last executing test programs:

1.857665338s ago: executing program 2 (id=6288):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x2, 0x0, 0x0, 0x7, 0x8}, {0x12, 0x3, 0x0, 0x1, 0x1, 0x400}, 0xa5, 0x4, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xf}, {0xd, 0xa}, {0x6}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x7, 0x10001, 0x3, 0x0, 0x7}, 0xf0, 0x1, 0x8, 0x3, 0x88a, 0x9, 0x8e, 0x1f, 0x3, 0xff, {0x4415, 0x2, 0x800, 0x5, 0x0, 0x5}}}}]}, 0x78}}, 0x4000) (async)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) (async, rerun: 32)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000100)={0x3, &(0x7f0000000000)=[{0x50, 0x7, 0x48, 0x1}, {0x28, 0xd8, 0x76, 0xfffff024}, {0x6, 0x26, 0x4, 0x207}]}, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r6) (async)
sendmsg$NL80211_CMD_STOP_NAN(r6, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, 0x0, 0x200, 0x70bd26, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x75}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x5}, 0x40)
sendto$inet6(r5, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

1.77809388s ago: executing program 2 (id=6289):
r0 = socket$kcm(0x10, 0x3, 0x10)
recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x10000)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="140000001000010000000000000000000025000a20000000000a01030000000000000000010000000900010073797a30000000003c000000090a0104000000000000000001edffff07000a40000000c79a9213876e6348d01c0b4227e4d1000900020073797a32000000000900010073797a30000000000800054000000003580000000c0a0102000000000000000001000900020073797a32000000002c000380280086d700000000000000001c000b801800018007000100637400000c00028008000140000000000900010073797a300000000014000000100eb6d34fd8e73a7f9f165e4e9116b900010000000000000000000000000a0000"], 0xdc}}, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'hsr0\x00', <r2=>0x0})
r3 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021a5553f8c6b23cbff070000e5373526a01edb"], 0x1c}, 0x1, 0x0, 0x0, 0x48050}, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0xfffffffffffffd4e)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES8=r4], 0x20}}, 0x0)
ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000140))
sendmsg$nl_route(r5, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0)
sendmsg$nl_route(r4, 0x0, 0x0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
recvmmsg$unix(r3, &(0x7f0000002380)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000002c0)=""/4096, 0x1000}], 0x1}}], 0x4000000000003b9, 0x26022, 0x0)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00'}, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0x0, 0x6}, {0x13}}}, 0x24}, 0x1, 0x0, 0x0, 0x24004000}, 0x20044810)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000380)="1400000036000b63d25a595c779f10ce0630fc60", 0x14}], 0x1}, 0x0)

1.632405009s ago: executing program 2 (id=6292):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000020000000000000003000000180000000300000000000000040000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc5c79a324b7d4b3d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x8, &(0x7f0000000b80)=@raw=[@map_val={0x18, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x6}, @ringbuf_query, @map_idx={0x18, 0x3, 0x5, 0x0, 0x8}], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000}, 0x94)
r3 = socket$phonet_pipe(0x23, 0x5, 0x2)
unshare(0xce46af93c6f8f9d1)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
ioctl$sock_inet_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f00000043c0)={'tunl0\x00', {0x2, 0x4e23, @empty}})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000)
socket$nl_generic(0x10, 0x3, 0x10)
r5 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000240)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14140e05251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b7800000000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=@ipv4_delrule={0x1c, 0x21, 0x1, 0x0, 0x25dfdbfe}, 0x1c}}, 0x44044)
bind$alg(0xffffffffffffffff, &(0x7f0000000500)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(camellia)\x00'}, 0x58)
socket$nl_netfilter(0x10, 0x3, 0xc)
listen(r3, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001ac0), 0xffffffffffffffff)
r9 = socket$kcm(0xa, 0x5, 0x0)
setsockopt$sock_attach_bpf(r3, 0x29, 0x6, &(0x7f0000000040)=r0, 0x4)
sendmsg$kcm(r9, &(0x7f00000000c0)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x3, @remote, 0x5, 0x4}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000080)='n', 0x1}], 0x1}, 0x2600c055)
sendmsg$NL80211_CMD_STOP_NAN(r7, &(0x7f0000001b80)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001b40)={&(0x7f0000001b00)={0x20, r8, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x7, 0x6}}}}, ["", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4044801}, 0x0)
sendto(r3, 0x0, 0x0, 0x0, 0x0, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a09040000000000000000020000000900020073797a32000000000900010073797a30000000fc43552a3f575381800b00010065787468647200002c681f39e53f95831692c1ab3cd422702c000280080007400000000c05000200000000000800034000000a4a"], 0x94}}, 0x0)
r10 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)={0x3c, 0x2d, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x800}, @nested={0x25, 0x11, 0x0, 0x1, [@generic="9e15c00619065e963eba3ef94d765eb501e2e4bea6b8d14b16632741a5bb965fe0"]}]}, 0x3c}], 0x1, 0x0, 0x0, 0x4000040}, 0x300)
sendmmsg$inet6(r1, &(0x7f0000002980)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x9, @empty, 0x7ff}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000100)="cd56a29e88ae991996c7820b022834a681dbabd667f730f5b9a88f0bf47645e343e59847432e05ef6809961e5cfe05c3682ea556eb95b06a40f640621a2d91dcc7e68374222c109411", 0x49}, {&(0x7f0000000200)="63ffcd86b3a7d7413b30ce26682c7853a118e7c8e89ee67802de6026c7485a83fa8319ae8daf9205b93eb53b1abfaf76f3acf78c69d7b4caede667f2a5810f9ad3638f62684fb8ba93686af56264e50bcd9260d7e744584dfe39dd3976204276a9ceced763cd5bb1b0a36cedaf642c995a50f04317fbd9459aa9285a753707317e64b186c8e716037eaeb2c03aa4c2ccbd81c0e16a28d6b34d69b5c66f16129917c064b601d40239dcf4f1bbbc7a605c596042997f59e13b7975b2d18ae1", 0xbe}, {&(0x7f00000002c0)="f57d043b14eb3d20b97744498eeb0c3c6c9617976631f514c0492e88c5eb5777d5e4b7097345f360077d8b5676d8db2e00dfdc4d49e425d6a86a988a1942", 0x3e}, {&(0x7f0000000300)="b056002d307cfbe3eeaaca77627f10431d29a9702df81cb9e1bda49ccf9d4eb7ecbd221731c1b27c43138fb9878204963ecf7b63402bdf99e7e2a2929de933c1269426e7c7f3b52ec9a2210c7bee98412942b59c570f60249800d9307d4a248209b914d85b9c943c0fc2bd42c5b35ee9ad8254c60601ff178c1a0f1344a80ac130442e4c1a2b66c4c39530176f78b98d0096a7dc092cf15076c3b638976963171248551b6bc06b5a1e7504418a473ec7a2b6a0f0ccd27d7870ef171b5dca22777fe20afc79f24e6412ede82a7f86e20aeb4c72cc3362589138cac16a0026ec6a5fb6", 0xe2}, {&(0x7f0000000400)="423ba58f2d6b461d2c98b612e40b3b6bd246498e0c633ba90e6efa31f22a3df5aaf62edd594fed81c85ac72b7daca3ccb82b94fd85724d8364a744e99e05554695f04cae9a6534a7c313939b2fa3bb5e74f0b76cab1c", 0x56}], 0x5, &(0x7f00000006c0)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0x80}}, @hopopts={{0x40, 0x29, 0x36, {0x3b, 0x4, '\x00', [@hao={0xc9, 0x10, @private0}, @hao={0xc9, 0x10, @empty}]}}}], 0x58}}, {{&(0x7f0000000740)={0xa, 0x4e21, 0x2, @remote, 0x1}, 0x1c, &(0x7f0000000640)=[{&(0x7f0000000780)="1cd6cb9ac71b9f1bab2658cc0f718d532a4cdb220b90714d1785fa4c20ecef9cfbeed2d64fca6d088abd04dbbe08f18f939bca567547139e7212ab592697f539", 0x40}, {&(0x7f00000007c0)="f97a967481e4d6cc36da70d876912f4a84048ba5063e6ef7c02d5c2008a6e768e7057e03d2e949fda6090b51d75cf9161dc38ff3cc89fda0940304743298ecbf794b57e9e4f80fa8d85f0cef9f9468158beb2a38903cb5c20288cf08ab06ed99d5baf4a1e5499296ffca657040cec61efd8fb30d0484e1f3bf37261c66e58eba7bee939eadc5fec7d33297e992bac99ecaa8243d33c5fa3a7daa6d9ab01483452a30f357f75b798500e567e77d7e7d24d4abdb57e00ebbf4080a7aa7", 0xbc}, {&(0x7f0000000880)="6f0015", 0x3}], 0x3}}, {{&(0x7f0000000900)={0xa, 0x4e24, 0x81, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, 0x1c, &(0x7f0000001a40), 0x0, &(0x7f0000002b40)=ANY=[], 0x118}}, {{&(0x7f0000001bc0)={0xa, 0x4e23, 0x6, @private0, 0xe0d}, 0x1c, &(0x7f0000001cc0)=[{&(0x7f0000001c00)="5fc935659040d11ece2070b33dae41a8271ae1b8b9207bc9d13ea80841a8f4e1ace56b8f4c1fb47e10c376f4ed8eead3bdc17c73964c6e65b9f8934e4b6b7cb6a2d8e3076c1cd9a6c7b4825dfa7b7c0d3135331b21b7b75d7a5988dae3d138fccdd85ca90d5ebdb0b8", 0x69}, {&(0x7f0000001c80)="2ae2cace52f1e8482e8f57569f02991dd6fcaf8c0f53219b72a58b8c7307c2e304dd5ca0d3b937", 0x27}], 0x2, &(0x7f0000001d00)}}, {{&(0x7f0000001ec0)={0xa, 0x4e23, 0xb, @private0, 0x9}, 0x1c, &(0x7f0000002080)=[{&(0x7f0000001f00)="a42f93767b3b9970f25322dc94e54b4116de78f703f81717a1d0d93fb2cd9217bd43fe9af80e22e77d70885ff8f54c8c1d319030f6ead00aa58484c5ac59ee63df1baf07b3f4c68b8be734228c9d2de270fcd318eb3f0cee1e92c8caec0c26918b19f31dee79a588", 0x83}, {&(0x7f0000001f80)="9ac68b18e013daa65dae0de5dda36e0e7e3b1479c7e0f69dc3dc6b6ac449a4b375c46209782c81ce86b88040f36817fcf3bb7bde3ebc3ebb5f3617e3cbac19e439070832ebbd2bade28684ae3ab6dfacf8e1378f7ee58073c49633ee2cb15c53f2750947310d61b70b68ec69368eb217a24a6d811887921b1faaaf124b3b5a080cce31bae1e36e78b6a1f54647682ca2820a86b09fb06a64ccf590df6fea9a29f1c8663df609f3fd77e6b1c27d5a30ac086130fa4d1591faf2ddccfe49257dd064ff0c738ceceea601601224f4098d55036e2411edc5394aacd1229b4a4ca277615b305c481e4002458ee15d5d5f4386fcaffe95c6", 0xf5}], 0x2, &(0x7f0000000940)=ANY=[@ANYBLOB="140000000000000029000000340000000200000000000000580000000000000029000000390000000008000000000000ff020000000000000000000000000001ff020000000000000000000000000001ff02000000000000000000000000000100000000000000000000ffff64010100b0010000000000002900000037000000013200000000000000010003423c3a832455661b508e7b8f62c6d4f7cd79687fa61045da95e3b2ec78c57c8d2eb83cb649028d0ac3c27f109ed05b5bdb2744203808fe1c1872b480fec469573cae86184140ef4f35dd54b043f0a6286c218903404f8302a5ff575394f33fbeb15b8d0b5d626a9fa8fba632d51597e22608d7751c8a4a8598e5b15f93f3164cacc35884177fbf6ff9b57ec17b6f2146c1b6bb7711f09a0eee55b3c042166e22d776fb5a0497e550e015a8f3e31d186b7da79e303ebc9ac36190861d060bccfa9ae4d2d39f83726c78dcf5ac242660c17b3d6a6ec5a97ff1eaa4fb48df883aa4c3ea0043367c3d1e9e6fb20871d3740df0ca421b331713a57518acc847be516fbb95344135762f769153420dbcf616a4d7ba62b1f421b0337b90ada8f3c83ab84954f09ecdbc0e192f36aa5f8796dac84d32179f6900743feb71b8aab601030708000000000080a100203bd62e7525a0b10b8fd477889a4d1b08743e73fc3b972403114656ea9cf7582845586f6223f2bdbc37fa4534c019384ddf79ae02da7d0bc83e3b56b200000000000000"], 0x220}}, {{&(0x7f0000002180)={0xa, 0x4e21, 0x12e, @loopback, 0x10001}, 0x1c, &(0x7f0000002380)=[{&(0x7f00000021c0)="5b22f3358dc681d9fc6e91c9b4f747e1c0ed760f87b2b77c5249baeca7f373de9af3729857c760cdfb2e930cf0b2745137323e091682a67cdfde9b2787e66093a5969bd5c00cb629877762790ae20ddfc4f7ab6e66d6e77972ec4e34b0594d2a78e400a8dd55500e5abea31e619a6757f0a51365609dca914f57ac3209be184ab232acc897916f5ed9dde5090290ea825483bff2ccbf546e5f1603283fe5974cba2f", 0xa2}, {&(0x7f0000002280)="d68ec46e1ff9c2fbbc6a288d666618655f990077b2b77e80275150b0821f1ae1fb3faba568b109f3251e3755995087871875e0e05ce9d7373e1baee65f4a59c9c79fd71c6a3859acd799beefc869af6575cacf60c745cb247613fdc6f41fffd2060122d3c9f05974d5b5723424ede041b3570cf2ef8b7f425a80b8f5b6883c9aa092ca56f9a668f98cd0174da871aeadd18f40c498f16f785a77bef6eaa7036b20fbd3fead6553a8c8dac8aaa18a57509f4b736742d69991eeaebaf9a830b27698c1a4a420cfd5b85e93040924dde1e06dd3368fcd8339514fc619b34497886fa8ced7f30662151f72f5a6fdcad5f63518a9f7f0f4fc90b914dc", 0xfa}], 0x2, &(0x7f0000002500)=[@rthdrdstopts={{0xa0, 0x29, 0x37, {0x21, 0x10, '\x00', [@enc_lim={0x4, 0x1, 0x6}, @generic={0x8, 0x75, "3e2ed3ebef52da2b55c2b7572f7ea255a2f475299d2f43a5ab805c8b814bdc49553c9f5b8fd5f26e44b525fd5093fba561ce875e49e95c32243c3b62b97edab565106617097b4722e661672ac4dfc1bee910630cd3ac81d473404cf0cffd67cdf1dcd9c4ff600a5b748309df733d6451b65bd118a7"}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x7fffffff}}, @pktinfo={{0x24, 0x29, 0x32, {@remote}}}], 0xe0}}, {{&(0x7f0000002600)={0xa, 0x4e21, 0x5, @empty, 0xaeb}, 0x1c, &(0x7f0000002740)=[{&(0x7f0000002640)="2181ed494d3a418e25afa433f300c4dc916ebac9c35be6fc2c17489d800b439b50d3e660925e8c619b2127ab5cb5c7a551ef8a21b3235a3bbcb12b162eb36272fce5511f57013a50b01f47dc4576cc245b81214a0638d307054bcdf770f97cedf23b3268a4f7fe32791bb5abc56411d0a0aa52e181e1b1ae14924f12b61eb8a993c3f7d50b242462311413b9718e91ac19f25ff21aa72e2e81543b0eef148db0a777334f08e9dedb2cc97cda7b97546eec7d274b1caa665a54161ba47e9b25625f45f3a9394bbc7c1c2b3a3c4f142ac2b568341caf34fba6e464cb24c842bf19fbaefeda8b6140071ce000da2ff7893c079b400008", 0xf5}], 0x1, &(0x7f0000000940)}}], 0x7, 0x40020)

1.314607922s ago: executing program 1 (id=6294):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NFT_BATCH(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000b00)=ANY=[@ANYRESHEX=r0, @ANYRES64, @ANYBLOB="56032bc8b3b454198cfe8e210f443f4c1ae75d33bf21ce4e8053417b1d4ab40ff4a1cb3e2b17b7c7fc137676650837b3e5c7287a59ed4966afbeac960c9c0866399cae0563ea22", @ANYBLOB="9c812a0d3c8fe6cbb9b3c3145bc827002603024fc3549524883d33f4d1b4f3485f9f07a1e020d6852c3975236db8634749b2dc2f0fdee2a2bc23fb11d9e911393b0997290f3f960d3de4c60f137fc1a42c05f35d329e2b6e9c54c76099606aea08880e7cbfdda165e9a75b7d8c528323d9c6f04a0349120c5a83192e20369fb89fa07e67993c978fcb60ee73fde857cdbb2433236cf30163f4935ec1afba0f74e42424cc585c", @ANYRES16=r5], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001040)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000800)="3aae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dea658eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff690894405a0b6abc3c4d0f6a16c0a95c0508bd7eeffcd1da0b17f7701448658864b429e9472edfeffbf34d6e7c78f4aa73c0", 0x2de}, {&(0x7f0000000300)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef0355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9061f52d674267bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0768021fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a6e453a8a28cd5c4b733fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d5407000000f5dbaa8ae8835dc47ed2537681827f6129759272574cf58f2f33e47a0e416573cfdcfb44ed9dd4ce41af4de9c471c49f12f090934c3b32f2f4777c65b1574826727f5f62774bffc67d5d906cd6cafc949930024b467f9daa96ab2a29eb029cd76c3c1caa005461d4f99023716f747f697f02824b2e1f85e289142f3bd534bc2d5ac09cf597d83f3a3295a6d3d8a4415a8aa0aa9ded7e40a107b0d1e8d7bb25b23d9ba3a65a00"/604, 0x25c}, {&(0x7f0000000240)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d859207067c10aa7352abbdf98e9bf033a3184a11e84639d3b9164d9c5d729f3dd409d39ff041e65", 0x46}], 0x3, 0x0, 0x0, 0x900}}], 0x2, 0x0)
getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newqdisc={0x4c, 0x24, 0xe0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xfff3, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x1c, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x842}, @TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x3}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000021}, 0x4044080)
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @remote}, 0x14)
sendto$inet6(r2, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f88a806892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r1, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x58, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0xc0, 0xa}}}}, [@NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x40}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x9}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

1.236935811s ago: executing program 0 (id=6295):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r2)
sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f00000002c0)={0x0, 0x900, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="410000000000000001000603000014000300060afc04090300f006e8ffff00000001080007003a3a2f2f140002"], 0x44}, 0x1, 0x1000000}, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x1c, 0x2d, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x8, 0x18, 0x0, 0x0, @binary="08ac0f00"}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84)

847.846052ms ago: executing program 1 (id=6296):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
listen(r0, 0xfffffffc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r5 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r5, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10)
sendmsg$rds(r5, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0xc0fe, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x24, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x100}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x20000001}, 0x0)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r2, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0)

667.629342ms ago: executing program 2 (id=6297):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000000010000000900010073797a30000000000900020073797a3000000000400003800800014000000000080002400000fbff2b0003801400010067656e6576653000000000000000000014000100776732000000000000000000c6e49c0f5c000000180a0101000b000000000000010000000900020073797a30000000000900010073797a300000000030000380"], 0x110}}, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a34000000090a01080000000000000000000000030800034000000098080004400000000208000a400000000108000c40fffffff9c0000000030a010400000000000000000000000392000c001dde6a5cdbdd18e2b693e3d59eded5e89b5b038a16961b01bf4d481335cd425fd9101ccf97835f1b6f1d1ec6debf0ed3544035aad1a6ea6d845f13048ad0418733b23a4d602d299a45b28b6315009b73ce7673715d48e633417340bb4dd944b42f769ca6a950dd75baf04ae5ccb46a845ecc0dfd7945f2097af044d1afeeba6e1918d43a60157adbecc87018c15d00000a000700726f7574650000000900030073797a31000000008c000000020a010100000000000000000a00000708000240000000000900010073797a31"], 0x1a8}, 0x1, 0x0, 0x0, 0x10}, 0x8)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0xffb2)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000280)=@gcm_256={{0x304}, "3f60eb8f2777c39a", "5985e81ad0d9585bc175cbecd3f55eb699e3070cc206f3ba527c85bde06fbf19", "bc5ec28f", "b200"}, 0x38)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000051e6850000002d0000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000005e6bf02f000000180001801400020076657468315f746f5f626174616476000c000380"], 0x38}, 0x1, 0x0, 0x0, 0x4000085}, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_kthread_stop_ret\x00', r3, 0x0, 0x100000}, 0x18)
r6 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r6, &(0x7f0000001200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001100)=ANY=[], 0x100}, 0x0)
close(r6)
write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x3261e)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x4, &(0x7f0000000100)=@gcm_256={{}, "24747942338921a1", "d830005894bf527ae179a7173985202bbfb61b36f3678de8ea2d0d6616076243", "5615d9f5", "7c5cec21291a43fe"}, 0x38)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="180000002d00090027bd7000000000000400000004001800ae611e111273429d7ab702a94070d45fd372553e11895b80f6d788c7d812be15281790dac9dbecceb5ab4cd8ce72b38983da4736f3ac3c49da1fe4f12a8b0d9d8700bac4db3910b5ea4189eb03f62bd569f39713595542206ea3c6f82a473684f1939a981a4a658dc28b3d0a99ad7cd3078aea28315fd2eda8c43ad871ffa3af2065aad6a369003c986d67e75e05ebad3749fd5ca7eff354858ae62c4cd237a8cfc6faa74e64b6"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x84)
r8 = socket(0x2b, 0x1, 0x0)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_REG(r4, &(0x7f0000000600)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000700)={0x4c, 0x0, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@NL80211_ATTR_REG_RULES={0x4}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x62}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x5}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x65}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0x22000001}, 0x20000042)
sendmsg$NL80211_CMD_LEAVE_MESH(r9, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10080}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x74}}}}, [""]}, 0x28}}, 0x8810)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'bridge0\x00'})
setsockopt$inet_int(r8, 0x0, 0x3, &(0x7f0000000000)=0xda, 0x4)

667.003604ms ago: executing program 0 (id=6298):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$phonet(0x23, 0x2, 0x1)
ioctl$SIOCPNDELRESOURCE(r1, 0x89ef, &(0x7f0000000200)=0x10000)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c004000c1e92d00090027bd700000f1ffff03000000070018007b5e0000"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84)

575.191619ms ago: executing program 1 (id=6299):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'bridge0\x00', <r4=>0x0})
sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=@bridge_getneigh={0x28, 0x1e, 0x3c964e403b131b43, 0x0, 0x0, {0x7, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$gtp(&(0x7f00000020c0), r5)
sendmsg$GTP_CMD_NEWPDP(r5, &(0x7f0000002200)={0x0, 0x0, &(0x7f00000021c0)={&(0x7f0000002140)={0x38, r6, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x1}, @GTPA_VERSION={0x8}, @GTPA_LINK={0x8}, @GTPA_FLOW={0x6, 0x6, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x80)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0)
sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000380)={0x50, r6, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r7}, @GTPA_FAMILY={0x5, 0xd, 0x25}, @GTPA_FAMILY={0x5, 0xd, 0x8}, @GTPA_VERSION={0x8}, @GTPA_FAMILY={0x5, 0xd, 0x1a}, @GTPA_TID={0xc}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4080)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000000)={'syztnl1\x00', &(0x7f0000000180)={'syztnl2\x00', r4, 0x20, 0x10, 0x80000001, 0xe, {{0x16, 0x4, 0x0, 0x2, 0x58, 0x65, 0x0, 0xff, 0x2f, 0x0, @private=0xa010102, @multicast2, {[@timestamp_prespec={0x44, 0x34, 0xe3, 0x3, 0xc, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x80000000}, {@dev={0xac, 0x14, 0x14, 0x43}}, {@loopback, 0xc8}, {@local, 0x2}, {@multicast1, 0x10001}, {@rand_addr=0x64010102, 0xe0000000}]}, @rr={0x7, 0xb, 0x84, [@multicast1, @empty]}, @noop, @noop]}}}}})
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00'})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)={0x1c, r1, 0x100, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000040}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

574.542135ms ago: executing program 2 (id=6300):
syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201})
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff0200000e0000000000000000000001"], 0xfdef)

447.769777ms ago: executing program 0 (id=6301):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0x80000000, 0x1}}, 0x20) (async)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x14, 0x10, &(0x7f0000000300)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@call={0x85, 0x0, 0x0, 0x11}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000400)='syzkaller\x00', 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r2}, 0x10) (async)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
bpf$MAP_CREATE(0x300000000000000, &(0x7f0000000080)=@base={0x1c, 0x4, 0x41, 0x0, 0x1, 0x1, 0x11, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x6}, 0x50) (async)
sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274140000001100"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async)
r4 = socket$netlink(0x10, 0x3, 0xc)
bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async)
r5 = socket$nl_sock_diag(0x10, 0x3, 0x4)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000540)=0xffffffff, 0x4) (async)
setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000200), 0x4) (async)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x8}, 0x48) (async)
r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r8}, &(0x7f0000000340), &(0x7f0000000380)=r9}, 0x20) (async)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r9, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50)
sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}]}, @CTA_TIMEOUT={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x40054}, 0x0) (async)
sendmsg$IPCTNL_MSG_CT_DELETE(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040)
r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r4)
sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, r10, 0x100, 0x70bd2d, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0x18, 0xfffffff7, @l2={'ib', 0x3a, 'wlan0\x00'}}}}, ["", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x4008001}, 0x8005) (async)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$TIPC_CMD_GET_BEARER_NAMES(r11, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x1c, 0x0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24002001}, 0x20000000) (async)
sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f00)={0x40, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_KEY={0x4}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000)
r12 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="640000000206010000000000000000000100000214000780080012400000000505001500060000000500010006000000050005000a00000005000400000000000900020073797a300000000016000300686173683a6e6574"], 0x64}, 0x1, 0x0, 0x0, 0xc0d1}, 0x0)

445.815719ms ago: executing program 1 (id=6302):
socket$inet6_udplite(0xa, 0x2, 0x88)
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) (rerun: 64)
sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000003000000400001"], 0x54}}, 0x0) (async, rerun: 32)
socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32)
socket$inet_tcp(0x2, 0x1, 0x0) (async)
r2 = socket$kcm(0x29, 0x2, 0x0)
write$cgroup_pressure(r2, &(0x7f0000000140)={'full'}, 0xfffffdef) (async)
ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x5452, &(0x7f0000000000)) (async)
ioctl$int_in(r2, 0x5452, 0x0)
socket$inet6(0xa, 0x80003, 0xff)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f00000000c0)='percpu_alloc_percpu\x00'}, 0x10)
ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000000c0)) (async, rerun: 64)
socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64)
socket$inet_sctp(0x2, 0x5, 0x84) (async, rerun: 64)
syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) (rerun: 64)
sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x38}}, 0x4) (async)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) (async, rerun: 64)
listen(r3, 0x3) (rerun: 64)
setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) (async, rerun: 64)
syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) (async, rerun: 64)
syz_emit_ethernet(0x4a, &(0x7f0000000480)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x10, 0x3, 0x0, 0x0, {[@md5sig={0x13, 0x12, "d242d7728c9386c4a0ac7e05bafbae38"}]}}}}}}}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x19, 0x4, 0x4, 0x20002, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000008000000060000000010"], 0x48) (async)
r5 = socket(0x10, 0x80003, 0x0) (async, rerun: 64)
r6 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 64)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000100000e00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) (async, rerun: 32)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@bloom_filter={0x1e, 0x0, 0xa, 0x89c8, 0x40401, r4, 0x7f, '\x00', r7, 0xffffffffffffffff, 0x4, 0x0, 0x3, 0x2}, 0x50) (rerun: 32)

353.787279ms ago: executing program 0 (id=6303):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@remote, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x8, 0x0, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8}, {0x0, 0x8}}}, 0xb8}}, 0x40080c4)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000002900)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x13}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x60}}, 0x40000010)
listen(r0, 0xfffffffc)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
r6 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=ANY=[@ANYBLOB="3ffdffff10005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0096002dda51f95fa20d3a"], 0x28}}, 0x0)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x100}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x20000001}, 0x0)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r5, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0)

353.402924ms ago: executing program 2 (id=6304):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000002d00010026bdf000fcdbdf25041a0000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
socket$packet(0x11, 0x2, 0x300)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r2 = socket(0x10, 0x803, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x200, 0x70bd2a, 0x1, {0x0, 0x0, 0x0, r4, {0xfff3, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0)
r5 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001380)=@newtfilter={0x24, 0x2c, 0x800, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r6, {0x4, 0x4}, {0x6}, {0x1, 0xf}}}, 0x24}}, 0x20040054)
r7 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
r9 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r9, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, 0x0, 0x0)
r10 = accept4(r9, 0x0, 0x0, 0x800)
sendmmsg$alg(r10, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)='\x00\x00\x00', 0x3}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000240)=""/238, 0xee}], 0x1}, 0x40000000)
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x100, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0xfffffffe}, @TCA_RATE={0x6, 0x5, {0x3c, 0x3}}]}, 0x48}}, 0x0)
r11 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00'})
socket(0x2, 0x80805, 0x0)
close(0x3)
r12 = socket$packet(0x11, 0x2, 0x300)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2, 0x13, r12, 0x0)
r13 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
setsockopt$X25_QBITINCL(r13, 0x106, 0x1, &(0x7f0000000000), 0x4)

287.802786ms ago: executing program 1 (id=6305):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10)
r1 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@assoc={0x18, 0x117, 0x4, 0xbf}], 0x18}, 0x0)
sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0)
recvmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/229, 0xe5}, {&(0x7f0000000840)=""/127, 0x7f}], 0x2}}], 0x1, 0x60, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x1c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0)
sendmsg$NFT_BATCH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000050a0900000000000000001d020000000900010073797a30000000000900030073797a32"], 0x54}}, 0x0)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r5=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x2c, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x2c}}, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000240))
r6 = socket(0x10, 0x803, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201})
r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
bind$inet6(r8, 0x0, 0x0)
r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="020000000400000006000000aa0b000000000000", @ANYRES32, @ANYBLOB="000000000040000000000000000000000000000051c29d4ddbb45b4e6f93f6e0e0bf8e7bed17959d045c53952c054e9e98f5dfea35427bc6d736d37eb07bebc6f0a0125f166728179244fce74ca11a7564e8d4deaf12d87c547485579a042be45a1ed3a977620004830121ef190810fb59b7556638773370d999a7989e7cbb12a86f74bbfb1e29d31d1f9f42713d7a71169db9e385575cbd8be755cce58382d73422cc4db5a203b2b941d274f2a50939dc56d162da1fdbebad68ddfdf0db51d768cf9984b755e1100cf7c9f3afee7f60e67f763bfa39a282cf7c180676", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0xa7c, r9, 0x5133c4bf67cd92a7}, 0x38)
r10 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000040)={0x0, 0x5f, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000014000780080008400000000008001240ffffffe80500010006000000050005000200000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x5c}}, 0x0)
r11 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local})
write$tun(r7, &(0x7f0000000080)=ANY=[], 0xfdef)
sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0)

107.523753ms ago: executing program 0 (id=6306):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000002b000b0000000000000000000800001008000300040001000c0001800600000088480000"], 0x28}}, 0x8000)
bpf$PROG_LOAD(0x5, 0x0, 0x0) (async)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000680)={'wlan0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000680)={'wlan0\x00', <r2=>0x0})
r3 = socket(0x10, 0x803, 0x0)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58) (async)
bind$alg(r4, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) (async)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440)
r5 = accept4(r4, 0x0, 0x0, 0x0)
ioctl$SIOCRSGCAUSE(r3, 0x89e0, &(0x7f0000000440))
sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x7bff, &(0x7f0000000180)={&(0x7f0000000140)=@delqdisc={0xfffffffffffffc9b}, 0x49d32d254ae22f79}}, 0x0)
getsockopt$sock_buf(r5, 0x1, 0x1a, 0x0, &(0x7f0000000340))
clock_gettime(0x0, &(0x7f0000000880)={<r6=>0x0, <r7=>0x0})
recvmmsg$unix(r5, &(0x7f0000012b80)=[{{&(0x7f00000005c0)=@abs, 0x6e, &(0x7f0000000740)=[{&(0x7f0000000640)=""/20, 0x14}, {&(0x7f000000d280)=""/4096, 0x1000}, {&(0x7f000000e280)=""/4096, 0x1000}, {&(0x7f0000000680)=""/141, 0x8d}], 0x4, &(0x7f0000000780)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, <r8=>0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x60}}, {{&(0x7f0000000800), 0x6e, &(0x7f000000f480)=[{&(0x7f000000f280)=""/166, 0xa6}, {&(0x7f000000f340)=""/162, 0xa2}, {&(0x7f000000f400)=""/72, 0x48}], 0x3, &(0x7f000000f4c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f000000f540), 0x6e, &(0x7f0000000500)=[{&(0x7f000000f5c0)=""/186, 0xba}, {&(0x7f000000f680)=""/238, 0xee}, {&(0x7f0000000b40)=""/4110, 0x100e}, {&(0x7f0000010780)=""/121, 0x79}, {&(0x7f0000010800)}, {&(0x7f0000010840)=""/4096, 0x1000}, {&(0x7f0000011840)=""/194, 0xc2}, {&(0x7f0000011940)=""/4096, 0x1000}, {&(0x7f0000012940)=""/176, 0xb0}], 0x9, &(0x7f0000012ac0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x98}}], 0x3, 0x60, &(0x7f0000012c40)={r6, r7+10000000})
sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async)
sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0)
r10 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=r2, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r9], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) (async)
sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=r2, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r9], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000)
socket$nl_route(0x10, 0x3, 0x0) (async)
r11 = socket$nl_route(0x10, 0x3, 0x0)
r12 = socket(0x1, 0x803, 0x0)
getsockname$packet(r12, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) (async)
getsockname$packet(r12, &(0x7f0000000100)={0x11, 0x0, <r13=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
r14 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(r14, 0x8004f50c, &(0x7f0000000240))
r15 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_netrom_SIOCDELRT(r8, 0x890c, &(0x7f00000003c0)={0x0, @default, @rose={'rose', 0x0}, 0x9, 'syz0\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xd2, 0x7, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]})
ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'veth1\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'veth1\x00', <r16=>0x0})
sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c000000100003041b00"/20, @ANYRES32=0x0, @ANYBLOB="46060900000000001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r16, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r13], 0x4c}, 0x1, 0x0, 0x0, 0x600}, 0x0)

106.108593ms ago: executing program 0 (id=6307):
socket$inet6(0xa, 0x1, 0x84)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000011006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac004000202080002000300010004000300eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0xa, 0x4, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x0, 0x9e}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00}, 0x94)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
r2 = socket$qrtr(0x2a, 0x2, 0x0)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90)
r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r3}, 0x10)
read(r4, 0x0, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000380)={'wlan1\x00', 0x8000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r8=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], 0x0}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r9=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYRES64=r9, @ANYBLOB="060184530f5a4ba03c1bb79a4ee631b8a263e74070a3628496588dee4c4b08d821d9e74c575792c7014e400aae06089b86b4abda58e69a18087bdb238294c6d5f61d5d306fd299f8f664acd4a222d66c", @ANYRES8=r8], 0x28}}, 0x40041)
socket$kcm(0x10, 0x2, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001c0001000000000004086aa42d"], 0x30}}, 0x0)
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0)
ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r11 = socket(0x400000000010, 0x3, 0x0)
r12 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r13=>0x0})
sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x10000001, 0xfffffffa}}}}]}, 0x44}}, 0x0)
sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000ac0)=@newtfilter={0x50c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfa, {0x0, 0x0, 0x0, r13, {0xfff3, 0xffe0}, {}, {0x5, 0x8}}, [@filter_kind_options=@f_fw={{0x7}, {0x4e0, 0x2, [@TCA_FW_POLICE={0x4c, 0x2, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xf92b}, @TCA_POLICE_TBF={0x3c, 0x1, {0x400, 0x6, 0x4, 0x734, 0x909, {0xc, 0x0, 0x6, 0x2, 0x5, 0x3}, {0x5, 0x0, 0x8, 0x96, 0x5, 0x3}, 0x3, 0x10000, 0x6}}]}, @TCA_FW_INDEV={0x14, 0x3, 'gretap0\x00'}, @TCA_FW_POLICE={0x414, 0x2, [@TCA_POLICE_RATE64={0xc, 0x8, 0x7}, @TCA_POLICE_RATE={0x404, 0x2, [0x6, 0x9, 0x7, 0x0, 0x7, 0x8, 0x2, 0x0, 0x2, 0x1, 0x3, 0x6, 0xfffffbff, 0xfffffffb, 0xffffffff, 0xc36, 0x7, 0x7f, 0x100, 0x1, 0x6, 0xd5, 0x0, 0x4, 0x7, 0x6294, 0xffffff2c, 0x200, 0x8, 0xb, 0x6, 0x0, 0x7, 0x2, 0x1, 0x9, 0x2, 0x3, 0x2, 0x40, 0x21e2, 0xfffffffc, 0x8, 0x9, 0xfffffffa, 0x5, 0x101, 0x8, 0x2, 0x6, 0x7, 0xffffffff, 0x2, 0x4, 0x9ff, 0x10000, 0x4, 0x5c, 0xffff, 0x5, 0x76, 0x6, 0x7, 0x3, 0x950, 0x5, 0xfb, 0x9, 0x6, 0xffffffff, 0xd, 0x80000001, 0x25852140, 0x5, 0x3a78, 0x2000200, 0x8, 0x8, 0x4, 0xfffffffc, 0x3, 0x200, 0x1000, 0x6, 0x4, 0xbd1e, 0x4, 0x5, 0x9, 0x1, 0xfffffff7, 0x3, 0xdb15, 0x9, 0x9c2, 0x3, 0xf7, 0x4, 0x3ff, 0x8, 0xc1a, 0xc03, 0x4, 0x8, 0x4, 0xd, 0x6, 0xffff, 0x51a, 0x0, 0x1ff, 0x11e, 0x6, 0x9, 0x0, 0x7b, 0x0, 0x331, 0x2d, 0x0, 0x5, 0x101, 0xfffffdd9, 0x4, 0x10000, 0x7c, 0xffff, 0x118, 0xffffffff, 0x5, 0x80, 0x49, 0x8, 0x2, 0x8, 0x9, 0x2, 0x4, 0x25, 0x800, 0x8, 0x101, 0xfffffffc, 0x6e9bf90c, 0x7, 0x5, 0xfffffffc, 0x4, 0x0, 0x2fa6, 0xd, 0x10001, 0x3, 0x6, 0x5af, 0xa, 0xb9, 0x7, 0xfffffffe, 0x8, 0xd, 0x1, 0xc, 0x4, 0x4, 0x8, 0x0, 0x4, 0x4, 0x4, 0x9, 0x1ff, 0x8, 0x7f, 0x81, 0x7, 0x9, 0x7f, 0xf, 0x5f42, 0x200, 0x6, 0x800, 0x9, 0x6, 0x8, 0x5, 0x6, 0x10001, 0x70000, 0x1, 0x3, 0x6, 0x3, 0x3, 0x410d, 0x0, 0x27, 0x2, 0x5, 0xb5, 0x7, 0x4789, 0x6, 0x2d, 0x10001, 0x6, 0xf0e, 0xe2ce, 0x81, 0x101, 0x3, 0x8, 0x3, 0x80, 0x7ff, 0x2, 0x8cf, 0x4, 0x2, 0x0, 0x6, 0x7c353faa, 0x9, 0x101, 0x0, 0x100, 0x5, 0x1, 0x3, 0x6, 0x401, 0x819, 0x8, 0x1, 0x7, 0x8, 0x3, 0x0, 0x2, 0x4, 0x7, 0x6, 0x800, 0x101, 0x4, 0xb, 0x2, 0x80000001, 0x0, 0x1, 0x7, 0x6, 0x2, 0x64, 0x7]}]}, @TCA_FW_POLICE={0x60, 0x2, [@TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x9}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x80000000}, @TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x7, 0xfffffff9, 0x0, 0x3, {0x9, 0x1, 0x5, 0x7, 0x5, 0x9}, {0x3, 0x2, 0xf050, 0xde62, 0x8c, 0x8}, 0x2, 0x65, 0x4}}]}, @TCA_FW_MASK={0x8, 0x5, 0x8}]}}]}, 0x50c}, 0x1, 0x0, 0x0, 0x848}, 0x4000010)
ioctl$BTRFS_IOC_QGROUP_CREATE(0xffffffffffffffff, 0x4010942a, &(0x7f0000000340)={0x0, 0x1})

0s ago: executing program 1 (id=6308):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x8240, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000040)={'vlan0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}}) (async)
r1 = socket$l2tp(0x2, 0x2, 0x73)
setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000080)={@loopback, @rand_addr=0x64010101, 0x0, 0x9, [@rand_addr=0x64010102, @remote, @private=0xa010101, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @dev={0xac, 0x14, 0x14, 0x20}, @local, @private=0xa010100, @remote]}, 0x34) (async)
poll(&(0x7f00000000c0)=[{r0, 0x240}], 0x1, 0x5) (async)
sendto$llc(0xffffffffffffffff, &(0x7f0000000100)="694660cc06c9ea5b9c757beb2f09f130d2006017b2db46aa995ca5449dfa7442d83278566677779d97b47dc42a336a3b5c421eff4b3ad305762fbaee0efe7dc30bc3105886d638ea5b04", 0x4a, 0x40040, &(0x7f0000000180)={0x1a, 0x305, 0x1e, 0x2b, 0x2, 0x5, @random="32cd93a290ce"}, 0x10) (async)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000200)={0x250, 0x3, 0x1, 0x3, 0x0, 0x0, {0x2, 0x0, 0x1}, [@CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x7}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x81}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0xe}]}, @CTA_TUPLE_ORIG={0x10, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_LABELS={0x14, 0x16, 0x1, 0x0, [0x8, 0x2, 0x80000001, 0x2]}, @CTA_TUPLE_REPLY={0xa8, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0xaa}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010102}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @rand_addr=' \x01\x00'}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x3}, @CTA_SYNPROXY={0x14, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x1000}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x3d}]}, @CTA_SEQ_ADJ_ORIG={0x1c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xe1}, @CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x80}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x7}, @CTA_TUPLE_REPLY={0x9c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x15}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @private1}}}]}, @CTA_TUPLE_ORIG={0x78, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x8e}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @broadcast}}, {0x14, 0x4, @mcast1}}}]}]}, 0x250}, 0x1, 0x0, 0x0, 0x8000}, 0x81) (async)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000580)=@mangle={'mangle\x00', 0x1f, 0x6, 0x5f0, 0x3f0, 0x4c0, 0x4c0, 0x0, 0x3f0, 0x558, 0x558, 0x558, 0x558, 0x558, 0x6, &(0x7f0000000500), {[{{@uncond, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'ip6erspan0\x00', {0x6, 0x280, 0x34, 0x4, 0x7fff, 0x7fffffff, 0x400, 0x3, 0xa0}, {0x5}}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x2, 0x8, [0x39, 0x3b, 0x2e, 0x1e, 0x1a, 0x9, 0x0, 0x37, 0x9, 0x29, 0x29, 0x23, 0xc, 0x38, 0x2a, 0x29], 0x1, 0x2, 0x9}}}, {{@ip={@multicast2, @multicast2, 0x0, 0xff, '\x00', 'vxcan1\x00', {}, {0xff}, 0x8, 0x3, 0x12}, 0x0, 0xc0, 0x100, 0x0, {}, [@common=@icmp={{0x28}, {0x3, "d5ee"}}, @common=@ttl={{0x28}, {0x0, 0xf}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x80, 0x5b13, @ipv6=@local, 0x4e24}}}, {{@ip={@loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xff000000, 0xff000000, 'ip6erspan0\x00', 'nr0\x00', {}, {0xff}, 0x4, 0x3, 0x22}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0xb0, 0x5, @rand_addr=0x64010100, 0x4e22}}}, {{@ip={@broadcast, @local, 0xffffffff, 0x0, 'veth1_to_team\x00', 'hsr0\x00', {0xff}, {0xff}, 0x16, 0x1, 0x21}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@addrtype={{0x30}, {0x210, 0xdb0}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x2, 0xa1e, @multicast2, 0x4e23}}}, {{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0x4}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x650)
getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000c80)={'nat\x00', 0x0, 0x3, 0x38, [0x5, 0x4, 0x6, 0x7f, 0x5c4a, 0x4], 0x3, &(0x7f0000000c00)=[{}, {}, {}], &(0x7f0000000c40)=""/56}, &(0x7f0000000d00)=0x78) (async, rerun: 32)
ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000d40)) (rerun: 32)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$ARPT_SO_GET_INFO(r3, 0x0, 0x60, &(0x7f0000000d80)={'filter\x00', 0x0, [0x7, 0xffffff48]}, &(0x7f0000000e00)=0x44)
ioctl$BTRFS_IOC_SYNC(r2, 0x9408, 0x0) (async, rerun: 32)
ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000e40)={0x800, 0x0, 0x8fe, 0xffffffff, 0x3a6bdf9a}) (async, rerun: 32)
r4 = socket$phonet_pipe(0x23, 0x5, 0x2)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r4, 0xc0096616, &(0x7f0000000e80)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) (async)
r5 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000ec0)=@req={0xe83a, 0x7, 0x6, 0x3ff}, 0x10) (async)
socket$nl_xfrm(0x10, 0x3, 0x6) (async)
connect$inet(r2, &(0x7f0000000f00)={0x2, 0x4e23, @local}, 0x10) (async)
sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000001040)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001000)={&(0x7f0000000f80)={0x78, 0x1, 0x1, 0x201, 0x0, 0x0, {0xa, 0x0, 0xa}, [@CTA_NAT_DST={0x64, 0xd, 0x0, 0x1, [@CTA_NAT_PROTO={0x24, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @local}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e21}]}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @CTA_NAT_V4_MINIP={0x8, 0x1, @multicast2}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) (async)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r6, &(0x7f0000001240)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001200)={&(0x7f00000010c0)={0x10c, 0x0, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x8, 0x8}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x9}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x5}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x3}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x6d}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xa}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}], @NL80211_ATTR_OPER_CLASS={0x5}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x164}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x5}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}], @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x331}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3b0}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x7}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xe}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1a}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x80000000}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x388}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x98a}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1464}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x22e}]]}, 0x10c}, 0x1, 0x0, 0x0, 0x8000}, 0x20008004)
poll(&(0x7f0000001280)=[{r3, 0x1}, {r1, 0x40}, {r1, 0x210}], 0x3, 0x7ff) (async)
sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f00000013c0)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001380)={&(0x7f0000001300)={0x58, 0x2, 0x3, 0x5, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x40}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x18}, @NFQA_CFG_FLAGS={0x8}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2a}, @NFQA_CFG_CMD={0x8, 0x1, {0x0, 0x0, 0x27}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x4, 0x2}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x400}]}, 0x58}, 0x1, 0x0, 0x0, 0x8800}, 0x20040080) (async)
r7 = socket$inet_sctp(0x2, 0x4, 0x84)
getsockopt$inet_sctp_SCTP_EVENTS(r7, 0x84, 0xb, &(0x7f0000001400), &(0x7f0000001440)=0xe)
ioctl$F2FS_IOC_MOVE_RANGE(r5, 0xc020f509, &(0x7f0000001480)={<r8=>r2, 0xe086, 0x6, 0x5})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001580)={0x18, 0x5, &(0x7f00000014c0)=@raw=[@map_val={0x18, 0x6, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x3}, @map_idx_val={0x18, 0xd, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x5}, @func={0x85, 0x0, 0x1, 0x0, 0x2}], &(0x7f0000001500)='syzkaller\x00', 0x4, 0x37, &(0x7f0000001540)=""/55, 0x41000, 0x9, '\x00', 0x0, 0x0, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94)

kernel console output (not intermixed with test programs):

ft allmulticast mode
[  475.917634][T27694] netlink: 'syz.1.5303': attribute type 1 has an invalid length.
[  475.964593][T27694] 8021q: adding VLAN 0 to HW filter on device bond55
[  475.985626][T27694] veth23: entered promiscuous mode
[  475.990524][T27694] bond55: (slave veth23): Enslaving as a backup interface with a down link
[  476.000945][T27694] bond8: (slave macvlan30): Releasing backup interface
[  476.003837][T27694] bond8: (slave macvlan30): the permanent HWaddr of slave - ce:91:ba:80:da:6b - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  476.013436][T27694] bond8: (slave macvlan31): Releasing backup interface
[  476.020313][T27694] bond55: (slave veth23): Releasing backup interface
[  476.044063][T27698] netlink: 'syz.2.5304': attribute type 10 has an invalid length.
[  476.105837][T27701] netlink: 'syz.1.5305': attribute type 1 has an invalid length.
[  476.109112][T27701] netlink: 'syz.1.5305': attribute type 1 has an invalid length.
[  476.132115][T27701] netlink: 'syz.1.5305': attribute type 1 has an invalid length.
[  476.161433][T27701] 8021q: adding VLAN 0 to HW filter on device bond56
[  476.301007][T27701] bond56: (slave wlan0): Opening slave failed
[  476.422021][T27715] IPVS: stopping backup sync thread 17690 ...
[  476.500643][T27722] netlink: 'syz.1.5310': attribute type 10 has an invalid length.
[  476.504884][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  476.508677][T27722] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  476.512231][T27722] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  477.200605][T27725] netlink: 'syz.0.5311': attribute type 1 has an invalid length.
[  477.203809][T27725] netlink: 'syz.0.5311': attribute type 1 has an invalid length.
[  477.264083][T27725] netlink: 'syz.0.5311': attribute type 1 has an invalid length.
[  477.282446][T27725] 8021q: adding VLAN 0 to HW filter on device bond30
[  477.296546][T27725] mac80211_hwsim hwsim797 wlan0: left promiscuous mode
[  477.301752][T27725] bond30: (slave wlan0): Opening slave failed
[  477.376739][T27728] syzkaller1: entered promiscuous mode
[  477.379359][T27728] syzkaller1: entered allmulticast mode
[  477.459373][T27741] 8021q: adding VLAN 0 to HW filter on device macvlan32
[  477.464418][T27741] bond8: (slave macvlan32): Enslaving as a backup interface with a down link
[  477.535026][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  478.351381][T27802] mac80211_hwsim hwsim922 wlan1: entered allmulticast mode
[  478.380061][T27805] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  478.383953][T27805] syzkaller0: entered promiscuous mode
[  478.389396][T27805] syzkaller0: entered allmulticast mode
[  478.417931][T27805] syzkaller0: mtu greater than device maximum
[  478.435023][T27804] tipc: Resetting bearer <eth:syzkaller0>
[  478.449247][T27804] tipc: Disabling bearer <eth:syzkaller0>
[  478.463212][T27807] lo speed is unknown, defaulting to 1000
[  478.574897][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  478.732752][T27827] mac80211_hwsim hwsim922 wlan1: left allmulticast mode
[  478.739277][T27827] geneve4: left allmulticast mode
[  478.745727][T27827] veth23: left promiscuous mode
[  478.912501][T27838] lo speed is unknown, defaulting to 1000
[  479.049227][T27845] mac80211_hwsim hwsim938 wlan1: left allmulticast mode
[  479.242153][T27841] __nla_validate_parse: 9 callbacks suppressed
[  479.242169][T27841] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5336'.
[  479.615038][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  480.586753][T27856] lo speed is unknown, defaulting to 1000
[  480.654897][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  480.659996][T27866] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  480.662915][T27866] syzkaller0: entered promiscuous mode
[  480.664894][T27866] syzkaller0: entered allmulticast mode
[  480.684333][T27866] tipc: Resetting bearer <eth:syzkaller0>
[  480.697921][T27866] tipc: Disabling bearer <eth:syzkaller0>
[  480.992673][T27874] lo speed is unknown, defaulting to 1000
[  481.060951][T27881] 8021q: adding VLAN 0 to HW filter on device macvlan33
[  481.067058][T27881] bond8: (slave macvlan33): Enslaving as a backup interface with a down link
[  481.093214][T27883] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  481.105458][T27883] syzkaller0: entered promiscuous mode
[  481.107781][T27883] syzkaller0: entered allmulticast mode
[  481.133394][T27883] syzkaller0: mtu less than device minimum
[  481.139519][T27882] tipc: Resetting bearer <eth:syzkaller0>
[  481.158467][T27882] tipc: Disabling bearer <eth:syzkaller0>
[  481.308687][T27902] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5352'.
[  481.544627][T27925] lo speed is unknown, defaulting to 1000
[  481.575378][T27928] validate_nla: 4 callbacks suppressed
[  481.575388][T27928] netlink: 'syz.2.5357': attribute type 2 has an invalid length.
[  481.694895][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  481.718886][T27931] bond8: (slave macvlan32): Releasing backup interface
[  481.721703][T27931] bond8: (slave macvlan32): the permanent HWaddr of slave - ee:f4:61:9f:6f:34 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  481.732131][T27931] bond8: (slave macvlan33): Releasing backup interface
[  481.809782][T27931] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5358'.
[  481.819890][T27931] netlink: 'syz.1.5358': attribute type 10 has an invalid length.
[  481.830046][T27934] netlink: 'syz.2.5359': attribute type 9 has an invalid length.
[  481.833409][T27934] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5359'.
[  482.144276][T27945] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5363'.
[  482.188740][T27948] netlink: 'syz.0.5364': attribute type 11 has an invalid length.
[  482.734999][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  483.774759][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  483.799610][T27989] lo speed is unknown, defaulting to 1000
[  483.808367][T27991] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5376'.
[  484.106022][T27999] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  484.108968][T27999] CPU: 1 UID: 0 PID: 27999 Comm: syz.1.5378 Not tainted syzkaller #0 PREEMPT(full) 
[  484.108979][T27999] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  484.108983][T27999] Call Trace:
[  484.108987][T27999]  <TASK>
[  484.108990][T27999]  dump_stack_lvl+0x189/0x250
[  484.109005][T27999]  ? __pfx_dump_stack_lvl+0x10/0x10
[  484.109014][T27999]  ? __pfx__printk+0x10/0x10
[  484.109026][T27999]  ? kernfs_path_from_node+0x2f/0x290
[  484.109034][T27999]  ? kernfs_path_from_node+0x250/0x290
[  484.109040][T27999]  ? kernfs_path_from_node+0x2f/0x290
[  484.109049][T27999]  sysfs_warn_dup+0x8e/0xa0
[  484.109057][T27999]  sysfs_do_create_link_sd+0xc0/0x110
[  484.109065][T27999]  device_add_class_symlinks+0x1cf/0x240
[  484.109075][T27999]  device_add+0x475/0xb50
[  484.109084][T27999]  wiphy_register+0x1ba6/0x28d0
[  484.109107][T27999]  ? __pfx_wiphy_register+0x10/0x10
[  484.109117][T27999]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  484.109129][T27999]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  484.109139][T27999]  ieee80211_register_hw+0x3425/0x4080
[  484.109154][T27999]  ? ieee80211_register_hw+0x1461/0x4080
[  484.109166][T27999]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  484.109176][T27999]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  484.109189][T27999]  ? __hrtimer_setup+0x187/0x210
[  484.109196][T27999]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  484.109208][T27999]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  484.109228][T27999]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  484.109236][T27999]  ? trace_kmalloc+0x1f/0xd0
[  484.109244][T27999]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  484.109254][T27999]  ? kstrndup+0xbf/0x160
[  484.109286][T27999]  hwsim_new_radio_nl+0xea4/0x1b10
[  484.109296][T27999]  ? __pfx___nla_validate_parse+0x10/0x10
[  484.109313][T27999]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  484.109327][T27999]  ? __nla_parse+0x40/0x60
[  484.109339][T27999]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  484.109351][T27999]  genl_family_rcv_msg_doit+0x215/0x300
[  484.109362][T27999]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  484.109376][T27999]  ? bpf_lsm_capable+0x9/0x20
[  484.109385][T27999]  ? security_capable+0x7e/0x2e0
[  484.109398][T27999]  genl_rcv_msg+0x60e/0x790
[  484.109409][T27999]  ? __pfx_genl_rcv_msg+0x10/0x10
[  484.109417][T27999]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  484.109432][T27999]  netlink_rcv_skb+0x208/0x470
[  484.109441][T27999]  ? __lock_acquire+0xab9/0xd20
[  484.109451][T27999]  ? __pfx_genl_rcv_msg+0x10/0x10
[  484.109460][T27999]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  484.109478][T27999]  ? down_read+0x1ad/0x2e0
[  484.109486][T27999]  genl_rcv+0x28/0x40
[  484.109493][T27999]  netlink_unicast+0x82f/0x9e0
[  484.109506][T27999]  ? __pfx_netlink_unicast+0x10/0x10
[  484.109516][T27999]  ? netlink_sendmsg+0x642/0xb30
[  484.109522][T27999]  ? skb_put+0x11b/0x210
[  484.109531][T27999]  netlink_sendmsg+0x805/0xb30
[  484.109541][T27999]  ? __pfx_netlink_sendmsg+0x10/0x10
[  484.109549][T27999]  ? aa_sock_msg_perm+0xf1/0x1d0
[  484.109557][T27999]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  484.109564][T27999]  ? __pfx_netlink_sendmsg+0x10/0x10
[  484.109571][T27999]  __sock_sendmsg+0x21c/0x270
[  484.109582][T27999]  ____sys_sendmsg+0x505/0x830
[  484.109592][T27999]  ? __pfx_____sys_sendmsg+0x10/0x10
[  484.109604][T27999]  ? import_iovec+0x74/0xa0
[  484.109614][T27999]  ___sys_sendmsg+0x21f/0x2a0
[  484.109622][T27999]  ? __pfx____sys_sendmsg+0x10/0x10
[  484.109645][T27999]  ? __fget_files+0x2a/0x420
[  484.109651][T27999]  ? __fget_files+0x3a0/0x420
[  484.109661][T27999]  __x64_sys_sendmsg+0x19b/0x260
[  484.109670][T27999]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  484.109682][T27999]  ? rcu_is_watching+0x15/0xb0
[  484.109691][T27999]  ? do_syscall_64+0xbe/0x3b0
[  484.109700][T27999]  do_syscall_64+0xfa/0x3b0
[  484.109706][T27999]  ? lockdep_hardirqs_on+0x9c/0x150
[  484.109715][T27999]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  484.109722][T27999]  ? exc_page_fault+0x9f/0xf0
[  484.109733][T27999]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  484.109739][T27999] RIP: 0033:0x7f95be58ebe9
[  484.109747][T27999] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  484.109753][T27999] RSP: 002b:00007f95bf48e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  484.109761][T27999] RAX: ffffffffffffffda RBX: 00007f95be7c5fa0 RCX: 00007f95be58ebe9
[  484.109766][T27999] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  484.109771][T27999] RBP: 00007f95be611e19 R08: 0000000000000000 R09: 0000000000000000
[  484.109775][T27999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  484.109779][T27999] R13: 00007f95be7c6038 R14: 00007f95be7c5fa0 R15: 00007fffaad6f958
[  484.109791][T27999]  </TASK>
[  484.417017][T28004] netlink: 'syz.2.5380': attribute type 2 has an invalid length.
[  484.419832][T28004] netlink: 'syz.2.5380': attribute type 12 has an invalid length.
[  484.448762][T27992] netlink: 'syz.0.5375': attribute type 2 has an invalid length.
[  484.532855][T28005] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5375'.
[  484.814894][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  484.888347][T28014] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5382'.
[  485.100870][T28020] syzkaller0: entered promiscuous mode
[  485.103217][T28020] syzkaller0: entered allmulticast mode
[  485.189841][T28023] lo speed is unknown, defaulting to 1000
[  485.437842][T28034] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5386'.
[  485.704348][T28040] netlink: 'syz.2.5388': attribute type 1 has an invalid length.
[  485.710677][T28040] netlink: 'syz.2.5388': attribute type 1 has an invalid length.
[  485.793862][T28041] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5388'.
[  485.822050][T28040] mac80211_hwsim hwsim669 wlan0: left promiscuous mode
[  485.854940][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  485.913039][T28049] netlink: 'syz.2.5390': attribute type 1 has an invalid length.
[  485.927502][T28049] netlink: 'syz.2.5390': attribute type 1 has an invalid length.
[  485.986268][T28058] 8021q: adding VLAN 0 to HW filter on device macvlan34
[  485.991116][T28058] bond8: (slave macvlan34): Enslaving as a backup interface with a down link
[  486.002474][T28060] bond4: option mode: unable to set because the bond device has slaves
[  486.033903][T28060] 8021q: adding VLAN 0 to HW filter on device macvlan25
[  486.041537][T28060] bond4: (slave macvlan25): speed changed to 0 on port 2
[  486.047233][T28060] bond4: (slave macvlan25): Enslaving as a backup interface with a down link
[  486.059186][T28060] bond4: (slave macvlan24): Releasing backup interface
[  486.062161][T28060] bond4: (slave macvlan24): the permanent HWaddr of slave - 02:0c:a2:35:26:a9 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  486.073032][T28060] bond4: (slave macvlan25): Releasing backup interface
[  486.500843][T28089] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5400'.
[  486.516563][T28089] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5400'.
[  486.895043][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  486.966661][T28093] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  487.209822][T28109] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5404'.
[  487.225521][T28107] validate_nla: 1 callbacks suppressed
[  487.225534][T28107] netlink: 'syz.1.5404': attribute type 1 has an invalid length.
[  487.231386][T28107] netlink: 232 bytes leftover after parsing attributes in process `syz.1.5404'.
[  487.325538][T28112] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  487.328983][T28112] CPU: 1 UID: 0 PID: 28112 Comm: syz.2.5405 Not tainted syzkaller #0 PREEMPT(full) 
[  487.328999][T28112] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  487.329007][T28112] Call Trace:
[  487.329012][T28112]  <TASK>
[  487.329017][T28112]  dump_stack_lvl+0x189/0x250
[  487.329038][T28112]  ? __pfx_dump_stack_lvl+0x10/0x10
[  487.329052][T28112]  ? __pfx__printk+0x10/0x10
[  487.329069][T28112]  ? kernfs_path_from_node+0x2f/0x290
[  487.329081][T28112]  ? kernfs_path_from_node+0x250/0x290
[  487.329092][T28112]  ? kernfs_path_from_node+0x2f/0x290
[  487.329107][T28112]  sysfs_warn_dup+0x8e/0xa0
[  487.329120][T28112]  sysfs_do_create_link_sd+0xc0/0x110
[  487.329134][T28112]  device_add_class_symlinks+0x1cf/0x240
[  487.329150][T28112]  device_add+0x475/0xb50
[  487.329166][T28112]  wiphy_register+0x1ba6/0x28d0
[  487.329196][T28112]  ? __pfx_wiphy_register+0x10/0x10
[  487.329211][T28112]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  487.329260][T28112]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  487.329278][T28112]  ieee80211_register_hw+0x3425/0x4080
[  487.329303][T28112]  ? ieee80211_register_hw+0x1461/0x4080
[  487.329330][T28112]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  487.329346][T28112]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  487.329368][T28112]  ? __hrtimer_setup+0x187/0x210
[  487.329378][T28112]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  487.329397][T28112]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  487.329433][T28112]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  487.329448][T28112]  ? trace_kmalloc+0x1f/0xd0
[  487.329460][T28112]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  487.329475][T28112]  ? kstrndup+0xbf/0x160
[  487.329494][T28112]  hwsim_new_radio_nl+0xea4/0x1b10
[  487.329510][T28112]  ? __pfx___nla_validate_parse+0x10/0x10
[  487.329538][T28112]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  487.329563][T28112]  ? __nla_parse+0x40/0x60
[  487.329582][T28112]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  487.329602][T28112]  genl_family_rcv_msg_doit+0x215/0x300
[  487.329620][T28112]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  487.329645][T28112]  ? bpf_lsm_capable+0x9/0x20
[  487.329660][T28112]  ? security_capable+0x7e/0x2e0
[  487.329680][T28112]  genl_rcv_msg+0x60e/0x790
[  487.329696][T28112]  ? __pfx_genl_rcv_msg+0x10/0x10
[  487.329708][T28112]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  487.329731][T28112]  netlink_rcv_skb+0x208/0x470
[  487.329744][T28112]  ? __lock_acquire+0xab9/0xd20
[  487.329759][T28112]  ? __pfx_genl_rcv_msg+0x10/0x10
[  487.329772][T28112]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  487.329800][T28112]  ? down_read+0x1ad/0x2e0
[  487.329813][T28112]  genl_rcv+0x28/0x40
[  487.329824][T28112]  netlink_unicast+0x82f/0x9e0
[  487.329844][T28112]  ? __pfx_netlink_unicast+0x10/0x10
[  487.329860][T28112]  ? netlink_sendmsg+0x642/0xb30
[  487.329869][T28112]  ? skb_put+0x11b/0x210
[  487.329883][T28112]  netlink_sendmsg+0x805/0xb30
[  487.329900][T28112]  ? __pfx_netlink_sendmsg+0x10/0x10
[  487.329914][T28112]  ? aa_sock_msg_perm+0xf1/0x1d0
[  487.329926][T28112]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  487.329937][T28112]  ? __pfx_netlink_sendmsg+0x10/0x10
[  487.329947][T28112]  __sock_sendmsg+0x21c/0x270
[  487.329963][T28112]  ____sys_sendmsg+0x505/0x830
[  487.329981][T28112]  ? __pfx_____sys_sendmsg+0x10/0x10
[  487.330001][T28112]  ? import_iovec+0x74/0xa0
[  487.330018][T28112]  ___sys_sendmsg+0x21f/0x2a0
[  487.330032][T28112]  ? __pfx____sys_sendmsg+0x10/0x10
[  487.330070][T28112]  ? __fget_files+0x2a/0x420
[  487.330080][T28112]  ? __fget_files+0x3a0/0x420
[  487.330097][T28112]  __x64_sys_sendmsg+0x19b/0x260
[  487.330112][T28112]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  487.330133][T28112]  ? rcu_is_watching+0x15/0xb0
[  487.330148][T28112]  ? do_syscall_64+0xbe/0x3b0
[  487.330163][T28112]  do_syscall_64+0xfa/0x3b0
[  487.330173][T28112]  ? lockdep_hardirqs_on+0x9c/0x150
[  487.330188][T28112]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  487.330201][T28112]  ? exc_page_fault+0x9f/0xf0
[  487.330218][T28112]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  487.330258][T28112] RIP: 0033:0x7f6621f8ebe9
[  487.330270][T28112] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  487.330280][T28112] RSP: 002b:00007f66201d5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  487.330294][T28112] RAX: ffffffffffffffda RBX: 00007f66221c6090 RCX: 00007f6621f8ebe9
[  487.330302][T28112] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  487.330317][T28112] RBP: 00007f6622011e19 R08: 0000000000000000 R09: 0000000000000000
[  487.330324][T28112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  487.330331][T28112] R13: 00007f66221c6128 R14: 00007f66221c6090 R15: 00007fff04829858
[  487.330352][T28112]  </TASK>
[  487.570764][T28121] lo speed is unknown, defaulting to 1000
[  487.610814][T28126] netlink: 'syz.1.5408': attribute type 10 has an invalid length.
[  487.792739][T28141] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5413'.
[  487.908001][T28149] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5411'.
[  487.934852][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  488.067799][T28155] netlink: 'syz.0.5415': attribute type 10 has an invalid length.
[  488.183046][T28163] netlink: 'syz.0.5418': attribute type 1 has an invalid length.
[  488.975003][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  489.372150][T28214] IPVS: set_ctl: invalid protocol: 44 224.0.0.1:20000
[  489.429062][T28220] netlink: 'syz.1.5432': attribute type 1 has an invalid length.
[  489.461344][T28220] syzkaller0: entered promiscuous mode
[  489.463563][T28220] syzkaller0: entered allmulticast mode
[  489.573851][T28224] __nla_validate_parse: 7 callbacks suppressed
[  489.573861][T28224] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5432'.
[  489.604367][T28229] netlink: 'syz.2.5436': attribute type 1 has an invalid length.
[  489.608947][T28228] netlink: 'syz.2.5436': attribute type 1 has an invalid length.
[  489.693377][T28226] lo speed is unknown, defaulting to 1000
[  490.016249][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  491.020167][T28248] netlink: 'syz.2.5439': attribute type 11 has an invalid length.
[  491.054946][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  491.299945][T28256] lo speed is unknown, defaulting to 1000
[  491.303228][T28257] lo speed is unknown, defaulting to 1000
[  491.347917][T28259] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5443'.
[  491.371401][T28263] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5444'.
[  491.374581][T28263] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5444'.
[  491.418280][T28264] team0: Unable to change to the same mode the team is in
[  491.477470][T28268] sctp: [Deprecated]: syz.0.5445 (pid 28268) Use of struct sctp_assoc_value in delayed_ack socket option.
[  491.477470][T28268] Use struct sctp_sack_info instead
[  491.502568][T28270] IPVS: set_ctl: invalid protocol: 33 10.1.1.0:20000
[  491.569825][T28277] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5447'.
[  491.673361][T28279] lo speed is unknown, defaulting to 1000
[  491.868927][T28280] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5448'.
[  491.918516][T28287] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5450'.
[  492.094862][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  492.345890][T28294] netlink: 'syz.0.5452': attribute type 12 has an invalid length.
[  492.348946][T28294] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.5452'.
[  492.512988][T28300] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5454'.
[  492.562021][T28305] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5455'.
[  492.696310][T28312] syzkaller1: entered promiscuous mode
[  492.698259][T28312] syzkaller1: entered allmulticast mode
[  492.840961][T28317] bond8: option mode: unable to set because the bond device has slaves
[  492.853490][T28318] bond8: (slave macvlan35): Error -98 calling set_mac_address
[  492.871795][T28317] bond8: (slave macvlan34): Releasing backup interface
[  492.989128][T28324] netlink: 'syz.2.5461': attribute type 4 has an invalid length.
[  493.057553][T28329] nbd: socks must be embedded in a SOCK_ITEM attr
[  493.110253][T28331] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  493.113510][T28332] syzkaller0: entered promiscuous mode
[  493.116238][T28332] syzkaller0: entered allmulticast mode
[  493.131222][T28333] tipc: Resetting bearer <eth:syzkaller0>
[  493.135212][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  493.145063][T28333] tipc: Resetting bearer <eth:syzkaller0>
[  493.156071][T28333] tipc: Disabling bearer <eth:syzkaller0>
[  493.256640][T28336] netlink: 'syz.2.5464': attribute type 10 has an invalid length.
[  493.469727][T28343] netlink: 'syz.0.5467': attribute type 10 has an invalid length.
[  493.690866][T28354] netlink: 'syz.2.5471': attribute type 1 has an invalid length.
[  493.694209][T28354] netlink: 'syz.2.5471': attribute type 1 has an invalid length.
[  494.175014][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  494.276875][T28381] netlink: 'syz.1.5478': attribute type 1 has an invalid length.
[  494.294422][T28381] 8021q: adding VLAN 0 to HW filter on device bond57
[  494.311502][T28381] veth25: entered promiscuous mode
[  494.315717][T28381] bond57: (slave veth25): Enslaving as a backup interface with a down link
[  494.712389][T28388] __nla_validate_parse: 12 callbacks suppressed
[  494.712405][T28388] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5480'.
[  494.731740][T28388] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5480'.
[  495.210515][T28396] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5482'.
[  495.224910][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  495.622346][T28413] netlink: 'syz.1.5488': attribute type 4 has an invalid length.
[  495.710337][T28427] netlink: 'syz.1.5491': attribute type 1 has an invalid length.
[  495.712789][T28427] netlink: 'syz.1.5491': attribute type 1 has an invalid length.
[  495.718581][T28427] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5491'.
[  495.721984][T28427] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5491'.
[  495.940681][T28442] 8021q: adding VLAN 0 to HW filter on device macvlan26
[  495.946389][T28442] bond4: (slave macvlan26): speed changed to 0 on port 1
[  495.950676][T28442] bond4: (slave macvlan26): Enslaving as a backup interface with a down link
[  496.254888][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  496.293861][T28463] 8021q: adding VLAN 0 to HW filter on device bond1
[  496.310084][T28461] 8021q: adding VLAN 0 to HW filter on device macvlan19
[  496.313746][T28461] bond1: (slave macvlan19): Enslaving as a backup interface with a down link
[  496.317810][T28462] tipc: Enabling of bearer <udp:syz2> rejected, failed to enable media
[  496.323678][T28461] bond1: (slave macvlan19): Releasing backup interface
[  496.338069][T28458] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  496.542345][T28480] bond4: (slave macvlan27): Error -98 calling set_mac_address
[  496.643856][T28488] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5502'.
[  496.648837][T28488] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5502'.
[  496.652059][T28488] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5502'.
[  496.660002][T28488] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5502'.
[  496.666655][T28488] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5502'.
[  497.295183][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  497.487896][T28527] validate_nla: 2 callbacks suppressed
[  497.487912][T28527] netlink: 'syz.2.5513': attribute type 1 has an invalid length.
[  497.494039][T28527] netlink: 'syz.2.5513': attribute type 1 has an invalid length.
[  497.600812][T28529] netlink: 'syz.2.5513': attribute type 1 has an invalid length.
[  497.623881][T28529] 8021q: adding VLAN 0 to HW filter on device bond20
[  497.633190][T28527] bond20: (slave wlan0): Opening slave failed
[  497.702319][T28548] bond57: (slave veth25): Releasing backup interface
[  497.734180][T28534] netlink: 'syz.1.5516': attribute type 10 has an invalid length.
[  498.322341][T28566] veth25: left promiscuous mode
[  498.344931][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  498.713865][T28590] lo speed is unknown, defaulting to 1000
[  499.158421][T28595] netlink: 'syz.0.5529': attribute type 2 has an invalid length.
[  499.384973][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  499.394835][   T62] block nbd2: Possible stuck request ffff888021de0000: control (read@0,1024B). Runtime 240 seconds
[  499.399820][   T62] block nbd2: Possible stuck request ffff888021de0200: control (read@1024,1024B). Runtime 240 seconds
[  499.404482][   T62] block nbd2: Possible stuck request ffff888021de0400: control (read@2048,1024B). Runtime 240 seconds
[  499.409414][   T62] block nbd2: Possible stuck request ffff888021de0600: control (read@3072,1024B). Runtime 240 seconds
[  499.754458][T28615] __nla_validate_parse: 9 callbacks suppressed
[  499.754472][T28615] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5534'.
[  499.842874][T28617] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5535'.
[  499.950590][T28612] lo speed is unknown, defaulting to 1000
[  500.021918][T28626] netlink: 'syz.2.5538': attribute type 10 has an invalid length.
[  500.025638][T28626] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5538'.
[  500.038080][T28626] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check.
[  500.054362][T28624] syzkaller0: entered promiscuous mode
[  500.058256][T28624] syzkaller0: entered allmulticast mode
[  500.063687][T28626] netlink: 14 bytes leftover after parsing attributes in process `syz.2.5538'.
[  500.361697][T28649] netlink: 'syz.0.5542': attribute type 1 has an invalid length.
[  500.365586][T28649] netlink: 'syz.0.5542': attribute type 1 has an invalid length.
[  500.414804][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  500.426646][T28652] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5543'.
[  500.432907][T28653] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5543'.
[  500.471742][T28655] netlink: 'syz.0.5542': attribute type 1 has an invalid length.
[  500.520678][T28655] 8021q: adding VLAN 0 to HW filter on device bond32
[  500.527604][T28649] bond32: (slave wlan0): Opening slave failed
[  500.551029][T28661] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5544'.
[  500.582936][T28664] lo speed is unknown, defaulting to 1000
[  500.807268][T28687] netlink: 248 bytes leftover after parsing attributes in process `syz.0.5550'.
[  501.011487][T28693] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5551'.
[  501.015898][T28695] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5552'.
[  501.163431][T28703] sctp: [Deprecated]: syz.0.5555 (pid 28703) Use of int in max_burst socket option.
[  501.163431][T28703] Use struct sctp_assoc_value instead
[  501.410230][T28709] netlink: 'syz.1.5556': attribute type 4 has an invalid length.
[  501.465169][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  501.485820][T28713] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  501.497457][T28713] syzkaller0: entered promiscuous mode
[  501.499473][T28713] syzkaller0: entered allmulticast mode
[  501.510625][T28713] tipc: Resetting bearer <eth:syzkaller0>
[  501.518356][T28712] tipc: Resetting bearer <eth:syzkaller0>
[  501.545123][T28712] tipc: Disabling bearer <eth:syzkaller0>
[  501.777658][T28725] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  502.001596][T28738] lo speed is unknown, defaulting to 1000
[  502.256429][T28744] bond4: (slave macvlan26): Releasing backup interface
[  502.343457][T28746] lo speed is unknown, defaulting to 1000
[  502.495005][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  502.598178][T28762] lo speed is unknown, defaulting to 1000
[  502.753475][T28749] validate_nla: 2 callbacks suppressed
[  502.753485][T28749] netlink: 'syz.0.5565': attribute type 2 has an invalid length.
[  502.760292][T28768] netlink: 'syz.1.5567': attribute type 2 has an invalid length.
[  503.079775][T28781] netlink: 'syz.0.5571': attribute type 1 has an invalid length.
[  503.082902][T28781] netlink: 'syz.0.5571': attribute type 1 has an invalid length.
[  503.247477][T28792] 8021q: adding VLAN 0 to HW filter on device macvlan35
[  503.251443][T28792] bond8: (slave macvlan35): Enslaving as a backup interface with a down link
[  503.545037][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  503.720956][T28829] netlink: 'syz.2.5584': attribute type 6 has an invalid length.
[  503.727978][T28829] netlink: 'syz.2.5584': attribute type 12 has an invalid length.
[  503.920757][T28840] netlink: 'syz.1.5586': attribute type 10 has an invalid length.
[  504.183463][T28853] netlink: 'syz.2.5589': attribute type 10 has an invalid length.
[  504.240592][T28855] netlink: 'syz.2.5590': attribute type 1 has an invalid length.
[  504.273740][T28855] 8021q: adding VLAN 0 to HW filter on device bond21
[  504.500664][T28861] netlink: 'syz.2.5592': attribute type 8 has an invalid length.
[  504.574916][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  504.602786][T28864] lo speed is unknown, defaulting to 1000
[  504.934455][T28881] lo speed is unknown, defaulting to 1000
[  505.616694][T28900] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  505.619984][T28900] CPU: 0 UID: 0 PID: 28900 Comm: syz.0.5603 Not tainted syzkaller #0 PREEMPT(full) 
[  505.620000][T28900] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  505.620008][T28900] Call Trace:
[  505.620013][T28900]  <TASK>
[  505.620020][T28900]  dump_stack_lvl+0x189/0x250
[  505.620068][T28900]  ? __pfx_dump_stack_lvl+0x10/0x10
[  505.620083][T28900]  ? __pfx__printk+0x10/0x10
[  505.620104][T28900]  ? kernfs_path_from_node+0x2f/0x290
[  505.620117][T28900]  ? kernfs_path_from_node+0x250/0x290
[  505.620128][T28900]  ? kernfs_path_from_node+0x2f/0x290
[  505.620144][T28900]  sysfs_warn_dup+0x8e/0xa0
[  505.620157][T28900]  sysfs_do_create_link_sd+0xc0/0x110
[  505.620181][T28900]  device_add_class_symlinks+0x1cf/0x240
[  505.620198][T28900]  device_add+0x475/0xb50
[  505.620214][T28900]  wiphy_register+0x1ba6/0x28d0
[  505.620245][T28900]  ? __pfx_wiphy_register+0x10/0x10
[  505.620261][T28900]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  505.620281][T28900]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  505.620299][T28900]  ieee80211_register_hw+0x3425/0x4080
[  505.620326][T28900]  ? ieee80211_register_hw+0x1461/0x4080
[  505.620346][T28900]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  505.620364][T28900]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  505.620386][T28900]  ? __hrtimer_setup+0x187/0x210
[  505.620397][T28900]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  505.620417][T28900]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  505.620453][T28900]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  505.620468][T28900]  ? trace_kmalloc+0x1f/0xd0
[  505.620480][T28900]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  505.620494][T28900]  ? kstrndup+0xbf/0x160
[  505.620512][T28900]  hwsim_new_radio_nl+0xea4/0x1b10
[  505.620530][T28900]  ? __pfx___nla_validate_parse+0x10/0x10
[  505.620559][T28900]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  505.620584][T28900]  ? __nla_parse+0x40/0x60
[  505.620604][T28900]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  505.620627][T28900]  genl_family_rcv_msg_doit+0x215/0x300
[  505.620647][T28900]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  505.620671][T28900]  ? bpf_lsm_capable+0x9/0x20
[  505.620685][T28900]  ? security_capable+0x7e/0x2e0
[  505.620708][T28900]  genl_rcv_msg+0x60e/0x790
[  505.620727][T28900]  ? __pfx_genl_rcv_msg+0x10/0x10
[  505.620741][T28900]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  505.620767][T28900]  netlink_rcv_skb+0x208/0x470
[  505.620783][T28900]  ? __lock_acquire+0xab9/0xd20
[  505.620801][T28900]  ? __pfx_genl_rcv_msg+0x10/0x10
[  505.620816][T28900]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  505.620848][T28900]  ? down_read+0x1ad/0x2e0
[  505.620862][T28900]  genl_rcv+0x28/0x40
[  505.620873][T28900]  netlink_unicast+0x82f/0x9e0
[  505.620896][T28900]  ? __pfx_netlink_unicast+0x10/0x10
[  505.620913][T28900]  ? netlink_sendmsg+0x642/0xb30
[  505.620922][T28900]  ? skb_put+0x11b/0x210
[  505.620937][T28900]  netlink_sendmsg+0x805/0xb30
[  505.620956][T28900]  ? __pfx_netlink_sendmsg+0x10/0x10
[  505.620970][T28900]  ? aa_sock_msg_perm+0xf1/0x1d0
[  505.620983][T28900]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  505.620995][T28900]  ? __pfx_netlink_sendmsg+0x10/0x10
[  505.621007][T28900]  __sock_sendmsg+0x21c/0x270
[  505.621049][T28900]  ____sys_sendmsg+0x505/0x830
[  505.621070][T28900]  ? __pfx_____sys_sendmsg+0x10/0x10
[  505.621090][T28900]  ? import_iovec+0x74/0xa0
[  505.621108][T28900]  ___sys_sendmsg+0x21f/0x2a0
[  505.621123][T28900]  ? __pfx____sys_sendmsg+0x10/0x10
[  505.621171][T28900]  ? __fget_files+0x2a/0x420
[  505.621181][T28900]  ? __fget_files+0x3a0/0x420
[  505.621200][T28900]  __x64_sys_sendmsg+0x19b/0x260
[  505.621216][T28900]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  505.621237][T28900]  ? rcu_is_watching+0x15/0xb0
[  505.621254][T28900]  ? do_syscall_64+0xbe/0x3b0
[  505.621269][T28900]  do_syscall_64+0xfa/0x3b0
[  505.621279][T28900]  ? lockdep_hardirqs_on+0x9c/0x150
[  505.621295][T28900]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  505.621307][T28900]  ? exc_page_fault+0x9f/0xf0
[  505.621325][T28900]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  505.621336][T28900] RIP: 0033:0x7f787838ebe9
[  505.621347][T28900] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  505.621357][T28900] RSP: 002b:00007f78792bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  505.621370][T28900] RAX: ffffffffffffffda RBX: 00007f78785c5fa0 RCX: 00007f787838ebe9
[  505.621379][T28900] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  505.621386][T28900] RBP: 00007f7878411e19 R08: 0000000000000000 R09: 0000000000000000
[  505.621393][T28900] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  505.621400][T28900] R13: 00007f78785c6038 R14: 00007f78785c5fa0 R15: 00007ffd30ff3898
[  505.621422][T28900]  </TASK>
[  505.802548][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  505.828808][T28884] delete_channel: no stack
[  505.934336][T28912] __nla_validate_parse: 10 callbacks suppressed
[  505.934351][T28912] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5606'.
[  506.104094][T28920] mac80211_hwsim hwsim1022 wlan1: entered allmulticast mode
[  506.117754][T28927] bond8: (slave macvlan35): Releasing backup interface
[  506.163953][T28920] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  506.169134][T28920] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  506.208046][T28933] 8021q: VLANs not supported on ip6gre0
[  506.213507][T28931] 8021q: VLANs not supported on ip6gre0
[  506.220523][T28934] 8021q: adding VLAN 0 to HW filter on device bond4
[  506.232085][T28934] 8021q: adding VLAN 0 to HW filter on device macvlan27
[  506.235996][T28934] bond4: (slave macvlan27): speed changed to 0 on port 1
[  506.240399][T28934] bond4: (slave macvlan27): Enslaving as a backup interface with a down link
[  506.263668][T28931] mac80211_hwsim hwsim1006 wlan1: entered allmulticast mode
[  506.383518][T28939] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5612'.
[  506.814993][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  506.861644][T28944] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5614'.
[  507.279604][T28965] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5620'.
[  507.283236][T28965] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5620'.
[  507.297463][T28965] team0: Mode changed to "broadcast"
[  507.300469][T28965] vlan0: entered promiscuous mode
[  507.376986][T28976] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5624'.
[  507.380832][T28976] mac80211_hwsim hwsim791 wlan0: entered promiscuous mode
[  507.442941][T28978] lo speed is unknown, defaulting to 1000
[  507.532809][T28989] lo speed is unknown, defaulting to 1000
[  507.695876][T28992] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5627'.
[  507.865184][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  508.053617][T29008] lo speed is unknown, defaulting to 1000
[  508.257217][T29012] netlink: 232 bytes leftover after parsing attributes in process `syz.2.5632'.
[  508.258105][T29014] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5632'.
[  508.372799][T29010] validate_nla: 8 callbacks suppressed
[  508.372811][T29010] netlink: 'syz.1.5631': attribute type 2 has an invalid length.
[  508.443460][T29014] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5632'.
[  508.894893][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  509.184302][T29042] mac80211_hwsim hwsim1022 wlan1: left allmulticast mode
[  509.536723][T29068] vlan0: left promiscuous mode
[  509.539014][T29068] mac80211_hwsim hwsim1006 wlan1: left allmulticast mode
[  509.561298][T29068] batadv_slave_1: entered promiscuous mode
[  509.613362][T29075] netlink: 'syz.1.5644': attribute type 12 has an invalid length.
[  509.728395][T29077] netlink: 'syz.2.5645': attribute type 9 has an invalid length.
[  509.908699][T29081] netlink: 'syz.1.5647': attribute type 10 has an invalid length.
[  509.919087][T29081] mac80211_hwsim hwsim1022 wlan1: entered allmulticast mode
[  509.935120][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  510.080906][T29095] netlink: 'syz.1.5651': attribute type 6 has an invalid length.
[  510.090288][T29095] netlink: 'syz.1.5651': attribute type 12 has an invalid length.
[  510.284103][T29062] batadv_slave_1: left promiscuous mode
[  510.368815][T29098] netlink: 'syz.2.5652': attribute type 12 has an invalid length.
[  510.529307][T29112] netlink: 'syz.2.5656': attribute type 1 has an invalid length.
[  510.532038][T29112] netlink: 'syz.2.5656': attribute type 1 has an invalid length.
[  510.542145][T29112] netlink: 'syz.2.5656': attribute type 1 has an invalid length.
[  510.562009][T29112] 8021q: adding VLAN 0 to HW filter on device bond22
[  510.571183][T29112] bond22: (slave wlan0): Opening slave failed
[  510.644312][T29115] lo speed is unknown, defaulting to 1000
[  510.963419][T29134] __nla_validate_parse: 12 callbacks suppressed
[  510.963429][T29134] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5662'.
[  510.974870][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  511.083402][T29137] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5663'.
[  511.246759][T29139] openvswitch: netlink: Duplicate or invalid key (type 0).
[  511.249276][T29139] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  511.262276][T29139] mac80211_hwsim hwsim1006 wlan1: entered allmulticast mode
[  511.315877][T29143] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144
[  511.409767][T29144] 8021q: adding VLAN 0 to HW filter on device bond33
[  511.432339][T29144] bond33: (slave wlan0): Opening slave failed
[  511.448016][T29150] netlink: 'syz.1.5668': attribute type 11 has an invalid length.
[  511.468055][T29152] netlink: 14 bytes leftover after parsing attributes in process `syz.2.5669'.
[  511.663268][T29166] bond0: option primary: mode dependency failed, not supported in mode 802.3ad(4)
[  511.790701][T29179] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5671'.
[  511.951533][T29187] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5672'.
[  511.972738][T29191] vlan4: entered promiscuous mode
[  511.974533][T29191] macvtap0: entered promiscuous mode
[  512.015205][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  512.026194][T29194] netlink: 104 bytes leftover after parsing attributes in process `syz.0.5676'.
[  512.096471][T29196] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5678'.
[  512.111590][T29198] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  512.117672][T29198] CPU: 0 UID: 0 PID: 29198 Comm: syz.0.5679 Not tainted syzkaller #0 PREEMPT(full) 
[  512.117685][T29198] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  512.117690][T29198] Call Trace:
[  512.117694][T29198]  <TASK>
[  512.117697][T29198]  dump_stack_lvl+0x189/0x250
[  512.117713][T29198]  ? __pfx_dump_stack_lvl+0x10/0x10
[  512.117723][T29198]  ? __pfx__printk+0x10/0x10
[  512.117735][T29198]  ? kernfs_path_from_node+0x2f/0x290
[  512.117744][T29198]  ? kernfs_path_from_node+0x250/0x290
[  512.117751][T29198]  ? kernfs_path_from_node+0x2f/0x290
[  512.117761][T29198]  sysfs_warn_dup+0x8e/0xa0
[  512.117769][T29198]  sysfs_do_create_link_sd+0xc0/0x110
[  512.117779][T29198]  device_add_class_symlinks+0x1cf/0x240
[  512.117795][T29198]  device_add+0x475/0xb50
[  512.117806][T29198]  wiphy_register+0x1ba6/0x28d0
[  512.117824][T29198]  ? __pfx_wiphy_register+0x10/0x10
[  512.117835][T29198]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  512.117847][T29198]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  512.117859][T29198]  ieee80211_register_hw+0x3425/0x4080
[  512.117874][T29198]  ? ieee80211_register_hw+0x1461/0x4080
[  512.117888][T29198]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  512.117898][T29198]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  512.117911][T29198]  ? __hrtimer_setup+0x187/0x210
[  512.117918][T29198]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  512.117929][T29198]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  512.117951][T29198]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  512.117982][T29198]  ? trace_kmalloc+0x1f/0xd0
[  512.117990][T29198]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  512.118001][T29198]  ? kstrndup+0xbf/0x160
[  512.118013][T29198]  hwsim_new_radio_nl+0xea4/0x1b10
[  512.118024][T29198]  ? __pfx___nla_validate_parse+0x10/0x10
[  512.118043][T29198]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  512.118057][T29198]  ? __nla_parse+0x40/0x60
[  512.118069][T29198]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  512.118081][T29198]  genl_family_rcv_msg_doit+0x215/0x300
[  512.118092][T29198]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  512.118106][T29198]  ? bpf_lsm_capable+0x9/0x20
[  512.118114][T29198]  ? security_capable+0x7e/0x2e0
[  512.118126][T29198]  genl_rcv_msg+0x60e/0x790
[  512.118137][T29198]  ? __pfx_genl_rcv_msg+0x10/0x10
[  512.118145][T29198]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  512.118160][T29198]  netlink_rcv_skb+0x208/0x470
[  512.118169][T29198]  ? __lock_acquire+0xab9/0xd20
[  512.118179][T29198]  ? __pfx_genl_rcv_msg+0x10/0x10
[  512.118187][T29198]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  512.118205][T29198]  ? down_read+0x1ad/0x2e0
[  512.118213][T29198]  genl_rcv+0x28/0x40
[  512.118220][T29198]  netlink_unicast+0x82f/0x9e0
[  512.118234][T29198]  ? __pfx_netlink_unicast+0x10/0x10
[  512.118243][T29198]  ? netlink_sendmsg+0x642/0xb30
[  512.118249][T29198]  ? skb_put+0x11b/0x210
[  512.118259][T29198]  netlink_sendmsg+0x805/0xb30
[  512.118276][T29198]  ? __pfx_netlink_sendmsg+0x10/0x10
[  512.118288][T29198]  ? aa_sock_msg_perm+0xf1/0x1d0
[  512.118300][T29198]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  512.118313][T29198]  ? __pfx_netlink_sendmsg+0x10/0x10
[  512.118326][T29198]  __sock_sendmsg+0x21c/0x270
[  512.118345][T29198]  ____sys_sendmsg+0x505/0x830
[  512.118363][T29198]  ? __pfx_____sys_sendmsg+0x10/0x10
[  512.118384][T29198]  ? import_iovec+0x74/0xa0
[  512.118397][T29198]  ___sys_sendmsg+0x21f/0x2a0
[  512.118406][T29198]  ? __pfx____sys_sendmsg+0x10/0x10
[  512.118430][T29198]  ? __fget_files+0x2a/0x420
[  512.118436][T29198]  ? __fget_files+0x3a0/0x420
[  512.118447][T29198]  __x64_sys_sendmsg+0x19b/0x260
[  512.118458][T29198]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  512.118471][T29198]  ? rcu_is_watching+0x15/0xb0
[  512.118481][T29198]  ? do_syscall_64+0xbe/0x3b0
[  512.118490][T29198]  do_syscall_64+0xfa/0x3b0
[  512.118496][T29198]  ? lockdep_hardirqs_on+0x9c/0x150
[  512.118505][T29198]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  512.118512][T29198]  ? exc_page_fault+0x9f/0xf0
[  512.118522][T29198]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  512.118529][T29198] RIP: 0033:0x7f787838ebe9
[  512.118537][T29198] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  512.118543][T29198] RSP: 002b:00007f78792bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  512.118552][T29198] RAX: ffffffffffffffda RBX: 00007f78785c5fa0 RCX: 00007f787838ebe9
[  512.118557][T29198] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  512.118562][T29198] RBP: 00007f7878411e19 R08: 0000000000000000 R09: 0000000000000000
[  512.118566][T29198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  512.118570][T29198] R13: 00007f78785c6038 R14: 00007f78785c5fa0 R15: 00007ffd30ff3898
[  512.118582][T29198]  </TASK>
[  512.316123][T29200] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5680'.
[  512.472642][T29202] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5681'.
[  512.923110][T29223] mac80211_hwsim hwsim1006 wlan1: left allmulticast mode
[  512.992701][T29230] netlink: 14 bytes leftover after parsing attributes in process `syz.2.5689'.
[  513.001918][T29230] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  513.055295][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  513.069607][T29232] 8021q: adding VLAN 0 to HW filter on device bond23
[  513.077237][T29232] bond4: (slave macvlan27): Releasing backup interface
[  513.128966][T29235] veth0_to_bridge: entered promiscuous mode
[  513.131557][T29235] veth0_to_bridge: left promiscuous mode
[  513.271598][T29237] mac80211_hwsim hwsim669 wlan0: entered promiscuous mode
[  513.276186][T29237] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  513.852199][T29255] tun1: tun_chr_ioctl cmd 1074025672
[  513.854467][T29255] tun1: ignored: set checksum disabled
[  514.095036][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  514.109016][T29265] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR
[  514.361801][T29287] sctp: [Deprecated]: syz.2.5702 (pid 29287) Use of int in maxseg socket option.
[  514.361801][T29287] Use struct sctp_assoc_value instead
[  514.438450][T29286] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  514.546479][T29295] ip6tnl1: entered promiscuous mode
[  514.598684][T29299] lo speed is unknown, defaulting to 1000
[  514.782624][T29300] validate_nla: 10 callbacks suppressed
[  514.782635][T29300] netlink: 'syz.0.5706': attribute type 2 has an invalid length.
[  514.811194][T29308] openvswitch: netlink: Geneve option length err (len 256, max 255).
[  515.135068][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  515.425796][T29320] lo speed is unknown, defaulting to 1000
[  515.681516][T29343] netlink: 'syz.2.5714': attribute type 1 has an invalid length.
[  515.701992][T29343] workqueue: Failed to create a rescuer kthread for wq "bond24": -EINTR
[  515.882996][T29364] mac80211_hwsim hwsim797 wlan0: entered promiscuous mode
[  515.890075][T29364] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  516.175222][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  516.313673][T29381] mac80211_hwsim hwsim791 wlan0: left promiscuous mode
[  516.438413][T29388] 8021q: adding VLAN 0 to HW filter on device bond1
[  516.440906][T29396] IPVS: set_ctl: invalid protocol: 22 127.0.0.1:20000
[  516.458772][T29388] 8021q: adding VLAN 0 to HW filter on device macvlan20
[  516.463441][T29388] bond1: (slave macvlan20): Enslaving as a backup interface with a down link
[  516.518658][T29393] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  516.534809][T29401] netlink: 'syz.1.5727': attribute type 1 has an invalid length.
[  516.538724][T29401] netlink: 'syz.1.5727': attribute type 1 has an invalid length.
[  516.588068][T29403] lo speed is unknown, defaulting to 1000
[  516.632465][T29406] netlink: 'syz.1.5727': attribute type 1 has an invalid length.
[  516.690401][T29406] 8021q: adding VLAN 0 to HW filter on device bond58
[  516.696007][T29401] bond58: (slave wlan0): Opening slave failed
[  516.842118][T29420] netlink: 'syz.2.5731': attribute type 9 has an invalid length.
[  516.928492][T29403] netlink: 'syz.0.5728': attribute type 2 has an invalid length.
[  517.215001][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  517.256054][T29431] 8021q: adding VLAN 0 to HW filter on device bond24
[  517.281586][T29434] 8021q: adding VLAN 0 to HW filter on device macvlan28
[  517.314336][T29434] bond4: (slave macvlan28): speed changed to 0 on port 1
[  517.326737][T29434] bond4: (slave macvlan28): Enslaving as a backup interface with a down link
[  517.512024][T29451] __nla_validate_parse: 3 callbacks suppressed
[  517.512034][T29451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5739'.
[  517.519892][T29451] netlink: 'syz.1.5739': attribute type 11 has an invalid length.
[  517.529195][T29449] bond4: (slave macvlan28): Releasing backup interface
[  517.655382][T29453] netlink: 'syz.2.5737': attribute type 10 has an invalid length.
[  517.909865][T29458] lo speed is unknown, defaulting to 1000
[  518.050868][T29459] netlink: 'syz.1.5741': attribute type 2 has an invalid length.
[  518.058306][T29459] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5741'.
[  518.163452][T29463] netlink: 'syz.0.5742': attribute type 1 has an invalid length.
[  518.227954][T29463] workqueue: Failed to create a rescuer kthread for wq "bond34": -EINTR
[  518.233098][T29464] mac80211_hwsim hwsim797 wlan0: left promiscuous mode
[  518.255236][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  518.312190][T29469] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5743'.
[  518.481946][T29474] lo speed is unknown, defaulting to 1000
[  518.500516][T29480] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5746'.
[  518.638483][T29481] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5745'.
[  518.641561][T29475] lo speed is unknown, defaulting to 1000
[  519.038841][T29490] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5748'.
[  519.093934][T29490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5748'.
[  519.103628][T29490] netlink: 312 bytes leftover after parsing attributes in process `syz.0.5748'.
[  519.111647][T29490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5748'.
[  519.295048][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  519.345034][   T12] bond1: Warning: Found an uninitialized port
[  519.355672][T29500] bond1: (slave macvlan20): Releasing backup interface
[  519.474967][T29508] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5753'.
[  519.534312][T29509] team0: Mode changed to "loadbalance"
[  519.900195][T29520] validate_nla: 3 callbacks suppressed
[  519.900209][T29520] netlink: 'syz.2.5756': attribute type 10 has an invalid length.
[  519.916645][T29519] mac80211_hwsim hwsim1046 wlan1: entered allmulticast mode
[  520.334940][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  520.349774][T29539] vlan0: left promiscuous mode
[  520.351935][T29539] bond0: left promiscuous mode
[  520.360359][T29539] mac80211_hwsim hwsim669 wlan0: left promiscuous mode
[  520.370164][T29539] mac80211_hwsim hwsim1046 wlan1: left allmulticast mode
[  520.608720][T29546] netlink: 'syz.0.5760': attribute type 7 has an invalid length.
[  520.686854][T29546] lo speed is unknown, defaulting to 1000
[  520.823709][T29550] lo speed is unknown, defaulting to 1000
[  521.089394][T29561] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  521.147096][T29553] netlink: 'syz.2.5761': attribute type 2 has an invalid length.
[  521.274354][T29569] netlink: 'syz.0.5766': attribute type 1 has an invalid length.
[  521.374922][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  521.378771][T29569] 8021q: adding VLAN 0 to HW filter on device bond34
[  521.400380][T29569] veth29: entered promiscuous mode
[  521.406285][T29569] bond34: (slave veth29): Enslaving as a backup interface with a down link
[  521.420399][T29569] bond34: (slave veth29): Releasing backup interface
[  521.525080][T29578] lo speed is unknown, defaulting to 1000
[  522.212331][T29588] netlink: 'syz.1.5771': attribute type 2 has an invalid length.
[  522.348880][T29606] netlink: 'syz.2.5774': attribute type 10 has an invalid length.
[  522.414983][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  523.464766][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  523.561825][T29616] __nla_validate_parse: 11 callbacks suppressed
[  523.561865][T29616] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5777'.
[  523.600431][T29619] netlink: 'syz.1.5776': attribute type 9 has an invalid length.
[  523.824937][T29627] netlink: 'syz.0.5778': attribute type 10 has an invalid length.
[  524.254053][T29638] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5782'.
[  524.278959][T29638] lo speed is unknown, defaulting to 1000
[  524.418661][T29641] netlink: 'syz.1.5783': attribute type 1 has an invalid length.
[  524.430097][T29641] netlink: 'syz.1.5783': attribute type 1 has an invalid length.
[  524.494956][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  524.692183][T29645] netlink: 212892 bytes leftover after parsing attributes in process `syz.0.5784'.
[  524.745936][T29664] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5788'.
[  524.849656][T29666] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  524.852217][T29666] CPU: 0 UID: 0 PID: 29666 Comm: syz.2.5787 Not tainted syzkaller #0 PREEMPT(full) 
[  524.852227][T29666] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  524.852231][T29666] Call Trace:
[  524.852235][T29666]  <TASK>
[  524.852239][T29666]  dump_stack_lvl+0x189/0x250
[  524.852253][T29666]  ? __pfx_dump_stack_lvl+0x10/0x10
[  524.852262][T29666]  ? __pfx__printk+0x10/0x10
[  524.852274][T29666]  ? kernfs_path_from_node+0x2f/0x290
[  524.852282][T29666]  ? kernfs_path_from_node+0x250/0x290
[  524.852289][T29666]  ? kernfs_path_from_node+0x2f/0x290
[  524.852298][T29666]  sysfs_warn_dup+0x8e/0xa0
[  524.852305][T29666]  sysfs_do_create_link_sd+0xc0/0x110
[  524.852314][T29666]  device_add_class_symlinks+0x1cf/0x240
[  524.852323][T29666]  device_add+0x475/0xb50
[  524.852332][T29666]  wiphy_register+0x1ba6/0x28d0
[  524.852351][T29666]  ? __pfx_wiphy_register+0x10/0x10
[  524.852360][T29666]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  524.852371][T29666]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  524.852382][T29666]  ieee80211_register_hw+0x3425/0x4080
[  524.852397][T29666]  ? ieee80211_register_hw+0x1461/0x4080
[  524.852408][T29666]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  524.852418][T29666]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  524.852437][T29666]  ? __hrtimer_setup+0x187/0x210
[  524.852444][T29666]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  524.852456][T29666]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  524.852477][T29666]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  524.852485][T29666]  ? trace_kmalloc+0x1f/0xd0
[  524.852493][T29666]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  524.852502][T29666]  ? kstrndup+0xbf/0x160
[  524.852514][T29666]  hwsim_new_radio_nl+0xea4/0x1b10
[  524.852524][T29666]  ? __pfx___nla_validate_parse+0x10/0x10
[  524.852541][T29666]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  524.852555][T29666]  ? __nla_parse+0x40/0x60
[  524.852566][T29666]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  524.852578][T29666]  genl_family_rcv_msg_doit+0x215/0x300
[  524.852593][T29666]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  524.852607][T29666]  ? bpf_lsm_capable+0x9/0x20
[  524.852621][T29666]  ? security_capable+0x7e/0x2e0
[  524.852634][T29666]  genl_rcv_msg+0x60e/0x790
[  524.852645][T29666]  ? __pfx_genl_rcv_msg+0x10/0x10
[  524.852652][T29666]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  524.852667][T29666]  netlink_rcv_skb+0x208/0x470
[  524.852676][T29666]  ? __lock_acquire+0xab9/0xd20
[  524.852687][T29666]  ? __pfx_genl_rcv_msg+0x10/0x10
[  524.852695][T29666]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  524.852713][T29666]  ? down_read+0x1ad/0x2e0
[  524.852721][T29666]  genl_rcv+0x28/0x40
[  524.852728][T29666]  netlink_unicast+0x82f/0x9e0
[  524.852741][T29666]  ? __pfx_netlink_unicast+0x10/0x10
[  524.852751][T29666]  ? netlink_sendmsg+0x642/0xb30
[  524.852757][T29666]  ? skb_put+0x11b/0x210
[  524.852766][T29666]  netlink_sendmsg+0x805/0xb30
[  524.852776][T29666]  ? __pfx_netlink_sendmsg+0x10/0x10
[  524.852784][T29666]  ? aa_sock_msg_perm+0xf1/0x1d0
[  524.852792][T29666]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  524.852799][T29666]  ? __pfx_netlink_sendmsg+0x10/0x10
[  524.852805][T29666]  __sock_sendmsg+0x21c/0x270
[  524.852834][T29666]  ____sys_sendmsg+0x505/0x830
[  524.852847][T29666]  ? __pfx_____sys_sendmsg+0x10/0x10
[  524.852859][T29666]  ? import_iovec+0x74/0xa0
[  524.852869][T29666]  ___sys_sendmsg+0x21f/0x2a0
[  524.852878][T29666]  ? __pfx____sys_sendmsg+0x10/0x10
[  524.852905][T29666]  ? __fget_files+0x2a/0x420
[  524.852911][T29666]  ? __fget_files+0x3a0/0x420
[  524.852922][T29666]  __x64_sys_sendmsg+0x19b/0x260
[  524.852930][T29666]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  524.852943][T29666]  ? do_user_addr_fault+0xc8a/0x1390
[  524.852955][T29666]  ? do_syscall_64+0xbe/0x3b0
[  524.852964][T29666]  do_syscall_64+0xfa/0x3b0
[  524.852970][T29666]  ? lockdep_hardirqs_on+0x9c/0x150
[  524.852979][T29666]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  524.852986][T29666]  ? exc_page_fault+0x9f/0xf0
[  524.852996][T29666]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  524.853003][T29666] RIP: 0033:0x7f6621f8ebe9
[  524.853011][T29666] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  524.853017][T29666] RSP: 002b:00007f66201b4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  524.853025][T29666] RAX: ffffffffffffffda RBX: 00007f66221c6180 RCX: 00007f6621f8ebe9
[  524.853031][T29666] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  524.853035][T29666] RBP: 00007f6622011e19 R08: 0000000000000000 R09: 0000000000000000
[  524.853039][T29666] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  524.853044][T29666] R13: 00007f66221c6218 R14: 00007f66221c6180 R15: 00007fff04829858
[  524.853056][T29666]  </TASK>
[  525.203266][T29675] lo speed is unknown, defaulting to 1000
[  525.297040][T29680] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5792'.
[  525.377493][T29683] lo speed is unknown, defaulting to 1000
[  525.383422][T29676] netlink: 'syz.0.5789': attribute type 2 has an invalid length.
[  525.391862][T29685] netlink: 'syz.2.5791': attribute type 10 has an invalid length.
[  525.395475][T29676] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5789'.
[  525.521611][T29686] netlink: 'syz.1.5793': attribute type 2 has an invalid length.
[  525.534864][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  525.546947][T29686] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5793'.
[  525.754889][T29691] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5794'.
[  525.798804][T29694] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5795'.
[  526.073390][T29701] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5797'.
[  526.181573][T29710] netlink: 'syz.2.5799': attribute type 1 has an invalid length.
[  526.226356][T29710] 8021q: adding VLAN 0 to HW filter on device bond25
[  526.257791][T29710] veth16: entered promiscuous mode
[  526.284195][T29710] veth17: entered promiscuous mode
[  526.388584][T29714] lo speed is unknown, defaulting to 1000
[  526.469723][T29731] lo speed is unknown, defaulting to 1000
[  526.575472][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  526.593083][T29741] ip6tnl1: entered promiscuous mode
[  526.623705][T29745] netlink: 'syz.0.5808': attribute type 6 has an invalid length.
[  526.673542][T29749] lo speed is unknown, defaulting to 1000
[  527.343740][ T5881] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  527.347878][ T5881] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  527.362172][ T5881] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  527.366929][ T5881] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  527.386015][T29782] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  527.394400][T29781] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  527.614939][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  528.210418][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  528.213526][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  528.655138][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  529.056932][T29848] __nla_validate_parse: 11 callbacks suppressed
[  529.056985][T29848] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5827'.
[  529.192623][T29858] netlink: 'syz.1.5829': attribute type 1 has an invalid length.
[  529.219019][T29853] mac80211_hwsim hwsim669 wlan0: entered promiscuous mode
[  529.224337][T29853] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  529.246005][T29858] 8021q: adding VLAN 0 to HW filter on device bond59
[  529.390309][T29869] lo speed is unknown, defaulting to 1000
[  529.469069][   T62] block nbd2: Possible stuck request ffff888021de0000: control (read@0,1024B). Runtime 270 seconds
[  529.473477][   T62] block nbd2: Possible stuck request ffff888021de0200: control (read@1024,1024B). Runtime 270 seconds
[  529.479277][   T62] block nbd2: Possible stuck request ffff888021de0400: control (read@2048,1024B). Runtime 270 seconds
[  529.483870][   T62] block nbd2: Possible stuck request ffff888021de0600: control (read@3072,1024B). Runtime 270 seconds
[  529.515401][T29876] netlink: 'syz.1.5831': attribute type 2 has an invalid length.
[  529.576468][T29884] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5834'.
[  529.670590][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  529.674058][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  529.694941][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  529.980403][T29897] netlink: 'syz.2.5838': attribute type 2 has an invalid length.
[  530.000981][T29897] k*: entered promiscuous mode
[  530.003349][T29897] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5838'.
[  530.034495][T29904] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5839'.
[  530.081026][T29909] IPVS: set_ctl: invalid protocol: 22 100.1.1.0:20002
[  530.170749][ T6767] wlan0: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID
[  530.222031][T29924] netlink: 'syz.2.5844': attribute type 9 has an invalid length.
[  530.695713][T29949] netlink: 'syz.0.5849': attribute type 6 has an invalid length.
[  530.735113][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  530.779090][T29949] netlink: 'syz.0.5849': attribute type 12 has an invalid length.
[  530.783414][T29949] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.5849'.
[  531.696226][T29977] netlink: 'syz.0.5854': attribute type 4 has an invalid length.
[  531.722765][T29977] netlink: 'syz.0.5854': attribute type 4 has an invalid length.
[  531.774959][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  531.820381][T29979] netlink: 'syz.1.5856': attribute type 21 has an invalid length.
[  531.828877][T29979] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5856'.
[  531.887956][T29983] sctp: [Deprecated]: syz.1.5858 (pid 29983) Use of struct sctp_assoc_value in delayed_ack socket option.
[  531.887956][T29983] Use struct sctp_sack_info instead
[  531.928084][T29986] lo speed is unknown, defaulting to 1000
[  531.937907][T29983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5858'.
[  531.942710][T29983] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5858'.
[  532.180898][ T5881] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0
[  532.183666][ T5881] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0
[  532.188396][ T5881] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0
[  532.194807][ T5881] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0
[  532.226929][T30011] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5864'.
[  532.255853][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  532.258701][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  532.270951][T30011] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  532.353107][T30022] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5868'.
[  532.397809][T30019] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  532.400371][T30019] CPU: 0 UID: 0 PID: 30019 Comm: syz.0.5867 Not tainted syzkaller #0 PREEMPT(full) 
[  532.400381][T30019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  532.400386][T30019] Call Trace:
[  532.400390][T30019]  <TASK>
[  532.400393][T30019]  dump_stack_lvl+0x189/0x250
[  532.400407][T30019]  ? __pfx_dump_stack_lvl+0x10/0x10
[  532.400416][T30019]  ? __pfx__printk+0x10/0x10
[  532.400428][T30019]  ? kernfs_path_from_node+0x2f/0x290
[  532.400436][T30019]  ? kernfs_path_from_node+0x250/0x290
[  532.400443][T30019]  ? kernfs_path_from_node+0x2f/0x290
[  532.400452][T30019]  sysfs_warn_dup+0x8e/0xa0
[  532.400460][T30019]  sysfs_do_create_link_sd+0xc0/0x110
[  532.400468][T30019]  device_add_class_symlinks+0x1cf/0x240
[  532.400478][T30019]  device_add+0x475/0xb50
[  532.400486][T30019]  wiphy_register+0x1ba6/0x28d0
[  532.400505][T30019]  ? __pfx_wiphy_register+0x10/0x10
[  532.400514][T30019]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  532.400525][T30019]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  532.400535][T30019]  ieee80211_register_hw+0x3425/0x4080
[  532.400550][T30019]  ? ieee80211_register_hw+0x1461/0x4080
[  532.400562][T30019]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  532.400572][T30019]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  532.400590][T30019]  ? __hrtimer_setup+0x187/0x210
[  532.400597][T30019]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  532.400609][T30019]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  532.400630][T30019]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  532.400638][T30019]  ? trace_kmalloc+0x1f/0xd0
[  532.400646][T30019]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  532.400655][T30019]  ? kstrndup+0xbf/0x160
[  532.400667][T30019]  hwsim_new_radio_nl+0xea4/0x1b10
[  532.400677][T30019]  ? __pfx___nla_validate_parse+0x10/0x10
[  532.400693][T30019]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  532.400707][T30019]  ? __nla_parse+0x40/0x60
[  532.400719][T30019]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  532.400731][T30019]  genl_family_rcv_msg_doit+0x215/0x300
[  532.400762][T30019]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  532.400776][T30019]  ? bpf_lsm_capable+0x9/0x20
[  532.400785][T30019]  ? security_capable+0x7e/0x2e0
[  532.400798][T30019]  genl_rcv_msg+0x60e/0x790
[  532.400809][T30019]  ? __pfx_genl_rcv_msg+0x10/0x10
[  532.400817][T30019]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  532.400831][T30019]  netlink_rcv_skb+0x208/0x470
[  532.400840][T30019]  ? __lock_acquire+0xab9/0xd20
[  532.400850][T30019]  ? __pfx_genl_rcv_msg+0x10/0x10
[  532.400859][T30019]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  532.400877][T30019]  ? down_read+0x1ad/0x2e0
[  532.400885][T30019]  genl_rcv+0x28/0x40
[  532.400892][T30019]  netlink_unicast+0x82f/0x9e0
[  532.400905][T30019]  ? __pfx_netlink_unicast+0x10/0x10
[  532.400915][T30019]  ? netlink_sendmsg+0x642/0xb30
[  532.400921][T30019]  ? skb_put+0x11b/0x210
[  532.400930][T30019]  netlink_sendmsg+0x805/0xb30
[  532.400940][T30019]  ? __pfx_netlink_sendmsg+0x10/0x10
[  532.400948][T30019]  ? aa_sock_msg_perm+0xf1/0x1d0
[  532.400955][T30019]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  532.400963][T30019]  ? __pfx_netlink_sendmsg+0x10/0x10
[  532.400970][T30019]  __sock_sendmsg+0x21c/0x270
[  532.400981][T30019]  ____sys_sendmsg+0x505/0x830
[  532.400991][T30019]  ? __pfx_____sys_sendmsg+0x10/0x10
[  532.401002][T30019]  ? import_iovec+0x74/0xa0
[  532.401012][T30019]  ___sys_sendmsg+0x21f/0x2a0
[  532.401021][T30019]  ? __pfx____sys_sendmsg+0x10/0x10
[  532.401044][T30019]  ? __fget_files+0x2a/0x420
[  532.401050][T30019]  ? __fget_files+0x3a0/0x420
[  532.401060][T30019]  __x64_sys_sendmsg+0x19b/0x260
[  532.401069][T30019]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  532.401081][T30019]  ? rcu_is_watching+0x15/0xb0
[  532.401090][T30019]  ? do_syscall_64+0xbe/0x3b0
[  532.401099][T30019]  do_syscall_64+0xfa/0x3b0
[  532.401104][T30019]  ? lockdep_hardirqs_on+0x9c/0x150
[  532.401114][T30019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  532.401121][T30019]  ? exc_page_fault+0x9f/0xf0
[  532.401131][T30019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  532.401138][T30019] RIP: 0033:0x7f787838ebe9
[  532.401145][T30019] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  532.401151][T30019] RSP: 002b:00007f78792bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  532.401160][T30019] RAX: ffffffffffffffda RBX: 00007f78785c5fa0 RCX: 00007f787838ebe9
[  532.401165][T30019] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000008
[  532.401170][T30019] RBP: 00007f7878411e19 R08: 0000000000000000 R09: 0000000000000000
[  532.401174][T30019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  532.401178][T30019] R13: 00007f78785c6038 R14: 00007f78785c5fa0 R15: 00007ffd30ff3898
[  532.401190][T30019]  </TASK>
[  532.612094][T30034] netlink: 'syz.0.5871': attribute type 1 has an invalid length.
[  532.616051][T30034] netlink: 'syz.0.5871': attribute type 1 has an invalid length.
[  532.708663][T30034] netlink: 'syz.0.5871': attribute type 1 has an invalid length.
[  532.727279][T30034] 8021q: adding VLAN 0 to HW filter on device bond35
[  532.782830][T30051] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  532.815042][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  532.873452][T30056] netlink: 'syz.2.5878': attribute type 10 has an invalid length.
[  532.885839][T30054] lo speed is unknown, defaulting to 1000
[  532.893560][ T6767] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  532.900435][ T6767] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  532.972308][   T32] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  532.977878][   T32] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  533.004506][T30059] netlink: 'syz.1.5877': attribute type 2 has an invalid length.
[  533.854882][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  534.035786][T30081] lo speed is unknown, defaulting to 1000
[  534.152191][T30086] __nla_validate_parse: 3 callbacks suppressed
[  534.152201][T30086] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5886'.
[  534.158462][T30086] netlink: 43 bytes leftover after parsing attributes in process `syz.1.5886'.
[  534.161599][T30086] netlink: 43 bytes leftover after parsing attributes in process `syz.1.5886'.
[  534.167877][T30086] mac80211_hwsim hwsim1073 wlan1: entered allmulticast mode
[  534.240421][T30088] mac80211_hwsim hwsim791 wlan0: entered promiscuous mode
[  534.243166][T30088] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  534.634225][T30106] 8021q: adding VLAN 0 to HW filter on device bond60
[  534.641187][T30106] mac80211_hwsim hwsim791 wlan0: left promiscuous mode
[  534.649575][T30106] bond60: (slave wlan0): Enslaving as an active interface with a down link
[  534.763170][T30104] netlink: 9472 bytes leftover after parsing attributes in process `syz.2.5892'.
[  534.867612][T30116] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  534.870908][T30116] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  534.894972][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  534.965785][T30125] 8021q: adding VLAN 0 to HW filter on device bond4
[  534.978980][T30125] 8021q: adding VLAN 0 to HW filter on device macvlan29
[  534.981849][T30125] bond4: (slave macvlan29): speed changed to 0 on port 1
[  534.985303][T30125] bond4: (slave macvlan29): Enslaving as a backup interface with a down link
[  534.999984][T30125] bond4: (slave macvlan29): Releasing backup interface
[  535.487471][T30143] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5902'.
[  535.498777][T30140] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5902'.
[  535.798939][T30149] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5905'.
[  535.874544][T30155] bond60: (slave wlan0): Releasing active interface
[  535.934531][T30157] ip6tnl1: left promiscuous mode
[  535.936894][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  535.940908][T30157] veth29: left promiscuous mode
[  535.973502][T30155] team0: Mode changed to "loadbalance"
[  536.260161][T30172] lo speed is unknown, defaulting to 1000
[  536.293419][T30176] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5914'.
[  536.451519][T30184] lo speed is unknown, defaulting to 1000
[  536.480392][T30187] lo speed is unknown, defaulting to 1000
[  536.610443][T30188] validate_nla: 12 callbacks suppressed
[  536.610453][T30188] netlink: 'syz.0.5917': attribute type 2 has an invalid length.
[  536.633308][T30188] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5917'.
[  536.974974][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  537.007386][T30200] netlink: 256 bytes leftover after parsing attributes in process `syz.0.5920'.
[  537.096444][T30203] mac80211_hwsim hwsim1073 wlan1: left allmulticast mode
[  537.127294][T30202] netlink: 'syz.1.5921': attribute type 10 has an invalid length.
[  537.137515][T30202] mac80211_hwsim hwsim1073 wlan1: entered allmulticast mode
[  537.260613][T30214] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  537.276483][T30209] lo speed is unknown, defaulting to 1000
[  537.402234][T30221] netlink: 'syz.2.5926': attribute type 10 has an invalid length.
[  537.543868][T30227] netlink: 'syz.2.5927': attribute type 10 has an invalid length.
[  537.650495][T30232] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  537.654189][T30232] syzkaller0: entered promiscuous mode
[  537.660256][T30232] syzkaller0: entered allmulticast mode
[  537.895593][T30239] netlink: 'syz.2.5932': attribute type 12 has an invalid length.
[  538.014924][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  538.116729][T30246] bond4: option mode: unable to set because the bond device is up
[  538.308971][T30256] mac80211_hwsim hwsim669 wlan0: left promiscuous mode
[  538.319558][T30256] veth16: left promiscuous mode
[  538.321804][T30256] veth17: left promiscuous mode
[  538.328029][T30256] ip6tnl1: left promiscuous mode
[  538.409073][T30258] lo speed is unknown, defaulting to 1000
[  538.428841][T30262] netlink: 'syz.0.5940': attribute type 1 has an invalid length.
[  538.455991][T30260] lo speed is unknown, defaulting to 1000
[  538.485553][T30262] veth31: entered promiscuous mode
[  538.490326][T30262] bond36: (slave veth31): Enslaving as a backup interface with a down link
[  538.496125][T30266] bond36: (slave veth31): Releasing backup interface
[  538.591057][T30269] 8021q: adding VLAN 0 to HW filter on device bond1
[  538.604500][T30269] 8021q: adding VLAN 0 to HW filter on device macvlan21
[  538.611080][T30269] bond1: (slave macvlan21): Enslaving as a backup interface with a down link
[  538.669210][T30272] netlink: 'syz.0.5942': attribute type 2 has an invalid length.
[  538.698364][T30277] netlink: 'syz.2.5938': attribute type 2 has an invalid length.
[  538.722881][T30267] netlink: 'syz.1.5939': attribute type 2 has an invalid length.
[  539.065323][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  539.092333][T30284] netlink: 'syz.0.5944': attribute type 9 has an invalid length.
[  539.501539][T30297] mac80211_hwsim hwsim1087 wlan1: entered allmulticast mode
[  540.094909][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  540.436489][T30323] netlink: 'syz.0.5954': attribute type 11 has an invalid length.
[  540.684636][T30329] __nla_validate_parse: 6 callbacks suppressed
[  540.688706][T30329] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5956'.
[  540.732468][T30334] bond1: (slave macvlan21): Releasing backup interface
[  540.756938][T30334] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  540.760242][T30334] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  540.771812][T30331] can: request_module (can-proto-0) failed.
[  541.135187][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  541.189412][T30349] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5962'.
[  541.910086][T30382] validate_nla: 7 callbacks suppressed
[  541.910100][T30382] netlink: 'syz.2.5970': attribute type 4 has an invalid length.
[  542.033925][T30389] netlink: 'syz.0.5973': attribute type 4 has an invalid length.
[  542.175020][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  542.288346][T30398] netlink: 'syz.0.5976': attribute type 1 has an invalid length.
[  542.291789][T30398] netlink: 'syz.0.5976': attribute type 1 has an invalid length.
[  542.390184][T30412] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  542.393114][T30412] syzkaller0: entered promiscuous mode
[  542.396877][T30412] syzkaller0: entered allmulticast mode
[  542.403088][T30412] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5978'.
[  542.439186][T30411] tipc: Resetting bearer <eth:syzkaller0>
[  542.451023][T30411] tipc: Disabling bearer <eth:syzkaller0>
[  542.519034][T30419] sch_tbf: burst 4398 is lower than device lo mtu (11337746) !
[  542.535319][T30420] netlink: 'syz.2.5979': attribute type 10 has an invalid length.
[  542.538271][T30418] netlink: 'syz.2.5979': attribute type 10 has an invalid length.
[  542.898693][T30447] netlink: 'syz.0.5986': attribute type 10 has an invalid length.
[  542.966177][T30450] netlink: 'syz.1.5989': attribute type 6 has an invalid length.
[  543.084764][T30454] netlink: 128 bytes leftover after parsing attributes in process `syz.1.5991'.
[  543.089016][T30454] netlink: 'syz.1.5991': attribute type 1 has an invalid length.
[  543.112309][T30454] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5991'.
[  543.181823][T30457] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5992'.
[  543.224930][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  543.237913][T30457] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5992'.
[  543.359364][T30463] netlink: 'syz.1.5995': attribute type 10 has an invalid length.
[  543.637891][T30470] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5997'.
[  543.769868][T30474] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.5998'.
[  543.972112][T30488] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6002'.
[  544.254943][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  544.279132][T30511] team0: Mode changed to "broadcast"
[  544.282498][T30511] vlan0: entered promiscuous mode
[  544.285379][T30511] erspan0: entered promiscuous mode
[  544.289235][T30511] tipc: Enabling of bearer <eth:team0> rejected, already enabled
[  544.363477][T30518] syzkaller1: entered promiscuous mode
[  544.367654][T30518] syzkaller1: entered allmulticast mode
[  544.514317][T30536] sch_tbf: burst 4398 is lower than device lo mtu (11337746) !
[  544.578795][T30539] mac80211_hwsim hwsim1073 wlan1: left allmulticast mode
[  545.295020][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  545.411523][T30581] tap0: tun_chr_ioctl cmd 1074025680
[  545.422855][T30581] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  545.533024][T30585] ip_vti0: Master is either lo or non-ether device
[  545.601981][T30580] tipc: Disabling bearer <eth:syzkaller0>
[  545.621204][T30589] veth27: entered promiscuous mode
[  545.984203][T30606] __nla_validate_parse: 7 callbacks suppressed
[  545.984213][T30606] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6032'.
[  546.022153][T30621] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6036'.
[  546.194157][T30628] netlink: 220 bytes leftover after parsing attributes in process `syz.1.6038'.
[  546.232093][T30630] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  546.236227][T30630] CPU: 1 UID: 0 PID: 30630 Comm: syz.0.6039 Not tainted syzkaller #0 PREEMPT(full) 
[  546.236244][T30630] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  546.236253][T30630] Call Trace:
[  546.236258][T30630]  <TASK>
[  546.236264][T30630]  dump_stack_lvl+0x189/0x250
[  546.236303][T30630]  ? __pfx_dump_stack_lvl+0x10/0x10
[  546.236318][T30630]  ? __pfx__printk+0x10/0x10
[  546.236339][T30630]  ? kernfs_path_from_node+0x2f/0x290
[  546.236353][T30630]  ? kernfs_path_from_node+0x250/0x290
[  546.236363][T30630]  ? kernfs_path_from_node+0x2f/0x290
[  546.236378][T30630]  sysfs_warn_dup+0x8e/0xa0
[  546.236389][T30630]  sysfs_do_create_link_sd+0xc0/0x110
[  546.236403][T30630]  device_add_class_symlinks+0x1cf/0x240
[  546.236418][T30630]  device_add+0x475/0xb50
[  546.236435][T30630]  wiphy_register+0x1ba6/0x28d0
[  546.236465][T30630]  ? __pfx_wiphy_register+0x10/0x10
[  546.236483][T30630]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  546.236505][T30630]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  546.236524][T30630]  ieee80211_register_hw+0x3425/0x4080
[  546.236552][T30630]  ? ieee80211_register_hw+0x1461/0x4080
[  546.236574][T30630]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  546.236619][T30630]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  546.236645][T30630]  ? __hrtimer_setup+0x187/0x210
[  546.236658][T30630]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  546.236679][T30630]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  546.236726][T30630]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  546.236742][T30630]  ? trace_kmalloc+0x1f/0xd0
[  546.236757][T30630]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  546.236774][T30630]  ? kstrndup+0xbf/0x160
[  546.236795][T30630]  hwsim_new_radio_nl+0xea4/0x1b10
[  546.236814][T30630]  ? __pfx___nla_validate_parse+0x10/0x10
[  546.236846][T30630]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  546.236872][T30630]  ? __nla_parse+0x40/0x60
[  546.236893][T30630]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  546.236915][T30630]  genl_family_rcv_msg_doit+0x215/0x300
[  546.236936][T30630]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  546.236961][T30630]  ? bpf_lsm_capable+0x9/0x20
[  546.236977][T30630]  ? security_capable+0x7e/0x2e0
[  546.237001][T30630]  genl_rcv_msg+0x60e/0x790
[  546.237022][T30630]  ? __pfx_genl_rcv_msg+0x10/0x10
[  546.237036][T30630]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  546.237064][T30630]  netlink_rcv_skb+0x208/0x470
[  546.237080][T30630]  ? __lock_acquire+0xab9/0xd20
[  546.237099][T30630]  ? __pfx_genl_rcv_msg+0x10/0x10
[  546.237115][T30630]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  546.237149][T30630]  ? down_read+0x1ad/0x2e0
[  546.237164][T30630]  genl_rcv+0x28/0x40
[  546.237177][T30630]  netlink_unicast+0x82f/0x9e0
[  546.237201][T30630]  ? __pfx_netlink_unicast+0x10/0x10
[  546.237220][T30630]  ? netlink_sendmsg+0x642/0xb30
[  546.237230][T30630]  ? skb_put+0x11b/0x210
[  546.237246][T30630]  netlink_sendmsg+0x805/0xb30
[  546.237265][T30630]  ? __pfx_netlink_sendmsg+0x10/0x10
[  546.237280][T30630]  ? aa_sock_msg_perm+0xf1/0x1d0
[  546.237294][T30630]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  546.237307][T30630]  ? __pfx_netlink_sendmsg+0x10/0x10
[  546.237320][T30630]  __sock_sendmsg+0x21c/0x270
[  546.237340][T30630]  ____sys_sendmsg+0x505/0x830
[  546.237359][T30630]  ? __pfx_____sys_sendmsg+0x10/0x10
[  546.237380][T30630]  ? import_iovec+0x74/0xa0
[  546.237398][T30630]  ___sys_sendmsg+0x21f/0x2a0
[  546.237414][T30630]  ? __pfx____sys_sendmsg+0x10/0x10
[  546.237456][T30630]  ? __fget_files+0x2a/0x420
[  546.237467][T30630]  ? __fget_files+0x3a0/0x420
[  546.237487][T30630]  __x64_sys_sendmsg+0x19b/0x260
[  546.237503][T30630]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  546.237526][T30630]  ? rcu_is_watching+0x15/0xb0
[  546.237543][T30630]  ? do_syscall_64+0xbe/0x3b0
[  546.237558][T30630]  do_syscall_64+0xfa/0x3b0
[  546.237568][T30630]  ? lockdep_hardirqs_on+0x9c/0x150
[  546.237586][T30630]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  546.237627][T30630]  ? exc_page_fault+0x9f/0xf0
[  546.237647][T30630]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  546.237660][T30630] RIP: 0033:0x7f787838ebe9
[  546.237673][T30630] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  546.237684][T30630] RSP: 002b:00007f78792bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  546.237707][T30630] RAX: ffffffffffffffda RBX: 00007f78785c5fa0 RCX: 00007f787838ebe9
[  546.237716][T30630] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  546.237725][T30630] RBP: 00007f7878411e19 R08: 0000000000000000 R09: 0000000000000000
[  546.237733][T30630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  546.237742][T30630] R13: 00007f78785c6038 R14: 00007f78785c5fa0 R15: 00007ffd30ff3898
[  546.237765][T30630]  </TASK>
[  546.334977][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  546.359818][T30630] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6039'.
[  546.560503][T30644] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6041'.
[  546.563967][T30644] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6041'.
[  546.626747][T30657] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6044'.
[  546.629955][T30657] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6044'.
[  546.633609][T30657] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6044'.
[  546.649763][T30661] netlink: 244 bytes leftover after parsing attributes in process `syz.0.6045'.
[  546.654040][T30661] netlink: 'syz.0.6045': attribute type 11 has an invalid length.
[  547.286373][T30682] validate_nla: 11 callbacks suppressed
[  547.286387][T30682] netlink: 'syz.1.6050': attribute type 6 has an invalid length.
[  547.292941][T30683] netlink: 'syz.1.6050': attribute type 6 has an invalid length.
[  547.311259][T30682] netlink: 'syz.1.6050': attribute type 12 has an invalid length.
[  547.374995][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  547.540484][T30681] netlink: 'syz.1.6050': attribute type 12 has an invalid length.
[  547.541724][T30696] lo speed is unknown, defaulting to 1000
[  547.777620][T30707] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  547.782399][T30707] CPU: 1 UID: 0 PID: 30707 Comm: syz.1.6055 Not tainted syzkaller #0 PREEMPT(full) 
[  547.782432][T30707] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  547.782442][T30707] Call Trace:
[  547.782447][T30707]  <TASK>
[  547.782453][T30707]  dump_stack_lvl+0x189/0x250
[  547.782476][T30707]  ? __pfx_dump_stack_lvl+0x10/0x10
[  547.782491][T30707]  ? __pfx__printk+0x10/0x10
[  547.782513][T30707]  ? kernfs_path_from_node+0x2f/0x290
[  547.782526][T30707]  ? kernfs_path_from_node+0x250/0x290
[  547.782539][T30707]  ? kernfs_path_from_node+0x2f/0x290
[  547.782555][T30707]  sysfs_warn_dup+0x8e/0xa0
[  547.782569][T30707]  sysfs_do_create_link_sd+0xc0/0x110
[  547.782608][T30707]  device_add_class_symlinks+0x1cf/0x240
[  547.782626][T30707]  device_add+0x475/0xb50
[  547.782642][T30707]  wiphy_register+0x1ba6/0x28d0
[  547.782677][T30707]  ? __pfx_wiphy_register+0x10/0x10
[  547.782692][T30707]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  547.782711][T30707]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  547.782728][T30707]  ieee80211_register_hw+0x3425/0x4080
[  547.782753][T30707]  ? ieee80211_register_hw+0x1461/0x4080
[  547.782772][T30707]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  547.782790][T30707]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  547.782812][T30707]  ? __hrtimer_setup+0x187/0x210
[  547.782823][T30707]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  547.782843][T30707]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  547.782882][T30707]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  547.782897][T30707]  ? trace_kmalloc+0x1f/0xd0
[  547.782912][T30707]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  547.782929][T30707]  ? kstrndup+0xbf/0x160
[  547.782949][T30707]  hwsim_new_radio_nl+0xea4/0x1b10
[  547.782968][T30707]  ? __pfx___nla_validate_parse+0x10/0x10
[  547.782997][T30707]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  547.783023][T30707]  ? __nla_parse+0x40/0x60
[  547.783044][T30707]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  547.783066][T30707]  genl_family_rcv_msg_doit+0x215/0x300
[  547.783086][T30707]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  547.783111][T30707]  ? bpf_lsm_capable+0x9/0x20
[  547.783127][T30707]  ? security_capable+0x7e/0x2e0
[  547.783150][T30707]  genl_rcv_msg+0x60e/0x790
[  547.783169][T30707]  ? __pfx_genl_rcv_msg+0x10/0x10
[  547.783183][T30707]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  547.783211][T30707]  netlink_rcv_skb+0x208/0x470
[  547.783229][T30707]  ? __lock_acquire+0xab9/0xd20
[  547.783247][T30707]  ? __pfx_genl_rcv_msg+0x10/0x10
[  547.783263][T30707]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  547.783296][T30707]  ? down_read+0x1ad/0x2e0
[  547.783310][T30707]  genl_rcv+0x28/0x40
[  547.783323][T30707]  netlink_unicast+0x82f/0x9e0
[  547.783346][T30707]  ? __pfx_netlink_unicast+0x10/0x10
[  547.783365][T30707]  ? netlink_sendmsg+0x642/0xb30
[  547.783374][T30707]  ? skb_put+0x11b/0x210
[  547.783396][T30707]  netlink_sendmsg+0x805/0xb30
[  547.783415][T30707]  ? __pfx_netlink_sendmsg+0x10/0x10
[  547.783429][T30707]  ? aa_sock_msg_perm+0xf1/0x1d0
[  547.783442][T30707]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  547.783455][T30707]  ? __pfx_netlink_sendmsg+0x10/0x10
[  547.783468][T30707]  __sock_sendmsg+0x21c/0x270
[  547.783488][T30707]  ____sys_sendmsg+0x505/0x830
[  547.783507][T30707]  ? __pfx_____sys_sendmsg+0x10/0x10
[  547.783528][T30707]  ? import_iovec+0x74/0xa0
[  547.783546][T30707]  ___sys_sendmsg+0x21f/0x2a0
[  547.783562][T30707]  ? __pfx____sys_sendmsg+0x10/0x10
[  547.783632][T30707]  ? __fget_files+0x2a/0x420
[  547.783643][T30707]  ? __fget_files+0x3a0/0x420
[  547.783662][T30707]  __x64_sys_sendmsg+0x19b/0x260
[  547.783678][T30707]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  547.783700][T30707]  ? rcu_is_watching+0x15/0xb0
[  547.783717][T30707]  ? do_syscall_64+0xbe/0x3b0
[  547.783732][T30707]  do_syscall_64+0xfa/0x3b0
[  547.783742][T30707]  ? lockdep_hardirqs_on+0x9c/0x150
[  547.783759][T30707]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  547.783771][T30707]  ? exc_page_fault+0x9f/0xf0
[  547.783790][T30707]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  547.783802][T30707] RIP: 0033:0x7f95be58ebe9
[  547.783814][T30707] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  547.783825][T30707] RSP: 002b:00007f95bf48e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  547.783839][T30707] RAX: ffffffffffffffda RBX: 00007f95be7c5fa0 RCX: 00007f95be58ebe9
[  547.783848][T30707] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000004
[  547.783856][T30707] RBP: 00007f95be611e19 R08: 0000000000000000 R09: 0000000000000000
[  547.783864][T30707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  547.783871][T30707] R13: 00007f95be7c6038 R14: 00007f95be7c5fa0 R15: 00007fffaad6f958
[  547.783893][T30707]  </TASK>
[  548.203328][T30721] netlink: 'syz.1.6058': attribute type 1 has an invalid length.
[  548.232870][T30728] netem: incorrect gi model size
[  548.241205][T30728] netem: change failed
[  548.414945][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  549.158462][T30762] lo speed is unknown, defaulting to 1000
[  549.430506][T30768] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  549.433015][T30768] CPU: 1 UID: 0 PID: 30768 Comm: syz.1.6072 Not tainted syzkaller #0 PREEMPT(full) 
[  549.433026][T30768] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  549.433032][T30768] Call Trace:
[  549.433036][T30768]  <TASK>
[  549.433056][T30768]  dump_stack_lvl+0x189/0x250
[  549.433071][T30768]  ? __pfx_dump_stack_lvl+0x10/0x10
[  549.433081][T30768]  ? __pfx__printk+0x10/0x10
[  549.433093][T30768]  ? kernfs_path_from_node+0x2f/0x290
[  549.433103][T30768]  ? kernfs_path_from_node+0x250/0x290
[  549.433110][T30768]  ? kernfs_path_from_node+0x2f/0x290
[  549.433121][T30768]  sysfs_warn_dup+0x8e/0xa0
[  549.433129][T30768]  sysfs_do_create_link_sd+0xc0/0x110
[  549.433138][T30768]  device_add_class_symlinks+0x1cf/0x240
[  549.433148][T30768]  device_add+0x475/0xb50
[  549.433157][T30768]  wiphy_register+0x1ba6/0x28d0
[  549.433174][T30768]  ? __pfx_wiphy_register+0x10/0x10
[  549.433184][T30768]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  549.433195][T30768]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  549.433206][T30768]  ieee80211_register_hw+0x3425/0x4080
[  549.433222][T30768]  ? ieee80211_register_hw+0x1461/0x4080
[  549.433234][T30768]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  549.433245][T30768]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  549.433259][T30768]  ? __hrtimer_setup+0x187/0x210
[  549.433268][T30768]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  549.433286][T30768]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  549.433316][T30768]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  549.433328][T30768]  ? trace_kmalloc+0x1f/0xd0
[  549.433339][T30768]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  549.433353][T30768]  ? kstrndup+0xbf/0x160
[  549.433369][T30768]  hwsim_new_radio_nl+0xea4/0x1b10
[  549.433379][T30768]  ? __pfx___nla_validate_parse+0x10/0x10
[  549.433396][T30768]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  549.433411][T30768]  ? __nla_parse+0x40/0x60
[  549.433422][T30768]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  549.433440][T30768]  genl_family_rcv_msg_doit+0x215/0x300
[  549.433452][T30768]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  549.433468][T30768]  ? bpf_lsm_capable+0x9/0x20
[  549.433477][T30768]  ? security_capable+0x7e/0x2e0
[  549.433491][T30768]  genl_rcv_msg+0x60e/0x790
[  549.433502][T30768]  ? __pfx_genl_rcv_msg+0x10/0x10
[  549.433511][T30768]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  549.433526][T30768]  netlink_rcv_skb+0x208/0x470
[  549.433537][T30768]  ? __lock_acquire+0xab9/0xd20
[  549.433548][T30768]  ? __pfx_genl_rcv_msg+0x10/0x10
[  549.433582][T30768]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  549.433602][T30768]  ? down_read+0x1ad/0x2e0
[  549.433611][T30768]  genl_rcv+0x28/0x40
[  549.433618][T30768]  netlink_unicast+0x82f/0x9e0
[  549.433632][T30768]  ? __pfx_netlink_unicast+0x10/0x10
[  549.433643][T30768]  ? netlink_sendmsg+0x642/0xb30
[  549.433649][T30768]  ? skb_put+0x11b/0x210
[  549.433658][T30768]  netlink_sendmsg+0x805/0xb30
[  549.433669][T30768]  ? __pfx_netlink_sendmsg+0x10/0x10
[  549.433678][T30768]  ? aa_sock_msg_perm+0xf1/0x1d0
[  549.433688][T30768]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  549.433696][T30768]  ? __pfx_netlink_sendmsg+0x10/0x10
[  549.433703][T30768]  __sock_sendmsg+0x21c/0x270
[  549.433714][T30768]  ____sys_sendmsg+0x505/0x830
[  549.433724][T30768]  ? __pfx_____sys_sendmsg+0x10/0x10
[  549.433736][T30768]  ? import_iovec+0x74/0xa0
[  549.433746][T30768]  ___sys_sendmsg+0x21f/0x2a0
[  549.433754][T30768]  ? __pfx____sys_sendmsg+0x10/0x10
[  549.433777][T30768]  ? __fget_files+0x2a/0x420
[  549.433783][T30768]  ? __fget_files+0x3a0/0x420
[  549.433794][T30768]  __x64_sys_sendmsg+0x19b/0x260
[  549.433803][T30768]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  549.433815][T30768]  ? rcu_is_watching+0x15/0xb0
[  549.433825][T30768]  ? do_syscall_64+0xbe/0x3b0
[  549.433834][T30768]  do_syscall_64+0xfa/0x3b0
[  549.433841][T30768]  ? lockdep_hardirqs_on+0x9c/0x150
[  549.433855][T30768]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  549.433865][T30768]  ? exc_page_fault+0x9f/0xf0
[  549.433882][T30768]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  549.433893][T30768] RIP: 0033:0x7f95be58ebe9
[  549.433905][T30768] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  549.433914][T30768] RSP: 002b:00007f95bf48e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  549.433927][T30768] RAX: ffffffffffffffda RBX: 00007f95be7c5fa0 RCX: 00007f95be58ebe9
[  549.433935][T30768] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000006
[  549.433941][T30768] RBP: 00007f95be611e19 R08: 0000000000000000 R09: 0000000000000000
[  549.433948][T30768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  549.433954][T30768] R13: 00007f95be7c6038 R14: 00007f95be7c5fa0 R15: 00007fffaad6f958
[  549.433974][T30768]  </TASK>
[  549.455084][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  549.673857][T30763] netlink: 'syz.0.6070': attribute type 2 has an invalid length.
[  549.690477][   T32] wlan0: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID
[  550.012257][T30780] netlink: 'syz.1.6074': attribute type 10 has an invalid length.
[  550.494809][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  550.602405][T30796] netlink: 'syz.1.6079': attribute type 1 has an invalid length.
[  550.609112][T30796] workqueue: Failed to create a rescuer kthread for wq "bond63": -EINTR
[  550.960566][T30814] netlink: 'syz.2.6083': attribute type 1 has an invalid length.
[  550.963152][T30814] netlink: 'syz.2.6083': attribute type 1 has an invalid length.
[  551.046595][T30814] 8021q: adding VLAN 0 to HW filter on device bond26
[  551.064927][T30814] bond26: (slave wlan0): Enslaving as an active interface with a down link
[  551.083316][T30814] vlan4: entered allmulticast mode
[  551.086528][T30814] vlan1: entered allmulticast mode
[  551.088805][T30814] veth0_vlan: entered allmulticast mode
[  551.091826][T30814] bond26: (slave vlan4): Opening slave failed
[  551.257403][T30827] __nla_validate_parse: 61 callbacks suppressed
[  551.257414][T30827] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6087'.
[  551.535011][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  551.760238][T30836] netlink: 'syz.1.6088': attribute type 11 has an invalid length.
[  552.164075][T30839] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6089'.
[  552.574773][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  552.778573][T30868] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6094'.
[  552.811820][T30873] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6096'.
[  552.816496][T30873] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6096'.
[  552.820035][T30873] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6096'.
[  552.824491][T30873] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6096'.
[  552.830397][T30872] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6096'.
[  552.833995][T30872] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6096'.
[  552.837500][T30871] lo speed is unknown, defaulting to 1000
[  552.840362][T30872] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6096'.
[  553.428199][T30900] lo speed is unknown, defaulting to 1000
[  553.615147][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  553.777437][T30901] validate_nla: 1 callbacks suppressed
[  553.777448][T30901] netlink: 'syz.2.6101': attribute type 2 has an invalid length.
[  554.291494][T30906] can: request_module (can-proto-0) failed.
[  554.466044][T30913] netlink: 'syz.1.6104': attribute type 1 has an invalid length.
[  554.470637][T30913] netlink: 'syz.1.6104': attribute type 1 has an invalid length.
[  554.497723][T30915] netlink: 'syz.1.6104': attribute type 1 has an invalid length.
[  554.507608][T30914] lo speed is unknown, defaulting to 1000
[  554.654930][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  555.032171][T30925] netlink: 'syz.2.6103': attribute type 2 has an invalid length.
[  555.409693][T30933] netlink: 'syz.2.6108': attribute type 282 has an invalid length.
[  555.426333][T30933] lo speed is unknown, defaulting to 1000
[  555.695093][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  555.700764][T30896] Set syz1 is full, maxelem 65536 reached
[  555.807849][T30934] netlink: 'syz.2.6108': attribute type 2 has an invalid length.
[  556.022363][T30943] netlink: 'syz.0.6111': attribute type 8 has an invalid length.
[  556.300081][T30950] __nla_validate_parse: 7 callbacks suppressed
[  556.300100][T30950] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6115'.
[  556.311332][T30950] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6115'.
[  556.317376][T30950] netlink: 'syz.2.6115': attribute type 10 has an invalid length.
[  556.321557][T30950] mac80211_hwsim hwsim1046 wlan1: entered allmulticast mode
[  556.385322][T30960] netlink: 152 bytes leftover after parsing attributes in process `syz.2.6117'.
[  556.455051][T30957] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6116'.
[  556.483434][T30967] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6118'.
[  556.575710][T30969] netlink: 14 bytes leftover after parsing attributes in process `syz.1.6119'.
[  556.734778][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  556.791304][T30981] mac80211_hwsim hwsim669 wlan0: entered promiscuous mode
[  556.794394][T30981] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  556.843802][T30985] bond26: (slave wlan0): Releasing active interface
[  556.859467][T30987] ip6gre1: entered allmulticast mode
[  556.876635][T30985] netlink: 'syz.2.6124': attribute type 10 has an invalid length.
[  556.889109][T30987] vlan0: left promiscuous mode
[  556.891150][T30987] erspan0: left promiscuous mode
[  556.919922][T30987] veth27: left promiscuous mode
[  556.934399][T30987] ip6gre1: left allmulticast mode
[  556.940340][T30989] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  556.944301][T30989] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  556.980733][T30991] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6126'.
[  557.246089][T31007] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6130'.
[  557.281713][T31004] 8021q: adding VLAN 0 to HW filter on device bond63
[  557.292317][T31004] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6129'.
[  557.390827][T31015] netlink: 119 bytes leftover after parsing attributes in process `syz.1.6131'.
[  557.775153][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  558.746634][T31033] delete_channel: no stack
[  558.748585][T31034] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  558.808168][T31062] lo speed is unknown, defaulting to 1000
[  558.813067][T31067] lo speed is unknown, defaulting to 1000
[  558.814823][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  559.132773][T31081] validate_nla: 8 callbacks suppressed
[  559.132786][T31081] netlink: 'syz.1.6148': attribute type 10 has an invalid length.
[  559.532321][T31099] netlink: 'syz.2.6153': attribute type 1 has an invalid length.
[  559.535257][   T62] block nbd2: Possible stuck request ffff888021de0000: control (read@0,1024B). Runtime 300 seconds
[  559.538795][   T62] block nbd2: Possible stuck request ffff888021de0200: control (read@1024,1024B). Runtime 300 seconds
[  559.542490][   T62] block nbd2: Possible stuck request ffff888021de0400: control (read@2048,1024B). Runtime 300 seconds
[  559.546663][   T62] block nbd2: Possible stuck request ffff888021de0600: control (read@3072,1024B). Runtime 300 seconds
[  559.591567][T31099] 8021q: adding VLAN 0 to HW filter on device bond27
[  559.790493][T31108] mac80211_hwsim hwsim669 wlan0: left promiscuous mode
[  559.802773][T31108] mac80211_hwsim hwsim1046 wlan1: left allmulticast mode
[  559.854905][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  559.975470][T31115] lo speed is unknown, defaulting to 1000
[  560.225748][T31115] netlink: 'syz.0.6157': attribute type 2 has an invalid length.
[  560.569781][T31132] netlink: 'syz.0.6162': attribute type 9 has an invalid length.
[  560.719913][T31145] netlink: 'syz.1.6164': attribute type 10 has an invalid length.
[  560.894894][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  560.928285][T31163] netlink: 'syz.0.6172': attribute type 2 has an invalid length.
[  560.960642][T31164] lo speed is unknown, defaulting to 1000
[  561.094214][T31174] vlan0: entered promiscuous mode
[  561.096803][T31174] bond0: entered promiscuous mode
[  561.108313][T31174] tipc: Enabling of bearer <eth:team0> rejected, failed to enable media
[  561.238013][T31186] netlink: 'syz.2.6176': attribute type 1 has an invalid length.
[  561.240968][T31186] netlink: 'syz.2.6176': attribute type 1 has an invalid length.
[  561.248354][T31186] netlink: 'syz.2.6176': attribute type 1 has an invalid length.
[  561.270013][T31186] 8021q: adding VLAN 0 to HW filter on device bond28
[  561.277538][T31186] bond28: (slave wlan0): Opening slave failed
[  561.361462][T31191] netlink: 'syz.2.6178': attribute type 1 has an invalid length.
[  561.392945][T31191] 8021q: adding VLAN 0 to HW filter on device bond29
[  561.408905][T31191] bond29: (slave wlan0): Opening slave failed
[  561.592612][T31199] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check.
[  561.643074][T31203] mac80211_hwsim hwsim669 wlan0: entered promiscuous mode
[  561.645898][T31203] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  561.661743][T31205] unsupported nlmsg_type 40
[  561.736254][T31215] __nla_validate_parse: 17 callbacks suppressed
[  561.736264][T31215] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6186'.
[  561.771849][T31217] netlink: 72 bytes leftover after parsing attributes in process `syz.2.6187'.
[  561.934902][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  561.970475][T31228] lo speed is unknown, defaulting to 1000
[  562.069987][T31238] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6192'.
[  562.122363][T31238] veth29: entered promiscuous mode
[  562.152145][T31232] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6190'.
[  562.190313][T31246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6194'.
[  562.239990][T31250] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6196'.
[  562.597016][T31258] mac80211_hwsim hwsim1073 wlan1: entered promiscuous mode
[  562.599901][T31258] mac80211_hwsim hwsim1073 wlan1: entered allmulticast mode
[  562.652741][T31260] netlink: 256 bytes leftover after parsing attributes in process `syz.0.6200'.
[  562.659810][T31260] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6200'.
[  562.669949][T31260] syz_tun: left allmulticast mode
[  562.839264][T31275] lo speed is unknown, defaulting to 1000
[  562.974939][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  563.088728][T31291] lo speed is unknown, defaulting to 1000
[  563.707270][T31309] 8021q: adding VLAN 0 to HW filter on device bond1
[  563.731258][T31309] 8021q: adding VLAN 0 to HW filter on device macvlan24
[  563.735765][T31309] bond1: (slave macvlan24): Enslaving as a backup interface with a down link
[  563.746763][T31309] bond1: (slave macvlan24): Releasing backup interface
[  563.756993][T31310] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6209'.
[  563.765318][T31310] mac80211_hwsim hwsim1073 wlan1: left promiscuous mode
[  563.768665][T31310] mac80211_hwsim hwsim1073 wlan1: left allmulticast mode
[  563.797364][T31314] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6211'.
[  564.007978][T31322] pim6reg1: entered promiscuous mode
[  564.014909][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  564.016037][T31322] pim6reg1: entered allmulticast mode
[  564.181253][T31329] vlan0: left promiscuous mode
[  564.182905][T31329] bond0: left promiscuous mode
[  564.192824][T31329] mac80211_hwsim hwsim669 wlan0: left promiscuous mode
[  564.343064][T31343] validate_nla: 8 callbacks suppressed
[  564.343073][T31343] netlink: 'syz.0.6217': attribute type 10 has an invalid length.
[  565.054889][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  565.211440][T31347] mac80211_hwsim hwsim791 wlan0: entered promiscuous mode
[  565.215418][T31347] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  565.318919][T31360] netlink: 'syz.2.6225': attribute type 1 has an invalid length.
[  565.369698][T31360] 8021q: adding VLAN 0 to HW filter on device bond30
[  565.375524][T31360] netlink: 'syz.2.6225': attribute type 10 has an invalid length.
[  565.389055][T31358] veth19: entered promiscuous mode
[  565.394532][T31358] bond30: (slave veth19): Enslaving as a backup interface with a down link
[  565.398622][T31366] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  565.444548][T31371] netlink: 'syz.2.6229': attribute type 11 has an invalid length.
[  566.014566][T31385] netlink: 'syz.1.6232': attribute type 6 has an invalid length.
[  566.041034][T31384] netlink: 'syz.1.6232': attribute type 12 has an invalid length.
[  566.104920][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  566.496631][T31398] IPv6: sit2: Disabled Multicast RS
[  566.628078][T31413] netlink: 'syz.0.6240': attribute type 1 has an invalid length.
[  566.630537][T31412] netlink: 'syz.0.6240': attribute type 1 has an invalid length.
[  566.655701][T31413] 8021q: adding VLAN 0 to HW filter on device bond37
[  566.673859][T31412] veth33: entered promiscuous mode
[  566.690103][T31413] veth35: entered promiscuous mode
[  566.790616][T31427] __nla_validate_parse: 4 callbacks suppressed
[  566.790633][T31427] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6241'.
[  566.850772][T31426] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6243'.
[  566.856711][T31426] netlink: 'syz.0.6243': attribute type 10 has an invalid length.
[  566.892611][T31431] tun1: tun_chr_ioctl cmd 1074025675
[  566.894414][T31431] tun1: persist enabled
[  566.897688][T31431] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6244'.
[  566.903309][T31431] tun1: tun_chr_ioctl cmd 1074025675
[  566.906499][T31431] tun1: persist enabled
[  567.113423][T31445] team0: Unable to change to the same mode the team is in
[  567.124107][T31445] vlan0: entered promiscuous mode
[  567.130069][T31445] erspan0: entered promiscuous mode
[  567.144894][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  567.243108][T31441] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  567.248952][T31441] CPU: 1 UID: 0 PID: 31441 Comm: syz.0.6245 Not tainted syzkaller #0 PREEMPT(full) 
[  567.248971][T31441] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  567.248980][T31441] Call Trace:
[  567.248986][T31441]  <TASK>
[  567.248992][T31441]  dump_stack_lvl+0x189/0x250
[  567.249016][T31441]  ? __pfx_dump_stack_lvl+0x10/0x10
[  567.249033][T31441]  ? __pfx__printk+0x10/0x10
[  567.249056][T31441]  ? kernfs_path_from_node+0x2f/0x290
[  567.249071][T31441]  ? kernfs_path_from_node+0x250/0x290
[  567.249083][T31441]  ? kernfs_path_from_node+0x2f/0x290
[  567.249100][T31441]  sysfs_warn_dup+0x8e/0xa0
[  567.249114][T31441]  sysfs_do_create_link_sd+0xc0/0x110
[  567.249131][T31441]  device_add_class_symlinks+0x1cf/0x240
[  567.249149][T31441]  device_add+0x475/0xb50
[  567.249198][T31441]  wiphy_register+0x1ba6/0x28d0
[  567.249233][T31441]  ? __pfx_wiphy_register+0x10/0x10
[  567.249251][T31441]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  567.249272][T31441]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  567.249291][T31441]  ieee80211_register_hw+0x3425/0x4080
[  567.249320][T31441]  ? ieee80211_register_hw+0x1461/0x4080
[  567.249342][T31441]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  567.249360][T31441]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  567.249413][T31441]  ? __hrtimer_setup+0x187/0x210
[  567.249425][T31441]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  567.249446][T31441]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  567.249486][T31441]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  567.249502][T31441]  ? trace_kmalloc+0x1f/0xd0
[  567.249517][T31441]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  567.249535][T31441]  ? kstrndup+0xbf/0x160
[  567.249557][T31441]  hwsim_new_radio_nl+0xea4/0x1b10
[  567.249577][T31441]  ? __pfx___nla_validate_parse+0x10/0x10
[  567.249607][T31441]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  567.249634][T31441]  ? __nla_parse+0x40/0x60
[  567.249655][T31441]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  567.249678][T31441]  genl_family_rcv_msg_doit+0x215/0x300
[  567.249699][T31441]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  567.249725][T31441]  ? bpf_lsm_capable+0x9/0x20
[  567.249740][T31441]  ? security_capable+0x7e/0x2e0
[  567.249762][T31441]  genl_rcv_msg+0x60e/0x790
[  567.249782][T31441]  ? __pfx_genl_rcv_msg+0x10/0x10
[  567.249796][T31441]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  567.249824][T31441]  netlink_rcv_skb+0x208/0x470
[  567.249841][T31441]  ? __lock_acquire+0xab9/0xd20
[  567.249859][T31441]  ? __pfx_genl_rcv_msg+0x10/0x10
[  567.249875][T31441]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  567.249909][T31441]  ? down_read+0x1ad/0x2e0
[  567.249924][T31441]  genl_rcv+0x28/0x40
[  567.249937][T31441]  netlink_unicast+0x82f/0x9e0
[  567.249961][T31441]  ? __pfx_netlink_unicast+0x10/0x10
[  567.249980][T31441]  ? netlink_sendmsg+0x642/0xb30
[  567.249990][T31441]  ? skb_put+0x11b/0x210
[  567.250006][T31441]  netlink_sendmsg+0x805/0xb30
[  567.250026][T31441]  ? __pfx_netlink_sendmsg+0x10/0x10
[  567.250040][T31441]  ? aa_sock_msg_perm+0xf1/0x1d0
[  567.250054][T31441]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  567.250067][T31441]  ? __pfx_netlink_sendmsg+0x10/0x10
[  567.250080][T31441]  __sock_sendmsg+0x21c/0x270
[  567.250105][T31441]  ____sys_sendmsg+0x505/0x830
[  567.250123][T31441]  ? __pfx_____sys_sendmsg+0x10/0x10
[  567.250145][T31441]  ? import_iovec+0x74/0xa0
[  567.250163][T31441]  ___sys_sendmsg+0x21f/0x2a0
[  567.250179][T31441]  ? __pfx____sys_sendmsg+0x10/0x10
[  567.250228][T31441]  ? __fget_files+0x2a/0x420
[  567.250240][T31441]  ? __fget_files+0x3a0/0x420
[  567.250260][T31441]  __x64_sys_sendmsg+0x19b/0x260
[  567.250278][T31441]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  567.250301][T31441]  ? rcu_is_watching+0x15/0xb0
[  567.250318][T31441]  ? do_syscall_64+0xbe/0x3b0
[  567.250333][T31441]  do_syscall_64+0xfa/0x3b0
[  567.250344][T31441]  ? lockdep_hardirqs_on+0x9c/0x150
[  567.250389][T31441]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  567.250404][T31441]  ? exc_page_fault+0x9f/0xf0
[  567.250424][T31441]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  567.250436][T31441] RIP: 0033:0x7f787838ebe9
[  567.250449][T31441] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  567.250459][T31441] RSP: 002b:00007f787929a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  567.250474][T31441] RAX: ffffffffffffffda RBX: 00007f78785c6090 RCX: 00007f787838ebe9
[  567.250484][T31441] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b
[  567.250492][T31441] RBP: 00007f7878411e19 R08: 0000000000000000 R09: 0000000000000000
[  567.250500][T31441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  567.250507][T31441] R13: 00007f78785c6128 R14: 00007f78785c6090 R15: 00007ffd30ff3898
[  567.250529][T31441]  </TASK>
[  567.588923][T31459] netlink: 'syz.2.6251': attribute type 10 has an invalid length.
[  567.619258][T31461] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6254'.
[  567.928623][T31473] netlink: 'syz.0.6257': attribute type 1 has an invalid length.
[  567.985305][T31473] 8021q: adding VLAN 0 to HW filter on device bond38
[  567.991409][T31473] bond38: (slave wlan0): Opening slave failed
[  568.037725][T31476] netlink: 200 bytes leftover after parsing attributes in process `syz.0.6258'.
[  568.184962][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  568.287156][T31488] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6263'.
[  568.418853][T31502] bond30: (slave veth19): Releasing backup interface
[  568.436397][T31505] syzkaller0: entered promiscuous mode
[  568.440054][T31505] syzkaller0: entered allmulticast mode
[  568.541657][T31514] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6267'.
[  568.609566][T31515] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6270'.
[  568.617019][T31513] netlink: 'syz.0.6271': attribute type 11 has an invalid length.
[  568.882643][T31535] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6275'.
[  569.214804][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  569.329211][T31570] netlink: 9472 bytes leftover after parsing attributes in process `syz.2.6286'.
[  569.720424][T31588] veth19: left promiscuous mode
[  570.046966][T31596] validate_nla: 7 callbacks suppressed
[  570.046981][T31596] netlink: 'syz.2.6292': attribute type 2 has an invalid length.
[  570.255098][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  571.247009][T31643] netlink: 'syz.0.6306': attribute type 1 has an invalid length.
[  571.250446][T31643] netlink: 'syz.0.6306': attribute type 1 has an invalid length.
[  571.294881][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
Connection to localhost closed by remote host.
[  571.911933][T31631] syz_tun (unregistering): left allmulticast mode
[  571.937129][T31655] syz_tun (unregistering): left allmulticast mode
[  572.336875][    C0] IPVS: rr: UDP 255.255.255.255:0 - no destination available
[  573.611568][T22220] bond1 (unregistering): Released all slaves
[  573.682939][T22220] bond2 (unregistering): Released all slaves
[  573.690045][T22220] bond3 (unregistering): Released all slaves
[  573.697153][T22220] bond4 (unregistering): Released all slaves
[  573.704009][T22220] bond5 (unregistering): Released all slaves
[  573.779811][T22220] bond6 (unregistering): Released all slaves
[  573.844585][T22220] bond7 (unregistering): Released all slaves
[  573.913266][T22220] bond8 (unregistering): Released all slaves
[  573.982083][T22220] bond9 (unregistering): Released all slaves
[  573.989128][T22220] bond10 (unregistering): Released all slaves
[  574.060398][T22220] bond11 (unregistering): Released all slaves
[  574.133492][T22220] bond12 (unregistering): Released all slaves
[  574.202213][T22220] bond13 (unregistering): Released all slaves
[  574.502459][T22220] bond0 (unregistering): Released all slaves
[  574.509834][T22220] bond14 (unregistering): Released all slaves
[  574.584962][T22220] bond15 (unregistering): Released all slaves
[  574.591521][T22220] bond16 (unregistering): Released all slaves
[  574.665582][T22220] bond17 (unregistering): Released all slaves
[  574.738464][T22220] bond18 (unregistering): Released all slaves
[  574.809346][T22220] bond19 (unregistering): Released all slaves
[  574.881016][T22220] bond20 (unregistering): Released all slaves
[  574.953243][T22220] bond21 (unregistering): Released all slaves
[  575.028841][T22220] bond22 (unregistering): Released all slaves
[  575.036130][T22220] bond23 (unregistering): Released all slaves
[  575.117673][T22220] bond24 (unregistering): Released all slaves
[  575.191676][T22220] bond25 (unregistering): Released all slaves
[  575.257255][T22220] bond26 (unregistering): Released all slaves
[  575.327574][T22220] bond27 (unregistering): Released all slaves
[  575.407144][T22220] bond28 (unregistering): Released all slaves
[  575.418237][T22220] bond29 (unregistering): Released all slaves
[  575.498801][T22220] bond30 (unregistering): Released all slaves
[  575.579942][T22220] bond31 (unregistering): Released all slaves
[  575.590192][T22220] bond32 (unregistering): Released all slaves
[  575.664518][T22220] bond33 (unregistering): Released all slaves
[  575.671422][T22220] bond34 (unregistering): Released all slaves
[  575.738555][T22220] bond35 (unregistering): Released all slaves
[  575.746408][T22220] bond36 (unregistering): Released all slaves
[  575.752907][T22220] bond37 (unregistering): Released all slaves
[  575.760038][T22220] bond38 (unregistering): Released all slaves
[  575.767959][T22220] bond39 (unregistering): Released all slaves
[  575.775993][T22220] bond40 (unregistering): Released all slaves
[  575.854077][T22220] bond41 (unregistering): Released all slaves
[  575.865656][T22220] bond42 (unregistering): Released all slaves
[  575.876477][T22220] bond43 (unregistering): Released all slaves
[  575.958568][T22220] bond44 (unregistering): Released all slaves
[  576.048598][T22220] bond45 (unregistering): Released all slaves
[  576.130119][T22220] bond46 (unregistering): Released all slaves
[  576.201460][T22220] bond47 (unregistering): Released all slaves
[  576.280831][T22220] bond48 (unregistering): Released all slaves
[  576.358351][T22220] bond49 (unregistering): Released all slaves
[  576.431406][T22220] bond50 (unregistering): Released all slaves
[  576.502780][T22220] bond51 (unregistering): Released all slaves
[  576.571309][T22220] bond52 (unregistering): Released all slaves
[  576.653227][T22220] bond53 (unregistering): Released all slaves
[  576.732119][T22220] bond54 (unregistering): Released all slaves
[  576.807699][T22220] bond55 (unregistering): Released all slaves
[  576.878177][T22220] bond56 (unregistering): Released all slaves
[  576.946038][T22220] bond57 (unregistering): Released all slaves
[  577.017379][T22220] bond58 (unregistering): Released all slaves
[  577.089519][T22220] bond59 (unregistering): Released all slaves
[  577.180789][T22220] bond60 (unregistering): Released all slaves
[  577.190228][T22220] bond61 (unregistering): Released all slaves
[  577.200936][T22220] bond62 (unregistering): Released all slaves
[  577.281417][T22220] bond63 (unregistering): Released all slaves
[  577.291227][T22220] bond64 (unregistering): Released all slaves
[  577.583832][T22220] tipc: Disabling bearer <udp:s>
[  577.595504][T22220] tipc: Disabling bearer <eth:team0>
[  577.626093][T22220] tipc: Disabling bearer <udp:syz2>
[  577.633308][T22220] tipc: Left network mode
[  586.970127][T22220] ------------[ cut here ]------------
[  586.972243][T22220] WARNING: CPU: 1 PID: 22220 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0x7e/0x100
[  586.976827][T22220] Modules linked in:
[  586.978810][T22220] CPU: 1 UID: 0 PID: 22220 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) 
[  586.983111][T22220] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  586.987592][T22220] Workqueue: netns cleanup_net
[  586.989673][T22220] RIP: 0010:xfrm6_tunnel_net_exit+0x7e/0x100
[  586.992342][T22220] Code: 98 35 df f7 4b 83 3c 2c 00 75 19 e8 6c c7 7b f7 49 81 fd f8 07 00 00 74 1d e8 5e c7 7b f7 49 83 c5 08 eb c9 e8 53 c7 7b f7 90 <0f> 0b 90 49 81 fd f8 07 00 00 75 e3 48 81 c3 00 08 00 00 45 31 f6
[  587.001028][T22220] RSP: 0018:ffffc90006e0f8b0 EFLAGS: 00010293
[  587.003748][T22220] RAX: ffffffff8a43e6bd RBX: ffff888023ab8000 RCX: ffff888127181cc0
[  587.007439][T22220] RDX: 0000000000000000 RSI: ffffffff8dba7696 RDI: ffff888023ab8000
[  587.010906][T22220] RBP: ffffc90006e0f9b0 R08: ffffffff8fa39037 R09: 1ffffffff1f47206
[  587.014477][T22220] R10: dffffc0000000000 R11: fffffbfff1f47207 R12: ffff888023ab8000
[  587.018075][T22220] R13: 0000000000000000 R14: ffff88802aac8000 R15: dffffc0000000000
[  587.021521][T22220] FS:  0000000000000000(0000) GS:ffff8881a3c18000(0000) knlGS:0000000000000000
[  587.025620][T22220] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  587.028458][T22220] CR2: 000000110c38e4af CR3: 000000000df36000 CR4: 00000000000006f0
[  587.031810][T22220] Call Trace:
[  587.033326][T22220]  <TASK>
[  587.034591][T22220]  ops_undo_list+0x49a/0x990
[  587.036787][T22220]  ? __pfx_ops_undo_list+0x10/0x10
[  587.038859][T22220]  ? do_raw_spin_unlock+0x4d/0x240
[  587.041066][T22220]  cleanup_net+0x4c5/0x800
[  587.043090][T22220]  ? __pfx_cleanup_net+0x10/0x10
[  587.045465][T22220]  ? _raw_spin_unlock_irq+0x23/0x50
[  587.047193][T22220]  ? process_scheduled_works+0x9ef/0x17b0
[  587.049126][T22220]  ? process_scheduled_works+0x9ef/0x17b0
[  587.051182][T22220]  process_scheduled_works+0xae1/0x17b0
[  587.053100][T22220]  ? __pfx_process_scheduled_works+0x10/0x10
[  587.055312][T22220]  worker_thread+0x8a0/0xda0
[  587.056929][T22220]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  587.059330][T22220]  ? __kthread_parkme+0x7b/0x200
[  587.061324][T22220]  kthread+0x711/0x8a0
[  587.062840][T22220]  ? __pfx_worker_thread+0x10/0x10
[  587.064978][T22220]  ? __pfx_kthread+0x10/0x10
[  587.066771][T22220]  ? _raw_spin_unlock_irq+0x23/0x50
[  587.068776][T22220]  ? lockdep_hardirqs_on+0x9c/0x150
[  587.070600][T22220]  ? __pfx_kthread+0x10/0x10
[  587.072377][T22220]  ret_from_fork+0x3fc/0x770
[  587.073940][T22220]  ? __pfx_ret_from_fork+0x10/0x10
[  587.075712][T22220]  ? __switch_to_asm+0x39/0x70
[  587.077426][T22220]  ? __switch_to_asm+0x33/0x70
[  587.079072][T22220]  ? __pfx_kthread+0x10/0x10
[  587.080659][T22220]  ret_from_fork_asm+0x1a/0x30
[  587.082328][T22220]  </TASK>
[  587.083528][T22220] Kernel panic - not syncing: kernel: panic_on_warn set ...
[  587.086642][T22220] CPU: 1 UID: 0 PID: 22220 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) 
[  587.090598][T22220] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  587.094991][T22220] Workqueue: netns cleanup_net
[  587.097069][T22220] Call Trace:
[  587.098609][T22220]  <TASK>
[  587.099880][T22220]  dump_stack_lvl+0x99/0x250
[  587.101925][T22220]  ? __asan_memcpy+0x40/0x70
[  587.104014][T22220]  ? __pfx_dump_stack_lvl+0x10/0x10
[  587.106264][T22220]  ? __pfx__printk+0x10/0x10
[  587.108245][T22220]  vpanic+0x281/0x750
[  587.109979][T22220]  ? __pfx__printk+0x10/0x10
[  587.112033][T22220]  ? __pfx_vpanic+0x10/0x10
[  587.114045][T22220]  ? is_bpf_text_address+0x292/0x2b0
[  587.116359][T22220]  panic+0xb9/0xc0
[  587.118030][T22220]  ? __pfx_panic+0x10/0x10
[  587.119930][T22220]  __warn+0x31b/0x4b0
[  587.121711][T22220]  ? xfrm6_tunnel_net_exit+0x7e/0x100
[  587.124046][T22220]  ? xfrm6_tunnel_net_exit+0x7e/0x100
[  587.126363][T22220]  report_bug+0x2be/0x4f0
[  587.128318][T22220]  ? xfrm6_tunnel_net_exit+0x7e/0x100
[  587.130641][T22220]  ? xfrm6_tunnel_net_exit+0x7e/0x100
[  587.132948][T22220]  ? xfrm6_tunnel_net_exit+0x80/0x100
[  587.135408][T22220]  handle_bug+0x84/0x160
[  587.137175][T22220]  exc_invalid_op+0x1a/0x50
[  587.139179][T22220]  asm_exc_invalid_op+0x1a/0x20
[  587.141283][T22220] RIP: 0010:xfrm6_tunnel_net_exit+0x7e/0x100
[  587.144035][T22220] Code: 98 35 df f7 4b 83 3c 2c 00 75 19 e8 6c c7 7b f7 49 81 fd f8 07 00 00 74 1d e8 5e c7 7b f7 49 83 c5 08 eb c9 e8 53 c7 7b f7 90 <0f> 0b 90 49 81 fd f8 07 00 00 75 e3 48 81 c3 00 08 00 00 45 31 f6
[  587.152345][T22220] RSP: 0018:ffffc90006e0f8b0 EFLAGS: 00010293
[  587.154924][T22220] RAX: ffffffff8a43e6bd RBX: ffff888023ab8000 RCX: ffff888127181cc0
[  587.157637][T22220] RDX: 0000000000000000 RSI: ffffffff8dba7696 RDI: ffff888023ab8000
[  587.160290][T22220] RBP: ffffc90006e0f9b0 R08: ffffffff8fa39037 R09: 1ffffffff1f47206
[  587.162904][T22220] R10: dffffc0000000000 R11: fffffbfff1f47207 R12: ffff888023ab8000
[  587.165504][T22220] R13: 0000000000000000 R14: ffff88802aac8000 R15: dffffc0000000000
[  587.168073][T22220]  ? xfrm6_tunnel_net_exit+0x7d/0x100
[  587.169805][T22220]  ops_undo_list+0x49a/0x990
[  587.171361][T22220]  ? __pfx_ops_undo_list+0x10/0x10
[  587.173013][T22220]  ? do_raw_spin_unlock+0x4d/0x240
[  587.174702][T22220]  cleanup_net+0x4c5/0x800
[  587.176212][T22220]  ? __pfx_cleanup_net+0x10/0x10
[  587.177870][T22220]  ? _raw_spin_unlock_irq+0x23/0x50
[  587.179627][T22220]  ? process_scheduled_works+0x9ef/0x17b0
[  587.181524][T22220]  ? process_scheduled_works+0x9ef/0x17b0
[  587.183386][T22220]  process_scheduled_works+0xae1/0x17b0
[  587.185219][T22220]  ? __pfx_process_scheduled_works+0x10/0x10
[  587.187682][T22220]  worker_thread+0x8a0/0xda0
[  587.189614][T22220]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  587.192124][T22220]  ? __kthread_parkme+0x7b/0x200
[  587.194175][T22220]  kthread+0x711/0x8a0
[  587.195616][T22220]  ? __pfx_worker_thread+0x10/0x10
[  587.197827][T22220]  ? __pfx_kthread+0x10/0x10
[  587.199618][T22220]  ? _raw_spin_unlock_irq+0x23/0x50
[  587.201724][T22220]  ? lockdep_hardirqs_on+0x9c/0x150
[  587.203829][T22220]  ? __pfx_kthread+0x10/0x10
[  587.205763][T22220]  ret_from_fork+0x3fc/0x770
[  587.207646][T22220]  ? __pfx_ret_from_fork+0x10/0x10
[  587.209730][T22220]  ? __switch_to_asm+0x39/0x70
[  587.211724][T22220]  ? __switch_to_asm+0x33/0x70
[  587.213689][T22220]  ? __pfx_kthread+0x10/0x10
[  587.215613][T22220]  ret_from_fork_asm+0x1a/0x30
[  587.217542][T22220]  </TASK>
[  587.219640][T22220] Kernel Offset: disabled
[  587.221377][T22220] Rebooting in 86400 seconds..

VM DIAGNOSIS:
10:15:01  Registers:
info registers vcpu 0

CPU#0
RAX=daab9cfdd53dd400 RBX=ffffffff819683c8 RCX=daab9cfdd53dd400 RDX=0000000000000001
RSI=ffffffff8d9b8241 RDI=ffffffff8be33880 RBP=ffffffff8de07eb8 RSP=ffffffff8de07d80
R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4
R12=ffffffff8fa39030 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a20
RIP=ffffffff8b79c3f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8618000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f78790f7d60 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000ff 0000000000000000 XMM01=6f6c2f7261762f00 6469756e69676f6c
XMM02=0000ffffffffff00 0000000000000000 XMM03=0000000000000000 000000000000002f
XMM04=74772f676f6c2f72 61762f00706d7475 XMM05=3f3f3f3f3f3f3f3f 3f3f3f3f3f3f3f3f
XMM06=9999999999999999 9999999999999999 XMM07=2020202020202020 2020202020202020
XMM08=0020202000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=e810ed4f4f52f000 RBX=ffffffff819683c8 RCX=e810ed4f4f52f000 RDX=0000000000000001
RSI=ffffffff8d9b8241 RDI=ffffffff8be33880 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f9b R9 =1ffff11026cc65f3 R10=dffffc0000000000 R11=ffffed1026cc65f4
R12=ffffffff8fa39030 R13=0000000000000001 R14=0000000000000001 R15=1ffff110200d0000
RIP=ffffffff8b79c3f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c18000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c38e4af CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000ff 0000000000000000 XMM01=6f6c2f7261762f00 6469756e69676f6c
XMM02=0000ffffffffff00 0000000000000000 XMM03=0000000000000000 000000000000002f
XMM04=74772f676f6c2f72 61762f00706d7475 XMM05=3f3f3f3f3f3f3f3f 3f3f3f3f3f3f3f3f
XMM06=9999999999999999 9999999999999999 XMM07=2020202020202020 2020202020202020
XMM08=0020202000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
