promiscuous mode
[  286.794693][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  286.814790][   T13] bridge_slave_0: left allmulticast mode
[  286.816847][   T13] bridge_slave_0: left promiscuous mode
[  286.819301][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  286.991361][ T5886] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  286.995977][ T5886] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  287.001204][ T5886] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  287.013627][ T5886] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  287.019011][ T5886] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  287.317391][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  287.324337][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  287.440260][   T13] bond0 (unregistering): (slave macvlan0): Releasing backup interface
[  287.520740][   T13] veth1_vlan: left allmulticast mode
[  287.523888][   T13] bond0 (unregistering): Released all slaves
[  287.530951][ T8906] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1227'.
[  287.535265][    T9] infiniband syz2: ib_query_port failed (-19)
[  287.544044][ T8907] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1227'.
[  287.698534][ T8908] chnl_net:caif_netlink_parms(): no params data found
[  287.882230][ T8924] netlink: 'syz.5.1231': attribute type 25 has an invalid length.
[  287.927785][ T8908] bridge0: port 1(bridge_slave_0) entered blocking state
[  287.930543][ T8908] bridge0: port 1(bridge_slave_0) entered disabled state
[  287.933122][ T8908] bridge_slave_0: entered allmulticast mode
[  287.949097][ T8908] bridge_slave_0: entered promiscuous mode
[  287.953703][ T8908] bridge0: port 2(bridge_slave_1) entered blocking state
[  287.957352][ T8908] bridge0: port 2(bridge_slave_1) entered disabled state
[  287.960136][ T8908] bridge_slave_1: entered allmulticast mode
[  287.963577][ T8908] bridge_slave_1: entered promiscuous mode
[  287.967379][ T8929] netlink: 144 bytes leftover after parsing attributes in process `syz.3.1233'.
[  288.077229][ T8908] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  288.092997][ T8908] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  288.163778][ T8938] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1237'.
[  288.176330][ T8940] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1238'.
[  288.179368][ T8938] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1237'.
[  288.183786][ T8940] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1238'.
[  288.190651][ T8908] team0: Port device team_slave_0 added
[  288.195371][ T8938] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1237'.
[  288.205511][ T8940] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1238'.
[  288.212035][ T8908] team0: Port device team_slave_1 added
[  288.296789][ T8908] batman_adv: batadv0: Adding interface: batadv_slave_0
[  288.299646][ T8908] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  288.319139][ T8908] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  288.324250][ T8908] batman_adv: batadv0: Adding interface: batadv_slave_1
[  288.337243][ T8908] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  288.348745][ T8908] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  288.355962][ T8950] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1242'.
[  288.367198][   T13] hsr_slave_0: left promiscuous mode
[  288.369950][   T13] hsr_slave_1: left promiscuous mode
[  288.378965][   T13] veth1_macvtap: left promiscuous mode
[  288.381086][   T13] veth0_macvtap: left promiscuous mode
[  288.383311][   T13] veth1_vlan: left promiscuous mode
[  288.386288][   T13] veth0_vlan: left promiscuous mode
[  288.777631][   T13] team0 (unregistering): Port device team_slave_1 removed
[  288.801332][   T13] team0 (unregistering): Port device C removed
[  289.045979][ T5889] Bluetooth: hci1: command tx timeout
[  289.166496][ T8908] hsr_slave_0: entered promiscuous mode
[  289.169591][ T8908] hsr_slave_1: entered promiscuous mode
[  289.172543][ T8908] debugfs: 'hsr0' already exists in 'hsr'
[  289.176566][ T8908] Cannot create hsr debugfs directory
[  289.526051][ T8908] netdevsim netdevsim6 netdevsim0: renamed from eth0
[  289.533136][ T8908] netdevsim netdevsim6 netdevsim1: renamed from eth1
[  289.546526][ T8908] netdevsim netdevsim6 netdevsim2: renamed from eth2
[  289.560126][ T8908] netdevsim netdevsim6 netdevsim3: renamed from eth3
[  289.680651][ T8908] 8021q: adding VLAN 0 to HW filter on device bond0
[  289.698128][ T9004] netlink: 'syz.5.1261': attribute type 21 has an invalid length.
[  289.717725][ T8908] 8021q: adding VLAN 0 to HW filter on device team0
[  289.729895][ T4687] bridge0: port 1(bridge_slave_0) entered blocking state
[  289.732942][ T4687] bridge0: port 1(bridge_slave_0) entered forwarding state
[  289.753709][ T4687] bridge0: port 2(bridge_slave_1) entered blocking state
[  289.756841][ T4687] bridge0: port 2(bridge_slave_1) entered forwarding state
[  289.881989][ T9012] netlink: 'syz.5.1264': attribute type 11 has an invalid length.
[  289.960448][ T9011] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  290.263129][ T8908] 8021q: adding VLAN 0 to HW filter on device batadv0
[  291.011844][ T8908] veth0_vlan: entered promiscuous mode
[  291.028765][ T8908] veth1_vlan: entered promiscuous mode
[  291.062617][ T8908] veth0_macvtap: entered promiscuous mode
[  291.072103][ T8908] veth1_macvtap: entered promiscuous mode
[  291.098435][ T8908] batman_adv: batadv0: Interface activated: batadv_slave_0
[  291.116489][ T8908] batman_adv: batadv0: Interface activated: batadv_slave_1
[  291.131346][ T7073] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  291.136699][ T7073] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  291.139930][ T5889] Bluetooth: hci1: command tx timeout
[  291.163606][ T7073] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  291.177096][ T7073] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  291.273340][   T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  291.280339][   T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  291.304315][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  291.308098][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  291.472811][ T9047] netlink: 'syz.5.1275': attribute type 21 has an invalid length.
[  292.698552][ T9100] delete_channel: no stack
[  292.700592][ T9100] delete_channel: no stack
[  293.204681][ T5889] Bluetooth: hci1: command tx timeout
[  293.520107][ T9125] __nla_validate_parse: 7 callbacks suppressed
[  293.520117][ T9125] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1309'.
[  293.621324][ T9131] netlink: 211 bytes leftover after parsing attributes in process `syz.5.1312'.
[  293.657826][ T9135] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1314'.
[  293.685225][ T9136] delete_channel: no stack
[  293.731962][ T9143] netlink: 830 bytes leftover after parsing attributes in process `syz.6.1318'.
[  294.034086][ T9170] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1330'.
[  294.041210][ T9169] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1331'.
[  294.047571][ T9169] openvswitch: netlink: Missing key (keys=40, expected=2000)
[  294.137174][ T9173] veth1_macvtap: left promiscuous mode
[  294.140514][ T9173] macsec0: entered promiscuous mode
[  294.309031][ T9181] netlink: 132 bytes leftover after parsing attributes in process `syz.6.1336'.
[  294.421283][ T5889] Bluetooth: hci0: unknown advertising packet type: 0x0c
[  294.647799][ T9204] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[  295.061588][ T9227] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1356'.
[  295.284914][ T5889] Bluetooth: hci1: command tx timeout
[  295.977556][ T9246] netlink: set zone limit has 8 unknown bytes
[  296.067636][ T9256] netlink: 'syz.5.1370': attribute type 39 has an invalid length.
[  296.141344][ T9263] netlink: 'syz.5.1378': attribute type 22 has an invalid length.
[  296.144127][ T9263] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1378'.
[  296.836293][ T9274] netlink: 'syz.5.1379': attribute type 46 has an invalid length.
[  297.157483][ T9281] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1381'.
[  299.334486][ T9327] netlink: 'syz.5.1398': attribute type 21 has an invalid length.
[  299.387594][ T9329] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1399'.
[  300.029701][ T9348] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1407'.
[  300.296129][ T9367] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1414'.
[  300.340254][ T9367] netlink: 830 bytes leftover after parsing attributes in process `syz.5.1414'.
[  300.406230][ T9378] netlink: 'syz.5.1419': attribute type 21 has an invalid length.
[  300.408855][ T9378] netlink: 'syz.5.1419': attribute type 15 has an invalid length.
[  300.411712][ T9378] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1419'.
[  300.416324][ T9378] IPv6: NLM_F_CREATE should be specified when creating new route
[  300.418919][ T9378] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  300.421289][ T9378] IPv6: NLM_F_CREATE should be set when creating new route
[  300.423747][ T9378] IPv6: NLM_F_CREATE should be set when creating new route
[  300.426207][ T9378] IPv6: NLM_F_CREATE should be set when creating new route
[  300.441467][ T9379] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1416'.
[  300.725059][   T27] wlan1: Trigger new scan to find an IBSS to join
[  301.127500][ T9393] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1424'.
[  301.130693][ T9393] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1424'.
[  301.133837][ T9393] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1424'.
[  302.017472][ T9412] netlink: 802 bytes leftover after parsing attributes in process `syz.3.1434'.
[  302.751149][ T9451] netlink: 'syz.6.1447': attribute type 2 has an invalid length.
[  303.306196][ T9501] netlink: 'syz.3.1470': attribute type 29 has an invalid length.
[  303.309195][ T9501] netlink: 'syz.3.1470': attribute type 3 has an invalid length.
[  303.468324][ T9520] openvswitch: netlink: Key type 50 is out of range max 32
[  303.764850][ T1087] wlan1: Trigger new scan to find an IBSS to join
[  303.780780][ T9543] netlink: 'syz.6.1490': attribute type 1 has an invalid length.
[  303.971202][ T9556] netlink: 'syz.6.1497': attribute type 10 has an invalid length.
[  303.977972][ T9556] syz_tun: entered promiscuous mode
[  303.991211][ T9556] bond0: (slave syz_tun): Enslaving as an active interface with an up link
[  304.255483][ T9568] netlink: 'syz.6.1502': attribute type 10 has an invalid length.
[  304.369808][ T9569] delete_channel: no stack
[  304.561204][ T9575] __nla_validate_parse: 7 callbacks suppressed
[  304.561298][ T9575] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1505'.
[  304.661462][ T1087] wlan1: Creating new IBSS network, BSSID 8e:10:88:36:36:38
[  305.211300][ T9592] netlink: 11318 bytes leftover after parsing attributes in process `syz.3.1514'.
[  305.484317][ T9606] hsr_slave_0: hsr_addr_subst_dest: Unknown node
[  305.488962][ T9606] hsr_slave_1: hsr_addr_subst_dest: Unknown node
[  305.566177][ T9612] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1522'.
[  305.942346][ T9626] netlink: 55631 bytes leftover after parsing attributes in process `syz.3.1529'.
[  305.946094][ T9626] netlink: 6264 bytes leftover after parsing attributes in process `syz.3.1529'.
[  305.949691][ T9626] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1529'.
[  306.348563][ T9646] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1538'.
[  306.352330][ T9646] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1538'.
[  306.424324][ T9653] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1541'.
[  306.431606][ T9653] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1541'.
[  306.481538][ T9659] netlink: 'syz.3.1543': attribute type 15 has an invalid length.
[  306.484745][ T9659] netlink: 'syz.3.1543': attribute type 7 has an invalid length.
[  306.813765][ T9687] tap0: tun_chr_ioctl cmd 2148553947
[  307.119016][ T9696] netlink: 'syz.5.1562': attribute type 1 has an invalid length.
[  309.220234][ T9777] netlink: 'syz.3.1596': attribute type 3 has an invalid length.
[  309.247664][ T9780] netlink: 'syz.5.1597': attribute type 29 has an invalid length.
[  309.251808][ T9780] netlink: 'syz.5.1597': attribute type 29 has an invalid length.
[  309.257742][ T9780] ==================================================================
[  309.260668][ T9780] BUG: KASAN: slab-use-after-free in xfrm_alloc_spi+0x570/0xf30
[  309.263580][ T9780] Read of size 4 at addr ffff8880283052c4 by task syz.5.1597/9780
[  309.267297][ T9780] 
[  309.268216][ T9780] CPU: 0 UID: 0 PID: 9780 Comm: syz.5.1597 Not tainted syzkaller #0 PREEMPT(full) 
[  309.268226][ T9780] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  309.268232][ T9780] Call Trace:
[  309.268236][ T9780]  <TASK>
[  309.268239][ T9780]  dump_stack_lvl+0x189/0x250
[  309.268250][ T9780]  ? __kasan_check_byte+0x12/0x40
[  309.268263][ T9780]  ? __pfx_dump_stack_lvl+0x10/0x10
[  309.268271][ T9780]  ? lock_release+0x4b/0x3e0
[  309.268282][ T9780]  ? __virt_addr_valid+0x4a5/0x5c0
[  309.268291][ T9780]  print_report+0xca/0x240
[  309.268297][ T9780]  ? xfrm_alloc_spi+0x570/0xf30
[  309.268305][ T9780]  kasan_report+0x118/0x150
[  309.268314][ T9780]  ? xfrm_alloc_spi+0x570/0xf30
[  309.268322][ T9780]  xfrm_alloc_spi+0x570/0xf30
[  309.268329][ T9780]  ? xfrm_alloc_spi+0x2a0/0xf30
[  309.268337][ T9780]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  309.268344][ T9780]  ? xfrm_find_acq+0x87/0xa0
[  309.268351][ T9780]  xfrm_alloc_userspi+0x70b/0xc90
[  309.268363][ T9780]  ? apparmor_capable+0x137/0x1b0
[  309.268376][ T9780]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  309.268388][ T9780]  ? __nla_parse+0x40/0x60
[  309.268400][ T9780]  xfrm_user_rcv_msg+0x7a3/0xab0
[  309.268408][ T9780]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  309.268421][ T9780]  ? __pfx___mutex_trylock_common+0x10/0x10
[  309.268428][ T9780]  ? rcu_is_watching+0x15/0xb0
[  309.268435][ T9780]  ? trace_contention_end+0x39/0x120
[  309.268442][ T9780]  ? __mutex_lock+0x335/0x1360
[  309.268453][ T9780]  netlink_rcv_skb+0x208/0x470
[  309.268463][ T9780]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  309.268470][ T9780]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  309.268481][ T9780]  ? netlink_deliver_tap+0x2e/0x1b0
[  309.268489][ T9780]  ? netlink_deliver_tap+0x2e/0x1b0
[  309.268498][ T9780]  xfrm_netlink_rcv+0x79/0x90
[  309.268505][ T9780]  netlink_unicast+0x82f/0x9e0
[  309.268514][ T9780]  ? __pfx_netlink_unicast+0x10/0x10
[  309.268522][ T9780]  ? netlink_sendmsg+0x642/0xb30
[  309.268530][ T9780]  ? skb_put+0x11b/0x210
[  309.268536][ T9780]  netlink_sendmsg+0x805/0xb30
[  309.268547][ T9780]  ? __pfx_netlink_sendmsg+0x10/0x10
[  309.268556][ T9780]  ? aa_sock_msg_perm+0xf1/0x1d0
[  309.268562][ T9780]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  309.268569][ T9780]  ? __pfx_netlink_sendmsg+0x10/0x10
[  309.268578][ T9780]  __sock_sendmsg+0x21c/0x270
[  309.268587][ T9780]  ____sys_sendmsg+0x505/0x830
[  309.268594][ T9780]  ? __pfx_____sys_sendmsg+0x10/0x10
[  309.268601][ T9780]  ? import_iovec+0x74/0xa0
[  309.268609][ T9780]  ___sys_sendmsg+0x21f/0x2a0
[  309.268653][ T9780]  ? __pfx____sys_sendmsg+0x10/0x10
[  309.268667][ T9780]  ? __fget_files+0x2a/0x420
[  309.268677][ T9780]  ? __fget_files+0x3a0/0x420
[  309.268689][ T9780]  __x64_sys_sendmsg+0x19b/0x260
[  309.268698][ T9780]  ? perf_trace_run_bpf_submit+0x100/0x170
[  309.268706][ T9780]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  309.268714][ T9780]  ? rcu_is_watching+0x15/0xb0
[  309.268721][ T9780]  ? do_syscall_64+0xbe/0x3b0
[  309.268731][ T9780]  do_syscall_64+0xfa/0x3b0
[  309.268739][ T9780]  ? lockdep_hardirqs_on+0x9c/0x150
[  309.268747][ T9780]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  309.268753][ T9780]  ? exc_page_fault+0x9f/0xf0
[  309.268761][ T9780]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  309.268768][ T9780] RIP: 0033:0x7facd0d8ebe9
[  309.268776][ T9780] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  309.268782][ T9780] RSP: 002b:00007facd1bff038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  309.268790][ T9780] RAX: ffffffffffffffda RBX: 00007facd0fc5fa0 RCX: 00007facd0d8ebe9
[  309.268795][ T9780] RDX: 0000000000000000 RSI: 0000200000000840 RDI: 0000000000000004
[  309.268799][ T9780] RBP: 00007facd0e11e19 R08: 0000000000000000 R09: 0000000000000000
[  309.268803][ T9780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  309.268807][ T9780] R13: 00007facd0fc6038 R14: 00007facd0fc5fa0 R15: 00007ffebdd01898
[  309.268814][ T9780]  </TASK>
[  309.268817][ T9780] 
[  309.325082][ T9784] netlink: 'syz.3.1600': attribute type 1 has an invalid length.
[  309.326315][ T9780] Allocated by task 8156:
[  309.326327][ T9780]  kasan_save_track+0x3e/0x80
[  309.326347][ T9780]  __kasan_slab_alloc+0x6c/0x80
[  309.326362][ T9780]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  309.413293][ T9780]  xfrm_state_alloc+0x24/0x2f0
[  309.414999][ T9780]  __find_acq_core+0x8a7/0x1c00
[  309.416751][ T9780]  xfrm_find_acq+0x78/0xa0
[  309.418491][ T9780]  xfrm_alloc_userspi+0x6b3/0xc90
[  309.420191][ T9780]  xfrm_user_rcv_msg+0x7a3/0xab0
[  309.422013][ T9780]  netlink_rcv_skb+0x208/0x470
[  309.423713][ T9780]  xfrm_netlink_rcv+0x79/0x90
[  309.425360][ T9780]  netlink_unicast+0x82f/0x9e0
[  309.427142][ T9780]  netlink_sendmsg+0x805/0xb30
[  309.428757][ T9780]  __sock_sendmsg+0x21c/0x270
[  309.430477][ T9780]  ____sys_sendmsg+0x505/0x830
[  309.432139][ T9780]  ___sys_sendmsg+0x21f/0x2a0
[  309.433839][ T9780]  __x64_sys_sendmsg+0x19b/0x260
[  309.435662][ T9780]  do_syscall_64+0xfa/0x3b0
[  309.437221][ T9780]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  309.439356][ T9780] 
[  309.440226][ T9780] Freed by task 9:
[  309.441674][ T9780]  kasan_save_track+0x3e/0x80
[  309.443315][ T9780]  kasan_save_free_info+0x46/0x50
[  309.445137][ T9780]  __kasan_slab_free+0x5b/0x80
[  309.446782][ T9780]  kmem_cache_free+0x18f/0x400
[  309.448467][ T9780]  xfrm_state_gc_task+0x52d/0x6b0
[  309.450136][ T9780]  process_scheduled_works+0xae1/0x17b0
[  309.452077][ T9780]  worker_thread+0x8a0/0xda0
[  309.453653][ T9780]  kthread+0x711/0x8a0
[  309.455140][ T9780]  ret_from_fork+0x3fc/0x770
[  309.456795][ T9780]  ret_from_fork_asm+0x1a/0x30
[  309.458523][ T9780] 
[  309.459439][ T9780] The buggy address belongs to the object at ffff888028305200
[  309.459439][ T9780]  which belongs to the cache xfrm_state of size 928
[  309.464320][ T9780] The buggy address is located 196 bytes inside of
[  309.464320][ T9780]  freed 928-byte region [ffff888028305200, ffff8880283055a0)
[  309.468828][ T9780] 
[  309.469762][ T9780] The buggy address belongs to the physical page:
[  309.471845][ T9780] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028304480 pfn:0x28304
[  309.475364][ T9780] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  309.478336][ T9780] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  309.480933][ T9780] page_type: f5(slab)
[  309.482233][ T9780] raw: 00fff00000000040 ffff8881051a8b40 dead000000000122 0000000000000000
[  309.485130][ T9780] raw: ffff888028304480 00000000800e000a 00000000f5000000 0000000000000000
[  309.488097][ T9780] head: 00fff00000000040 ffff8881051a8b40 dead000000000122 0000000000000000
[  309.491019][ T9780] head: ffff888028304480 00000000800e000a 00000000f5000000 0000000000000000
[  309.494055][ T9780] head: 00fff00000000002 ffffea0000a0c101 00000000ffffffff 00000000ffffffff
[  309.497442][ T9780] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  309.501195][ T9780] page dumped because: kasan: bad access detected
[  309.503974][ T9780] page_owner tracks the page as allocated
[  309.506417][ T9780] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6143, tgid 6142 (syz.1.102), ts 66828616418, free_ts 66677083864
[  309.514273][ T9780]  post_alloc_hook+0x240/0x2a0
[  309.516391][ T9780]  get_page_from_freelist+0x21e4/0x22c0
[  309.518937][ T9780]  __alloc_frozen_pages_noprof+0x181/0x370
[  309.521497][ T9780]  alloc_pages_mpol+0x232/0x4a0
[  309.523640][ T9780]  allocate_slab+0x8a/0x370
[  309.525560][ T9780]  ___slab_alloc+0xbeb/0x1410
[  309.527534][ T9780]  kmem_cache_alloc_noprof+0x283/0x3c0
[  309.529896][ T9780]  xfrm_state_alloc+0x24/0x2f0
[  309.532055][ T9780]  xfrm_add_sa+0x17d1/0x4070
[  309.533991][ T9780]  xfrm_user_rcv_msg+0x7a3/0xab0
[  309.536066][ T9780]  netlink_rcv_skb+0x208/0x470
[  309.538107][ T9780]  xfrm_netlink_rcv+0x79/0x90
[  309.540099][ T9780]  netlink_unicast+0x82f/0x9e0
[  309.542149][ T9780]  netlink_sendmsg+0x805/0xb30
[  309.544205][ T9780]  __sock_sendmsg+0x21c/0x270
[  309.546360][ T9780]  ____sys_sendmsg+0x505/0x830
[  309.548427][ T9780] page last free pid 6129 tgid 6128 stack trace:
[  309.551126][ T9780]  __free_frozen_pages+0xbc4/0xd30
[  309.553304][ T9780]  stack_depot_save_flags+0x436/0x860
[  309.555582][ T9780]  kasan_save_track+0x4f/0x80
[  309.557700][ T9780]  __kasan_slab_alloc+0x6c/0x80
[  309.559858][ T9780]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  309.562241][ T9780]  rxrpc_alloc_call+0x278/0xd50
[  309.564311][ T9780]  rxrpc_service_prealloc_one+0x387/0xe20
[  309.566906][ T9780]  afs_charge_preallocation+0x1fa/0x4e0
[  309.569313][ T9780]  afs_open_socket+0x302/0x3a0
[  309.571271][ T9780]  afs_net_init+0x67d/0x880
[  309.572821][ T9780]  ops_init+0x35c/0x5c0
[  309.574224][ T9780]  setup_net+0x10c/0x320
[  309.575659][ T9780]  copy_net_ns+0x31b/0x4d0
[  309.577147][ T9780]  create_new_namespaces+0x3f3/0x720
[  309.578900][ T9780]  copy_namespaces+0x438/0x4b0
[  309.580576][ T9780]  copy_process+0x1733/0x3c00
[  309.582141][ T9780] 
[  309.583023][ T9780] Memory state around the buggy address:
[  309.585036][ T9780]  ffff888028305180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  309.587900][ T9780]  ffff888028305200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  309.591174][ T9780] >ffff888028305280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  309.594316][ T9780]                                            ^
[  309.596539][ T9780]  ffff888028305300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  309.599430][ T9780]  ffff888028305380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  309.602306][ T9780] ==================================================================
[  309.605381][ T9780] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  309.608247][ T9780] CPU: 0 UID: 0 PID: 9780 Comm: syz.5.1597 Not tainted syzkaller #0 PREEMPT(full) 
[  309.611640][ T9780] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  309.615209][ T9780] Call Trace:
[  309.616427][ T9780]  <TASK>
[  309.617516][ T9780]  dump_stack_lvl+0x99/0x250
[  309.619315][ T9780]  ? __asan_memcpy+0x40/0x70
[  309.620984][ T9780]  ? __pfx_dump_stack_lvl+0x10/0x10
[  309.622868][ T9780]  ? __pfx__printk+0x10/0x10
[  309.624661][ T9780]  vpanic+0x281/0x750
[  309.626321][ T9780]  ? __pfx_vpanic+0x10/0x10
[  309.628259][ T9780]  ? irqentry_exit+0x74/0x90
[  309.630210][ T9780]  panic+0xb9/0xc0
[  309.631822][ T9780]  ? __pfx_panic+0x10/0x10
[  309.633718][ T9780]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  309.636144][ T9780]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  309.638644][ T9780]  ? xfrm_alloc_spi+0x570/0xf30
[  309.640749][ T9780]  check_panic_on_warn+0x89/0xb0
[  309.642887][ T9780]  ? xfrm_alloc_spi+0x570/0xf30
[  309.644941][ T9780]  end_report+0x78/0x160
[  309.646668][ T9780]  kasan_report+0x129/0x150
[  309.648536][ T9780]  ? xfrm_alloc_spi+0x570/0xf30
[  309.650584][ T9780]  xfrm_alloc_spi+0x570/0xf30
[  309.652527][ T9780]  ? xfrm_alloc_spi+0x2a0/0xf30
[  309.654587][ T9780]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  309.656756][ T9780]  ? xfrm_find_acq+0x87/0xa0
[  309.658512][ T9780]  xfrm_alloc_userspi+0x70b/0xc90
[  309.660646][ T9780]  ? apparmor_capable+0x137/0x1b0
[  309.662775][ T9780]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  309.665081][ T9780]  ? __nla_parse+0x40/0x60
[  309.666977][ T9780]  xfrm_user_rcv_msg+0x7a3/0xab0
[  309.669063][ T9780]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  309.671377][ T9780]  ? __pfx___mutex_trylock_common+0x10/0x10
[  309.673852][ T9780]  ? rcu_is_watching+0x15/0xb0
[  309.675874][ T9780]  ? trace_contention_end+0x39/0x120
[  309.677757][ T9780]  ? __mutex_lock+0x335/0x1360
[  309.679768][ T9780]  netlink_rcv_skb+0x208/0x470
[  309.681470][ T9780]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  309.683248][ T9780]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  309.685203][ T9780]  ? netlink_deliver_tap+0x2e/0x1b0
[  309.687308][ T9780]  ? netlink_deliver_tap+0x2e/0x1b0
[  309.689379][ T9780]  xfrm_netlink_rcv+0x79/0x90
[  309.690961][ T9780]  netlink_unicast+0x82f/0x9e0
[  309.692779][ T9780]  ? __pfx_netlink_unicast+0x10/0x10
[  309.694693][ T9780]  ? netlink_sendmsg+0x642/0xb30
[  309.696334][ T9780]  ? skb_put+0x11b/0x210
[  309.697775][ T9780]  netlink_sendmsg+0x805/0xb30
[  309.699832][ T9780]  ? __pfx_netlink_sendmsg+0x10/0x10
[  309.702022][ T9780]  ? aa_sock_msg_perm+0xf1/0x1d0
[  309.703633][ T9780]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  309.705375][ T9780]  ? __pfx_netlink_sendmsg+0x10/0x10
[  309.707109][ T9780]  __sock_sendmsg+0x21c/0x270
[  309.708764][ T9780]  ____sys_sendmsg+0x505/0x830
[  309.710601][ T9780]  ? __pfx_____sys_sendmsg+0x10/0x10
[  309.712435][ T9780]  ? import_iovec+0x74/0xa0
[  309.714080][ T9780]  ___sys_sendmsg+0x21f/0x2a0
[  309.715820][ T9780]  ? __pfx____sys_sendmsg+0x10/0x10
[  309.717781][ T9780]  ? __fget_files+0x2a/0x420
[  309.719718][ T9780]  ? __fget_files+0x3a0/0x420
[  309.721700][ T9780]  __x64_sys_sendmsg+0x19b/0x260
[  309.723295][ T9780]  ? perf_trace_run_bpf_submit+0x100/0x170
[  309.725413][ T9780]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  309.727336][ T9780]  ? rcu_is_watching+0x15/0xb0
[  309.729109][ T9780]  ? do_syscall_64+0xbe/0x3b0
[  309.730675][ T9780]  do_syscall_64+0xfa/0x3b0
[  309.732137][ T9780]  ? lockdep_hardirqs_on+0x9c/0x150
[  309.733797][ T9780]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  309.735728][ T9780]  ? exc_page_fault+0x9f/0xf0
[  309.737523][ T9780]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  309.739574][ T9780] RIP: 0033:0x7facd0d8ebe9
[  309.741437][ T9780] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  309.748731][ T9780] RSP: 002b:00007facd1bff038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  309.752069][ T9780] RAX: ffffffffffffffda RBX: 00007facd0fc5fa0 RCX: 00007facd0d8ebe9
[  309.755325][ T9780] RDX: 0000000000000000 RSI: 0000200000000840 RDI: 0000000000000004
[  309.758526][ T9780] RBP: 00007facd0e11e19 R08: 0000000000000000 R09: 0000000000000000
[  309.761515][ T9780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  309.764628][ T9780] R13: 00007facd0fc6038 R14: 00007facd0fc5fa0 R15: 00007ffebdd01898
[  309.767653][ T9780]  </TASK>
[  309.769828][ T9780] Kernel Offset: disabled
[  309.771479][ T9780] Rebooting in 86400 seconds..

VM DIAGNOSIS:
16:14:51  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000072 RBX=0000000000000072 RCX=0000000000000000 RDX=00000000000003f8
RSI=000000000000120d RDI=000000000000120e RBP=00000000000003f8 RSP=ffffc90001d9e9f0
R8 =ffff888107450237 R9 =1ffff11020e8a046 R10=dffffc0000000000 R11=ffffffff854f0870
R12=dffffc0000000000 R13=ffffffff99af98ed R14=ffffffff99dee3a0 R15=0000000000000000
RIP=ffffffff854f08ec RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007facd1bff6c0 ffffffff 00c00000
GS =0000 ffff8880b861c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000004140 CR3=0000000042828000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000200000000300 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007facd0f97498 00007facd0f97470 XMM03=00007facd0f974a8 00007facd0f974a0
XMM04=00007facd1afd100 00007facd0f97460 XMM05=00007facd0f97478 00007facd0f974c0
XMM06=00007facd0f974b8 00007facd0f974b0 XMM07=00007facd0f974a8 00007facd0f974a0
XMM08=0000000000000000 00007facd0e12ee7 XMM09=0000000000000000 00007facd0e12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000001 RBX=ffffffff90340701 RCX=4ec8ca2b50201600 RDX=ffffc900001b7501
RSI=ffffffff8172c195 RDI=ffffffff8e139ea0 RBP=dffffc0000000000 RSP=ffffc900001b7370
R8 =ffffc900001b7c70 R9 =0000000000000000 R10=ffffc900001b7518 R11=fffff52000036ea5
R12=ffffc900001b7c80 R13=ffffffff8172c195 R14=ffffffff8e139ea0 R15=ffffffff8172c195
RIP=ffffffff81a65e29 RFL=00000297 [--S-APC] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f01069c7dac CR3=0000000022574000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffff8167991b ffffffff8167991b
XMM02=ffffffff81c939bc ffffffff8167991b XMM03=ffffffff81c939bc ffffffff81c939bc
XMM04=00007fd534afd100 00007fd533f97460 XMM05=00007fd533f97478 00007fd533f974c0
XMM06=00007fd533f974b8 00007fd533f974b0 XMM07=00007fd533f974a8 00007fd533f974a0
XMM08=0000000000000000 00007fd533e12ee7 XMM09=0000000000000000 00007fd533e12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
