last executing test programs:

770.478481ms ago: executing program 0 (id=1):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01080000000000000000010000000900030073797a320000004014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d65746100000000140002800800014000000012080002400000002214000000110001"], 0xd8}}, 0x0)

710.474627ms ago: executing program 0 (id=6):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000240)={'team0\x00', <r3=>0x0})
sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f00000047c0)={0x60, r2, 0x405, 0x70bd27, 0x25dfdbfe, {}, [{{0x8, 0x1, r3}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000084}, 0x44084)
sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@getnexthop={0x20, 0x76, 0xb0d, 0x4000, 0x0, {0x3}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0)
unshare(0x68040200)
socket$inet(0x2, 0x3, 0x7)
socket$inet6_sctp(0xa, 0x1, 0x84)
socket$nl_generic(0x10, 0x3, 0x10)
epoll_create1(0x0)
r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10)
ppoll(&(0x7f0000000500)=[{r4}], 0x1, 0x0, 0x0, 0x0)
pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000000)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0)
syz_emit_ethernet(0x4e, &(0x7f0000000540)=ANY=[@ANYBLOB="cd1242bdc9ea000000000000080049000040000800000001907864010102ffffffff01940401009404000094048fcbd9118507be5db652aa53c800000000000308b07800067f4345170fff0065b9f9f5290008ac1e0001ac141404"], 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
r6 = socket(0x1e, 0x4, 0x0)
r7 = socket(0x840000000002, 0x3, 0xff)
sendmmsg$inet(r7, &(0x7f0000000440)=[{{&(0x7f00000001c0)={0x2, 0x0, @local}, 0x10, &(0x7f0000001980)=[{&(0x7f0000000200)="a1c0ffff000039a9029e2d34161c0000", 0x10}, {0x0, 0x2e}], 0x2}}], 0x1, 0x0)
setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000140)=@req={0x7, 0x1, 0x8, 0x9}, 0x10)
recvmmsg$unix(r6, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0)
sendmmsg(r6, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000)
setsockopt$SO_J1939_FILTER(r7, 0x6b, 0x1, &(0x7f00000003c0)=[{0x2, 0x0, {0x2, 0x1}, {0x0, 0x1}, 0xfd}, {0x0, 0x0, {0x1, 0x1, 0x1}, {0x1, 0xff, 0x3}, 0x2, 0xfe}, {0x2, 0x0, {0x1, 0xf0, 0x3}, {0x1, 0x1, 0x4}, 0xff, 0xfd}, {0x0, 0x1, {0x1, 0xf0, 0x2}, {0x1, 0x0, 0x3}, 0x0, 0xff}, {0x2, 0x2, {0x2, 0xf0, 0x4}, {0x2, 0x1, 0x3}, 0xfe, 0xff}, {0x1, 0x3, {0x2, 0xf0, 0x3}, {0x2, 0xf0, 0x1}, 0xfe, 0xfe}, {0x1, 0x1, {0x0, 0x1, 0x3}, {0x1, 0x0, 0x3}, 0x1, 0x1}, {0x3, 0x3, {0x0, 0xf0, 0x3}, {0x1, 0xf0, 0x2}, 0x2}], 0x100)
close(0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x12, 0xffffffffffffffff, 0xfffff000)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000100)="290000002000190f00003fffffffda060200000000e80001dd0000040d000600ea1100000005000000", 0x29}], 0x1)
socket$nl_route(0x10, 0x3, 0x0)

709.594222ms ago: executing program 2 (id=3):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket(0x8, 0x6, 0x0)
r3 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x5c, 0x2, [@TCA_FW_INDEV={0x0, 0x3, 'vxcan1\x00'}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x84}, 0x8000)
r5 = socket(0x10, 0x80002, 0x0)
socket(0x2, 0x2, 0x1)
sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x14, 0x0, 0x1, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x400}, 0x4040014)
sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000b40)=@newsa={0x150, 0x10, 0x413, 0x70bd29, 0x0, {{@in=@empty, @in6=@private1, 0x0, 0x0, 0x4e24, 0x0, 0x0, 0x0, 0x20, 0x3b}, {@in=@private=0xa010102, 0x0, 0x32}, @in=@multicast1, {0x3ff, 0xfffffffffffffffe, 0x0, 0x0, 0x3, 0x80000, 0x81}, {0x3, 0x5, 0x4, 0x4000006}, {0x0, 0xfffffff9, 0x80020}, 0x0, 0x0, 0xa, 0x4, 0x81, 0x68}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "25cac5216d3c8af0aa763c9a18bf448c5d9f5459"}}]}, 0x150}, 0x1, 0x0, 0x0, 0x612fc0b6c779297b}, 0x0)
r6 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4)
r7 = socket$inet6(0xa, 0x2, 0x0)
r8 = socket(0x10, 0x803, 0x0)
sendmsg$SMC_PNETID_GET(r8, &(0x7f0000000300)={0x0, 0xfffffffffffffccd, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x20008004}, 0x0)
getsockname$packet(r8, &(0x7f00000005c0)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000001000370429bd7000fcdbdf2500000000", @ANYRES32=r9, @ANYBLOB="890c0400000000003c0012800b000100697036746e6c00002c000280080008003200000014000200fc"], 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
r11 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_MCAST_MSFILTER(r11, 0x29, 0x30, &(0x7f0000001c40)=ANY=[@ANYBLOB="02000000000000000a004e2200000001ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000aa9c8bbca63aad7e0b3739aece"], 0x90)
sendmsg$nl_generic(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="240000002b000b0000000000000000000500000000000900"/36], 0x24}}, 0x8000)
sendmmsg$inet(r7, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r9, @empty, @rand_addr=0x3}}}], 0x20}}], 0x1, 0x4040880)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0), 0xffffffffffffffff)
socket$nl_route(0x10, 0x3, 0x0)
r12 = socket(0x10, 0x2, 0x0)
sendmsg$nl_generic(r12, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000740)=ANY=[@ANYBLOB="12000000180001002bbd7000fbdbdf251d"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4044800)

439.560601ms ago: executing program 1 (id=9):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xf}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x34, 0x2, [@TCA_FQ_CODEL_ECN={0x8, 0x4, 0x1}, @TCA_FQ_CODEL_LIMIT={0x8, 0x2, 0x7fffffff}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffffa}, @TCA_FQ_CODEL_INTERVAL={0x8, 0x3, 0x9}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x40}, @TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x6}]}}]}, 0x68}}, 0x4000090)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), r2)
sendmsg$MPTCP_PM_CMD_GET_ADDR(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, r3, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xd5a1}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xeb}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x80}]}, 0x48}, 0x1, 0x0, 0x0, 0x20044881}, 0x80)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge0\x00', <r4=>0x0})
sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="300000001d000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="000096000a000200aaaaaaaaaa0c"], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0)

351.338451ms ago: executing program 2 (id=10):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bond0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfeffffff}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x44}, 0x1, 0xba01}, 0x810)

280.155306ms ago: executing program 1 (id=11):
bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xa, 0xb, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000f7ffffff00000000000000001801000020696c2500000000002020207b1af8ff00060000bfa100000000000007010000f8ffffffb702000008000000b7030000000000007b0000001000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000140)={'syztnl0\x00', &(0x7f00000000c0)={'gretap0\x00', <r1=>0x0, 0x10, 0x1, 0x10000, 0x1, {{0x9, 0x4, 0x1, 0x28, 0x24, 0x67, 0x0, 0x71, 0x4, 0x0, @loopback, @empty, {[@noop, @timestamp_prespec={0x44, 0xc, 0x92, 0x3, 0x9, [{@empty, 0x2}]}]}}}}})
setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x80, 0x6, @vifc_lcl_ifindex=r1, @empty}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xa, 0xb, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000f7ffffff00000000000000001801000020696c2500000000002020207b1af8ff00060000bfa100000000000007010000f8ffffffb702000008000000b7030000000000007b0000001000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
socket(0x10, 0x3, 0x0) (async)
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) (async)
getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) (async)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000140)={'syztnl0\x00', &(0x7f00000000c0)={'gretap0\x00', 0x0, 0x10, 0x1, 0x10000, 0x1, {{0x9, 0x4, 0x1, 0x28, 0x24, 0x67, 0x0, 0x71, 0x4, 0x0, @loopback, @empty, {[@noop, @timestamp_prespec={0x44, 0xc, 0x92, 0x3, 0x9, [{@empty, 0x2}]}]}}}}}) (async)
setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x80, 0x6, @vifc_lcl_ifindex=r1, @empty}, 0x10) (async)

228.954375ms ago: executing program 1 (id=12):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bond0\x00', <r2=>0x0})
socket$netlink(0x10, 0x3, 0x15)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001400)=@newlink={0x4c, 0x10, 0x49920d862a92153b, 0x800, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2040000, 0x1b400}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x4c}}, 0x0)

170.012735ms ago: executing program 2 (id=13):
r0 = socket(0x400000000010, 0x3, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x140002, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r3 = socket(0x400000000010, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfffc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x400}}}]}, 0x38}}, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newtfilter={0x60, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xf}, {}, {0x7, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0x30, 0x2, [@TCA_FLOW_EMATCHES={0x2c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x7, 0x3, 0x6}, {0x8, 0x100, 0xb, 0x2}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004884}, 0x0)
r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002d000100000000005000000000040100800c0011000000000000000000140009000000100000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c21262377d0c2fd523014e8017dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f0ce29573549d34e2a5e9ed1e079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa"], 0x114}], 0x1}, 0x0)

119.92064ms ago: executing program 1 (id=14):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000002fc0)=@newtaction={0xac, 0x30, 0x1, 0x70bd2d, 0x0, {}, [{0x98, 0x1, [@m_bpf={0x44, 0x2, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1, 0x3ff, 0xf, 0x401, 0x6}}]}, {0x4}, {0xc}, {0xc}}}, @m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x9}}]}, {0x4}, {0xc, 0x7, {0x0, 0x40000000}}, {0xc}}}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4040000}, 0x40c0)

119.541106ms ago: executing program 1 (id=15):
r0 = socket(0x10, 0x803, 0x0)
syz_genetlink_get_family_id$SEG6(&(0x7f0000000240), 0xffffffffffffffff) (async)
r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000240), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
socket$unix(0x1, 0x5, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x100000c, 0x4031, 0xffffffffffffffff, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async)
r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
connect$802154_dgram(r4, &(0x7f0000000000)={0x24, @none={0x0, 0x1}}, 0x14)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan1\x00', <r5=>0x0})
syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000040)={'wlan0\x00', <r8=>0x0})
sendmsg$NL80211_CMD_JOIN_IBSS(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x34, r6, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5e}, @NL80211_ATTR_SSID={0x5, 0x34, @random="f7"}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x34}}, 0x8d0)
sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x24, r3, 0xd66771a5e8224ded, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_PID={0x8}]}, 0x24}}, 0x0)
bind$rds(r0, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10)
r9 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xb, &(0x7f0000000280)=@framed={{0x18, 0x3}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r9}, @ldst={0x2, 0x2, 0x1, 0x1, 0x4, 0x18, 0xfffffffffffffff0}, @initr0, @exit, @alu={0x7, 0x0, 0xd, 0x3, 0x0, 0xfffffffffffffff4, 0x10}]}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4c}, 0x94)
sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)={0x38, r3, 0x100, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x40051}, 0x11)
sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=r1, @ANYBLOB="21052dbd7000fcdbdf2501000000140001000000000008000000007bd30000000000"], 0x28}, 0x1, 0x0, 0x0, 0xc4}, 0x80)

50.385969ms ago: executing program 2 (id=16):
r0 = socket(0x840000000002, 0x3, 0xff)
setsockopt$inet_int(r0, 0x0, 0x16, &(0x7f0000000000)=0x9, 0x4)
sendmmsg$inet(r0, &(0x7f0000000440)=[{{&(0x7f00000001c0)={0x2, 0xfe, @local}, 0x10, &(0x7f0000001980)=[{&(0x7f0000000200)="a9050000002074640000000000003552bde5c064c6", 0x15}, {&(0x7f0000001140)="174640b6d80fb2eedc81ba60ccbb9d", 0xf}], 0x2}}], 0x1, 0x0)

479.65µs ago: executing program 2 (id=17):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
r1 = openat$cgroup_devices(r0, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0)
write$cgroup_devices(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB='c 75:', @ANYRESDEC], 0xd)
socket$inet6_sctp(0xa, 0x1, 0x84)
r2 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00'})
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r4, 0x1000)
sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000340)={0x14, 0x0, 0x9, 0x201, 0x0, 0x0, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x4040000)
mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x6, 0x12, r4, 0xfffff000)
socket(0x1f, 0x80000, 0x0)
r5 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r5, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e)
r6 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r6, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e)
connect$pptp(r6, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e)
connect$pptp(r6, &(0x7f0000000100)={0x18, 0x2, {0x1, @multicast1}}, 0x1e)
ioctl$PPPIOCGCHAN(r5, 0x80047437, &(0x7f0000001f00))
connect$pppoe(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, {0x15, @remote, 'bond0\x00'}}, 0x1e)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$PPPIOCATTCHAN(r7, 0x40047438, &(0x7f0000000040)=0x2)
ioctl$PPPIOCBRIDGECHAN(r7, 0x40047435, &(0x7f0000000200)=0x1)
sendmmsg(r5, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0)
mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0)
mmap(&(0x7f000086a000/0x2000)=nil, 0x2000, 0x4, 0x11, r4, 0x2000)
close(0x3)
socket(0x2, 0x80805, 0x0)

0s ago: executing program 1 (id=18):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01080000000000000000010000000900030073797a32fffffff514000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d65746100000000140002800800014000000012080002400000002214000000110001"], 0xd8}}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:64929' (ED25519) to the list of known hosts.
syzkaller login: [   40.637360][ T5750] cgroup: Unknown subsys name 'net'
[   40.739238][ T5750] cgroup: Unknown subsys name 'cpuset'
[   40.745183][ T5750] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   41.974517][ T5750] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   44.970849][   T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   44.977500][ T5816] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   44.980400][ T5818] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   44.982845][ T5818] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   44.986134][ T5818] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   44.989340][ T5818] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   44.991920][ T5816] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   44.994959][ T5818] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   44.997541][ T5818] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   45.001205][ T5816] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   45.024016][ T5210] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   45.037615][ T5210] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   45.040953][ T5210] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   45.045738][ T5210] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   45.048710][ T5210] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   45.227327][ T5817] chnl_net:caif_netlink_parms(): no params data found
[   45.278565][ T5814] chnl_net:caif_netlink_parms(): no params data found
[   45.298672][ T5821] chnl_net:caif_netlink_parms(): no params data found
[   45.378434][ T5817] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.381420][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state
[   45.383921][ T5817] bridge_slave_0: entered allmulticast mode
[   45.387465][ T5817] bridge_slave_0: entered promiscuous mode
[   45.404584][ T5817] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.408118][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state
[   45.410558][ T5817] bridge_slave_1: entered allmulticast mode
[   45.413267][ T5817] bridge_slave_1: entered promiscuous mode
[   45.454781][ T5814] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.457448][ T5814] bridge0: port 1(bridge_slave_0) entered disabled state
[   45.459875][ T5814] bridge_slave_0: entered allmulticast mode
[   45.462658][ T5814] bridge_slave_0: entered promiscuous mode
[   45.476019][ T5817] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   45.488358][ T5817] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   45.518602][ T5821] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.521463][ T5821] bridge0: port 1(bridge_slave_0) entered disabled state
[   45.524040][ T5821] bridge_slave_0: entered allmulticast mode
[   45.528048][ T5821] bridge_slave_0: entered promiscuous mode
[   45.530832][ T5814] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.533209][ T5814] bridge0: port 2(bridge_slave_1) entered disabled state
[   45.535707][ T5814] bridge_slave_1: entered allmulticast mode
[   45.539869][ T5814] bridge_slave_1: entered promiscuous mode
[   45.559127][ T5817] team0: Port device team_slave_0 added
[   45.561468][ T5821] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.563915][ T5821] bridge0: port 2(bridge_slave_1) entered disabled state
[   45.566331][ T5821] bridge_slave_1: entered allmulticast mode
[   45.569246][ T5821] bridge_slave_1: entered promiscuous mode
[   45.581122][ T5814] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   45.585632][ T5814] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   45.589819][ T5817] team0: Port device team_slave_1 added
[   45.627659][ T5821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   45.631221][ T5817] batman_adv: batadv0: Adding interface: batadv_slave_0
[   45.633567][ T5817] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   45.642349][ T5817] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   45.654275][ T5814] team0: Port device team_slave_0 added
[   45.658271][ T5821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   45.661640][ T5817] batman_adv: batadv0: Adding interface: batadv_slave_1
[   45.663977][ T5817] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   45.672581][ T5817] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   45.677684][ T5814] team0: Port device team_slave_1 added
[   45.711535][ T5821] team0: Port device team_slave_0 added
[   45.714830][ T5821] team0: Port device team_slave_1 added
[   45.717687][ T5814] batman_adv: batadv0: Adding interface: batadv_slave_0
[   45.720006][ T5814] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   45.729637][ T5814] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   45.740787][ T5814] batman_adv: batadv0: Adding interface: batadv_slave_1
[   45.743129][ T5814] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   45.751843][ T5814] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   45.770435][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_0
[   45.772768][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   45.781572][ T5821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   45.799954][ T5817] hsr_slave_0: entered promiscuous mode
[   45.802389][ T5817] hsr_slave_1: entered promiscuous mode
[   45.805005][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_1
[   45.807749][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   45.816134][ T5821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   45.865965][ T5814] hsr_slave_0: entered promiscuous mode
[   45.868645][ T5814] hsr_slave_1: entered promiscuous mode
[   45.870819][ T5814] debugfs: 'hsr0' already exists in 'hsr'
[   45.872771][ T5814] Cannot create hsr debugfs directory
[   45.902446][ T5821] hsr_slave_0: entered promiscuous mode
[   45.904778][ T5821] hsr_slave_1: entered promiscuous mode
[   45.907102][ T5821] debugfs: 'hsr0' already exists in 'hsr'
[   45.909017][ T5821] Cannot create hsr debugfs directory
[   46.073268][ T5817] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   46.089091][ T5817] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   46.093939][ T5817] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   46.103533][ T5817] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   46.134419][ T5817] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.136954][ T5817] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.139729][ T5817] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.142114][ T5817] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.147705][ T5814] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   46.152026][ T5814] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   46.163074][ T5814] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   46.179323][ T5814] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   46.191528][   T36] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.194552][   T36] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.219178][ T5821] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   46.227932][ T5821] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   46.232162][ T5821] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   46.237757][ T5821] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   46.294752][ T5817] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.315022][ T5817] 8021q: adding VLAN 0 to HW filter on device team0
[   46.324801][   T29] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.327385][   T29] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.337151][   T29] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.339622][   T29] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.344273][ T5814] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.361208][ T5821] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.378964][ T5817] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   46.390792][ T5814] 8021q: adding VLAN 0 to HW filter on device team0
[   46.399538][ T5821] 8021q: adding VLAN 0 to HW filter on device team0
[   46.404845][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.407301][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.425264][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.427784][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.432130][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.434555][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.438744][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.441134][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.483550][ T5814] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   46.489093][ T5814] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   46.524623][ T5817] 8021q: adding VLAN 0 to HW filter on device batadv0
[   46.570483][ T5817] veth0_vlan: entered promiscuous mode
[   46.585208][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0
[   46.590633][ T5817] veth1_vlan: entered promiscuous mode
[   46.628009][ T5817] veth0_macvtap: entered promiscuous mode
[   46.641668][ T5814] 8021q: adding VLAN 0 to HW filter on device batadv0
[   46.644175][ T5821] veth0_vlan: entered promiscuous mode
[   46.648832][ T5817] veth1_macvtap: entered promiscuous mode
[   46.659583][ T5821] veth1_vlan: entered promiscuous mode
[   46.664648][ T5817] batman_adv: batadv0: Interface activated: batadv_slave_0
[   46.670199][ T5817] batman_adv: batadv0: Interface activated: batadv_slave_1
[   46.686995][ T5852] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   46.693022][ T5852] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   46.695950][ T5852] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   46.703386][ T5852] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   46.725857][ T5821] veth0_macvtap: entered promiscuous mode
[   46.731898][ T5821] veth1_macvtap: entered promiscuous mode
[   46.735512][ T5814] veth0_vlan: entered promiscuous mode
[   46.745423][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0
[   46.760409][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1
[   46.765915][ T5814] veth1_vlan: entered promiscuous mode
[   46.780779][ T5833] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   46.785496][ T5833] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   46.790228][ T5833] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   46.793120][ T5833] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   46.822701][ T1096] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   46.825423][ T1096] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   46.843857][ T5814] veth0_macvtap: entered promiscuous mode
[   46.853253][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   46.855873][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   46.868620][ T5814] veth1_macvtap: entered promiscuous mode
[   46.882677][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   46.885312][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   46.902273][ T5814] batman_adv: batadv0: Interface activated: batadv_slave_0
[   46.909134][ T5814] batman_adv: batadv0: Interface activated: batadv_slave_1
[   46.914129][   T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   46.919486][ T5852] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   46.922807][ T5852] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   46.926085][ T5852] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   46.931392][   T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   46.932116][ T5852] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   46.947113][ T5817] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   47.017980][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.021742][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.052478][   T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.055086][   T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.067564][ T5210] Bluetooth: hci0: command tx timeout
[   47.070021][ T5818] Bluetooth: hci2: command tx timeout
[   47.077657][ T5818] Bluetooth: hci1: command tx timeout
[   47.182966][ T5910] Zero length message leads to an empty skb
[   47.185966][ T5910] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3'.
[   47.222400][ T5910] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3'.
[   47.440997][ T5926] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9'.
[   47.445318][ T5926] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9'.
[   47.498833][ T5928] ipvlan2: entered promiscuous mode
[   47.500738][ T5928] ipvlan2: entered allmulticast mode
[   47.502593][ T5928] bond0: entered allmulticast mode
[   47.504276][ T5928] bond_slave_0: entered allmulticast mode
[   47.506137][ T5928] bond_slave_1: entered allmulticast mode
[   47.512195][ T5928] 8021q: adding VLAN 0 to HW filter on device ipvlan2
[   47.515568][ T5928] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond.
[   47.573333][ T5935] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   47.625233][ T5935] 8021q: adding VLAN 0 to HW filter on device bond1
[   47.632336][ T5935] bond0: (slave bond1): Enslaving as an active interface with an up link
[   47.824826][ T5953] BUG: unable to handle page fault for address: ffffffffffffffdb
[   47.827412][ T5953] #PF: supervisor write access in kernel mode
[   47.830283][ T5953] #PF: error_code(0x0002) - not-present page
[   47.832315][ T5953] PGD df3d067 P4D df3d067 PUD df3f067 PMD 0 
[   47.834377][ T5953] Oops: Oops: 0002 [#1] SMP KASAN PTI
[   47.836141][ T5953] CPU: 0 UID: 0 PID: 5953 Comm: syz.2.17 Not tainted 6.16.0-syzkaller-06588-g759dfc7d04ba-dirty #0 PREEMPT(full) 
[   47.840032][ T5953] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   47.843419][ T5953] RIP: 0010:rcuref_put+0x172/0x210
[   47.845098][ T5953] Code: c7 c7 80 c0 91 8c be 68 00 00 00 48 c7 c2 c0 c0 91 8c e8 f1 85 40 f8 48 89 df be 04 00 00 00 e8 04 c1 c5 f8 41 be ff ff ff ff <f0> 44 0f c1 33 41 8d 76 ff bf ff ff ff ff e8 9b 9f 62 f8 41 ff ce
[   47.851458][ T5953] RSP: 0018:ffffc9000459f460 EFLAGS: 00010256
[   47.853492][ T5953] RAX: ffffffff895d1401 RBX: ffffffffffffffdb RCX: ffffffff895d153c
[   47.856050][ T5953] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffffffffffdb
[   47.858761][ T5953] RBP: ffffc9000459f4f8 R08: ffffffffffffffde R09: 1ffffffffffffffb
[   47.861428][ T5953] R10: dffffc0000000000 R11: fffffbfffffffffc R12: dffffc0000000000
[   47.864086][ T5953] R13: dffffc0000000000 R14: 00000000ffffffff R15: 1ffff920008b3e8c
[   47.866784][ T5953] FS:  00007f1141f1b6c0(0000) GS:ffff8880b8680000(0000) knlGS:0000000000000000
[   47.869766][ T5953] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   47.871938][ T5953] CR2: ffffffffffffffdb CR3: 0000000107a7c000 CR4: 00000000000006f0
[   47.874514][ T5953] Call Trace:
[   47.875626][ T5953]  <TASK>
[   47.876707][ T5953]  ? __pfx_rcuref_put+0x10/0x10
[   47.878388][ T5953]  dst_release+0x24/0x1b0
[   47.879873][ T5953]  pptp_xmit+0x14b/0x1a90
[   47.881345][ T5953]  ? __lock_acquire+0xab9/0xd20
[   47.883021][ T5953]  ? __pfx_pptp_xmit+0x10/0x10
[   47.884650][ T5953]  ? do_raw_spin_lock+0x121/0x290
[   47.886302][ T5953]  ? skb_scrub_packet+0x262/0x3d0
[   47.887980][ T5953]  ppp_input+0x27c/0x9f0
[   47.889448][ T5953]  ? ppp_input+0x55/0x9f0
[   47.890957][ T5953]  pppoe_rcv_core+0xc4/0x2b0
[   47.892544][ T5953]  ? __pfx_pppoe_rcv_core+0x10/0x10
[   47.894247][ T5953]  __release_sock+0x24c/0x350
[   47.895841][ T5953]  release_sock+0x5f/0x1f0
[   47.897384][ T5953]  pppoe_sendmsg+0x137/0x790
[   47.898961][ T5953]  ? __pfx_pppoe_sendmsg+0x10/0x10
[   47.900630][ T5953]  ? aa_sock_msg_perm+0x94/0x160
[   47.902231][ T5953]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   47.903939][ T5953]  ? __pfx_pppoe_sendmsg+0x10/0x10
[   47.905607][ T5953]  __sock_sendmsg+0x21c/0x270
[   47.907160][ T5953]  ____sys_sendmsg+0x52d/0x830
[   47.908743][ T5953]  ? __pfx_____sys_sendmsg+0x10/0x10
[   47.910470][ T5953]  ? import_iovec+0x74/0xa0
[   47.911949][ T5953]  ___sys_sendmsg+0x21f/0x2a0
[   47.913529][ T5953]  ? __pfx____sys_sendmsg+0x10/0x10
[   47.915241][ T5953]  ? __fget_files+0x2a/0x420
[   47.916816][ T5953]  ? __fget_files+0x3a0/0x420
[   47.918383][ T5953]  __sys_sendmmsg+0x227/0x430
[   47.919950][ T5953]  ? __pfx___sys_sendmmsg+0x10/0x10
[   47.921652][ T5953]  ? do_futex+0x395/0x420
[   47.923083][ T5953]  ? ppp_ioctl+0x145a/0x19a0
[   47.924660][ T5953]  ? __fget_files+0x2a/0x420
[   47.926215][ T5953]  ? rcu_is_watching+0x15/0xb0
[   47.927868][ T5953]  __x64_sys_sendmmsg+0xa0/0xc0
[   47.929519][ T5953]  do_syscall_64+0xfa/0x3b0
[   47.931061][ T5953]  ? lockdep_hardirqs_on+0x9c/0x150
[   47.932831][ T5953]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.934889][ T5953]  ? exc_page_fault+0x9f/0xf0
[   47.936497][ T5953]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   47.938498][ T5953] RIP: 0033:0x7f114118eb69
[   47.940016][ T5953] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   47.946461][ T5953] RSP: 002b:00007f1141f1b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[   47.949243][ T5953] RAX: ffffffffffffffda RBX: 00007f11413b5fa0 RCX: 00007f114118eb69
[   47.951941][ T5953] RDX: 0000000000000001 RSI: 00002000000008c0 RDI: 0000000000000009
[   47.954548][ T5953] RBP: 00007f1141211df1 R08: 0000000000000000 R09: 0000000000000000
[   47.957126][ T5953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   47.959796][ T5953] R13: 0000000000000000 R14: 00007f11413b5fa0 R15: 00007ffe5eac8a68
[   47.962459][ T5953]  </TASK>
[   47.963520][ T5953] Modules linked in:
[   47.964860][ T5953] CR2: ffffffffffffffdb
[   47.966284][ T5953] ---[ end trace 0000000000000000 ]---
[   47.968136][ T5953] RIP: 0010:rcuref_put+0x172/0x210
[   47.969886][ T5953] Code: c7 c7 80 c0 91 8c be 68 00 00 00 48 c7 c2 c0 c0 91 8c e8 f1 85 40 f8 48 89 df be 04 00 00 00 e8 04 c1 c5 f8 41 be ff ff ff ff <f0> 44 0f c1 33 41 8d 76 ff bf ff ff ff ff e8 9b 9f 62 f8 41 ff ce
[   47.976143][ T5953] RSP: 0018:ffffc9000459f460 EFLAGS: 00010256
[   47.978164][ T5953] RAX: ffffffff895d1401 RBX: ffffffffffffffdb RCX: ffffffff895d153c
[   47.980825][ T5953] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffffffffffdb
[   47.983504][ T5953] RBP: ffffc9000459f4f8 R08: ffffffffffffffde R09: 1ffffffffffffffb
[   47.986150][ T5953] R10: dffffc0000000000 R11: fffffbfffffffffc R12: dffffc0000000000
[   47.988835][ T5953] R13: dffffc0000000000 R14: 00000000ffffffff R15: 1ffff920008b3e8c
[   47.991503][ T5953] FS:  00007f1141f1b6c0(0000) GS:ffff8880b8680000(0000) knlGS:0000000000000000
[   47.994479][ T5953] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   47.996689][ T5953] CR2: ffffffffffffffdb CR3: 0000000107a7c000 CR4: 00000000000006f0
[   47.999378][ T5953] Kernel panic - not syncing: Fatal exception in interrupt
[   48.002408][ T5953] Kernel Offset: disabled
[   48.003831][ T5953] Rebooting in 86400 seconds..

VM DIAGNOSIS:
19:40:21  Registers:
info registers vcpu 0

CPU#0
RAX=000000000000006b RBX=000000000000006b RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000943 RDI=0000000000000944 RBP=00000000000003f8 RSP=ffffc9000459eab0
R8 =ffff888107b20237 R9 =1ffff11020f64046 R10=dffffc0000000000 R11=ffffffff854c1d90
R12=dffffc0000000000 R13=ffffffff99a95918 R14=ffffffff99d9a4e0 R15=0000000000000000
RIP=ffffffff854c1e0c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f1141f1b6c0 ffffffff 00c00000
GS =0000 ffff8880b8680000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=ffffffffffffffdb CR3=0000000107a7c000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f1141387498 00007f1141387470 XMM03=00007f11413874a8 00007f11413874a0
XMM04=00007f1141eed100 00007f1141387460 XMM05=00007f1141387478 00007f11413874c0
XMM06=00007f11413874b8 00007f11413874b0 XMM07=00007f11413874a8 00007f11413874a0
XMM08=0000000000000000 00007f1141212eab XMM09=0000000000000000 00007f1141212f89
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff81b4451b RBX=1ffff11009608385 RCX=ffff888021471cc0 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc90002b6f700 RSP=ffffc90002b6f580
R8 =ffffffff8fa07af7 R9 =1ffffffff1f40f5e R10=dffffc0000000000 R11=fffffbfff1f40f5f
R12=ffff88804b041c28 R13=dffffc0000000000 R14=ffff88813663b180 R15=0000000000000000
RIP=ffffffff81b44503 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c80000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fa8656e7d60 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00007fa864b876c3 00007fa864b876c3 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 00ff000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=00005555945bf76e 00005555945bf5e0
XMM06=0000000000000000 0000000000000000 XMM07=03c00302100003b0 0303b01000019003
XMM08=0100110000001422 0000004002000812 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
