last executing test programs:

1.520225147s ago: executing program 1 (id=324):
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {}, {0xe, 0xd}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x36b}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x3, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0)

1.441149988s ago: executing program 1 (id=325):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x400000000000000b, 0xb54b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x4, 0xfffff271, 0xffff, 0x0, 0x0, 0x0, 0x24}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010)

1.382149598s ago: executing program 1 (id=326):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="6c0000000206050000000000000000000000fffc120003006269746d61703a69702c6d616300000005000400000000000900020073587a31000000002000078005000300050000000c00018008000140ffffffff08000840000000e405000500020000000500010006"], 0x6c}, 0x1, 0x0, 0x0, 0x4010}, 0x0)

1.381910854s ago: executing program 1 (id=327):
r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x15, 0x10, &(0x7f0000000000)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {}, [@jmp={0x5, 0x1, 0x6, 0x9, 0x4, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x2f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94)

1.310944971s ago: executing program 1 (id=328):
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0)
r2 = socket$netlink(0x10, 0x3, 0xa)
sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x3, 0x2, 0x5, 0x0, 0x0, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x20044010}, 0x14)

1.199941701s ago: executing program 1 (id=329):
bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000007feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407000000c04100001d440000000000006b0a00fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48)

579.803575ms ago: executing program 0 (id=337):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x11, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000300)='syzkaller\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0)
ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000340)={'bridge_slave_1\x00'})

522.329374ms ago: executing program 0 (id=339):
write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000000), 0x2a979d)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x3)
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000000)='cpu&\t\t')

462.674589ms ago: executing program 2 (id=340):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x2}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="364000001a00910006000000000000000a"], 0xfe33)

382.248934ms ago: executing program 0 (id=341):
socket$kcm(0x2, 0x5, 0x84)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_config_ext={0x3, 0x8001}, 0x0, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$kcm(0xa, 0x2, 0x73)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
close(0xffffffffffffffff)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040))
r0 = socket$kcm(0xa, 0x922000000003, 0x11)
r1 = socket$kcm(0x10, 0x2, 0x4)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0)
setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r2, 0x4)
sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x4)

290.839443ms ago: executing program 2 (id=342):
r0 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffffffffffff99, &(0x7f0000000080)=[{&(0x7f00000000c0)="e03f030010000b05d25a806c8c6f94f90324fc601000010025000000053582fb8f51c18fffd99b8e8bc137153e37", 0x33fe0}], 0x1}, 0x40040)

160.228877ms ago: executing program 2 (id=343):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0xfffd}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x58}}, 0x0)

152.814458ms ago: executing program 0 (id=344):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xe6e}]}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}]}, 0x58}}, 0x0)

152.579048ms ago: executing program 2 (id=345):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000002d00)={0x28, 0x0, 0x2, 0x5, 0x0, 0x0, {0xa, 0x0, 0xfffe}, [@CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x1}, @CTA_EXPECT_MASTER={0x4}, @CTA_EXPECT_TUPLE={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x803}, 0x4044)

92.242394ms ago: executing program 2 (id=346):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xef, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x800, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$kcm(0x2, 0x1, 0x84)
setsockopt$sock_attach_bpf(r0, 0x84, 0x11, &(0x7f0000000000), 0x8)

92.082054ms ago: executing program 0 (id=347):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000900020073797a310000000005000400000000000d0003006c6973743a736574000000000c000780080006000000000005000500020000000500010006"], 0x54}}, 0x0)

344.393µs ago: executing program 2 (id=348):
r0 = socket$inet(0x2, 0x2, 0x1)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r1}, 0x18)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000240)="96bc1480bb58", 0x6}], 0x2, &(0x7f0000000040)=[@ip_tos_u8={{0x11, 0x0, 0x7}}], 0x18}, 0x40010)

0s ago: executing program 0 (id=349):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0))
socket$kcm(0x2b, 0x1, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_config_ext={0x3, 0x8001}, 0x0, 0x2e, 0xfffffbff, 0x3, 0x10000003, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x1}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000140))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0)
recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x20}, 0x122)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280))
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080))
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x90)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'dummy0\x00'})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000900007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000080))

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:60412' (ED25519) to the list of known hosts.
syzkaller login: [   48.417891][ T5790] cgroup: Unknown subsys name 'net'
[   48.505828][ T5790] cgroup: Unknown subsys name 'cpuset'
[   48.510122][ T5790] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   49.800149][ T5790] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   60.021931][ T5868] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   60.025703][ T5868] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   60.029331][ T5868] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   60.042474][ T5868] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   60.046121][ T5868] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   60.084280][ T5234] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   60.089094][ T5873] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   60.093033][ T5873] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   60.098735][ T5873] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   60.104138][ T5873] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   60.124843][ T5234] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   60.131686][ T5234] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   60.135057][ T5234] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   60.138461][ T5234] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   60.141839][ T5234] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   60.425015][ T5867] chnl_net:caif_netlink_parms(): no params data found
[   60.493068][ T5871] chnl_net:caif_netlink_parms(): no params data found
[   60.554894][ T5867] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.558723][ T5867] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.562214][ T5867] bridge_slave_0: entered allmulticast mode
[   60.565846][ T5867] bridge_slave_0: entered promiscuous mode
[   60.570212][ T5870] chnl_net:caif_netlink_parms(): no params data found
[   60.587680][ T5867] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.590542][ T5867] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.593657][ T5867] bridge_slave_1: entered allmulticast mode
[   60.597171][ T5867] bridge_slave_1: entered promiscuous mode
[   60.667250][ T5867] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.685741][ T5867] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   60.693924][ T5871] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.697053][ T5871] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.700180][ T5871] bridge_slave_0: entered allmulticast mode
[   60.705585][ T5871] bridge_slave_0: entered promiscuous mode
[   60.735746][ T5871] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.738639][ T5871] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.743750][ T5871] bridge_slave_1: entered allmulticast mode
[   60.747512][ T5871] bridge_slave_1: entered promiscuous mode
[   60.751724][ T5867] team0: Port device team_slave_0 added
[   60.775494][ T5867] team0: Port device team_slave_1 added
[   60.777507][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.780153][ T5870] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.783074][ T5870] bridge_slave_0: entered allmulticast mode
[   60.786443][ T5870] bridge_slave_0: entered promiscuous mode
[   60.825348][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.827860][ T5870] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.830595][ T5870] bridge_slave_1: entered allmulticast mode
[   60.834954][ T5870] bridge_slave_1: entered promiscuous mode
[   60.839034][ T5871] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.843934][ T5867] batman_adv: batadv0: Adding interface: batadv_slave_0
[   60.846088][ T5867] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.854486][ T5867] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   60.868353][ T5871] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   60.872137][ T5867] batman_adv: batadv0: Adding interface: batadv_slave_1
[   60.874275][ T5867] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.882683][ T5867] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   60.914755][ T5870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   60.939140][ T5870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   60.943286][ T5871] team0: Port device team_slave_0 added
[   60.971783][ T5871] team0: Port device team_slave_1 added
[   60.987547][ T5870] team0: Port device team_slave_0 added
[   60.992015][ T5870] team0: Port device team_slave_1 added
[   60.999050][ T5867] hsr_slave_0: entered promiscuous mode
[   61.002698][ T5867] hsr_slave_1: entered promiscuous mode
[   61.056711][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.059512][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.070100][ T5870] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.077798][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.080570][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.090609][ T5870] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.097854][ T5871] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.100610][ T5871] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.111067][ T5871] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.137488][ T5871] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.139962][ T5871] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   61.151589][ T5871] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.206717][ T5870] hsr_slave_0: entered promiscuous mode
[   61.209187][ T5870] hsr_slave_1: entered promiscuous mode
[   61.212053][ T5870] debugfs: 'hsr0' already exists in 'hsr'
[   61.214307][ T5870] Cannot create hsr debugfs directory
[   61.244760][ T5871] hsr_slave_0: entered promiscuous mode
[   61.247754][ T5871] hsr_slave_1: entered promiscuous mode
[   61.250553][ T5871] debugfs: 'hsr0' already exists in 'hsr'
[   61.253175][ T5871] Cannot create hsr debugfs directory
[   61.500132][ T5867] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   61.509042][ T5867] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   61.520134][ T5867] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   61.540194][ T5867] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   61.566138][ T5870] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   61.572778][ T5870] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   61.582875][ T5870] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   61.597169][ T5870] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   61.648188][ T5871] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   61.653526][ T5871] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   61.659481][ T5871] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   61.666378][ T5871] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   61.770009][ T5870] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.778291][ T5867] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.799745][ T5867] 8021q: adding VLAN 0 to HW filter on device team0
[   61.816508][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.819087][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   61.824882][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.827598][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   61.846139][ T5870] 8021q: adding VLAN 0 to HW filter on device team0
[   61.853765][ T5871] 8021q: adding VLAN 0 to HW filter on device bond0
[   61.868000][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.870480][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   61.886553][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.889460][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   61.909501][ T5871] 8021q: adding VLAN 0 to HW filter on device team0
[   61.926984][  T628] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.930031][  T628] bridge0: port 1(bridge_slave_0) entered forwarding state
[   61.963970][  T628] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.966921][  T628] bridge0: port 2(bridge_slave_1) entered forwarding state
[   62.094034][ T5868] Bluetooth: hci0: command tx timeout
[   62.133555][ T5867] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.145441][ T5870] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.172921][ T5868] Bluetooth: hci2: command tx timeout
[   62.175456][ T5868] Bluetooth: hci1: command tx timeout
[   62.208341][ T5867] veth0_vlan: entered promiscuous mode
[   62.218276][ T5870] veth0_vlan: entered promiscuous mode
[   62.225584][ T5867] veth1_vlan: entered promiscuous mode
[   62.237769][ T5870] veth1_vlan: entered promiscuous mode
[   62.243161][ T5871] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.278701][ T5867] veth0_macvtap: entered promiscuous mode
[   62.295881][ T5870] veth0_macvtap: entered promiscuous mode
[   62.306269][ T5867] veth1_macvtap: entered promiscuous mode
[   62.314687][ T5870] veth1_macvtap: entered promiscuous mode
[   62.336929][ T5867] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.351604][ T5867] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.354030][ T5871] veth0_vlan: entered promiscuous mode
[   62.364641][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.374741][ T5860] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.380830][ T5871] veth1_vlan: entered promiscuous mode
[   62.385259][ T5860] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.393621][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.396612][ T5860] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.408651][ T5860] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.421219][ T5878] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.427538][ T5878] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.440561][ T5878] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.464285][ T5878] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.482574][ T5871] veth0_macvtap: entered promiscuous mode
[   62.498341][ T5871] veth1_macvtap: entered promiscuous mode
[   62.537540][   T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.540644][   T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.542923][ T5871] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.573612][ T5871] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.577823][   T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.591273][   T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.594199][ T5895] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.599296][ T5895] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.623481][ T5895] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.627978][ T5860] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.633678][  T628] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.635600][   T52] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.637180][  T628] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.656589][   T52] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.710935][ T5870] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   62.722285][   T69] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.727664][   T69] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.773996][   T28] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.783616][   T28] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.816207][ T5936] netlink: 16 bytes leftover after parsing attributes in process `syz.2.13'.
[   63.408583][ T5962] netlink: 'syz.1.25': attribute type 2 has an invalid length.
[   63.812444][ T5987] netlink: 'syz.2.36': attribute type 13 has an invalid length.
[   64.091349][    C0] hrtimer: interrupt took 28885 ns
[   64.173676][ T5234] Bluetooth: hci0: command tx timeout
[   64.252369][ T5234] Bluetooth: hci1: command tx timeout
[   64.254358][ T5234] Bluetooth: hci2: command tx timeout
[   64.267530][ T6009] netlink: 40 bytes leftover after parsing attributes in process `syz.2.46'.
[   64.365943][ T6014] netlink: 60 bytes leftover after parsing attributes in process `syz.0.48'.
[   64.618938][ T6027] netlink: 209588 bytes leftover after parsing attributes in process `syz.0.54'.
[   64.671877][ T6028] =======================================================
[   64.671877][ T6028] WARNING: The mand mount option has been deprecated and
[   64.671877][ T6028]          and is ignored by this kernel. Remove the mand
[   64.671877][ T6028]          option from the mount to silence this warning.
[   64.671877][ T6028] =======================================================
[   66.023802][ T6077] netlink: 64019 bytes leftover after parsing attributes in process `syz.2.77'.
[   66.181604][ T6089] netlink: 'syz.2.83': attribute type 22 has an invalid length.
[   66.239935][ T6093] lo: entered allmulticast mode
[   66.258187][ T6093] Zero length message leads to an empty skb
[   66.259297][ T5234] Bluetooth: hci0: command tx timeout
[   66.324241][ T6098] lo: entered promiscuous mode
[   66.326357][ T6098] lo: left allmulticast mode
[   66.332277][ T5234] Bluetooth: hci2: command tx timeout
[   66.334591][ T5868] Bluetooth: hci1: command tx timeout
[   66.637332][ T6103] Driver unsupported XDP return value 0 on prog  (id 33) dev N/A, expect packet loss!
[   67.117021][ T6129] netlink: 8 bytes leftover after parsing attributes in process `syz.2.99'.
[   68.332210][ T5234] Bluetooth: hci0: command tx timeout
[   68.351152][ T6151] netlink: 56 bytes leftover after parsing attributes in process `syz.2.107'.
[   68.411533][ T5234] Bluetooth: hci2: command tx timeout
[   68.413805][ T5868] Bluetooth: hci1: command tx timeout
[   69.105480][ T6169] netlink: 20 bytes leftover after parsing attributes in process `syz.2.115'.
[   69.161737][ T6176] netlink: 40 bytes leftover after parsing attributes in process `syz.1.117'.
[   69.165237][ T6176] netlink: 40 bytes leftover after parsing attributes in process `syz.1.117'.
[   69.219665][ T6170] netlink: 'syz.0.116': attribute type 3 has an invalid length.
[   69.233047][ T6170] netlink: 132 bytes leftover after parsing attributes in process `syz.0.116'.
[   69.246234][ T6174] can: request_module (can-proto-5) failed.
[   69.945153][ T6218] netlink: 104 bytes leftover after parsing attributes in process `syz.1.138'.
[   69.963537][ T6220] netlink: 'syz.0.139': attribute type 2 has an invalid length.
[   69.971627][ T6220] netlink: 'syz.0.139': attribute type 1 has an invalid length.
[   69.977134][ T6220] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.139'.
[   70.765918][ T6237] netlink: 183676 bytes leftover after parsing attributes in process `syz.0.145'.
[   70.770579][ T6238] netlink: 324 bytes leftover after parsing attributes in process `syz.2.143'.
[   71.056300][ T6249] netlink: 48 bytes leftover after parsing attributes in process `syz.1.147'.
[   71.186507][ T6257] netlink: 'syz.1.152': attribute type 10 has an invalid length.
[   71.190467][ T6257] batman_adv: batadv0: Adding interface: vlan1
[   71.194321][ T6257] batman_adv: batadv0: The MTU of interface vlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.204479][ T6257] batman_adv: batadv0: Interface activated: vlan1
[   71.216275][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   71.220118][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   71.327354][ T6261] netlink: ct family unspecified
[   71.329602][ T6261] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   73.370075][ T5234] Bluetooth: hci2: unexpected subevent 0x1a length: 150 > 6
[   73.392842][ T6349] __nla_validate_parse: 4 callbacks suppressed
[   73.392856][ T6349] netlink: 8 bytes leftover after parsing attributes in process `syz.2.193'.
[   73.446204][ T6353] openvswitch: netlink: Missing valid actions attribute.
[   73.449437][ T6353] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   73.554320][ T6360] warning: `syz.0.199' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   73.628919][ T6364] delete_channel: no stack
[   73.631176][ T6364] delete_channel: no stack
[   73.682436][ T6364] netlink: 'syz.0.201': attribute type 6 has an invalid length.
[   73.686951][ T6364] netlink: 164 bytes leftover after parsing attributes in process `syz.0.201'.
[   74.288815][ T6405] netlink: 132 bytes leftover after parsing attributes in process `syz.0.218'.
[   74.349892][ T6412] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   75.252123][ T6426] netlink: 'syz.0.228': attribute type 210 has an invalid length.
[   76.272572][ T6449] netlink: 'syz.0.238': attribute type 12 has an invalid length.
[   76.276142][ T6449] netlink: 132 bytes leftover after parsing attributes in process `syz.0.238'.
[   76.360627][ T6450] syz.0.238 (6450) used obsolete PPPIOCDETACH ioctl
[   76.432551][ T6449] syz.0.238 uses obsolete (PF_INET,SOCK_PACKET)
[   76.668507][ T6455] netlink: 202920 bytes leftover after parsing attributes in process `syz.1.241'.
[   77.147945][ T6473] netlink: 26 bytes leftover after parsing attributes in process `syz.2.247'.
[   77.226681][ T6476] netlink: 132 bytes leftover after parsing attributes in process `syz.1.248'.
[   77.235522][ T6476] netlink: 132 bytes leftover after parsing attributes in process `syz.1.248'.
[   77.378836][ T6479] sit0: entered allmulticast mode
[   77.402606][ T6479] sit0: entered promiscuous mode
[   77.759315][ T6482] netlink: 132 bytes leftover after parsing attributes in process `syz.0.250'.
[   78.913629][ T6500] netlink: 'syz.0.258': attribute type 17 has an invalid length.
[   78.916860][ T6500] netlink: 152 bytes leftover after parsing attributes in process `syz.0.258'.
[   78.921088][ T6500] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   79.245380][ T6516] netlink: 68 bytes leftover after parsing attributes in process `syz.1.266'.
[   79.623830][ T6529] netlink: 'syz.2.270': attribute type 27 has an invalid length.
[   79.626637][ T6529] netlink: 2418 bytes leftover after parsing attributes in process `syz.2.270'.
[   79.758300][ T6537] netlink: 'syz.2.274': attribute type 11 has an invalid length.
[   79.773569][ T6537] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.274'.
[   80.072094][ T6534] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   80.235269][ T6557] cgroup: Unknown subsys name 'uid'
[   80.601496][ T6571] syzkaller1: tun_chr_ioctl cmd 1074025677
[   80.603948][ T6571] syzkaller1: linktype set to 780
[   80.684596][ T6565] netlink: 60 bytes leftover after parsing attributes in process `syz.0.286'.
[   80.692545][ T6565] netlink: 60 bytes leftover after parsing attributes in process `syz.0.286'.
[   81.352802][ T6603] netlink: 'syz.0.303': attribute type 2 has an invalid length.
[   81.355796][ T6603] netlink: 137592 bytes leftover after parsing attributes in process `syz.0.303'.
[   81.484218][   T10] cfg80211: failed to load regulatory.db
[   82.263592][ T6622] netlink: 96 bytes leftover after parsing attributes in process `syz.1.313'.
[   82.286150][ T6622] netlink: 96 bytes leftover after parsing attributes in process `syz.1.313'.
[   82.559807][ T6648] netlink: 'syz.1.324': attribute type 13 has an invalid length.
[   82.564162][ T6648] netlink: 'syz.1.324': attribute type 17 has an invalid length.
[   82.570102][ T6648] gretap0: refused to change device tx_queue_len
[   82.574385][ T6648] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[   83.434447][ T6673] C: renamed from team_slave_0 (while UP)
[   83.437968][ T6673] netlink: 'syz.2.336': attribute type 3 has an invalid length.
[   83.441254][ T6673] netlink: 'syz.2.336': attribute type 1 has an invalid length.
[   83.446440][ T6673] netlink: 116 bytes leftover after parsing attributes in process `syz.2.336'.
[   83.843979][ T6687] netlink: 'syz.2.342': attribute type 1 has an invalid length.
[   84.675402][ T5860] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.723324][ T5860] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.793998][ T5860] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.861037][ T5860] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.933434][ T5860] bridge_slave_1: left allmulticast mode
[   84.935768][ T5860] bridge_slave_1: left promiscuous mode
[   84.938262][ T5860] bridge0: port 2(bridge_slave_1) entered disabled state
[   84.944373][ T5860] bridge_slave_0: left allmulticast mode
[   84.946372][ T5860] bridge_slave_0: left promiscuous mode
[   84.948369][ T5860] bridge0: port 1(bridge_slave_0) entered disabled state
[   85.145491][ T5860] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   85.150027][ T5860] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   85.154524][ T5860] bond0 (unregistering): Released all slaves
[   85.397114][ T5860] hsr_slave_0: left promiscuous mode
[   85.399824][ T5860] hsr_slave_1: left promiscuous mode
[   85.402802][ T5860] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   85.405910][ T5860] batman_adv: batadv0: Removing interface: batadv_slave_0
[   85.409774][ T5860] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   85.412991][ T5860] batman_adv: batadv0: Removing interface: batadv_slave_1
[   85.422067][ T5860] veth1_macvtap: left promiscuous mode
[   85.424148][ T5860] veth0_macvtap: left promiscuous mode
[   85.426796][ T5860] veth1_vlan: left promiscuous mode
[   85.428845][ T5860] veth0_vlan: left promiscuous mode
[   85.659478][ T5860] team0 (unregistering): Port device team_slave_1 removed
[   85.685148][ T5860] team0 (unregistering): Port device C removed
[   86.301157][ T5860] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.374925][ T5860] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.443494][ T5860] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.508296][ T5860] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.622878][ T5860] bridge_slave_1: left allmulticast mode
[   86.625262][ T5860] bridge_slave_1: left promiscuous mode
[   86.628013][ T5860] bridge0: port 2(bridge_slave_1) entered disabled state
[   86.633116][ T5860] bridge_slave_0: left allmulticast mode
[   86.634924][ T5860] bridge_slave_0: left promiscuous mode
[   86.637114][ T5860] bridge0: port 1(bridge_slave_0) entered disabled state
[   86.882810][ T5860] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   86.887197][ T5860] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   86.890821][ T5860] bond0 (unregistering): Released all slaves
[   87.125015][ T5860] hsr_slave_0: left promiscuous mode
[   87.127275][ T5860] hsr_slave_1: left promiscuous mode
[   87.129428][ T5860] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   87.132078][ T5860] batman_adv: batadv0: Removing interface: batadv_slave_0
[   87.135010][ T5860] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   87.137512][ T5860] batman_adv: batadv0: Removing interface: batadv_slave_1
[   87.145680][ T5860] veth1_macvtap: left promiscuous mode
[   87.147579][ T5860] veth0_macvtap: left promiscuous mode
[   87.149500][ T5860] veth1_vlan: left promiscuous mode
[   87.151282][ T5860] veth0_vlan: left promiscuous mode
[   87.382726][ T5860] team0 (unregistering): Port device team_slave_1 removed
[   87.400870][ T5860] team0 (unregistering): Port device team_slave_0 removed

VM DIAGNOSIS:
10:26:59  Registers:
info registers vcpu 0

CPU#0
RAX=d990c0aff0427000 RBX=ffffffff819682f8 RCX=d990c0aff0427000 RDX=0000000000000001
RSI=ffffffff8d9b6cef RDI=ffffffff8be33300 RBP=ffffffff8de07eb8 RSP=ffffffff8de07d80
R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4
R12=ffffffff8fa37f30 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a20
RIP=ffffffff8b79e3f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861a000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b33910ff8 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 00000000000000ff XMM01=0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=53c5d3d0abbf3200 RBX=ffffffff819682f8 RCX=53c5d3d0abbf3200 RDX=0000000000000001
RSI=ffffffff8d9b6cef RDI=ffffffff8be33300 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f9b R9 =1ffff11026cc65f3 R10=dffffc0000000000 R11=ffffed1026cc65f4
R12=ffffffff8fa37f30 R13=0000000000000001 R14=0000000000000001 R15=1ffff110200d0000
RIP=ffffffff8b79e3f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1a000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007ff4c8c87e20 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00ff0000ff000000 0000000000000000 XMM01=00000000ff000000 0000000000000000
XMM02=ff00000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
