last executing test programs:

1m26.706712914s ago: executing program 2 (id=285):
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x28, 0x13, 0x100, 0xffffffff, 0x0, {0x1}, [@typed={0x4, 0x11f}, @nested={0xc, 0x401, 0x0, 0x1, [@typed={0x8, 0x22, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}]}, @typed={0x4, 0x7}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0x3}, {0x6}, {0x4, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x20040080}, 0x40004)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}}, 0x84)

1m26.642070114s ago: executing program 2 (id=287):
socket$kcm(0x2, 0x3, 0x2)
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x12002, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x4, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000580))
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x4, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x80, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = socket$kcm(0x2c, 0x3, 0x0)
r3 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r3, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r1, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
write$cgroup_freezer_state(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
recvmsg(r2, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x40000062)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={0xffffffffffffffff, 0x0, 0x0}, 0x20)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r4, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, <r5=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_DELETE(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380000000201050000000000000000000a000005180002801400018008003bb2ac72ac75b4210200e00000020c0019"], 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x4000800)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
r7 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000069114a00000000008510000002000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', r5, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000ec0)={r7, 0xe0, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000bc0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x9, 0x6, &(0x7f0000000c00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000c80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xcd, &(0x7f0000000cc0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x0, 0x0, &(0x7f0000000d40), 0x8, 0xc, 0x8, 0x8, &(0x7f0000000d80)}}, 0x10)
sendmsg$IPCTNL_MSG_CT_GET_DYING(r7, &(0x7f0000000fc0)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x480}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x14, 0x6, 0x1, 0x401, 0x0, 0x0, {0x5, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x4008011)

1m26.343671141s ago: executing program 2 (id=290):
r0 = socket$kcm(0x2, 0x5, 0x84)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
close(r2)
recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r3=>0xffffffffffffffff]}}], 0x18}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a000000040000000000000001"], 0x50)
setsockopt$sock_attach_bpf(r0, 0x84, 0x22, &(0x7f0000000000)=r3, 0x10)

1m26.270231831s ago: executing program 2 (id=292):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01080000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d657461000000001400028008000140000000120800024000000021"], 0xd8}}, 0x8090)

1m24.499266533s ago: executing program 2 (id=295):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newtaction={0x44, 0x30, 0x1, 0x0, 0x0, {}, [{0x30, 0x1, [@m_ife={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x44}}, 0x0)

1m24.266523146s ago: executing program 2 (id=300):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000009112c9000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94)

1m24.115825824s ago: executing program 32 (id=300):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000009112c9000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94)

1.077982727s ago: executing program 0 (id=1519):
r0 = socket$kcm(0x15, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000001b00)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @private2, 0x1000000}, 0x80, 0x0}, 0x0)

1.00909583s ago: executing program 0 (id=1520):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_CHAIN_COUNTERS={0x10, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x2bf4}]}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x6}}, @NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0xa}, @NFT_OBJECT_QUOTA=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_DELFLOWTABLE={0x34, 0x18, 0xa, 0xd02, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xb8}, 0x1, 0x0, 0x0, 0xc000}, 0x20008000)
r0 = socket$kcm(0x10, 0x2, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="364000001a00910006000000000000000a"], 0xfe33)

1.008797009s ago: executing program 0 (id=1521):
perf_event_open$cgroup(&(0x7f00000003c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xb)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x248, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000, 0x10001}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair(0x1, 0x1, 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, 0x0)
r0 = socket$kcm(0x2, 0x922000000001, 0x106)
setsockopt$sock_attach_bpf(r0, 0x29, 0x42, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
socket$kcm(0x2, 0x3, 0x84)
syz_clone(0xa49a4080, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc)

597.32863ms ago: executing program 1 (id=1531):
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x5, 0x4, &(0x7f0000000d00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000004, 0x0, 0x0, 0x0, 0x24}, [@call={0x85, 0x0, 0x0, 0x1b}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

590.825171ms ago: executing program 0 (id=1532):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_USERDATA={0x7, 0x7, 0x1, 0x0, "628755"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xe}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x20048090)

512.916929ms ago: executing program 1 (id=1534):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580), &(0x7f00000004c0), 0x1000, r0}, 0x38)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10)

450.761177ms ago: executing program 1 (id=1535):
socket$kcm(0x10, 0x3, 0x10)
r0 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x7, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x4, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x8)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=@newtaction={0xf0, 0x30, 0x1, 0xe501, 0x0, {}, [{0xdc, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x81000000, 0x800, 0x0, 0x0, {0x0, 0x1}, {}, 0x8001}}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x6c, 0x2, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x0, 0x0, 0x0, 0x400000, {0x0, 0x0, 0x0, 0x0, 0xffff}, {0x4, 0x2}}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0xf0}}, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x100000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0)
socketpair(0x2c, 0x2, 0x80004, &(0x7f00000013c0))
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={@map, 0xffffffffffffffff, 0x6}, 0x14)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x2d}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90)
socket$kcm(0x2, 0x200000000000001, 0x106)
sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x3406c012)

450.396321ms ago: executing program 0 (id=1536):
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1d, 0xc, &(0x7f0000000fc0)=ANY=[@ANYBLOB="1800000000000000000000000000100085000000bb000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000003100000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x64, '\x00', 0x0, @lsm=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa2af}, 0x94)

341.532693ms ago: executing program 0 (id=1538):
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socket$kcm(0xa, 0x5, 0x0)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x20, 0x12504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x4, 0x0, @perf_bp={0x0, 0x8}, 0x7602, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = socket$kcm(0xa, 0x5, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@bloom_filter={0x1e, 0x0, 0x400007, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x50)
ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890b, &(0x7f0000000000))
r1 = socket$kcm(0xa, 0x2, 0x0)
sendmsg$inet(r1, &(0x7f0000000380)={&(0x7f0000000040)={0xa, 0xa, @local}, 0x1b, &(0x7f0000000180)=[{&(0x7f0000000080)="a2", 0xff0e}], 0x4, 0x0, 0x0, 0xa6820000}, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x1}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000240)='ns/user\x00')
socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000140))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
sendmsg$inet(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x0)
recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x122)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280))
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x90)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'dummy0\x00'})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000080))
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="81108d00000000"], &(0x7f00000000c0)='GPL\x00', 0x2}, 0x94)

341.181262ms ago: executing program 3 (id=1539):
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002ec0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e01f3440cee51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cad32b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337602d3e5a815232f5e16c1b30c3a6abc85018e5ff2c91018afc9ffc2cc788bee1b47683db012469398685211dfbbae3e2ed0a50e7393bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d300006aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7af22e30d46a9d26d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977fb536a9caab37d9ac4cfc1c7b400000000000007ffc826b956ba859ac8e3c177b91bd7d5e41ff83ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d000069a16203a967c1bbe09315c29877a308bcc87dc3addb08142bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8240000e3428d2129369ee1b85af9ffffff0d0df414b315f651c8412392191fa83ee830548f11be359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92000000000f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb74d4ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905de328c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a978ee56c83a3466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342e0eaf6f330e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea95ec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf81700cd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be3827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f969369de47422604e2fc5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293b6c833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b612272d40f522d8c98c879aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbe71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd46dbd61627a2e0a74b5e6aefb7eee403502734137ff47a57f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a125e3af1130d66a7b66837ae7e7123dde7404a067ad0a6a2d6bec9411b61cad4121be3c72ff3a04713042253d438e7becf8120de3895b8ce974958bde39cb8da3427a2e9e2de936431e67fed5ab5684db07de39083d8948cc4c8a2608100000000000000000000aecb8b0b7941088f971ce17427eec32a012295cc0cdd32955176b6ad5a4bb953e58ccfa9428f452cfb5a48a9fda26db3985c8be3c2f99827da074825b01c4a3a71fb59d5798100000000000000c76b05a45d2dd8c20d971e2f3e4369168f5cb83d6ff3a18733fec726034fbfa95624135bee374414b2c8c61f52357a520efd6a10aff244bc8a62ed367981fb4d5d77f7bc093958ff46527499957da4934cd4b370cf76f72dd05fa80cdfb68c836fd81be7a58532e041a87f9222f157610a4bcdc05b2a55308c8e7568b90f7a338557e816a16972aea79dff5becefa6f9c5ce6c58fb38da9e7532dc53cfdc2e789b76f7d32aca1bfea2aa62621b78dded30fc07171866bf3d552900000000a32dda61eeda1750e157c2d569b9d08f583c0ee28daec2e8bb85f3c8e91c4448096ee953def18dc73e55cb30f9cd069d8780b00eaba382f0c3ae391c30a5f1b0f36dd0c2193b791995d2890327a10d7abac76d1202f72e97f0105184d7aaaab8d3e29c9a8d263f076b55cf53c5bb9c0662a3d19a6722d7f83ae4331d3256f90af0857788b380ccc3b266c418e66d1d756d5df6423dd0cea67bc235d3776d22270fc19301ead09f156893e9"], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001300)={&(0x7f0000000c00)='net_dev_start_xmit\x00', r1}, 0x10)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe2c, 0x60000000, &(0x7f0000000100)="b9ff03316844268cb89e14f0080047e0ffff00124000632f77fbac14fe16e000030a07080403fe80000020006558845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0x24, 0x60000000}, 0x2c)

268.788961ms ago: executing program 3 (id=1540):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002580)={&(0x7f0000002400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0xb, [@var={0x8, 0x0, 0x0, 0xe, 0x4}]}, {0x0, [0x61, 0x60, 0x61, 0x0, 0x5f, 0x0, 0x5f, 0x5f, 0x10]}}, 0x0, 0x33, 0x0, 0x1, 0xfffffffe}, 0x28)

267.272357ms ago: executing program 1 (id=1541):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
mkdir(0x0, 0x18b)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x3b, &(0x7f0000000000)='/proc/sys/net/ipv4\x00\x00s/sync_\x00le\xf44.\xab%\xf8\xff\xff\xff\xff\xff\xff\xff=\x11\xc8\xdd\x15\xcc\xd2\xf1d\'%\x11c\x91l,'}, 0x30)
mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x989046, 0x0)
mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x11, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000300)='syzkaller\x00'}, 0x90)
r1 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000380)="1400000036000b63d25a80648c2594f90b24fc60", 0x14}], 0x1}, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30)
mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xfffffff7, 0x0, 0x1}, 0x48)
sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="18000000150081054e81f782db44b9040a1d3b020a000000", 0x18}], 0x1, 0x0, 0x0, 0x7400}, 0x4000)
mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b)
mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x989046, 0x0)
mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000000), 0x4)
sendmsg$kcm(r2, &(0x7f0000000040)={&(0x7f0000000280)=@caif=@dgm={0x25, 0x9, 0x9}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000500)="62042700ffff00000000002f1eafbcf706e12b30087f5c582d26116642c47a5f8786ee601e65ab3c06d4b8bf4a81cb3e247345af215542f41ddf82f618438a34f90186cee844", 0x46}], 0x1}, 0x4008000)
mount$bpf(0x0, &(0x7f0000000ac0)='./file0/../file0\x00', 0x0, 0x44000, 0x0)

261.59579ms ago: executing program 3 (id=1542):
r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r0, r1, 0x26, 0x0, @void}, 0x10)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000440)={r0, r1, 0x5, 0x0, @val=@tracing={0x0, 0xfff}}, 0x20)

181.683912ms ago: executing program 3 (id=1543):
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000120000002400000008000000850000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000005c0)='sched_switch\x00', r0}, 0x18)
r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r1}, 0x8)
write$cgroup_int(r2, &(0x7f00000001c0)=0x8200000000000000, 0xfffffdef)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000e00)={&(0x7f0000000980)='sys_exit\x00', r3}, 0x10)
r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r4}, 0x8)
write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef)
bpf$PROG_LOAD(0x5, 0x0, 0x0)

79.955226ms ago: executing program 1 (id=1544):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x64, 0x30, 0x1, 0x0, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x5}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x10)

423.868µs ago: executing program 3 (id=1545):
ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff)
socket$nl_xfrm(0x10, 0x3, 0x6)
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff)
r0 = socket$kcm(0x2, 0x5, 0x84)
sendmsg$inet(r0, &(0x7f0000000680)={&(0x7f0000000140)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0)
r1 = socket$kcm(0xa, 0x5, 0x0)
setsockopt$sock_attach_bpf(r1, 0x0, 0x11, 0x0, 0x0)

159.395µs ago: executing program 1 (id=1546):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000400)={0x1c, 0x1, 0x4, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x21000}, 0x800)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000001280)={&(0x7f0000000580)=ANY=[@ANYBLOB="20000000010401010000000000000000050000010a000200"], 0x20}, 0x1, 0x0, 0x0, 0x4000001}, 0x4008054)

0s ago: executing program 3 (id=1547):
bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4)
sendmsg$inet(r2, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x4000014)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:30977' (ED25519) to the list of known hosts.
syzkaller login: [   58.615817][ T5833] cgroup: Unknown subsys name 'net'
[   58.726807][ T5833] cgroup: Unknown subsys name 'cpuset'
[   58.733261][ T5833] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   60.814155][ T5833] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   66.863538][ T5853] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   66.868992][ T5853] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   66.874257][ T5853] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   66.877307][ T5853] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   66.892842][ T5853] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   66.906693][ T5858] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   66.910584][ T5858] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   66.914255][ T5853] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   66.914712][ T5858] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   66.920680][ T5858] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   66.925161][ T5858] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   66.929263][ T5854] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   66.937321][ T5861] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   66.952789][ T5861] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   66.955795][ T5861] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   67.317449][ T5849] chnl_net:caif_netlink_parms(): no params data found
[   67.368512][ T5848] chnl_net:caif_netlink_parms(): no params data found
[   67.428803][ T5855] chnl_net:caif_netlink_parms(): no params data found
[   67.513334][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state
[   67.517008][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state
[   67.520283][ T5849] bridge_slave_0: entered allmulticast mode
[   67.526157][ T5849] bridge_slave_0: entered promiscuous mode
[   67.565315][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.568278][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state
[   67.571254][ T5849] bridge_slave_1: entered allmulticast mode
[   67.576168][ T5849] bridge_slave_1: entered promiscuous mode
[   67.603702][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[   67.606554][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[   67.609505][ T5848] bridge_slave_0: entered allmulticast mode
[   67.613551][ T5848] bridge_slave_0: entered promiscuous mode
[   67.662129][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.665099][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[   67.668004][ T5848] bridge_slave_1: entered allmulticast mode
[   67.672033][ T5848] bridge_slave_1: entered promiscuous mode
[   67.678949][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   67.687661][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   67.708217][ T5855] bridge0: port 1(bridge_slave_0) entered blocking state
[   67.711171][ T5855] bridge0: port 1(bridge_slave_0) entered disabled state
[   67.714788][ T5855] bridge_slave_0: entered allmulticast mode
[   67.718735][ T5855] bridge_slave_0: entered promiscuous mode
[   67.748636][ T5855] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.751892][ T5855] bridge0: port 2(bridge_slave_1) entered disabled state
[   67.754915][ T5855] bridge_slave_1: entered allmulticast mode
[   67.758881][ T5855] bridge_slave_1: entered promiscuous mode
[   67.791014][ T5849] team0: Port device team_slave_0 added
[   67.814553][ T5855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   67.820422][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   67.826480][ T5849] team0: Port device team_slave_1 added
[   67.831330][ T5855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   67.838219][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   67.908919][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0
[   67.913005][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   67.923567][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   67.945997][ T5848] team0: Port device team_slave_0 added
[   67.950047][ T5855] team0: Port device team_slave_0 added
[   67.954927][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1
[   67.957703][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   67.968774][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   67.975812][ T5848] team0: Port device team_slave_1 added
[   67.986545][ T5855] team0: Port device team_slave_1 added
[   68.019781][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[   68.023036][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   68.034617][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   68.068316][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[   68.071212][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   68.084057][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   68.115470][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_0
[   68.118410][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   68.129137][ T5855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   68.146086][ T5849] hsr_slave_0: entered promiscuous mode
[   68.149459][ T5849] hsr_slave_1: entered promiscuous mode
[   68.155313][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_1
[   68.158189][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   68.168853][ T5855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   68.279483][ T5855] hsr_slave_0: entered promiscuous mode
[   68.284711][ T5855] hsr_slave_1: entered promiscuous mode
[   68.287561][ T5855] debugfs: 'hsr0' already exists in 'hsr'
[   68.289802][ T5855] Cannot create hsr debugfs directory
[   68.297454][ T5848] hsr_slave_0: entered promiscuous mode
[   68.300569][ T5848] hsr_slave_1: entered promiscuous mode
[   68.306155][ T5848] debugfs: 'hsr0' already exists in 'hsr'
[   68.308363][ T5848] Cannot create hsr debugfs directory
[   68.661069][ T5849] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   68.670710][ T5849] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   68.678147][ T5849] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   68.700005][ T5849] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   68.755485][ T5855] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   68.762891][ T5855] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   68.783666][ T5855] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   68.790080][ T5855] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   68.847858][ T5848] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   68.868477][ T5848] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   68.889278][ T5848] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   68.899464][ T5848] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   68.985034][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0
[   69.002646][   T55] Bluetooth: hci1: command tx timeout
[   69.002664][ T5861] Bluetooth: hci0: command tx timeout
[   69.002893][ T5861] Bluetooth: hci2: command tx timeout
[   69.029535][ T5849] 8021q: adding VLAN 0 to HW filter on device team0
[   69.051179][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   69.054076][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   69.060392][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   69.062660][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   69.090532][ T5855] 8021q: adding VLAN 0 to HW filter on device bond0
[   69.141243][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[   69.150260][ T5855] 8021q: adding VLAN 0 to HW filter on device team0
[   69.170243][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   69.173530][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   69.191303][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[   69.195303][ T4310] bridge0: port 2(bridge_slave_1) entered blocking state
[   69.197579][ T4310] bridge0: port 2(bridge_slave_1) entered forwarding state
[   69.207133][ T5849] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   69.225747][ T4310] bridge0: port 1(bridge_slave_0) entered blocking state
[   69.228033][ T4310] bridge0: port 1(bridge_slave_0) entered forwarding state
[   69.245440][ T4310] bridge0: port 2(bridge_slave_1) entered blocking state
[   69.248332][ T4310] bridge0: port 2(bridge_slave_1) entered forwarding state
[   69.431546][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0
[   69.487188][ T5855] 8021q: adding VLAN 0 to HW filter on device batadv0
[   69.510864][ T5849] veth0_vlan: entered promiscuous mode
[   69.527034][ T5849] veth1_vlan: entered promiscuous mode
[   69.589737][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[   69.597878][ T5849] veth0_macvtap: entered promiscuous mode
[   69.609836][ T5849] veth1_macvtap: entered promiscuous mode
[   69.615720][ T5855] veth0_vlan: entered promiscuous mode
[   69.637282][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0
[   69.644259][ T5855] veth1_vlan: entered promiscuous mode
[   69.657527][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1
[   69.673994][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   69.677124][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   69.689260][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   69.695360][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   69.772705][ T5848] veth0_vlan: entered promiscuous mode
[   69.779479][ T5855] veth0_macvtap: entered promiscuous mode
[   69.780137][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   69.788362][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   69.790813][ T5848] veth1_vlan: entered promiscuous mode
[   69.797564][ T5855] veth1_macvtap: entered promiscuous mode
[   69.843309][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   69.845354][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_0
[   69.846024][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   69.853665][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_1
[   69.875267][ T5740] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   69.882808][ T5740] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   69.892729][ T5740] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   69.896624][ T5740] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   69.930305][ T5848] veth0_macvtap: entered promiscuous mode
[   69.935880][ T5849] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   69.960304][ T5848] veth1_macvtap: entered promiscuous mode
[   70.046331][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[   70.049949][ T5918] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET)
[   70.063225][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   70.072537][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   70.076364][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[   70.099004][ T5740] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   70.116758][ T5740] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   70.139733][ T5740] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   70.155702][ T4310] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   70.165106][ T4310] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   70.171521][ T5740] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   70.340785][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   70.346266][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   70.416128][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   70.419811][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   70.730271][ T5942] netlink: 'syz.0.14': attribute type 3 has an invalid length.
[   70.806991][ T5861] Bluetooth: hci2: unexpected event 0x31 length: 82 > 6
[   71.082397][ T5861] Bluetooth: hci1: command tx timeout
[   71.088022][ T5853] Bluetooth: hci0: command tx timeout
[   71.088086][   T55] Bluetooth: hci2: command tx timeout
[   71.231043][ T5960] netlink: 132 bytes leftover after parsing attributes in process `syz.1.21'.
[   71.297709][ T5964] netlink: 12 bytes leftover after parsing attributes in process `syz.1.23'.
[   71.341577][ T5966] netlink: 'syz.2.24': attribute type 11 has an invalid length.
[   71.347474][ T5966] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.24'.
[   71.490228][ T5965] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   71.516741][ T5972] netlink: 16 bytes leftover after parsing attributes in process `syz.1.27'.
[   71.631624][    C0] hrtimer: interrupt took 43958 ns
[   71.994490][ T5992] netlink: 12 bytes leftover after parsing attributes in process `syz.1.34'.
[   72.228664][ T6000] netlink: 'syz.0.39': attribute type 1 has an invalid length.
[   72.233933][ T6000] netlink: 168864 bytes leftover after parsing attributes in process `syz.0.39'.
[   72.350063][ T6002] warning: `syz.2.40' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   72.435746][ T6013] netlink: 180 bytes leftover after parsing attributes in process `syz.0.45'.
[   72.970401][ T6037] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   73.038103][ T6035] syzkaller0: entered promiscuous mode
[   73.040576][ T6035] syzkaller0: entered allmulticast mode
[   73.048238][ T6039] netlink: 152 bytes leftover after parsing attributes in process `syz.2.56'.
[   73.053097][ T6039] netlink: 6 bytes leftover after parsing attributes in process `syz.2.56'.
[   73.162637][   T55] Bluetooth: hci2: command tx timeout
[   73.164501][   T55] Bluetooth: hci1: command tx timeout
[   73.166253][   T55] Bluetooth: hci0: command tx timeout
[   73.241162][ T6048] Zero length message leads to an empty skb
[   74.134532][ T6048] erspan0 speed is unknown, defaulting to 1000
[   74.140819][ T6048] erspan0 speed is unknown, defaulting to 1000
[   74.145477][ T6048] erspan0 speed is unknown, defaulting to 1000
[   74.310304][ T6061] netlink: 220 bytes leftover after parsing attributes in process `syz.0.67'.
[   74.359996][ T6048] infiniband syz0: set active
[   74.364877][ T5850] erspan0 speed is unknown, defaulting to 1000
[   74.369718][ T6048] infiniband syz0: added erspan0
[   74.381570][ T6048] syz0: rxe_create_cq: returned err = -12
[   74.385033][ T6048] infiniband syz0: Couldn't create ib_mad CQ
[   74.387575][ T6048] infiniband syz0: Couldn't open port 1
[   74.422499][ T6048] RDS/IB: syz0: added
[   74.427758][ T6048] smc: adding ib device syz0 with port count 1
[   74.430353][ T6048] smc:    ib device syz0 port 1 has pnetid 
[   74.435391][   T47] erspan0 speed is unknown, defaulting to 1000
[   74.439778][ T6048] erspan0 speed is unknown, defaulting to 1000
[   74.691298][ T6048] erspan0 speed is unknown, defaulting to 1000
[   74.709775][ T6077] IPv6: NLM_F_REPLACE set, but no existing node found!
[   74.979382][ T6048] erspan0 speed is unknown, defaulting to 1000
[   75.192497][ T6092] netlink: 'syz.0.81': attribute type 4 has an invalid length.
[   75.253461][ T5861] Bluetooth: hci0: command tx timeout
[   75.255730][ T5861] Bluetooth: hci1: command tx timeout
[   75.257903][ T5861] Bluetooth: hci2: command tx timeout
[   75.537060][ T6092] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check.
[   75.692565][ T6092] syz.0.81 (6092) used greatest stack depth: 19536 bytes left
[   76.270134][ T6136] netdevsim netdevsim0: Firmware load for '/../file0' refused, path contains '..' component
[   76.449496][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[   76.452591][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[   77.386141][ T6171] bridge0: port 2(bridge_slave_1) entered disabled state
[   77.393171][ T6171] bridge0: port 1(bridge_slave_0) entered disabled state
[   77.460788][ T6171] bridge0: entered allmulticast mode
[   77.543328][ T6168] bridge0: port 2(bridge_slave_1) entered blocking state
[   77.545623][ T6168] bridge0: port 2(bridge_slave_1) entered forwarding state
[   77.549277][ T6168] bridge0: port 1(bridge_slave_0) entered blocking state
[   77.551995][ T6168] bridge0: port 1(bridge_slave_0) entered forwarding state
[   77.593358][ T6168] bridge0: entered promiscuous mode
[   77.599335][ T6172] netlink: 'syz.1.113': attribute type 39 has an invalid length.
[   78.436467][ T6204] __nla_validate_parse: 5 callbacks suppressed
[   78.436526][ T6204] netlink: 12 bytes leftover after parsing attributes in process `syz.0.129'.
[   78.765002][ T6212] netlink: 'syz.1.133': attribute type 25 has an invalid length.
[   79.525313][ T6259] netlink: 52 bytes leftover after parsing attributes in process `syz.1.153'.
[   81.127984][ T6293] netlink: 'syz.1.167': attribute type 27 has an invalid length.
[   81.136313][ T6293] netlink: 'syz.1.167': attribute type 3 has an invalid length.
[   81.143736][ T6293] netlink: 132 bytes leftover after parsing attributes in process `syz.1.167'.
[   81.448339][ T6297] syz.2.169 (6297) used greatest stack depth: 19264 bytes left
[   81.513762][ T6304] syzkaller0: create flow: hash 3636333662 index 1
[   81.584445][ T6301] syzkaller0: delete flow: hash 3636333662 index 1
[   81.833992][ T6312] netlink: 'syz.2.176': attribute type 21 has an invalid length.
[   81.837061][ T6312] netlink: 14565 bytes leftover after parsing attributes in process `syz.2.176'.
[   82.100923][ T6316] netlink: 'syz.0.178': attribute type 10 has an invalid length.
[   82.665811][ T6316] team0: Port device geneve1 added
[   82.749258][ T6316] syz.0.178 (6316) used greatest stack depth: 18560 bytes left
[   83.300490][ T6345] netlink: 104 bytes leftover after parsing attributes in process `syz.2.191'.
[   84.042545][ T6351] netlink: 16 bytes leftover after parsing attributes in process `syz.2.194'.
[   84.467149][ T6378] openvswitch: netlink: Multiple metadata blocks provided
[   84.477381][ T6375] netlink: 'syz.0.202': attribute type 1 has an invalid length.
[   84.673047][ T6386] netlink: 'syz.2.207': attribute type 3 has an invalid length.
[   84.675409][ T6386] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.207'.
[   84.820894][ T6397] netlink: 6 bytes leftover after parsing attributes in process `syz.1.212'.
[   84.901528][ T6399] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   84.992721][ T6405] netlink: 15999 bytes leftover after parsing attributes in process `syz.2.216'.
[   85.160839][ T6412] netlink: 'syz.0.217': attribute type 21 has an invalid length.
[   85.170072][ T6412] IPv6: NLM_F_CREATE should be specified when creating new route
[   85.376097][ T6423] netlink: 'syz.1.223': attribute type 3 has an invalid length.
[   85.387187][ T6423] netlink: 12 bytes leftover after parsing attributes in process `syz.1.223'.
[   85.406222][ T6423] netlink: 56 bytes leftover after parsing attributes in process `syz.1.223'.
[   86.098919][ T6446] netlink: 17 bytes leftover after parsing attributes in process `syz.0.234'.
[   86.429645][ T6450] C: renamed from team_slave_0 (while UP)
[   86.435424][ T6450] netlink: 'syz.0.235': attribute type 1 has an invalid length.
[   86.437899][ T6450] netlink: 152 bytes leftover after parsing attributes in process `syz.0.235'.
[   86.440715][ T6450] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[   86.685877][  T794] cfg80211: failed to load regulatory.db
[   86.833427][ T6473] netlink: 'syz.1.245': attribute type 25 has an invalid length.
[   86.969913][ T6477] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   87.298912][ T6472] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   87.325949][ T6475] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[   87.350278][ T6475] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[   87.421005][ T6487] netlink: 60 bytes leftover after parsing attributes in process `syz.2.251'.
[   87.426611][ T6487] netlink: 60 bytes leftover after parsing attributes in process `syz.2.251'.
[   88.596452][   T55] Bluetooth: hci0: unexpected event 0x03 length: 151 > 11
[   88.789565][ T6529] delete_channel: no stack
[   89.790937][ T6535] syz.0.274: vmalloc error: size 6291456, failed to allocated page array size 12288, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[   89.799703][ T6535] CPU: 0 UID: 0 PID: 6535 Comm: syz.0.274 Not tainted syzkaller #0 PREEMPT(full) 
[   89.799718][ T6535] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   89.799725][ T6535] Call Trace:
[   89.799731][ T6535]  <TASK>
[   89.799737][ T6535]  dump_stack_lvl+0x189/0x250
[   89.799769][ T6535]  ? __pfx_rcu_read_unlock_special+0x10/0x10
[   89.799789][ T6535]  ? __pfx_dump_stack_lvl+0x10/0x10
[   89.799803][ T6535]  ? __pfx__printk+0x10/0x10
[   89.799821][ T6535]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   89.799834][ T6535]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   89.799862][ T6535]  warn_alloc+0x214/0x310
[   89.799887][ T6535]  ? __pfx_warn_alloc+0x10/0x10
[   89.799918][ T6535]  ? __get_vm_area_node+0x28f/0x300
[   89.799936][ T6535]  ? hash_netport4_resize+0x235/0x1b60
[   89.799960][ T6535]  __vmalloc_node_range_noprof+0x67e/0x12f0
[   89.800038][ T6535]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[   89.800066][ T6535]  ? rcu_is_watching+0x15/0xb0
[   89.800080][ T6535]  ? hash_netport4_resize+0x235/0x1b60
[   89.800091][ T6535]  ? hash_netport4_resize+0x235/0x1b60
[   89.800100][ T6535]  __kvmalloc_node_noprof+0x3b8/0x5f0
[   89.800118][ T6535]  ? hash_netport4_resize+0x235/0x1b60
[   89.800147][ T6535]  hash_netport4_resize+0x235/0x1b60
[   89.800159][ T6535]  ? hash_netport4_uadt+0xc97/0xf30
[   89.800185][ T6535]  ? __pfx_hash_netport4_add+0x10/0x10
[   89.800199][ T6535]  ? __pfx_hash_netport4_uadt+0x10/0x10
[   89.800233][ T6535]  ? __pfx___local_bh_enable_ip+0x10/0x10
[   89.800267][ T6535]  call_ad+0x44e/0xb00
[   89.800297][ T6535]  ? __pfx_call_ad+0x10/0x10
[   89.800339][ T6535]  ? __nla_parse+0x40/0x60
[   89.800361][ T6535]  ip_set_ad+0x791/0x930
[   89.800393][ T6535]  ? __pfx_ip_set_ad+0x10/0x10
[   89.800483][ T6535]  nfnetlink_rcv_msg+0xb4d/0x1130
[   89.800503][ T6535]  ? nfnetlink_rcv_msg+0x20d/0x1130
[   89.800557][ T6535]  ? __pfx_nfnetlink_rcv_msg+0x10/0x10
[   89.800695][ T6535]  netlink_rcv_skb+0x208/0x470
[   89.800728][ T6535]  ? __pfx_nfnetlink_rcv_msg+0x10/0x10
[   89.800749][ T6535]  ? __pfx_netlink_rcv_skb+0x10/0x10
[   89.800789][ T6535]  ? bpf_lsm_capable+0x9/0x20
[   89.800801][ T6535]  ? security_capable+0x7e/0x2e0
[   89.800828][ T6535]  nfnetlink_rcv+0x26a/0x2520
[   89.800853][ T6535]  ? __dev_queue_xmit+0x1d79/0x3b50
[   89.800933][ T6535]  ? __pfx_nfnetlink_rcv+0x10/0x10
[   89.800956][ T6535]  ? __pfx___dev_queue_xmit+0x10/0x10
[   89.801028][ T6535]  ? perf_trace_run_bpf_submit+0xee/0x170
[   89.801057][ T6535]  ? perf_trace_lock+0x2f8/0x3b0
[   89.801070][ T6535]  ? __skb_clone+0x483/0x7a0
[   89.801094][ T6535]  ? __pfx_perf_trace_lock+0x10/0x10
[   89.801106][ T6535]  ? skb_clone+0x246/0x3a0
[   89.801127][ T6535]  ? __netlink_deliver_tap+0x807/0x850
[   89.801139][ T6535]  ? netlink_deliver_tap+0x2e/0x1b0
[   89.801165][ T6535]  ? netlink_deliver_tap+0x2e/0x1b0
[   89.801194][ T6535]  netlink_unicast+0x82f/0x9e0
[   89.801225][ T6535]  ? __pfx_netlink_unicast+0x10/0x10
[   89.801241][ T6535]  ? netlink_sendmsg+0x642/0xb30
[   89.801250][ T6535]  ? skb_put+0x11b/0x210
[   89.801272][ T6535]  netlink_sendmsg+0x805/0xb30
[   89.801304][ T6535]  ? __pfx_netlink_sendmsg+0x10/0x10
[   89.801323][ T6535]  ? aa_sock_msg_perm+0xf1/0x1d0
[   89.801341][ T6535]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   89.801352][ T6535]  ? __pfx_netlink_sendmsg+0x10/0x10
[   89.801367][ T6535]  __sock_sendmsg+0x21c/0x270
[   89.801392][ T6535]  ____sys_sendmsg+0x505/0x830
[   89.801418][ T6535]  ? __pfx_____sys_sendmsg+0x10/0x10
[   89.801452][ T6535]  ? import_iovec+0x74/0xa0
[   89.801476][ T6535]  ___sys_sendmsg+0x21f/0x2a0
[   89.801496][ T6535]  ? __pfx____sys_sendmsg+0x10/0x10
[   89.801554][ T6535]  ? __fget_files+0x2a/0x420
[   89.801613][ T6535]  ? __fget_files+0x2a/0x420
[   89.801623][ T6535]  ? __fget_files+0x3a0/0x420
[   89.801655][ T6535]  __x64_sys_sendmsg+0x19b/0x260
[   89.801676][ T6535]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   89.801712][ T6535]  ? rcu_is_watching+0x15/0xb0
[   89.801734][ T6535]  ? do_syscall_64+0xbe/0x3b0
[   89.801757][ T6535]  do_syscall_64+0xfa/0x3b0
[   89.801767][ T6535]  ? lockdep_hardirqs_on+0x9c/0x150
[   89.801780][ T6535]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   89.801789][ T6535]  ? exc_page_fault+0x9f/0xf0
[   89.801807][ T6535]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   89.801815][ T6535] RIP: 0033:0x7f1128b8eba9
[   89.801828][ T6535] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   89.801836][ T6535] RSP: 002b:00007f1129940038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   89.801846][ T6535] RAX: ffffffffffffffda RBX: 00007f1128dd5fa0 RCX: 00007f1128b8eba9
[   89.801852][ T6535] RDX: 0000000000000080 RSI: 00002000000002c0 RDI: 000000000000000b
[   89.801858][ T6535] RBP: 00007f1128c11e19 R08: 0000000000000000 R09: 0000000000000000
[   89.801863][ T6535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   89.801868][ T6535] R13: 00007f1128dd6038 R14: 00007f1128dd5fa0 R15: 00007ffd932f3968
[   89.801908][ T6535]  </TASK>
[   90.022178][ T6535] Mem-Info:
[   90.023294][ T6535] active_anon:5491 inactive_anon:0 isolated_anon:0
[   90.023294][ T6535]  active_file:13696 inactive_file:38245 isolated_file:0
[   90.023294][ T6535]  unevictable:1768 dirty:423 writeback:0
[   90.023294][ T6535]  slab_reclaimable:9762 slab_unreclaimable:53844
[   90.023294][ T6535]  mapped:18028 shmem:2432 pagetables:932
[   90.023294][ T6535]  sec_pagetables:0 bounce:0
[   90.023294][ T6535]  kernel_misc_reclaimable:0
[   90.023294][ T6535]  free:285327 free_pcp:17740 free_cma:0
[   90.037284][ T6535] Node 0 active_anon:14268kB inactive_anon:0kB active_file:28040kB inactive_file:8052kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:27064kB dirty:1404kB writeback:0kB shmem:5016kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5872kB pagetables:2044kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   90.047255][ T6535] Node 1 active_anon:7764kB inactive_anon:0kB active_file:26744kB inactive_file:144928kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:45048kB dirty:288kB writeback:0kB shmem:4712kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5552kB pagetables:1684kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   90.057251][ T6535] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[   90.067971][ T6535] lowmem_reserve[]: 0 811 811 811 811
[   90.070319][ T6535] Node 0 DMA32 free:412812kB boost:0kB min:33660kB low:42072kB high:50484kB reserved_highatomic:0KB free_highatomic:0KB active_anon:14268kB inactive_anon:0kB active_file:28040kB inactive_file:8052kB unevictable:3536kB writepending:1404kB present:1556484kB managed:830888kB mlocked:0kB bounce:0kB free_pcp:33096kB local_pcp:18508kB free_cma:0kB
[   90.081202][ T6535] lowmem_reserve[]: 0 0 0 0 0
[   90.082819][ T6535] Node 1 DMA32 free:458492kB boost:0kB min:19192kB low:23988kB high:28784kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:116kB local_pcp:0kB free_cma:0kB
[   90.092611][ T6535] lowmem_reserve[]: 0 0 854 854 854
[   90.094303][ T6535] Node 1 Normal free:254644kB boost:0kB min:36612kB low:45764kB high:54916kB reserved_highatomic:0KB free_highatomic:0KB active_anon:7764kB inactive_anon:0kB active_file:26744kB inactive_file:144928kB unevictable:3536kB writepending:288kB present:1048576kB managed:874952kB mlocked:0kB bounce:0kB free_pcp:37720kB local_pcp:15340kB free_cma:0kB
[   90.104404][ T6535] lowmem_reserve[]: 0 0 0 0 0
[   90.106342][ T6535] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[   90.112274][ T6535] Node 0 DMA32: 183*4kB (UM) 148*8kB (UM) 141*16kB (UME) 468*32kB (UME) 231*64kB (UME) 102*128kB (UM) 39*256kB (UM) 31*512kB (UM) 16*1024kB (UM) 8*2048kB (UM) 75*4096kB (UM) = 412812kB
[   90.119931][ T6535] Node 1 DMA32: 3*4kB (UM) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 3*2048kB (UM) 109*4096kB (M) = 458492kB
[   90.144092][ T6535] Node 1 Normal: 687*4kB (UM) 479*8kB (UME) 540*16kB (UME) 394*32kB (UME) 160*64kB (UM) 90*128kB (UME) 43*256kB (UME) 37*512kB (UM) 21*1024kB (UM) 7*2048kB (UME) 34*4096kB (UM) = 254644kB
[   90.150330][ T6535] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   90.153451][ T6535] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   90.156663][ T6535] 54373 total pagecache pages
[   90.159293][ T6535] 0 pages in swap cache
[   90.161084][ T6535] Free swap  = 124996kB
[   90.162943][ T6535] Total swap = 124996kB
[   90.164700][ T6535] 786301 pages RAM
[   90.166267][ T6535] 0 pages HighMem/MovableOnly
[   90.168299][ T6535] 241347 pages reserved
[   90.170007][ T6535] 0 pages cma reserved
[   90.237751][ T6560] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[   92.933776][ T6606] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   92.984050][ T6608] netlink: 'syz.1.306': attribute type 21 has an invalid length.
[   92.987344][ T6608] IPv6: NLM_F_CREATE should be specified when creating new route
[   93.184889][ T5861] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   93.188981][ T5861] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   93.194708][ T5861] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   93.200272][ T5861] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   93.206281][ T5861] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   93.249425][ T6617] erspan0 speed is unknown, defaulting to 1000
[   93.554683][ T6617] chnl_net:caif_netlink_parms(): no params data found
[   93.748082][ T6617] bridge0: port 1(bridge_slave_0) entered blocking state
[   93.752183][ T6617] bridge0: port 1(bridge_slave_0) entered disabled state
[   93.755340][ T6617] bridge_slave_0: entered allmulticast mode
[   93.759259][ T6617] bridge_slave_0: entered promiscuous mode
[   93.764765][ T6617] bridge0: port 2(bridge_slave_1) entered blocking state
[   93.767878][ T6617] bridge0: port 2(bridge_slave_1) entered disabled state
[   93.770911][ T6617] bridge_slave_1: entered allmulticast mode
[   93.775546][ T6617] bridge_slave_1: entered promiscuous mode
[   93.798193][ T6645] openvswitch: netlink: Geneve option length err (len 612, max 255).
[   93.834207][ T6617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   93.841351][ T6617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   93.909646][ T6617] team0: Port device team_slave_0 added
[   93.916406][ T6617] team0: Port device team_slave_1 added
[   93.952114][ T6617] batman_adv: batadv0: Adding interface: batadv_slave_0
[   93.955083][ T6617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   93.965797][ T6617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   93.972274][ T6617] batman_adv: batadv0: Adding interface: batadv_slave_1
[   93.975205][ T6617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   93.985822][ T6617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   94.024273][ T6617] hsr_slave_0: entered promiscuous mode
[   94.026654][ T6617] hsr_slave_1: entered promiscuous mode
[   94.029049][ T6617] debugfs: 'hsr0' already exists in 'hsr'
[   94.031548][ T6617] Cannot create hsr debugfs directory
[   94.318872][ T6617] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   94.326119][ T6617] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   94.334409][ T6617] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   94.341173][ T6617] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   94.343508][ T6664] netlink: 'syz.1.327': attribute type 1 has an invalid length.
[   94.396684][ T6617] bridge0: port 2(bridge_slave_1) entered blocking state
[   94.399923][ T6617] bridge0: port 2(bridge_slave_1) entered forwarding state
[   94.403389][ T6617] bridge0: port 1(bridge_slave_0) entered blocking state
[   94.406411][ T6617] bridge0: port 1(bridge_slave_0) entered forwarding state
[   94.428317][ T6674] __nla_validate_parse: 2 callbacks suppressed
[   94.428337][ T6674] netlink: 12 bytes leftover after parsing attributes in process `syz.1.329'.
[   94.439006][ T6674] netlink: 76 bytes leftover after parsing attributes in process `syz.1.329'.
[   94.481889][ T6617] 8021q: adding VLAN 0 to HW filter on device bond0
[   94.498634][   T26] bridge0: port 1(bridge_slave_0) entered disabled state
[   94.503385][   T26] bridge0: port 2(bridge_slave_1) entered disabled state
[   94.677376][ T6617] 8021q: adding VLAN 0 to HW filter on device team0
[   94.693898][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   94.696371][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   94.704392][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   94.707093][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   94.876515][ T6617] 8021q: adding VLAN 0 to HW filter on device batadv0
[   94.929017][ T6617] veth0_vlan: entered promiscuous mode
[   94.941349][ T6617] veth1_vlan: entered promiscuous mode
[   94.965432][ T6617] veth0_macvtap: entered promiscuous mode
[   94.974091][ T6617] veth1_macvtap: entered promiscuous mode
[   94.991216][ T6617] batman_adv: batadv0: Interface activated: batadv_slave_0
[   95.001718][ T6617] batman_adv: batadv0: Interface activated: batadv_slave_1
[   95.025973][ T5740] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   95.035384][ T5740] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   95.039074][ T5740] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   95.044650][ T5740] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   95.180986][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   95.190754][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   95.214812][ T6692] netlink: 28 bytes leftover after parsing attributes in process `syz.0.335'.
[   95.217673][ T6692] netlink: 28 bytes leftover after parsing attributes in process `syz.0.335'.
[   95.245393][   T55] Bluetooth: hci2: command tx timeout
[   95.286851][ T3538] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   95.289399][ T3538] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   95.731006][ T6706] netlink: 'syz.3.341': attribute type 16 has an invalid length.
[   95.739997][ T6706] netlink: 152 bytes leftover after parsing attributes in process `syz.3.341'.
[   96.096924][ T6721] netlink: 948 bytes leftover after parsing attributes in process `syz.0.347'.
[   96.619816][ T6739] netlink: 24 bytes leftover after parsing attributes in process `syz.1.356'.
[   97.201060][ T6758] netlink: 8 bytes leftover after parsing attributes in process `syz.1.363'.
[   97.239603][ T6760] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes.
[   97.291914][ T6764] netlink: 20 bytes leftover after parsing attributes in process `syz.3.367'.
[   97.323319][   T55] Bluetooth: hci2: command tx timeout
[   97.574694][ T6784] netlink: 'syz.1.373': attribute type 1 has an invalid length.
[   97.577774][ T6784] netlink: 8 bytes leftover after parsing attributes in process `syz.1.373'.
[   97.630312][ T6788] netlink: 'syz.1.374': attribute type 1 has an invalid length.
[   97.746389][ T6795] netlink: 'syz.1.376': attribute type 1 has an invalid length.
[   97.751361][ T6797] netlink: 'syz.3.377': attribute type 4 has an invalid length.
[   98.137469][ T6818] netlink: 'syz.1.387': attribute type 23 has an invalid length.
[   98.616235][ T6837] netlink: 'syz.1.390': attribute type 39 has an invalid length.
[   98.839019][ T6839] netlink: 'syz.3.396': attribute type 21 has an invalid length.
[   99.165843][ T6855] openvswitch: netlink: IP tunnel TTL not specified.
[   99.209605][ T6860] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only
[   99.401906][   T55] Bluetooth: hci2: command tx timeout
[   99.609463][ T6888] netlink: 'syz.3.414': attribute type 4 has an invalid length.
[   99.614065][ T6888] netlink: 'syz.3.414': attribute type 11 has an invalid length.
[   99.617128][ T6888] __nla_validate_parse: 5 callbacks suppressed
[   99.617137][ T6888] netlink: 196896 bytes leftover after parsing attributes in process `syz.3.414'.
[   99.618851][ T6890] netlink: 192 bytes leftover after parsing attributes in process `syz.0.415'.
[   99.764193][ T6900] netlink: 14 bytes leftover after parsing attributes in process `syz.3.420'.
[   99.826082][ T6904] rdma_rxe: rxe_newlink: failed to add veth0_vlan
[   99.849021][ T6905] netlink: 48 bytes leftover after parsing attributes in process `syz.3.422'.
[  100.749941][ T6921] netlink: 48 bytes leftover after parsing attributes in process `syz.0.429'.
[  100.860356][ T6927] delete_channel: no stack
[  101.093254][   T55] Bluetooth: hci0: unexpected subevent 0x01 length: 150 > 18
[  101.182447][ T6953] netlink: 'syz.1.444': attribute type 3 has an invalid length.
[  101.185968][ T6953] netlink: 132 bytes leftover after parsing attributes in process `syz.1.444'.
[  101.328049][ T6950] lo speed is unknown, defaulting to 1000
[  101.337297][ T6950] lo speed is unknown, defaulting to 1000
[  101.366180][ T6950] lo speed is unknown, defaulting to 1000
[  101.486377][ T5861] Bluetooth: hci2: command tx timeout
[  101.550256][ T6961] netlink: 'syz.1.447': attribute type 3 has an invalid length.
[  101.558762][ T6961] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.447'.
[  101.604474][ T6950] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[  101.868413][ T6950] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  102.057861][ T6950] lo speed is unknown, defaulting to 1000
[  102.065197][ T6950] lo speed is unknown, defaulting to 1000
[  102.069053][ T6950] lo speed is unknown, defaulting to 1000
[  102.075619][ T6950] lo speed is unknown, defaulting to 1000
[  102.116179][ T6971] netlink: 4 bytes leftover after parsing attributes in process `syz.1.451'.
[  102.441432][ T5861] Bluetooth: hci2: unexpected subevent 0x01 length: 150 > 18
[  102.528863][ T6991] netlink: 132 bytes leftover after parsing attributes in process `syz.1.459'.
[  102.708401][ T6999] openvswitch: netlink: VXLAN extension message has 1 unknown bytes.
[  102.797957][ T7008] netlink: 28 bytes leftover after parsing attributes in process `syz.3.468'.
[  103.161863][   T55] Bluetooth: hci0: command tx timeout
[  103.779139][ T7009] delete_channel: no stack
[  104.672954][ T7058] syzkaller0: entered promiscuous mode
[  104.675125][ T7058] syzkaller0: entered allmulticast mode
[  104.713897][ T7060] __nla_validate_parse: 3 callbacks suppressed
[  104.713958][ T7060] netlink: 8 bytes leftover after parsing attributes in process `syz.1.490'.
[  104.727126][ T7060] netlink: 204 bytes leftover after parsing attributes in process `syz.1.490'.
[  105.860147][ T7077] netlink: 'syz.3.497': attribute type 2 has an invalid length.
[  105.864178][ T7077] netlink: 'syz.3.497': attribute type 5 has an invalid length.
[  105.868159][ T7077] netlink: 'syz.3.497': attribute type 6 has an invalid length.
[  105.874279][ T7077] netlink: 'syz.3.497': attribute type 7 has an invalid length.
[  105.877496][ T7077] netlink: 9 bytes leftover after parsing attributes in process `syz.3.497'.
[  105.893794][ T7077] netlink: 130080 bytes leftover after parsing attributes in process `syz.3.497'.
[  105.898825][ T7077] netlink: 'syz.3.497': attribute type 2 has an invalid length.
[  105.904167][ T7077] netlink: 'syz.3.497': attribute type 5 has an invalid length.
[  105.908122][ T7077] netlink: 'syz.3.497': attribute type 6 has an invalid length.
[  105.914448][ T7077] netlink: 'syz.3.497': attribute type 7 has an invalid length.
[  105.918100][ T7077] netlink: 9 bytes leftover after parsing attributes in process `syz.3.497'.
[  107.054912][ T7088] netlink: 'syz.3.502': attribute type 2 has an invalid length.
[  107.057460][ T7088] netlink: 'syz.3.502': attribute type 1 has an invalid length.
[  107.060147][ T7088] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.502'.
[  107.064190][ T7088] nbd: must specify at least one socket
[  107.167895][ T7092] netlink: 176 bytes leftover after parsing attributes in process `syz.3.504'.
[  107.427710][ T7103] netlink: 44 bytes leftover after parsing attributes in process `syz.3.511'.
[  107.465630][ T7106] netlink: 168 bytes leftover after parsing attributes in process `syz.3.512'.
[  107.470978][ T7104] netlink: 63503 bytes leftover after parsing attributes in process `syz.1.509'.
[  107.488352][ T7108] hsr_slave_0: hsr_addr_subst_dest: Unknown node
[  107.490634][ T7108] hsr_slave_1: hsr_addr_subst_dest: Unknown node
[  107.797259][ T7131] sit0: entered allmulticast mode
[  107.822137][ T7131] sit0: entered promiscuous mode
[  108.063576][ T7149] openvswitch: netlink: Unknown nsh attribute 0
[  108.066054][ T7149] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  109.002656][ T7190] netlink: zone id is out of range
[  109.005151][ T7190] netlink: zone id is out of range
[  109.007438][ T7190] netlink: zone id is out of range
[  109.009576][ T7190] netlink: zone id is out of range
[  109.014838][ T7190] netlink: zone id is out of range
[  109.018679][ T7190] netlink: zone id is out of range
[  109.020914][ T7190] netlink: zone id is out of range
[  109.028139][ T7190] netlink: zone id is out of range
[  109.320399][ T7212] vlan0: entered allmulticast mode
[  109.322927][ T7212] veth0_vlan: entered allmulticast mode
[  109.342704][ T7212] team0: Port device vlan0 added
[  109.746497][   T55] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4
[  109.944526][ T7265] __nla_validate_parse: 5 callbacks suppressed
[  109.944540][ T7265] netlink: 8 bytes leftover after parsing attributes in process `syz.3.586'.
[  110.011211][ T7271] netlink: 44 bytes leftover after parsing attributes in process `syz.3.589'.
[  110.779513][    C1] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 1017863009 wd_nsec: 1017863052
[  110.814928][ T7267] delete_channel: no stack
[  110.908673][ T7301] validate_nla: 8 callbacks suppressed
[  110.908700][ T7301] netlink: 'syz.1.597': attribute type 9 has an invalid length.
[  110.915253][ T7301] netlink: 61951 bytes leftover after parsing attributes in process `syz.1.597'.
[  111.055605][ T7314] netlink: 'syz.0.603': attribute type 1 has an invalid length.
[  111.108616][ T7318] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.604'.
[  112.081044][ T7362] @: renamed from bond_slave_0 (while UP)
[  112.083310][   T55] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4
[  112.682106][ T7379] netlink: 16 bytes leftover after parsing attributes in process `syz.0.631'.
[  112.756785][ T7383] netlink: 'syz.1.633': attribute type 11 has an invalid length.
[  112.760078][ T7383] netlink: 'syz.1.633': attribute type 15 has an invalid length.
[  112.766730][ T7383] netlink: 'syz.1.633': attribute type 16 has an invalid length.
[  112.770418][ T7383] netlink: 'syz.1.633': attribute type 21 has an invalid length.
[  112.773933][ T7383] netlink: 'syz.1.633': attribute type 25 has an invalid length.
[  112.777183][ T7383] netlink: 'syz.1.633': attribute type 27 has an invalid length.
[  112.780294][ T7383] netlink: 'syz.1.633': attribute type 28 has an invalid length.
[  112.783902][ T7383] netlink: 'syz.1.633': attribute type 29 has an invalid length.
[  114.152066][ T7423] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.648'.
[  114.162063][ T7419] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.648'.
[  114.168064][ T7426] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.651'.
[  114.181920][ T7419] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.648'.
[  114.344243][ T7438] netlink: 137592 bytes leftover after parsing attributes in process `syz.0.657'.
[  114.912364][ T7468] siw: device registration error -23
[  114.978448][ T7467] siw: device registration error -23
[  115.224135][ T7473] syzkaller0: entered promiscuous mode
[  115.226293][ T7473] syzkaller0: entered allmulticast mode
[  116.949939][ T7477] __nla_validate_parse: 2 callbacks suppressed
[  116.949952][ T7477] netlink: 28 bytes leftover after parsing attributes in process `syz.1.675'.
[  116.955670][ T7477] netlink: 28 bytes leftover after parsing attributes in process `syz.1.675'.
[  117.196118][ T7502] netlink: 132 bytes leftover after parsing attributes in process `syz.1.682'.
[  117.408312][ T7518] _Z`Ԁ@S!!: entered promiscuous mode
[  117.450618][ T7518] netlink: 8 bytes leftover after parsing attributes in process `syz.0.688'.
[  117.944393][ T7553] netlink: 60 bytes leftover after parsing attributes in process `syz.0.703'.
[  117.968753][ T7548] netlink: 60 bytes leftover after parsing attributes in process `syz.0.703'.
[  118.020089][ T7556] validate_nla: 3 callbacks suppressed
[  118.020109][ T7556] netlink: 'syz.3.705': attribute type 2 has an invalid length.
[  118.135285][ T7562] netlink: 'syz.0.708': attribute type 1 has an invalid length.
[  118.142038][ T7562] netlink: 'syz.0.708': attribute type 4 has an invalid length.
[  118.240156][ T7571] netlink: 152 bytes leftover after parsing attributes in process `syz.3.713'.
[  118.246774][ T7571] tc_dump_action: action bad kind
[  118.702922][ T7588] netlink: 'syz.1.720': attribute type 1 has an invalid length.
[  119.676656][ T7607] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  119.681284][ T7607] batman_adv: batadv0: Removing interface: batadv_slave_0
[  120.011551][ T7607] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  120.026641][ T7607] batman_adv: batadv0: Removing interface: batadv_slave_1
[  120.148034][ T7613] netlink: 'syz.3.729': attribute type 4 has an invalid length.
[  121.473883][ T7642] netlink: 'syz.1.737': attribute type 4 has an invalid length.
[  121.476952][ T7642] netlink: 152 bytes leftover after parsing attributes in process `syz.1.737'.
[  121.483836][ T7642] net_ratelimit: 4 callbacks suppressed
[  121.483868][ T7642] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check.
[  121.584062][ T7651] netlink: 'syz.1.742': attribute type 1 has an invalid length.
[  121.845061][ T7666] netlink: 92 bytes leftover after parsing attributes in process `syz.1.749'.
[  121.947324][ T7666] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  122.032241][ T7678] netlink: 'syz.0.755': attribute type 2 has an invalid length.
[  122.363251][   T55] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4
[  122.414784][ T7700] : renamed from bond0
[  122.617958][ T7710] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode
[  122.677200][ T7721] =======================================================
[  122.677200][ T7721] WARNING: The mand mount option has been deprecated and
[  122.677200][ T7721]          and is ignored by this kernel. Remove the mand
[  122.677200][ T7721]          option from the mount to silence this warning.
[  122.677200][ T7721] =======================================================
[  123.776643][ T7738] blkio.reset_stats is deprecated
[  125.889115][ T7743] pim6reg0: tun_chr_ioctl cmd 1074025681
[  125.952913][ T7747] netlink: 8 bytes leftover after parsing attributes in process `syz.0.784'.
[  125.956083][ T7747] openvswitch: netlink: Missing key (keys=40, expected=2000)
[  125.982091][ T7749] netlink: 188 bytes leftover after parsing attributes in process `syz.3.785'.
[  126.098745][ T7760] netlink: 'syz.3.790': attribute type 1 has an invalid length.
[  126.101490][ T7760] netlink: 'syz.3.790': attribute type 2 has an invalid length.
[  126.174647][ T7753] sctp: [Deprecated]: syz.0.787 (pid 7753) Use of struct sctp_assoc_value in delayed_ack socket option.
[  126.174647][ T7753] Use struct sctp_sack_info instead
[  127.239331][ T7797] netlink: 12 bytes leftover after parsing attributes in process `syz.0.808'.
[  128.520404][ T7818] xt_time: invalid argument - start or stop time greater than 23:59:59
[  129.502040][ T7839] netlink: 4400 bytes leftover after parsing attributes in process `syz.0.824'.
[  129.740212][ T7855] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.830'.
[  129.786242][ T7860] netlink: 8 bytes leftover after parsing attributes in process `syz.3.833'.
[  129.865884][ T7865] openvswitch: netlink: VXLAN extension message has 3 unknown bytes.
[  130.021289][ T7869] netlink: 'syz.3.837': attribute type 27 has an invalid length.
[  130.025295][ T7869] netlink: 164 bytes leftover after parsing attributes in process `syz.3.837'.
[  130.125415][ T7879] netlink: 'syz.3.842': attribute type 29 has an invalid length.
[  130.129688][ T7879] netlink: 'syz.3.842': attribute type 29 has an invalid length.
[  130.232212][ T7887] netlink: 35840 bytes leftover after parsing attributes in process `syz.0.846'.
[  130.261038][ T7883] TCP: TCP_TX_DELAY enabled
[  130.674819][ T7919] netlink: 'syz.3.861': attribute type 21 has an invalid length.
[  131.213652][ T7919] netlink: 14 bytes leftover after parsing attributes in process `syz.3.861'.
[  131.561571][ T7927] C: renamed from team_slave_0 (while UP)
[  131.574249][ T7927] netlink: 'syz.3.861': attribute type 4 has an invalid length.
[  131.577484][ T7927] netlink: 116 bytes leftover after parsing attributes in process `syz.3.861'.
[  131.582159][ T7927] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[  132.060964][   T55] Bluetooth: hci2: unexpected event 0x04 length: 15 > 10
[  132.176609][ T7950] netlink: 'syz.3.871': attribute type 12 has an invalid length.
[  132.182995][ T7950] netlink: 120 bytes leftover after parsing attributes in process `syz.3.871'.
[  132.291114][ T7960] netlink: 76 bytes leftover after parsing attributes in process `syz.1.877'.
[  133.038034][ T7995] netlink: 20 bytes leftover after parsing attributes in process `syz.1.893'.
[  133.148612][ T8005] netlink: 8 bytes leftover after parsing attributes in process `syz.1.897'.
[  133.153404][ T8005] netlink: 312 bytes leftover after parsing attributes in process `syz.1.897'.
[  133.156403][ T8005] netlink: 8 bytes leftover after parsing attributes in process `syz.1.897'.
[  133.573840][ T8030] netlink: 16255 bytes leftover after parsing attributes in process `syz.1.908'.
[  134.140229][   T55] Bluetooth: hci2: command tx timeout
[  134.255736][ T8060] netlink: 'syz.3.922': attribute type 5 has an invalid length.
[  134.319702][ T8064] netlink: 1053 bytes leftover after parsing attributes in process `syz.3.923'.
[  135.651265][   T33] audit: type=1107 audit(1758171427.479:2): pid=8089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''
[  135.721117][ T8096] netlink: 'syz.3.937': attribute type 10 has an invalid length.
[  135.727278][ T8096] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  135.734856][ T5850] lo speed is unknown, defaulting to 1000
[  135.839633][ T8104] tQ6\bY4: renamed from lo (while UP)
[  136.558534][ T8147] __nla_validate_parse: 5 callbacks suppressed
[  136.558551][ T8147] netlink: 44 bytes leftover after parsing attributes in process `syz.0.961'.
[  137.280184][ T8172] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.971'.
[  137.376833][ T8127] infiniband syz!: set active
[  137.379251][ T8127] infiniband syz!: added team_slave_0
[  137.393010][ T8127] syz!: rxe_create_cq: returned err = -12
[  137.395513][ T8127] infiniband syz!: Couldn't create ib_mad CQ
[  137.398179][ T8127] infiniband syz!: Couldn't open port 1
[  137.472963][ T8127] RDS/IB: syz!: added
[  137.474800][ T8127] smc: adding ib device syz! with port count 1
[  137.477339][ T8127] smc:    ib device syz! port 1 has pnetid 
[  138.206522][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  138.209194][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  138.430112][ T8194] netlink: 4 bytes leftover after parsing attributes in process `syz.1.980'.
[  138.479222][ T8196] netlink: 'syz.0.981': attribute type 21 has an invalid length.
[  138.483260][ T8196] netlink: 164 bytes leftover after parsing attributes in process `syz.0.981'.
[  139.716899][ T8203] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.983'.
[  139.883706][ T8215] netlink: 1010 bytes leftover after parsing attributes in process `syz.3.990'.
[  139.887814][ T8215] bridge: RTM_NEWNEIGH with invalid state 0x1
[  139.929876][ T8219] netlink: 'syz.0.993': attribute type 25 has an invalid length.
[  139.933025][ T8219] netlink: 'syz.0.993': attribute type 28 has an invalid length.
[  140.274534][ T8243] netlink: 'syz.1.1003': attribute type 1 has an invalid length.
[  140.277765][ T8243] netlink: 124 bytes leftover after parsing attributes in process `syz.1.1003'.
[  140.283114][ T8243] netlink: 125920 bytes leftover after parsing attributes in process `syz.1.1003'.
[  140.287152][ T8243] netlink: 'syz.1.1003': attribute type 1 has an invalid length.
[  140.290143][ T8243] netlink: 124 bytes leftover after parsing attributes in process `syz.1.1003'.
[  140.503020][ T8257] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  140.838058][ T8269] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1014'.
[  140.875284][ T8272] netlink: 'syz.3.1015': attribute type 4 has an invalid length.
[  140.988615][ T8279] Illegal XDP return value 4294967274 on prog  (id 322) dev N/A, expect packet loss!
[  141.163161][ T8285] rdma_rxe: rxe_newlink: failed to add lo
[  141.333721][ T8256] delete_channel: no stack
[  141.492836][ T8304] openvswitch: netlink: nsh attribute has 2 unknown bytes.
[  141.496588][ T8304] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  141.668029][ T8310] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1031'.
[  141.683779][ T8310] bridge0: port 1(bridge_slave_0) entered disabled state
[  142.489250][ T8310] bridge_slave_0 (unregistering): left allmulticast mode
[  142.493415][ T8310] bridge_slave_0 (unregistering): left promiscuous mode
[  142.496431][ T8310] bridge0: port 1(bridge_slave_0) entered disabled state
[  142.596223][ T8312] openvswitch: netlink: Missing key (keys=2000040, expected=2000)
[  142.699782][ T8322] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes.
[  142.872447][    C1] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[  142.875733][ T8334] netlink: 'syz.1.1043': attribute type 21 has an invalid length.
[  142.919905][ T8337] hsr_slave_0: hsr_addr_subst_dest: Unknown node
[  142.922996][ T8337] hsr_slave_1: hsr_addr_subst_dest: Unknown node
[  143.823514][ T8388] netlink: 'syz.1.1067': attribute type 29 has an invalid length.
[  143.940141][ T8393] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1070'.
[  144.051342][ T8402] xt_socket: unknown flags 0x40
[  144.112383][ T8408] netlink: 'syz.3.1077': attribute type 1 has an invalid length.
[  144.307309][ T8415] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1075'.
[  144.746112][ T8429] netlink: 'syz.3.1085': attribute type 1 has an invalid length.
[  145.284071][ T8442] netlink: 'syz.0.1091': attribute type 1 has an invalid length.
[  145.431237][ T8449] syzkaller0: entered promiscuous mode
[  145.433698][ T8449] syzkaller0: entered allmulticast mode
[  146.175068][ T8467] netlink: 'syz.3.1103': attribute type 21 has an invalid length.
[  146.682981][ T8459] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1099'.
[  146.689109][ T8467] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1103'.
[  146.854453][ T8479] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1109'.
[  147.092539][ T8496] netlink: 'syz.3.1116': attribute type 10 has an invalid length.
[  147.095549][ T8496] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1116'.
[  147.109464][ T8500] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1119'.
[  147.114128][ T8500] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1119'.
[  147.294812][ T8506] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1122'.
[  147.370010][ T8516] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1127'.
[  148.083494][ T8555] netlink: 65027 bytes leftover after parsing attributes in process `syz.3.1145'.
[  148.514426][ T8579] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1155'.
[  148.817624][ T8596] netlink: 'syz.0.1163': attribute type 2 has an invalid length.
[  148.820986][ T8596] netlink: 'syz.0.1163': attribute type 8 has an invalid length.
[  148.891216][ T8598] netlink: 'syz.3.1164': attribute type 3 has an invalid length.
[  149.084493][ T8612] netlink: 'syz.0.1170': attribute type 21 has an invalid length.
[  149.195884][ T8616] netlink: 'syz.0.1171': attribute type 10 has an invalid length.
[  149.215968][ T8616] wlan1: mtu less than device minimum
[  149.218213][ T8616] : (slave wlan1): Error -22 calling dev_set_mtu
[  149.234868][ T8608] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  149.239258][ T8608] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  149.314157][ T8618] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x37
[  150.546424][ T8673] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  151.346615][ T8693] netlink: 'syz.0.1207': attribute type 39 has an invalid length.
[  152.411242][ T8719] __nla_validate_parse: 9 callbacks suppressed
[  152.411255][ T8719] netlink: 140 bytes leftover after parsing attributes in process `syz.3.1218'.
[  152.417822][ T8719] netlink: 6 bytes leftover after parsing attributes in process `syz.3.1218'.
[  152.454384][ T8723] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1219'.
[  152.457411][ T8723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1219'.
[  152.838150][ T8748] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1231'.
[  152.844739][ T8748] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1231'.
[  153.263313][ T8754] veth1_macvtap: left promiscuous mode
[  153.301770][ T8751] veth1_macvtap: entered promiscuous mode
[  153.304514][ T8751] macsec0: entered promiscuous mode
[  153.307429][ T8751] macsec0: entered allmulticast mode
[  153.309704][ T8751] veth1_macvtap: entered allmulticast mode
[  153.488216][ T8766] syzkaller1: tun_chr_ioctl cmd 1074025673
[  154.790214][ T8797] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1253'.
[  155.039928][ T8797] syzkaller0: entered promiscuous mode
[  155.042738][ T8797] syzkaller0: entered allmulticast mode
[  156.122942][ T8830] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048)
[  156.597330][ T8866] netlink: 'syz.3.1283': attribute type 2 has an invalid length.
[  156.600917][ T8866] netlink: 'syz.3.1283': attribute type 1 has an invalid length.
[  156.604634][ T8866] netlink: 199820 bytes leftover after parsing attributes in process `syz.3.1283'.
[  156.608664][ T8866] block nbd5: not configured, cannot reconfigure
[  156.790737][ T8876] netlink: 'syz.3.1289': attribute type 4 has an invalid length.
[  156.795201][ T8876] netlink: 'syz.3.1289': attribute type 3 has an invalid length.
[  156.798434][ T8876] netlink: 199820 bytes leftover after parsing attributes in process `syz.3.1289'.
[  156.839347][ T8878] netlink: 11562 bytes leftover after parsing attributes in process `syz.1.1290'.
[  157.014605][ T8888] xt_l2tp: invalid flags combination: 8
[  157.026529][ T8886] syzkaller0: entered promiscuous mode
[  157.028285][ T8886] syzkaller0: entered allmulticast mode
[  158.064703][ T8908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1304'.
[  158.851954][ T8896] veth0_vlan: entered allmulticast mode
[  158.865527][ T8900] veth0_vlan: left promiscuous mode
[  158.869441][ T8900] veth0_vlan: entered promiscuous mode
[  158.939926][ T8920] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1309'.
[  158.982672][ T8916] netlink: 'syz.0.1307': attribute type 9 has an invalid length.
[  158.985169][ T8916] netlink: 61951 bytes leftover after parsing attributes in process `syz.0.1307'.
[  159.302020][ T8948] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1320'.
[  159.309047][ T8948] netlink: 'syz.0.1320': attribute type 2 has an invalid length.
[  159.313181][ T8948] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1320'.
[  159.737352][ T8955] netlink: 'syz.3.1323': attribute type 27 has an invalid length.
[  159.740085][ T8955] netlink: 2418 bytes leftover after parsing attributes in process `syz.3.1323'.
[  159.756619][ T8952] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1322'.
[  159.828329][ T8959] netlink: 'syz.3.1325': attribute type 29 has an invalid length.
[  159.833665][ T8959] netlink: 'syz.3.1325': attribute type 29 has an invalid length.
[  159.837343][ T8959] netlink: 'syz.3.1325': attribute type 29 has an invalid length.
[  160.476781][ T8999] : entered promiscuous mode
[  160.498837][ T9001] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1344'.
[  161.123498][ T9017] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1350'.
[  162.987100][ T9067] validate_nla: 1 callbacks suppressed
[  162.987157][ T9067] netlink: 'syz.3.1373': attribute type 29 has an invalid length.
[  163.008748][ T9069] netlink: 'syz.3.1373': attribute type 29 has an invalid length.
[  163.013830][ T9067] netlink: 'syz.3.1373': attribute type 29 has an invalid length.
[  163.112468][ T9069] netlink: 'syz.3.1373': attribute type 29 has an invalid length.
[  163.207119][ T9076] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1376'.
[  164.303799][ T9106] openvswitch: netlink: IP tunnel dst address not specified
[  167.584361][ T9131] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1401'.
[  167.986295][ T9150] netlink: 'syz.0.1406': attribute type 11 has an invalid length.
[  167.988838][ T9150] netlink: 149476 bytes leftover after parsing attributes in process `syz.0.1406'.
[  168.047094][ T9146] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  168.087752][ T9153] tmpfs: Bad value for 'gid'
[  168.089338][ T9153] tmpfs: Bad value for 'gid'
[  168.645975][ T9163] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode
[  168.654382][ T9164] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[  170.891099][ T9212] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1435'.
[  170.899145][ T9215] netlink: 'syz.3.1436': attribute type 10 has an invalid length.
[  171.345789][   T55] Bluetooth: hci2: Dropping invalid advertising data
[  171.349083][   T55] Bluetooth: hci2: unknown advertising packet type: 0xff
[  171.506016][ T9251] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1453'.
[  171.633937][ T9264] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1459'.
[  171.636685][ T9264] hsr0: entered promiscuous mode
[  171.638585][ T9264] hsr0: entered allmulticast mode
[  171.640054][ T9264] hsr_slave_0: entered allmulticast mode
[  171.642582][ T9264] hsr_slave_1: entered allmulticast mode
[  171.984191][ T9283] netlink: 'syz.0.1468': attribute type 41 has an invalid length.
[  171.987196][ T9283] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1468'.
[  172.031089][ T9285] netlink: 'syz.1.1469': attribute type 8 has an invalid length.
[  172.034472][ T9285] netlink: 'syz.1.1469': attribute type 6 has an invalid length.
[  172.037704][ T9285] netlink: 144448 bytes leftover after parsing attributes in process `syz.1.1469'.
[  172.308464][ T9300] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  172.317843][ T9300] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  172.576647][ T9305] syzkaller0: entered promiscuous mode
[  172.578898][ T9305] syzkaller0: entered allmulticast mode
[  174.325814][ T9329] netlink: 2 bytes leftover after parsing attributes in process `syz.0.1487'.
[  174.397252][ T9334] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  174.751411][ T9364] hsr_slave_0: hsr_addr_subst_dest: Unknown node
[  174.754730][ T9364] hsr_slave_1: hsr_addr_subst_dest: Unknown node
[  174.843398][ T9364] xt_time: unknown flags 0xf4
[  175.016265][ T9372] netlink: 'syz.1.1506': attribute type 1 has an invalid length.
[  175.019603][ T9372] netlink: 15534 bytes leftover after parsing attributes in process `syz.1.1506'.
[  175.195971][ T9380] erspan0 speed is unknown, defaulting to 1000
[  175.393895][ T9380] lo speed is unknown, defaulting to 1000
[  175.503532][ T9391] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1515'.
[  175.590461][ T9393] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1516'.
[  176.048241][ T9411] netlink: 137592 bytes leftover after parsing attributes in process `syz.1.1523'.
[  176.054396][ T9411] nbd: must specify a size in bytes for the device
[  176.297547][ T9423] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1529'.
[  176.338756][ T9425] openvswitch: netlink: Tunnel attr 72 out of range max 16
[  176.997139][ T9465] ==================================================================
[  177.000307][ T9465] BUG: KASAN: slab-use-after-free in xfrm_alloc_spi+0x570/0xf30
[  177.002992][ T9465] Read of size 4 at addr ffff88802fe55bc4 by task syz.1.1548/9465
[  177.006584][ T9465] 
[  177.007914][ T9465] CPU: 0 UID: 0 PID: 9465 Comm: syz.1.1548 Not tainted syzkaller #0 PREEMPT(full) 
[  177.007953][ T9465] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  177.007973][ T9465] Call Trace:
[  177.007980][ T9465]  <TASK>
[  177.007987][ T9465]  dump_stack_lvl+0x189/0x250
[  177.008010][ T9465]  ? __kasan_check_byte+0x12/0x40
[  177.008034][ T9465]  ? __pfx_dump_stack_lvl+0x10/0x10
[  177.008051][ T9465]  ? lock_release+0x4b/0x3e0
[  177.008076][ T9465]  ? __virt_addr_valid+0x4a5/0x5c0
[  177.008094][ T9465]  print_report+0xca/0x240
[  177.008117][ T9465]  ? xfrm_alloc_spi+0x570/0xf30
[  177.008137][ T9465]  kasan_report+0x118/0x150
[  177.008158][ T9465]  ? xfrm_alloc_spi+0x570/0xf30
[  177.008179][ T9465]  xfrm_alloc_spi+0x570/0xf30
[  177.008198][ T9465]  ? xfrm_alloc_spi+0x2a0/0xf30
[  177.008222][ T9465]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  177.008240][ T9465]  ? xfrm_find_acq+0x87/0xa0
[  177.008260][ T9465]  xfrm_alloc_userspi+0x70b/0xc90
[  177.008291][ T9465]  ? apparmor_capable+0x137/0x1b0
[  177.008311][ T9465]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  177.008335][ T9465]  ? __nla_parse+0x40/0x60
[  177.008352][ T9465]  xfrm_user_rcv_msg+0x7a3/0xab0
[  177.008373][ T9465]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  177.008406][ T9465]  ? __pfx___mutex_trylock_common+0x10/0x10
[  177.008423][ T9465]  ? rcu_is_watching+0x15/0xb0
[  177.008439][ T9465]  ? trace_contention_end+0x39/0x120
[  177.008454][ T9465]  ? __mutex_lock+0x335/0x1350
[  177.008472][ T9465]  netlink_rcv_skb+0x208/0x470
[  177.008491][ T9465]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  177.008512][ T9465]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  177.008534][ T9465]  ? netlink_deliver_tap+0x2e/0x1b0
[  177.008549][ T9465]  ? netlink_deliver_tap+0x2e/0x1b0
[  177.008562][ T9465]  xfrm_netlink_rcv+0x79/0x90
[  177.008578][ T9465]  netlink_unicast+0x82f/0x9e0
[  177.008591][ T9465]  ? __pfx_netlink_unicast+0x10/0x10
[  177.008602][ T9465]  ? netlink_sendmsg+0x642/0xb30
[  177.008613][ T9465]  ? skb_put+0x11b/0x210
[  177.008628][ T9465]  netlink_sendmsg+0x805/0xb30
[  177.008643][ T9465]  ? __pfx_netlink_sendmsg+0x10/0x10
[  177.008656][ T9465]  ? aa_sock_msg_perm+0xf1/0x1d0
[  177.008668][ T9465]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  177.008682][ T9465]  ? __pfx_netlink_sendmsg+0x10/0x10
[  177.008696][ T9465]  __sock_sendmsg+0x21c/0x270
[  177.008718][ T9465]  ____sys_sendmsg+0x505/0x830
[  177.008735][ T9465]  ? __pfx_____sys_sendmsg+0x10/0x10
[  177.008754][ T9465]  ? import_iovec+0x74/0xa0
[  177.008772][ T9465]  ___sys_sendmsg+0x21f/0x2a0
[  177.008790][ T9465]  ? __pfx____sys_sendmsg+0x10/0x10
[  177.008858][ T9465]  ? __fget_files+0x2a/0x420
[  177.008872][ T9465]  ? __fget_files+0x3a0/0x420
[  177.008887][ T9465]  __x64_sys_sendmsg+0x19b/0x260
[  177.008905][ T9465]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  177.008927][ T9465]  ? rcu_is_watching+0x15/0xb0
[  177.008941][ T9465]  ? do_syscall_64+0xbe/0x3b0
[  177.008960][ T9465]  do_syscall_64+0xfa/0x3b0
[  177.008975][ T9465]  ? lockdep_hardirqs_on+0x9c/0x150
[  177.008987][ T9465]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  177.009000][ T9465]  ? exc_page_fault+0x9f/0xf0
[  177.009015][ T9465]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  177.009029][ T9465] RIP: 0033:0x7f3eb8d8eba9
[  177.009041][ T9465] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  177.009054][ T9465] RSP: 002b:00007f3eb6ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  177.009070][ T9465] RAX: ffffffffffffffda RBX: 00007f3eb8fd5fa0 RCX: 00007f3eb8d8eba9
[  177.009081][ T9465] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003
[  177.009091][ T9465] RBP: 00007f3eb8e11e19 R08: 0000000000000000 R09: 0000000000000000
[  177.009100][ T9465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  177.009116][ T9465] R13: 00007f3eb8fd6038 R14: 00007f3eb8fd5fa0 R15: 00007ffff996bbb8
[  177.009134][ T9465]  </TASK>
[  177.009140][ T9465] 
[  177.141485][ T9465] Allocated by task 8931:
[  177.143026][ T9465]  kasan_save_track+0x3e/0x80
[  177.144685][ T9465]  __kasan_slab_alloc+0x6c/0x80
[  177.146383][ T9465]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  177.148253][ T9465]  xfrm_state_alloc+0x24/0x2f0
[  177.149890][ T9465]  xfrm_add_sa+0x17d1/0x4070
[  177.151497][ T9465]  xfrm_user_rcv_msg+0x7a3/0xab0
[  177.153217][ T9465]  netlink_rcv_skb+0x208/0x470
[  177.154861][ T9465]  xfrm_netlink_rcv+0x79/0x90
[  177.156495][ T9465]  netlink_unicast+0x82f/0x9e0
[  177.158149][ T9465]  netlink_sendmsg+0x805/0xb30
[  177.159888][ T9465]  __sock_sendmsg+0x21c/0x270
[  177.161523][ T9465]  ____sys_sendmsg+0x505/0x830
[  177.163200][ T9465]  ___sys_sendmsg+0x21f/0x2a0
[  177.164777][ T9465]  __x64_sys_sendmsg+0x19b/0x260
[  177.166518][ T9465]  do_syscall_64+0xfa/0x3b0
[  177.168084][ T9465]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  177.170116][ T9465] 
[  177.170961][ T9465] Freed by task 5887:
[  177.172371][ T9465]  kasan_save_track+0x3e/0x80
[  177.174035][ T9465]  kasan_save_free_info+0x46/0x50
[  177.175770][ T9465]  __kasan_slab_free+0x5b/0x80
[  177.177468][ T9465]  kmem_cache_free+0x18f/0x400
[  177.179106][ T9465]  xfrm_state_gc_task+0x52d/0x6b0
[  177.180877][ T9465]  process_scheduled_works+0xae1/0x17b0
[  177.182760][ T9465]  worker_thread+0x8a0/0xda0
[  177.184411][ T9465]  kthread+0x711/0x8a0
[  177.185833][ T9465]  ret_from_fork+0x439/0x7d0
[  177.187413][ T9465]  ret_from_fork_asm+0x1a/0x30
[  177.189079][ T9465] 
[  177.189922][ T9465] The buggy address belongs to the object at ffff88802fe55b00
[  177.189922][ T9465]  which belongs to the cache xfrm_state of size 928
[  177.194665][ T9465] The buggy address is located 196 bytes inside of
[  177.194665][ T9465]  freed 928-byte region [ffff88802fe55b00, ffff88802fe55ea0)
[  177.199409][ T9465] 
[  177.200254][ T9465] The buggy address belongs to the physical page:
[  177.202464][ T9465] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802fe56400 pfn:0x2fe54
[  177.206003][ T9465] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  177.208989][ T9465] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  177.211667][ T9465] page_type: f5(slab)
[  177.213112][ T9465] raw: 00fff00000000040 ffff888104e79640 dead000000000122 0000000000000000
[  177.216140][ T9465] raw: ffff88802fe56400 00000000800e0007 00000000f5000000 0000000000000000
[  177.219120][ T9465] head: 00fff00000000040 ffff888104e79640 dead000000000122 0000000000000000
[  177.222194][ T9465] head: ffff88802fe56400 00000000800e0007 00000000f5000000 0000000000000000
[  177.225228][ T9465] head: 00fff00000000002 ffffea0000bf9501 00000000ffffffff 00000000ffffffff
[  177.228216][ T9465] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  177.231192][ T9465] page dumped because: kasan: bad access detected
[  177.233427][ T9465] page_owner tracks the page as allocated
[  177.235382][ T9465] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6764, tgid 6763 (syz.3.367), ts 97303136581, free_ts 97289225626
[  177.241710][ T9465]  post_alloc_hook+0x240/0x2a0
[  177.243350][ T9465]  get_page_from_freelist+0x21e4/0x22c0
[  177.245195][ T9465]  __alloc_frozen_pages_noprof+0x181/0x370
[  177.247159][ T9465]  alloc_pages_mpol+0x232/0x4a0
[  177.248833][ T9465]  allocate_slab+0x8a/0x370
[  177.250459][ T9465]  ___slab_alloc+0xbeb/0x1420
[  177.252178][ T9465]  kmem_cache_alloc_noprof+0x283/0x3c0
[  177.254078][ T9465]  xfrm_state_alloc+0x24/0x2f0
[  177.255683][ T9465]  __find_acq_core+0x8a7/0x1c00
[  177.257332][ T9465]  xfrm_find_acq+0x78/0xa0
[  177.258876][ T9465]  xfrm_alloc_userspi+0x6b3/0xc90
[  177.260578][ T9465]  xfrm_user_rcv_msg+0x7a3/0xab0
[  177.262301][ T9465]  netlink_rcv_skb+0x208/0x470
[  177.264006][ T9465]  xfrm_netlink_rcv+0x79/0x90
[  177.265684][ T9465]  netlink_unicast+0x82f/0x9e0
[  177.267356][ T9465]  netlink_sendmsg+0x805/0xb30
[  177.269026][ T9465] page last free pid 6762 tgid 6761 stack trace:
[  177.271212][ T9465]  __free_frozen_pages+0xbc4/0xd30
[  177.273061][ T9465]  stack_depot_save_flags+0x436/0x860
[  177.274900][ T9465]  kasan_save_track+0x4f/0x80
[  177.276563][ T9465]  __kasan_slab_alloc+0x6c/0x80
[  177.278394][ T9465]  kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[  177.280424][ T9465]  __alloc_skb+0x112/0x2d0
[  177.282000][ T9465]  alloc_skb_with_frags+0xca/0x890
[  177.283742][ T9465]  sock_alloc_send_pskb+0x857/0x990
[  177.285509][ T9465]  raw_send_hdrinc+0x289/0x1470
[  177.287180][ T9465]  raw_sendmsg+0x1357/0x18b0
[  177.288811][ T9465]  __sock_sendmsg+0x19c/0x270
[  177.290428][ T9465]  ____sys_sendmsg+0x505/0x830
[  177.292112][ T9465]  ___sys_sendmsg+0x21f/0x2a0
[  177.293763][ T9465]  __x64_sys_sendmsg+0x19b/0x260
[  177.295500][ T9465]  do_syscall_64+0xfa/0x3b0
[  177.297071][ T9465]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  177.299107][ T9465] 
[  177.299962][ T9465] Memory state around the buggy address:
[  177.301866][ T9465]  ffff88802fe55a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  177.304569][ T9465]  ffff88802fe55b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  177.307269][ T9465] >ffff88802fe55b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  177.309893][ T9465]                                            ^
[  177.312086][ T9465]  ffff88802fe55c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  177.314772][ T9465]  ffff88802fe55c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  177.317531][ T9465] ==================================================================
[  177.320493][ T9465] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  177.323304][ T9465] CPU: 0 UID: 0 PID: 9465 Comm: syz.1.1548 Not tainted syzkaller #0 PREEMPT(full) 
[  177.326563][ T9465] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  177.330148][ T9465] Call Trace:
[  177.331389][ T9465]  <TASK>
[  177.332447][ T9465]  dump_stack_lvl+0x99/0x250
[  177.334055][ T9465]  ? __asan_memcpy+0x40/0x70
[  177.335656][ T9465]  ? __pfx_dump_stack_lvl+0x10/0x10
[  177.337570][ T9465]  ? __pfx__printk+0x10/0x10
[  177.339193][ T9465]  vpanic+0x281/0x750
[  177.340606][ T9465]  ? __pfx_vpanic+0x10/0x10
[  177.342252][ T9465]  ? irqentry_exit+0x74/0x90
[  177.343875][ T9465]  panic+0xb9/0xc0
[  177.345173][ T9465]  ? __pfx_panic+0x10/0x10
[  177.346691][ T9465]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  177.348731][ T9465]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  177.350754][ T9465]  ? xfrm_alloc_spi+0x570/0xf30
[  177.352494][ T9465]  check_panic_on_warn+0x89/0xb0
[  177.354185][ T9465]  ? xfrm_alloc_spi+0x570/0xf30
[  177.355932][ T9465]  end_report+0x78/0x160
[  177.357446][ T9465]  kasan_report+0x129/0x150
[  177.359039][ T9465]  ? xfrm_alloc_spi+0x570/0xf30
[  177.360811][ T9465]  xfrm_alloc_spi+0x570/0xf30
[  177.362463][ T9465]  ? xfrm_alloc_spi+0x2a0/0xf30
[  177.364229][ T9465]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  177.366122][ T9465]  ? xfrm_find_acq+0x87/0xa0
[  177.367809][ T9465]  xfrm_alloc_userspi+0x70b/0xc90
[  177.369616][ T9465]  ? apparmor_capable+0x137/0x1b0
[  177.371387][ T9465]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  177.373378][ T9465]  ? __nla_parse+0x40/0x60
[  177.374917][ T9465]  xfrm_user_rcv_msg+0x7a3/0xab0
[  177.376710][ T9465]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  177.378651][ T9465]  ? __pfx___mutex_trylock_common+0x10/0x10
[  177.380760][ T9465]  ? rcu_is_watching+0x15/0xb0
[  177.382471][ T9465]  ? trace_contention_end+0x39/0x120
[  177.384361][ T9465]  ? __mutex_lock+0x335/0x1350
[  177.386088][ T9465]  netlink_rcv_skb+0x208/0x470
[  177.387770][ T9465]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  177.389626][ T9465]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  177.391420][ T9465]  ? netlink_deliver_tap+0x2e/0x1b0
[  177.393224][ T9465]  ? netlink_deliver_tap+0x2e/0x1b0
[  177.395034][ T9465]  xfrm_netlink_rcv+0x79/0x90
[  177.396702][ T9465]  netlink_unicast+0x82f/0x9e0
[  177.398449][ T9465]  ? __pfx_netlink_unicast+0x10/0x10
[  177.400292][ T9465]  ? netlink_sendmsg+0x642/0xb30
[  177.402058][ T9465]  ? skb_put+0x11b/0x210
[  177.403571][ T9465]  netlink_sendmsg+0x805/0xb30
[  177.405321][ T9465]  ? __pfx_netlink_sendmsg+0x10/0x10
[  177.407154][ T9465]  ? aa_sock_msg_perm+0xf1/0x1d0
[  177.408892][ T9465]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  177.410757][ T9465]  ? __pfx_netlink_sendmsg+0x10/0x10
[  177.412644][ T9465]  __sock_sendmsg+0x21c/0x270
[  177.414309][ T9465]  ____sys_sendmsg+0x505/0x830
[  177.416014][ T9465]  ? __pfx_____sys_sendmsg+0x10/0x10
[  177.417887][ T9465]  ? import_iovec+0x74/0xa0
[  177.419459][ T9465]  ___sys_sendmsg+0x21f/0x2a0
[  177.421130][ T9465]  ? __pfx____sys_sendmsg+0x10/0x10
[  177.422983][ T9465]  ? __fget_files+0x2a/0x420
[  177.424618][ T9465]  ? __fget_files+0x3a0/0x420
[  177.426249][ T9465]  __x64_sys_sendmsg+0x19b/0x260
[  177.427969][ T9465]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  177.429946][ T9465]  ? rcu_is_watching+0x15/0xb0
[  177.431670][ T9465]  ? do_syscall_64+0xbe/0x3b0
[  177.433286][ T9465]  do_syscall_64+0xfa/0x3b0
[  177.434903][ T9465]  ? lockdep_hardirqs_on+0x9c/0x150
[  177.436715][ T9465]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  177.438878][ T9465]  ? exc_page_fault+0x9f/0xf0
[  177.440529][ T9465]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  177.442589][ T9465] RIP: 0033:0x7f3eb8d8eba9
[  177.444154][ T9465] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  177.450802][ T9465] RSP: 002b:00007f3eb6ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  177.453722][ T9465] RAX: ffffffffffffffda RBX: 00007f3eb8fd5fa0 RCX: 00007f3eb8d8eba9
[  177.456435][ T9465] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003
[  177.459250][ T9465] RBP: 00007f3eb8e11e19 R08: 0000000000000000 R09: 0000000000000000
[  177.462096][ T9465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  177.464894][ T9465] R13: 00007f3eb8fd6038 R14: 00007f3eb8fd5fa0 R15: 00007ffff996bbb8
[  177.467644][ T9465]  </TASK>
[  177.469368][ T9465] Kernel Offset: disabled
[  177.470871][ T9465] Rebooting in 86400 seconds..

VM DIAGNOSIS:
04:57:49  Registers:
info registers vcpu 0

CPU#0
RAX=000000000000006b RBX=000000000000006b RCX=0000000000000000 RDX=00000000000003f8
RSI=00000000000012d3 RDI=00000000000012d4 RBP=00000000000003f8 RSP=ffffc90006b569f0
R8 =ffff888020658237 R9 =1ffff110040cb046 R10=dffffc0000000000 R11=ffffffff854f9ec0
R12=dffffc0000000000 R13=ffffffff99b02906 R14=ffffffff99df7420 R15=0000000000000000
RIP=ffffffff854f9f3c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f3eb6ff66c0 ffffffff 00c00000
GS =0000 ffff8880b8613000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000540 CR3=0000000113188000 CR4=000006f0
DR0=0000000000000000 DR1=0000200000000300 DR2=0000200000000300 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f3eb8fa7498 00007f3eb8fa7470 XMM03=00007f3eb8fa74a8 00007f3eb8fa74a0
XMM04=00007f3eb9b0d100 00007f3eb8fa7460 XMM05=00007f3eb8fa7478 00007f3eb8fa74c0
XMM06=00007f3eb8fa74b8 00007f3eb8fa74b0 XMM07=00007f3eb8fa74a8 00007f3eb8fa74a0
XMM08=0000000000000000 00007f3eb8e12ee7 XMM09=0000000000000000 00007f3eb8e12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff82093019 RBX=000000000002afdd RCX=ffff88802253b980 RDX=0000000000000000
RSI=0000000000012a4d RDI=000000000002afdd RBP=ffffc90003a1f600 RSP=ffffc90003a1f360
R8 =ffff8881102ea243 R9 =1ffff1102205d448 R10=dffffc0000000000 R11=ffffed102205d449
R12=ffff88802302b680 R13=000000000013ffff R14=0000000000012a4d R15=800000002afdd007
RIP=ffffffff81bfc100 RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00005555610f2500 ffffffff 00c00000
GS =0000 ffff8881a3c13000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fba4dd056c0 CR3=0000000023dd4000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f3eb8e12e53
XMM06=0000000000000000 00007f3eb8e12e4d XMM07=0000000000000000 00007f3eb8e12e61
XMM08=0000000000000000 00007f3eb8e12ee7 XMM09=0000000000000000 00007f3eb8e12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
