last executing test programs:

2.150784619s ago: executing program 1 (id=1646):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2000000010000104000000000000000000480000", @ANYRES32=0x0, @ANYBLOB="ae1e020000000000f902131b82d24f2f12f31d5ca6dee3535dccc47340087e579ea024bde28231771fc2b4c4740cb8f506a15949ad196fdc92d6769551919414b20ce8ba63e7bd1586c1999c63cbcddd4e2bcd536d50570e58e37ec8374e346cb40bd55a19fce92bb36a02d7e019ea5f27c493cea8eb072cbef72db5d5f01130c6f60d75bae0b3a468bb"], 0x20}}, 0x0)
r1 = socket$kcm(0x10, 0x3, 0x10)
r2 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0x0, 0xfff}, 0x8)
sendto$inet6(r2, &(0x7f0000000140)='\x00', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x0, 0xffffffff, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0xa}, 0x1c)
getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, 0x0, &(0x7f0000000200))
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="1400000022000b0fd25a806c8c6f94f90124fc60", 0x14}], 0x1}, 0x4000010)
socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0)
ioctl$TUNSETVNETBE(0xffffffffffffffff, 0x400454de, &(0x7f0000000240))
close(r4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0))
ioctl$SIOCSIFHWADDR(r4, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="062000000010"})
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001000010000003a194618d96d6d2e8553", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0)
r5 = socket$kcm(0x10, 0x2, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={<r6=>0xffffffffffffffff})
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', <r8=>0x0})
recvfrom$ax25(r4, &(0x7f0000000140)=""/29, 0x1d, 0x10000, &(0x7f00000001c0)={{0x3, @bcast, 0x1}, [@null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_NEW_STATION(r9, &(0x7f0000007380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x44, r7, 0xe096044a3fc9e6f1, 0xffffffff, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x4}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0xfa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000d0}, 0x8050)
sendmsg$kcm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0)
r10 = socket$unix(0x1, 0x2, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000100)={'wlan1\x00'})
connect$inet6(r4, &(0x7f0000000340)={0xa, 0x4e21, 0xf14, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8}, 0x1c)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000710441000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28}, 0x94)

1.319074236s ago: executing program 1 (id=1658):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000002a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a98030000e6ff00000000020000000900010073797a30000000000944fd20ca4e00030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x2000e000)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0)
r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf250401f2800800180006ac0f"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xfffb}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELRULE={0x2c, 0x8, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa8}}, 0x0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001380)=@base={0x12, 0x5, 0x8, 0x1}, 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x18, 0xe, &(0x7f0000001440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000001800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x6, 0x3aa, &(0x7f0000002080)=""/4102}, 0x94)
socketpair(0x5, 0x5, 0xffff8001, &(0x7f0000000040)={<r4=>0xffffffffffffffff})
sendmsg$IPSET_CMD_TYPE(r4, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0xd, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x48001}, 0x20000004)

1.06510647s ago: executing program 1 (id=1660):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01030000000000af9d00030000000900010073797a3000000000080002400000000228000000200a01040000000000000000030000000900010073797a3000000000080002"], 0x78}}, 0x0)
r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_REGISTER_BEACONS(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000004b5fd41776491474de6e970963e8f5756723d5f6a0fb1d19a5ca14d6e31f810b5ffd09771c67bf83be4fb55889a1392956f516e6fd3869727324fcc525d7a04188a8e7e8ac715870819558a3a1cf2c86352e140ce3d068a89fbf485de2d64f34f1b8dd85a71631f83f3030301549253f8aeb377a7029", @ANYRES16=r2, @ANYBLOB="070000000000fddbdf250800000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0)
r4 = socket(0x10, 0x3, 0x0)
syz_emit_ethernet(0x1c7, &(0x7f00000005c0)={@local, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00@\x00', 0x191, 0x2f, 0xff, @private0, @mcast2, {[@hopopts={0xfd, 0x24, '\x00', [@jumbo={0xc2, 0x4, 0x8}, @enc_lim={0x4, 0x1, 0x8}, @enc_lim, @ra={0x5, 0x2, 0x3}, @calipso={0x7, 0x40, {0x3, 0xe, 0x3, 0x6, [0x80000000, 0x2, 0x7, 0x2, 0x3, 0xf, 0x9]}}, @padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x6}, @enc_lim={0x4, 0x1, 0x9}, @hao={0xc9, 0x10, @local}, @generic={0x4, 0xad, "6d346a1811e7111edcf1609542ecb54c98b407cb46a38e5510397bc39f30c3201b1e69265b614cfccf947cc324091e65da32022b28834659c124677bd7a14bf5cacf40acd57a967532404db216f891db10b111e0ca966660751e30164122fd0548adf89260b33d4c8717ffb95b4312dd10db222deb5d68e4d982fe6c94859f7dd946fc190397c93525032069d32cb11e6c3d1ffd089fab98bffd9ca1ae34b7f1c2f0aaf82db055aca58f99b68a"}]}], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x8100, 0x17, 0x2, [0x81], "ed30db66d87e976700000000c3215168fca325a95a0009"}, {0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x800, [0x0, 0x7]}, {}, {0x8, 0x88be, 0x86ddffff, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x1, {0x400000}}}, {0x8, 0x22eb, 0x4, {{0x0, 0x2, 0x1}, 0x2, {0x7f, 0x8}}}}}}}}}, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000080)={0x4000, 0x3, 0x0, 0xffdfffff}, 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x4, &(0x7f0000000140)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000280)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x11}, 0x94)
sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1d0001001600010000000000701161004d069f0a7938067200000000000abf8c9a961bf2130f710337b5bf1603adee5cb4faee8ff6f42fb68a70b1f3b0e3a39085ac89b421fef32d9ce2989514429616f918b91f3dc8692d637aaea6753771900100f322a5b7d80de2e5180e9dc1ea9d8e382ab6c727610844d5a1ea415807cb5d208da778414e49da7f9d8a36b8476336449513812d7d8beab1b8e1f44e5c", @ANYRESHEX=r0], 0x1c}}, 0x0)
r5 = socket$packet(0x11, 0x3, 0x300)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a80)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x100}, [@call={0x85, 0x0, 0x0, 0xc6}]}, &(0x7f0000000040)='syzkaller\x00'}, 0x94)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
setsockopt$packet_int(r5, 0x107, 0xc, &(0x7f0000000000), 0x4)
setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x2}, 0x10)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01030000000000af9d00030000000900010073797a3000000000080002400000000228000000200a01040000000000000000030000000900010073797a3000000000080002"], 0x78}}, 0x0) (async)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) (async)
sendmsg$NL80211_CMD_REGISTER_BEACONS(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000004b5fd41776491474de6e970963e8f5756723d5f6a0fb1d19a5ca14d6e31f810b5ffd09771c67bf83be4fb55889a1392956f516e6fd3869727324fcc525d7a04188a8e7e8ac715870819558a3a1cf2c86352e140ce3d068a89fbf485de2d64f34f1b8dd85a71631f83f3030301549253f8aeb377a7029", @ANYRES16=r2, @ANYBLOB="070000000000fddbdf250800000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) (async)
socket(0x10, 0x3, 0x0) (async)
syz_emit_ethernet(0x1c7, &(0x7f00000005c0)={@local, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00@\x00', 0x191, 0x2f, 0xff, @private0, @mcast2, {[@hopopts={0xfd, 0x24, '\x00', [@jumbo={0xc2, 0x4, 0x8}, @enc_lim={0x4, 0x1, 0x8}, @enc_lim, @ra={0x5, 0x2, 0x3}, @calipso={0x7, 0x40, {0x3, 0xe, 0x3, 0x6, [0x80000000, 0x2, 0x7, 0x2, 0x3, 0xf, 0x9]}}, @padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x6}, @enc_lim={0x4, 0x1, 0x9}, @hao={0xc9, 0x10, @local}, @generic={0x4, 0xad, "6d346a1811e7111edcf1609542ecb54c98b407cb46a38e5510397bc39f30c3201b1e69265b614cfccf947cc324091e65da32022b28834659c124677bd7a14bf5cacf40acd57a967532404db216f891db10b111e0ca966660751e30164122fd0548adf89260b33d4c8717ffb95b4312dd10db222deb5d68e4d982fe6c94859f7dd946fc190397c93525032069d32cb11e6c3d1ffd089fab98bffd9ca1ae34b7f1c2f0aaf82db055aca58f99b68a"}]}], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x8100, 0x17, 0x2, [0x81], "ed30db66d87e976700000000c3215168fca325a95a0009"}, {0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x800, [0x0, 0x7]}, {}, {0x8, 0x88be, 0x86ddffff, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x1, {0x400000}}}, {0x8, 0x22eb, 0x4, {{0x0, 0x2, 0x1}, 0x2, {0x7f, 0x8}}}}}}}}}, 0x0) (async)
setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000080)={0x4000, 0x3, 0x0, 0xffdfffff}, 0x10) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x4, &(0x7f0000000140)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000280)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x11}, 0x94) (async)
sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1d0001001600010000000000701161004d069f0a7938067200000000000abf8c9a961bf2130f710337b5bf1603adee5cb4faee8ff6f42fb68a70b1f3b0e3a39085ac89b421fef32d9ce2989514429616f918b91f3dc8692d637aaea6753771900100f322a5b7d80de2e5180e9dc1ea9d8e382ab6c727610844d5a1ea415807cb5d208da778414e49da7f9d8a36b8476336449513812d7d8beab1b8e1f44e5c", @ANYRESHEX=r0], 0x1c}}, 0x0) (async)
socket$packet(0x11, 0x3, 0x300) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a80)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x100}, [@call={0x85, 0x0, 0x0, 0xc6}]}, &(0x7f0000000040)='syzkaller\x00'}, 0x94) (async)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) (async)
setsockopt$packet_int(r5, 0x107, 0xc, &(0x7f0000000000), 0x4) (async)
setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x2}, 0x10) (async)

990.336467ms ago: executing program 1 (id=1662):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001000), 0xffffffffffffffff)
vmsplice(r0, 0x0, 0x0, 0x5)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)={0x64, r4, 0x917, 0x1000, 0x25dfdbfd, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @loopback={0xffff0000}}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x64}, 0x1, 0x0, 0x0, 0x44}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000001040)={0x2c, r2, 0x601, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20004041}, 0x0)

922.727225ms ago: executing program 1 (id=1663):
syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) (async)
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0)
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) (async)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wlan0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r2, 0x1, 0x2, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) (async)
sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r2, 0x1, 0x2, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_MPATH(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x34, r2, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x53}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004010}, 0x44001)
close(r1)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) (async)
bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200))
socket$netlink(0x10, 0x3, 0x0) (async)
socket$netlink(0x10, 0x3, 0x0)
r5 = socket$kcm(0x10, 0x3, 0x10)
clock_gettime(0x2, &(0x7f00000001c0))
sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x5d, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90224fc60", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0)
socket$key(0xf, 0x3, 0x2)
bpf$PROG_LOAD(0x5, 0x0, 0x0) (async)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r6 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_INITMSG(r6, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc4d4}, 0x8)
sendto$inet6(r6, &(0x7f0000000580)="81", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000800)={0x5, 0x3, 0x4, 0xb, 0x3, 0x3ff, 0xc1, 0x7}, 0x20) (async)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000800)={0x5, 0x3, 0x4, 0xb, 0x3, 0x3ff, 0xc1, 0x7}, 0x20)
syz_80211_join_ibss(&(0x7f0000000240)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0)
bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) (async)
bind$bt_hci(0xffffffffffffffff, 0x0, 0x0)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff)
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x20, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@lsrr={0x83, 0x7, 0xd2, [@loopback]}, @ra={0x94, 0x4}, @timestamp={0x44, 0x4}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, {[@fastopen={0x22, 0x2}]}}}}}}}, 0x0)

724.38832ms ago: executing program 0 (id=1665):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10)
r1 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@assoc={0xfffffffffffffd66, 0x117, 0x4, 0xbf}], 0x18}, 0x4000040)
sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0)
recvmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/229, 0xe5}, {&(0x7f0000000840)=""/127, 0x7f}], 0x2}}], 0x1, 0x60, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x2c, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x2c}}, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000240)={'team0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0)
ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201})
r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
bind$inet6(r9, 0x0, 0x0)
setsockopt$inet_mreqn(r6, 0x0, 0x20, &(0x7f00000001c0)={@multicast2, @rand_addr=0x64010100, r5}, 0xc)
r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x2, 0x4, 0x6, 0xbaa}, 0x48)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0xa7c, r10, 0x5133c4bf67cd92a7}, 0x38)
r11 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r11, &(0x7f0000000040)={0x0, 0x5f, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000014000780080008400000000008001240ffffffe80500010006000000050005000200000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x5c}}, 0x0)
r12 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local})
write$tun(r8, &(0x7f0000000080)=ANY=[], 0xfdef)
sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0)
getsockname$packet(r6, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x18, 0x16, &(0x7f0000000400)=@raw=[@call={0x85, 0x0, 0x0, 0x6e}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x3f}, @tail_call={{0x18, 0x2, 0x1, 0x0, r10}}], &(0x7f0000000340)='syzkaller\x00', 0x2, 0xdb, &(0x7f0000000640)=""/219, 0x41100, 0x25, '\x00', r5, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000380)={0x1, 0x2}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x3, 0x4, 0x9}, 0x10, 0x0, 0x0, 0x2, &(0x7f00000007c0)=[r10, r10, r10, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000800)=[{0x1, 0x4, 0x9, 0x5}, {0x3, 0x3, 0x10, 0x7}], 0x10, 0x3}, 0x94)
sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[], 0x34}}, 0x0)

646.03171ms ago: executing program 2 (id=1667):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000002d00010026bdf000fcdbdf25041a0000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) (async)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
socket$packet(0x11, 0x2, 0x300) (async)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000340)={'veth0\x00', 0x100})
r2 = socket(0x10, 0x803, 0x0)
socket$unix(0x1, 0x1, 0x0) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x200, 0x70bd2a, 0x1, {0x0, 0x0, 0x0, r3, {0xfff3, 0x9}, {0x9, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0) (async, rerun: 32)
r4 = socket(0x2b, 0x803, 0x0) (async, rerun: 32)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'ip6_vti0\x00'})
sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001380)=@deltclass={0x24, 0x29, 0x0, 0x70bd26, 0x1, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff2}, {0x7, 0x4}, {0x0, 0x1}}}, 0x24}}, 0x20040054) (async)
r5 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
r7 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r7, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x58) (async)
setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) (async)
r8 = accept4(r7, 0x0, 0x0, 0x800)
sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)='\x00\x00\x00', 0x3}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async)
recvmsg(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000600)=""/238, 0xee}], 0x1}, 0x40000121)
sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x100, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0xfffffffe}, @TCA_RATE={0x6, 0x5, {0x3c, 0x3}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0)
socket$packet(0x11, 0x2, 0x300)
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000000092c000000000000000008500000053000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8dfffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000980)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x25}, 0x94)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x400000000010, 0x3, 0x0) (async)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})

579.571714ms ago: executing program 0 (id=1668):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
vmsplice(r0, &(0x7f0000001300)=[{&(0x7f0000000000)="1b28a91d85e299294adc91676d5baf7463a2c514e22ed78f1841522843b55aaa08576e44353e12d8aad3defa71136cdbb2bfca14114960161d7f21461ec00711e6ef45048a25c95ab808067ab97f42571ecbd6344470819e08d2f9e4e30c38c93b5cd0799c7d1caa214e423cb29b516a8785a55026cf4d94c322a9575cafdd99c207690fb5a22bce2becde2274", 0x8d}, {&(0x7f00000000c0)="3fc5624707eb9182dc26bfd44d1e4cc7a654cbf7b9082f30a89f5fb4543f41555684cbc7e29b80f6d4aba01523402f1ca8597606bef855761e516e9b55691b8a9e24689cc8459bea7f6e8d141aa71099f32ba154309ed8550a06b281527ceaf53fe32b2bba849e0995aa4085d5efadef5c75eedd27012fbc93bf5c51c72c48d565aab3dad2d4c8813fe05e952822bdaa4a86566454b7bb9b31a448d8a61c83354a4ecb948f179635a31e0302f3a96d32e606446fadbc12b3619f8b48ff557fbec4bc5790b61faadfbcef03786f86a2920fbcc61a2a3c004c68b9d9f500b9b301c1b4ac4a20add426717407f6cf9ca3495a6930f4bed69ef3b8f8c5bb5b34", 0xfe}, {&(0x7f00000001c0)="48c19bf29fdca5fac5f31330d732fa7335cd66040efeb664ef27435e58e13d", 0x1f}, {&(0x7f0000000200)="1f00a7930bbb74fb51d2ef572ba8e180f56fc1200b289d526baa0785b604e0fab6d86aa726472bb450fd21339e0d3c68f1e179c689600dfa27e8ea36e47db22fc9b720e423cd07738bedea04eb926a48e23e0d8624c440855122bfbd5482bb679d2e9616626b438be7f0ad150ec9a3d2a05866cc1454a6f9fdc26d568b02707443e43597bc797860b33f2c94b0c82d42e8f8a65170a3fe116216706818dd585617c0de9fb1dd72b92202c1e29ae76dd9dd725049f4bb4e5771d31efb0635d5d0a84901cb198dbbe21dab5a64bb5930f8e28933867ff94f6e790a3b775508257d423e1eedbc73da3ee4", 0xe9}, {&(0x7f0000000300)="0c4c654c4bc0bbf994ae0140ac92732f51c54a6a11d786ad06885ed40b4f96221d994dc9859c1c51b45afdb0aded245adfb04d31a6c5bd56e32dd2f5af1b87a147be6eefb0590438d313254d2855d5207363708470dd72fca3af20e1484534b2dd3948a9e9d1e7508dc22cbcc7cb2f3f5a705d312a7ebe035acf6455a99251dc66adf9c12696840d34b4dadee1510b37b43231409be5f4504c83e1ba13a4d30749b7a3c5a4e2bd8aa1c32cf9b2302922d493f458fd6c96afe71ae483e651c45fc48ecc367e19f09a32703ac4814e4a9648459a47acb13bd289d419e47f9391c9458d8c3a2560059dfdbdd594883a2e8fae0924c488f91f682a9efd516222776e5e5c4d942bfe51d14e5bff233e39fb2109c8a4f5036b6b9ab684b179af3235063e0d8c64944ed8d215c06254d4c40398e4d14698e9337142c32962f4804a906db548e142ef7c63b10edcf38e50e341e4c08f7f09e24f36a9339806397e0087cf93a930d7887edc296092d7633fa027722f2d2267aa9065f30b01be7e8fb7235ae73bf053a1eb9eca2cf822d000b01708e047a8b09a903eaa545f682adc0285a945f19b232114ab7db1597d08a3fedbb784fce66d7dc4c7e157a937b8e79c3414b43edbd6960af2bb7328a035a5a60f18e280f56a65142f530575fc22b42e645960ec183aa0127e4f262fce17a6ecea1dcbb602cf1e5bf7c116751d89d3b4cede58dc4c0cbc2e4b900c28af5f68d28b904bb7b264550a9e02afc1152125ff1c950877a2816753b4605604dc234dce2e3b3c13de34ae9619f25fd0a280ff2f29bff115c928221db9f13c1298dbffbcc1e676dac623800e691f24e81ad80ab3294d3125dccbca9d49cb5735d9b2cbf12fd994dd1342ae0e2ce2b1bf66e2b3d6c3440b7df6a704c6e2194d09b26c6bb411020b356d96185e4282f8ffedd1eb88525ec64e3659099fc911bd7aad917fb123f90db5750c0194104e2dd13ac54ed8b0b9f0cda6d03f641454a48465fe8416dc8e8412700655550e4c8bd87e49c7f78276c6db411c01e9226407e054dd73bf65188c922cb31f9462cbd307eae1bc79f434d46f7ca6b1dce59984436fd0b9fcd6a3724c34497953dd32abf0ab95b12d32501e18ed307d45a4d073ea859670709664daa2bf4e33a2253d356fe85bb6de9773c9c84d0495b33317b035642bba2ebfd8c815d952214285e38f3a64fafe762a2042c46ef122d1e0b87b230b591205d53316d51bdf363538ff5009ae89e500f86ee62142a89087e141a313133ba7b66fa8155116dfdb7609a543affe32b6fc21c74bec775d127b0f505eec8d3eb52d6d12ee465819a84048fdaac3b32b920781b7a23d8cfe8addbd71e005347a66754ae0e613355061a55820566203f5b6a770c3ca746511f2f4203b45ada97efadfff62bd6e8cdcac409477c3700a31e0f969ab0a27b54dc8cb121324500f8edf97317830bbddf96b78bd3d42bbfb576ded118be14e23cb546c0f515a4b26513cc04614d014825345ad98aa466f0c39c4d4c9f650f2dc5f61b1f24b6d03868f47a1fc632acb976c5f8d744a8dcdbf38df890c18b4152296806cd2910b3f99cdcc890776d7f528c3fbc0d48f79904430592f9adeaab9568333eb958e042c2cfb58133c3482c556f03faa7a40124693126bd07560bddf7a39fd946746b8db8bfeef78e298a1110ff86b7c9b343979c497f1de7a9e38ca1122b6f20ba03284767f1dc2e01695b67f3b0db7bf6e3047e7e8512aba565ddcbb391644bfa52a08ce6faac8aa7cf9380a7d703476183a327f95064c3dc5b1f4c7967b765252f171028ae203f276608033b6e1d81940e55f165e6790502245d68b1d5e80cd61c2a8ba7f6d497c969e5254792062b89a2ad995ed48be360cf01130833c6711a08a9a4c80f92aed55887ca6fcf4c37cc55358e442083bd5d0d3a67249484526f98efd9e7935b62c7f65e85f9bea5e9f7e82b7d54bfaffd9268ec526a609a090477aff27b5a0ef937480690889255828cafeed87e3daf08705fdd0c9eba473c12a7677714d402ba83e7696329b7c8277f6801dd589741998255c100232ca4c34175745d3d79cc711917353a94757eff15baae10e5c801530c737d85f10c3eef9638243828f9ec0d2d0a874bc96af20e90255293b846bcb8ff56871951df98084d505c77034c2735f2b0b090d70d6c474fc16a59c949264bb95b4ec7ebe949e49fa4519d97dd4b17036357a26edc2b6a123c3c59e7127de0d470b0364466d409efe47d4578fcd4821f47b7ceeddc3d1ded51095cb2c7962d6f77d3eca6ec706d7a11663e6c4da39b4058cb19fddc2068268b589540b6746420ecd89b4b307f9affac9a809110b4113a93b10186b53a24bd6b68639ec896ae6e4675dc8693b18a496ce857ccf84d653b1d1943c297918be4ef836af51d74d435d53992db2084e1483351aeaa2137c8f6f1a85d4fef29fdcaea79c752c0636a5bb4acad6dc32ed7ef687d6dc666fbc4ab38c8dc99eba3d2f0ba91555ed5f14218fb022aeb92a1667a2dde1272afc4e6430067869019995b4be4fca5e62123d1298f61d2cc462e164a6818c24b956737a504c33278c75530d7a412c012ba78e08ce13f0b43d31815ccb2c92354839d15a067f1581d47ae459d830c7695ddc0a0dd3e8431269541523d0461320ae306cd93678b0f5ab46e146bd002dc14d542b5bfadc18cffd5d8f6745117009c155e3dce0602202d416c093dad35f9651cf424d04bb6b9455d36442d6710306321677bf6f610d5abc2db7def7eeb2c8850b59a7275743de856e9f124c4c96afe40703cca946b2351710a7cc963b0b65e5a1eda21e34412bde9f82e756aece51161b9aab26245253fc355bb87de30ebab756f7c2478356796d127b67a6831a63961808529826e2be2a3ba20de8bfb36a9c449574c14109aa344dceac0b0322a1fb2924ce85eb9f6483b3543c0e878fe9a4cf873ab228ab43eb7b6eb78fbdc4bba0ec795fb042cf86635e1b83b2f56817a114c8c7c37715337b54ffba5ea0a0fb2bd13b3619dcf5b3e92dc8123975e2a7b213eb028d23f76f894a90db8cd6daaa96ffc4629174020591b3ffb32b0bafe130a0622be7e4c5687015b4bedbae2aee6399f136c981aa495826b23a536b3d308095ed6f3cad2c7b21c30459f55bd476a3bfbf5f34d9f720a08cf108c7d6a0a2162b4a129a32fa663d10c0a2963e441c7126b597dd2f4cac7e80ea599edce7badb81017e1383edbb8f15daf1860360dd3e8eaaa893dcc07ff285d0ca5fdc336b3ae35c65a6315394c6794f264302aa557e18d4048f4616089cd4297d54a8794ea731cfe01850c27c9771324bc3e564f55961193ac73ff14afe28aa7a60a513b11bb40d090fd2f188b17ac5bd61931c9314ef78f9ce3be117cd1109bd0a29ff030e68e3d32d3708b916ca926f94c6999cfe258d3b4ec14b83e5dd580a1cb8d8055124079275812940361310cae0be40f71a02fa68abfd6699e3556f8defa21788cb6ea7c41e0c93139e6e4a8280668cec60ed6f23e7eda3d8c2020ac259221c22cbce1bb93b4ca8f57e30f3361938df62f7fa082a73bc35cf7cfda49a75f5d596ecb374b95249c3a17fe3c2c1cba1e31ad1534070e020ddaae847f4d2df39cce5e89836d200d6bb45ed92981d16f58b18733eb005ac59666aa56e46e6614e688ff76bbbf239d071f4a81fbb7f2b22fa8f6a41ddf5046ba3bfb1f229af2ed2a01c4c502461be1db85e5c798f51fe7a08a9ca2407a52ff2911bc45388ad7d14feb9d7a963393ad8e615659bbd14c02ccafa2d333769bfcd9b8c6d6b06a1f623af3e6b86603f64fa0536fe5495e7c8e07479f1cb84b7d544088c9f5197c2c048d5e10be3c9bddfc031e1eee30fce2e909e435a07a4c1a113c07c41668183f7630e3eff4ceffc47de5d2d2253dd969934ccb2218f30ac2e3e513aa97de41f41c8190f025926f00f3825a6e431bc7f48a0e43830ddea3d3afd931cc8321d152d08d263afbec27c1e0c9cff6eeda0e92db4af6fa4a8f76aabf8f75bd2df9a5ff3b797a243bd504b38a6bfa37b6511dc25a56adab5ad029921867df0749379595c13ddd5116cc0f079f22633d58ce4b0b38eafdfaaf6f9b73e7e9cabe42d44ee2d31e6438d278aadd782875894147acbb0276a7cd1acaef37f51e182e98f1911bd397b712cfc134fb9824933fe9fb6ca865b19089f85c0277f5644035ea9cff58cdb92902effd5948ac6cdb907640ff855dcdbe9d183dc98f9c0d8fef3f7a019f72d93adab3edbd1f9aacdd747d3d5154a91ff0c648d883ebe9262420b7a5dfa4f713a1ed72822a62e577e884db948c5dd82bf3411fdc1d1ee75d208fb53beac225f28b0a6d8a1084ace10318a12b49d7cb9f432511fe2aa69c2e45f0278affa0b4ad77b3ebf6132b753ed768cc515b497d2198e9d4ce8c4076d753ca11fff86d2fa3c578e2a6755e3e528fdd3375444fa3f2daf2851dda011579d0f7ac95ec4e97f739877e1c8fa8ef9c48a3d7c4a5be3b94a59813e2d36063eed2cc6dafadb1a19b662e88d9ee7c3f14589a2a40f4434b7c9e6b30af118ba5d42fb26274fe59c27776559c4e67e4538b4a17dedfacd7095855db435a504861be2920d8f128c0d5395b39235bd1771dfd63d9ab00c6146c128c0e0e2a79a9e95373a434e74cc39fad06a93c5ccec38c3c86197a06226dbc4eb2cea5be0f8ea37e41dd9e47b080db263cb18dbbaa1921f57c1eb0b21ed3cc0a283b74b9a431c0a4b51980b96ac008af7f47f401b2988c7ef07b2e00f482ed8fcf80a6f6c9070088d96f371e5577cb1e11be8c33cf7fc2c135a6d5e9e4827b7336c347867a2527701f02ff04d814ccca3dd6eebcefbadae560bfd1ab28b7999ee18406f4c74f286559669d7dc3d127b5c8e17d28965dcc6e16892d8b7208185f36c0fea26c06e40e1b91c1bfe6b57128dda5273fb6a0ae19017870ad702734c06225c527b24fde1e399cec2db28ff56d812843ee27d870e7376a6875bc3b378cf675f41283d685262c0ccb3c2ca9bc23355bcf432611de8c835d9f918fb2752026fef54ec4c427cc6270a6695ef016d54192cbff06abfb8f1eb82e8ddd0e5e99c354ef474b4626a1e4ab98c25181ad06e4ec1921d93edeae293246e21e03dff975c81077ed9bcea09fa8210db5eba69f7d4212d159ae7ef90db4f3c36c2da3ce6f318a9952b6ccf350fad2c0ac1a74f67d944d681b27063a88b03e38ec93a41fff4fc519537be910d5984ac15bed550142cd8a2a203c8dffce25c7f8c740f2b0af9daff9691d352028388925f8a1abddc819676400aa5963db5f0705ff8ab85c1b62c2f140dc2a8f10be1e6cec181e7e57e03254c0a1ec16c2015181dbfe149b05951b175e9bb743a3a51a16375dc6adab8f5fe29eb2eaedb0465dbf8f68264a8e65fae0cedbf60e4ee5d28deb5229eb85c34d6d23184f71d44150534068486ca094ed1c37686a14afe7b9474eb247b9d2f6a0c0ce59438a8b8fbc5ed6bda43904f31692dbc28242425e1993a5ada0d6a2a214df3b79d854ba19be436b623a695e130012500d1cb0d6ac0ca4444753d07fecfd34b274bc490211acf1947814ad31f25de199ebcbcb44197998f8f5432367e35187b1effad99c03993f54496d2481e9b4432130c5575f05341d70826f147f2bd17f693bee7ac6fe227da86414d2911f9fe189381a7876ca63ef2acc54e6230a1fa2bc1bb19b3ee269371475a6f0025ed4f993e917357d5f8f2552f3b3dd8c72cda1752af", 0x1000}], 0x5, 0xd) (async, rerun: 32)
pwrite64(r0, &(0x7f0000001380)="634650080f3ffa5a5a1917cf50776bf8352a520128c114aeaffad0136790ec06", 0x20, 0x80) (rerun: 32)
r1 = socket$nl_generic(0x10, 0x3, 0x10) (async)
ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000001400)={'wg2\x00', <r2=>0x0})
sendmsg$ETHTOOL_MSG_RINGS_SET(r1, &(0x7f0000001500)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000014c0)={&(0x7f0000001440)={0x6c, 0x0, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_RINGS_RX_JUMBO={0x8}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x3}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x7fffffff}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0xfffffff7}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x9}, @ETHTOOL_A_RINGS_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x791f}]}, 0x6c}}, 0x4000) (async)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001580), 0xffffffffffffffff)
sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f0000001640)={&(0x7f0000001540), 0xc, &(0x7f0000001600)={&(0x7f00000015c0)={0x2c, r4, 0x300, 0x70bd25, 0x25dfdbff, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x80) (async)
sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f0000001740)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x20, r4, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x4) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001840)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001800)={&(0x7f00000017c0)=@getstats={0x1c, 0x5e, 0x10, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, 0x5}}, 0x1c}, 0x1, 0x0, 0x0, 0x4048081}, 0x8000) (async)
r5 = socket$inet6(0xa, 0xa, 0xf)
r6 = accept4$inet6(r5, &(0x7f0000001880)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @broadcast}}, &(0x7f00000018c0)=0x1c, 0x800)
r7 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f0000001900)=0x2, 0x4) (async)
r8 = socket$packet(0x11, 0xd68c7e7714a9ef3f, 0x300) (async)
sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x1c, 0x0, 0x0, 0x70bd27, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4805) (async)
sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001a80)={0x50, 0x13, 0xa, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x2000c804)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r3, &(0x7f0000001c80)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001c40)={&(0x7f0000001bc0)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @empty}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @private=0xa010100}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_virt_wifi\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_batadv\x00'}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x40840}, 0x4080)
sendto(r7, &(0x7f0000001cc0)="d524683458d9e19caa05ffc0af3283099ca6", 0x12, 0x0, &(0x7f0000001d00)=@sco={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0x80)
ioctl$sock_ifreq(r6, 0x8971, &(0x7f0000001d80)={'veth1_to_bridge\x00', @ifru_hwaddr}) (async, rerun: 32)
ioctl$F2FS_IOC_MOVE_RANGE(r9, 0xc020f509, &(0x7f0000001dc0)={<r10=>r8, 0x7fffffffffffffff, 0x3, 0x5}) (rerun: 32)
recvfrom$ax25(r10, &(0x7f0000001e00)=""/95, 0x5f, 0x10000, &(0x7f0000001e80)={{0x3, @null, 0x3}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast]}, 0x48) (async)
sendmsg$IEEE802154_START_REQ(r3, &(0x7f0000001fc0)={&(0x7f0000001f00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r4, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x6}, @IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0xb}, @IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x14}, 0x0)
close(r10) (async)
ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000002040)={'wpan1\x00', <r11=>0x0})
sendmsg$NL802154_CMD_NEW_SEC_KEY(r3, &(0x7f0000002100)={&(0x7f0000002000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000020c0)={&(0x7f0000002080)={0x24, 0x0, 0x6cebf777f464cfbe, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044800}, 0x14000)
r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000002140), r12)

460.009032ms ago: executing program 0 (id=1669):
bpf$MAP_CREATE(0x0, 0x0, 0xfffffffffffffd36) (async)
r0 = socket(0x2b, 0x1, 0x1)
connect$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0xffffffff, @hyper}, 0x10) (async)
r1 = socket$inet_sctp(0x2, 0x1, 0x84) (async)
r2 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x1c, &(0x7f0000000340)=[@in6={0xa, 0x4e21, 0x7, @remote, 0xc4ad}]}, &(0x7f0000000100)=0x10) (async)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [<r3=>0x0]}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000000)={r3, 0x9}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000080)={0xffff, 0x200, 0x0, 0x7, r3}, &(0x7f0000000180)=0x10) (async)
r4 = socket$kcm(0x10, 0x2, 0x0) (async)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond0\x00'}) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x13, 0x2000038f, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='mm_lru_insertion\x00', r5}, 0x10) (async)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) (async)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000700)='mm_lru_insertion\x00', r6}, 0x10) (async)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0)
write$cgroup_type(r7, &(0x7f0000000180), 0x40010) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0) (async)
sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x48, &(0x7f0000000100)=[{&(0x7f0000000200)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) (async)
bpf$PROG_LOAD(0x5, 0x0, 0x0) (async)
r8 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) (async)
ioctl(r8, 0x8b1b, 0x0) (async)
setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x6a, 0x2, 0x20000002, 0x3) (async)
r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90)

459.808799ms ago: executing program 2 (id=1670):
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10)
write(r0, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000680)=ANY=[@ANYBLOB="b7000000010003c3bfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff0000000065040200000000ff2d400500000000003400000001ed00007b030000000000001d440000000000007a0a00fe00ffffffdb03000000010000b5000000000000009500000000000000023bc065b78111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e51815548000000000000000275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7f300c095199fe3ff3128e599b0eaebbdbd732c9cc00eec36574a8f6456e2ccae25ea21714eca8cf5d803e04d83b46e21557c0afc646cb7790b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2400000000000000800643a98d9ec21ead2ed51b104d4d91af25b845b9f75dd08d123deda8ebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987af1714e72ba7616536fd9aa58f2477184b6a89adaf17b0baf587aef370a2d426a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d64364c82770c8204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee7d26b34381fcb59b854e9d5a17f4720082f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
syz_emit_ethernet(0x36, &(0x7f0000000180)={@multicast, @random="50a245d5cde0", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @broadcast}, @timestamp_reply={0x11, 0xe0, 0x0, 0x0, 0x0, 0x810001}}}}}, 0x0)
sendmsg$OSF_MSG_ADD(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="081500000005110400000000000000000100000554020100"], 0x1508}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40101}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)

399.542283ms ago: executing program 0 (id=1671):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32)
syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r2) (async, rerun: 32)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 32)
syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', &(0x7f0000000340)=@default_ap_ssid, 0x6, 0x2) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async, rerun: 64)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x68}}, 0x0) (async, rerun: 64)
sendmsg$NFT_MSG_GETFLOWTABLE(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, 0x17, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x80}}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x850)
close(0x3) (async)
sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0)
sendmsg$NFT_BATCH(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x5c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_FLOWTABLE_HOOK={0x30, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'veth1_to_bridge\x00'}]}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x84}, 0x1, 0x0, 0x0, 0x40044}, 0x20008000) (async)
getsockopt$IP_VS_SO_GET_SERVICES(r5, 0x0, 0x482, &(0x7f0000000ec0)=""/4096, &(0x7f0000000280)=0x1000)
getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000440)={0x0, 0x5f, "a4f84068f72506c42614253ac681157afb1260b5e1a3f371afb1639913eac28fa4b153ee34c1af6fecb36994d7039cfc993077abd2c46ad0585e4fbca11862f4e0c793b64b4662959887d9a977fb17ec0312323a0806ef922136861fe94e5c"}, &(0x7f0000000380)=0x67)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000400)={'wlan0\x00', <r7=>0x0})
socket$netlink(0x10, 0x3, 0x0) (async)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="01002bbd7000fbdbdf252100000008000300", @ANYRES32=r7, @ANYBLOB="a29e73ad41643e104c916fc966749fbe53227e574a2747cd768dd00ea0f4bf493714345f419df629886bf0a13a97f5e34c109ae7c649a050ea4d3ea43961a6007c1674e79a267dc5be7897c84a89a72097bc2cf211a7ea330c86604e"], 0x1c}, 0x1, 0x0, 0x0, 0x24004084}, 0x40000)
r9 = socket$inet_sctp(0x2, 0x5, 0x84)
setsockopt$IP_VS_SO_SET_ADDDEST(r9, 0x0, 0x487, &(0x7f0000000540)={{0x2c, @broadcast, 0x4e24, 0x4, 'nq\x00', 0x12, 0x8, 0x50}, {@broadcast, 0x4e24, 0x1, 0x4, 0xde14, 0x2}}, 0x44)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r10=>0x0}) (async)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3300000}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x80}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
r11 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000022c0)=@newtaction={0xe68, 0x30, 0x25, 0x0, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x5, 0x0, 0x20000000, 0x80, 0x9}, 0x3, 0xc}, [{0x8, 0x8, 0x4, 0xae34, 0x8000, 0x387}, {0x7f, 0x7ff, 0xe, 0x0, 0x40, 0x3}, {0x101, 0x1, 0x1c5c00, 0x2b, 0xef4, 0x3}, {0x1, 0x5, 0x101, 0x1, 0x8, 0xe54}, {0x1, 0x60000, 0x1, 0x0, 0x2, 0x6}, {0x6, 0x7ff, 0x1000, 0x2, 0x5, 0x4}, {0x4, 0xaf, 0x8, 0xc2, 0x3, 0x6}, {0x3, 0x4, 0x8000, 0x3, 0xc6, 0xffffffff}, {0x7ad8, 0x1, 0xffffff80, 0x7fffffff, 0xc, 0x9}, {0xa0f, 0xffffffff, 0x1, 0x6, 0x301f, 0x1ff}, {0x9, 0x8, 0x80000000, 0x800, 0xfffffff7, 0xfffffff8}, {0xb, 0x8, 0x8, 0xc, 0xfffffffa, 0x8}, {0x71, 0x8, 0x6, 0x9, 0x8, 0xe}, {0x6, 0x1, 0x4, 0x4, 0xffffffc0, 0x1}, {0x0, 0x3af, 0x6, 0x800, 0xffffffff, 0xb}, {0x6, 0x7, 0x0, 0x1, 0x2, 0x8}, {0x9, 0x8, 0x9, 0x5, 0x4, 0x6}, {0x5, 0x5, 0x8bd2, 0x200, 0x1, 0x8}, {0xc5f0, 0x3, 0x4, 0x80000000, 0x4, 0x7}, {0x8, 0x2, 0xf9ca, 0x40, 0x8001, 0x2}, {0xffff0001, 0xcd, 0x2, 0x401, 0x5, 0x81}, {0x9, 0x3, 0x400, 0x4, 0xffff, 0x9}, {0x1, 0x4f1, 0x5, 0x0, 0x2, 0xffff}, {0xd, 0x2, 0x6, 0x7, 0x7, 0x1}, {0x5, 0x7fe00, 0x4, 0x7, 0x5, 0xffffffff}, {0x7, 0x63, 0x2, 0x2, 0x8, 0xa0b}, {0xfffffffe, 0x9, 0x4, 0x6, 0xe, 0x8}, {0x1000, 0x9, 0xfffffff9, 0x80000000, 0x7fffffff, 0x6}, {0x0, 0x100, 0x0, 0x8, 0xd, 0x7fffffff}, {0x4, 0x8, 0x3, 0x8, 0x81, 0x1}, {0x4, 0x0, 0xecf, 0x80000001, 0x80000001}, {0x0, 0x0, 0x8001, 0x3, 0x5, 0x4}, {0x3, 0x2, 0x1ff, 0x2, 0x400, 0x9}, {0x2, 0x4, 0x3, 0x0, 0xbb4, 0x9}, {0x100, 0x7, 0x5, 0xfffffffb, 0x9, 0xf1d}, {0xfff, 0x1, 0x9, 0x6, 0x6, 0x9}, {0x5, 0x0, 0x1, 0x100, 0x0, 0x3}, {0x2, 0x0, 0x40, 0x2, 0x6, 0x6}, {0x736, 0x8, 0xfffffc01, 0x185a, 0x4, 0x6}, {0x0, 0x8, 0x1bf6, 0x2, 0xff, 0x7}, {0x1, 0x5, 0x9, 0xdf8, 0x6, 0xf4}, {0x1, 0x100, 0x0, 0x5, 0x81, 0x6}, {0xac7, 0xff, 0x10001, 0x718, 0x4, 0x816}, {0x7, 0x8, 0x400, 0x9, 0x7fff, 0x5}, {0x80000000, 0x10000, 0x2, 0x3, 0x2, 0x20c21145}, {0x4d0, 0x2, 0x80000001, 0x2, 0x400}, {0x0, 0x81, 0x0, 0x3, 0xfffffffe, 0x9}, {0x6, 0x80000000, 0xfffffffd, 0x9c, 0x76c, 0x7}, {0x0, 0x8001, 0x3, 0x8, 0x5, 0xf89}, {0x0, 0x0, 0x4, 0xfffffffc, 0xfffffff5, 0x15}, {0x3, 0x8000, 0xd, 0x407, 0x6}, {0xc89, 0x1, 0x7f, 0x5, 0x6, 0x7}, {0x101, 0x0, 0xffff3eec, 0x8001, 0x8, 0x80}, {0xd16a, 0x3, 0x7f940, 0xffff, 0x8, 0x5aaa1249}, {0x1, 0xffffffff, 0x5, 0x440, 0x6, 0x5}, {0x8, 0xb7, 0x4, 0x40, 0x3, 0x6}, {0xa584, 0x11c3217, 0x4, 0x7f, 0x6}, {0x8001, 0x5, 0x80, 0x8, 0x800, 0xffffffba}, {0x6, 0x70, 0x7, 0x7f, 0x1, 0x6}, {0x5, 0x4, 0x101, 0x3, 0x510, 0xe}, {0x5, 0x2, 0x7, 0x6, 0x1, 0xc}, {0x80000000, 0x9, 0xfb, 0x0, 0xfffffffc, 0x8}, {0x13f, 0x6308, 0x80000001, 0x4, 0x11, 0x3}, {0x7fff, 0x7f, 0x9, 0x1, 0x0, 0xbb}, {0x3, 0x0, 0xfffff7e6, 0x2, 0x8, 0x1}, {0x8, 0x9, 0xffffffff, 0x6, 0x9, 0x4}, {0x1, 0x8, 0x200, 0x0, 0xa, 0xfff}, {0xe, 0x7dc, 0x200, 0x8, 0x9, 0x6}, {0x9, 0x9, 0xf, 0x8, 0x10001, 0x1}, {0x0, 0xc422, 0x1, 0x7, 0xad, 0x2}, {0x6e, 0x7a5, 0x6, 0xb17, 0x4, 0x6}, {0x2, 0xffff, 0xa35, 0x4, 0x30, 0x2}, {0x8, 0x139, 0x3, 0xfe4, 0xfae2, 0x1d}, {0x0, 0x10, 0x1, 0x1, 0xfffffffc, 0x2}, {0x94ea, 0x5, 0xff, 0x1ff, 0x9, 0x7}, {0x0, 0x8, 0x5, 0x6, 0x5, 0x8}, {0x9, 0x2, 0x8000, 0x5, 0xe7, 0x80000}, {0x2, 0xfffffffe, 0x7, 0x8, 0x401, 0x1}, {0x0, 0x7, 0x7e5, 0x101, 0x2fc3d16b, 0x8a1}, {0x8, 0x3, 0xf2c1, 0x5, 0x4f, 0x4}, {0x4827, 0x6, 0x50, 0x7, 0x3, 0x8a36}, {0x7, 0x7, 0x0, 0x400, 0x5, 0x1}, {0x4, 0x55, 0x9, 0x1, 0x995f, 0x6}, {0x12d, 0x8, 0x12, 0x4, 0x16b28b32, 0x1ff}, {0x9, 0x8000, 0x5, 0x4, 0x1712, 0xfffffff9}, {0x1, 0x2, 0x6, 0x8, 0x10000, 0x80}, {0x9, 0xb, 0x3, 0xb9b, 0x10001, 0xff}, {0x9, 0x5, 0x6, 0x7, 0x2, 0x80000001}, {0x1, 0xfffffff1, 0x7, 0x5ea, 0x9, 0x1}, {0x5, 0x2, 0x3ff, 0x8, 0x10000, 0x2}, {0xf, 0x4e0, 0x5, 0x4cb8, 0x3, 0x5}, {0x401, 0x7, 0x7, 0x8, 0x9, 0x700}, {0x2, 0x64800000, 0x2, 0x1, 0x5, 0x6}, {0xfffffff8, 0xa694, 0x10000, 0x8, 0x6, 0x800000}, {0xf93c, 0x0, 0x69ff, 0x0, 0x6, 0xc9dc}, {0x1, 0x101, 0x5, 0x1000, 0xa176, 0x6}, {0x549d, 0x2, 0xe, 0x3, 0x2, 0x5}, {0x5, 0xa1a, 0x800, 0x5, 0x7962, 0x5}, {0xfffffc00, 0x8, 0x5, 0x9, 0x5, 0x80}, {0x7, 0x7, 0x3, 0x6, 0x7, 0x10001}, {0xf5, 0x8, 0x6, 0x54ca47f, 0x10}, {0xa70, 0x2, 0xd68f, 0x1000, 0x7, 0x6}, {0x6, 0x1, 0xffffffff, 0xabb, 0x199f36cd, 0x205}, {0x7fff, 0x5f8, 0x0, 0x4, 0x10000, 0x6}, {0x5aee, 0x6, 0x40, 0x161, 0x5b3, 0x1}, {0x9, 0x5, 0xce, 0xff, 0x8, 0x2}, {0xf, 0x6, 0xa, 0x0, 0xff, 0x40}, {0x6, 0x3, 0x8, 0x3, 0x2, 0x7f}, {0x7f, 0xad4, 0xbe, 0x3, 0xffffffff}, {0x8000, 0x7, 0x5902, 0x8db, 0x8, 0x4}, {0x1, 0x0, 0x5, 0x1, 0x2, 0x1000}, {0x2, 0x2, 0x3, 0x4d798692, 0x8, 0x9}, {0x9, 0x100, 0x1ff, 0x1, 0xce, 0x1}, {0x9, 0x6, 0x3, 0x7, 0x1, 0x9}, {0x0, 0x4, 0x8, 0x7f, 0x1, 0x7abb0080}, {0x8, 0x1c, 0x13a, 0x8, 0x400, 0x2}, {0x0, 0x401, 0x5, 0x10, 0x101, 0x5}, {0x3, 0x32, 0x0, 0x2, 0xa999, 0x3}, {0xfffffff8, 0xffffffff, 0x600000, 0x1, 0x3634, 0x8b1}, {0x2, 0x20, 0x8, 0x75e, 0x81, 0x3}, {0x3, 0x7, 0x1, 0x3, 0x7, 0x7fff}, {0xbe83, 0xa, 0xffffffff, 0x7, 0x3, 0x6}, {0x6, 0x3, 0x1ff, 0x3, 0xe, 0x3}, {0x3, 0x4, 0x2, 0x7fff, 0x0, 0x3}, {0xf, 0x80, 0x1, 0xfff, 0x1, 0x3}, {0x9bf8, 0x3, 0x9, 0x0, 0x495, 0x5}, {0x2, 0x8001, 0xd7, 0x2, 0x3a, 0xfffffff9}, {0x54, 0x3, 0x200, 0x313, 0x1, 0x3b}], [{0x0, 0x1}, {0x3, 0x1}, {0x4}, {}, {}, {0x1, 0x1}, {}, {0x4, 0x1}, {0x3}, {0x5, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x5}, {0x0, 0x1}, {0x5}, {0x1, 0x1}, {0x1, 0x1}, {0x5}, {0x3, 0x1}, {0x7, 0x1}, {}, {0x2, 0x1}, {0x3}, {0x2}, {0x5}, {0x0, 0x1}, {0x5}, {}, {0x0, 0x3}, {}, {0x5, 0x1}, {0x2}, {0x5}, {0x3}, {0x1, 0x1}, {0x2}, {0x2, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x2}, {0x5, 0x1}, {0x5, 0x1}, {0x2}, {0x3}, {0x2}, {0x2}, {0x5}, {}, {0x8, 0x1}, {0x2}, {0x3, 0x1}, {0x3}, {0x1}, {}, {0x3}, {0x1, 0x1}, {0xc79cf2f2edece73d}, {0x2, 0x1}, {0x2}, {0x2}, {0x1}, {0x1, 0x1}, {0x4}, {0x1, 0x1}, {0x3}, {0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {}, {0x5}, {0x5}, {0x1}, {}, {0x4}, {0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x6, 0x1}, {0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x3}, {0x4}, {0x3}, {0x2, 0x1}, {0x4, 0x1}, {0x5}, {0x3, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {}, {0x1, 0x1}, {0x2}, {0x4, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x3}, {0x3, 0x3}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x3}, {0x2, 0x1}, {0x2, 0x1}, {}, {}, {0x4, 0x1}, {0xc9aec9811236d39, 0x1}, {}, {0x4}, {0x0, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x1}], 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) (async)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="600000001000ffff27bd7000ebdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="137c0300231a0500400012800e0001006970366772657461700000002c0002801400060000000000000000000000ffff7f000001140007000000000000000041fffffffffffffffe"], 0x60}, 0x1, 0x0, 0x0, 0x1}, 0x20040000)

397.492203ms ago: executing program 2 (id=1672):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20040051}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020000000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}, 0x1, 0x0, 0x0, 0x40050}, 0x0)
syz_emit_ethernet(0x3a, &(0x7f00000000c0)={@local, @random="cf3cccaf382f", @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0xfe, 0x6, 0x0, @remote, @local, {[@end]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}}}}}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x70, 0x0, 0x205, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x4a, 0xe, {{{}, {}, @device_b, @broadcast, @from_mac=@device_b}, 0x0, @default, 0x5d7f, @void, @void, @val={0x3, 0x1, 0xb8}, @void, @void, @void, @void, @val={0x2a, 0x1, {0x0, 0x1}}, @void, @val={0x2d, 0x1a, {0x1000, 0x1, 0x6, 0x0, {0x7, 0xc9, 0x0, 0x7, 0x0, 0x1, 0x0, 0x2, 0x1}, 0x8, 0xb, 0x4}}, @void, @void, @void}}, @NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x70}}, 0x0)
sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002801c001780"], 0x44}, 0x1, 0x0, 0x0, 0xc000}, 0xc000)
sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000002d00010026bdf000fcdbdf25041a0000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000)
socket$packet(0x11, 0x2, 0x300)
socket$packet(0x11, 0x2, 0x300)
socket$pppoe(0x18, 0x1, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r3, 0x8982, &(0x7f0000000080))
r4 = socket$inet6(0xa, 0x2, 0x3a)
sendmmsg$inet6(r4, 0x0, 0x0, 0x4000880)
syz_open_procfs$namespace(0x0, 0x0)
sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001b00)=ANY=[@ANYBLOB, @ANYBLOB, @ANYBLOB, @ANYRES32, @ANYRES32, @ANYBLOB, @ANYRES32=r1, @ANYRES32, @ANYBLOB="be0e3295e7e9a3a28b222472eed6a664b98fee0475ac3660e4367b690b4b04d9d9d8657c7f2229a8ddd98d1ff550d9730a688d831c499ccee2f9edd1801fd30e126fd14c69a12946d2af9b7640ebdc2dc53756aca27223565afa8df6bed13d178027466a0a8f664fcfa9c11d9c0dea84299bc72bf46b9bcf6f8506c9b88e31395e67246802d64292e0d108b68a2e6e0da394346fa327e70c32e383e209d7a8801f9219a2daf23f770bf662969088df94b1fe9c5050791675e922f0371dec97f97a90673727c5433837cc3d5d933be525a44e339dc4454fe2721c5014a679d6c3b6fe491cd4197aa5bbdacb1f505db9d1d9aaa115eb23857f201f03217bddccc5cd21f3bb544c5c75c70cd6391aa2b0aa86f19cab63ca03ce597312a1257bf30547e88de9d47730ff371032b724472866f858e383b2b58f5ea4203245403760d1e04d098976cb0aaa1badcc1f4a0c114ec64d36f0a58b5388fc789f3fd063cc7840b89d5b3f7e4d0d1d8de786d8bd56bab33791b1e8fa7305b8c6d745b4e97cde53c38d45de661c71be03d6f5b87c2331a00db3c87db355c6c91612", @ANYRES32], 0x51c0}, 0x1, 0x0, 0x0, 0x20004094}, 0xc000)
r5 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
socket$nl_generic(0x10, 0x3, 0x10)
close(0x3)

339.595541ms ago: executing program 0 (id=1673):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000002b000b0000000000000000000800001008000300040001000c0001800600000088480000"], 0x28}}, 0x8000)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000680)={'wlan0\x00', <r2=>0x0})
r3 = socket(0x10, 0x803, 0x0)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440)
r5 = accept4(r4, 0x0, 0x0, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x7bff, &(0x7f0000000180)={&(0x7f0000000140)=@delqdisc={0xfffffffffffffc9b}, 0x49d32d254ae22f79}}, 0x0)
getsockopt$sock_buf(r5, 0x1, 0x1a, 0x0, &(0x7f0000000340))
recvmmsg$unix(r5, &(0x7f0000012b80)=[{{&(0x7f00000005c0)=@abs, 0x6e, &(0x7f0000000740)=[{&(0x7f0000000640)=""/20, 0x14}, {&(0x7f000000d280)=""/4096, 0x1000}, {&(0x7f000000e280)=""/4096, 0x1000}, {&(0x7f0000000680)=""/141, 0x8d}], 0x4, &(0x7f0000000780)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, <r6=>0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, <r7=>0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x60}}, {{&(0x7f0000000800), 0x6e, &(0x7f000000f480)=[{&(0x7f000000f280)=""/178, 0xb2}, {&(0x7f000000f340)=""/162, 0xa2}, {&(0x7f000000f400)=""/72, 0x48}], 0x3, &(0x7f000000f4c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f000000f540), 0x6e, &(0x7f0000012a00)=[{&(0x7f000000f5c0)=""/186, 0xba}, {&(0x7f000000f680)=""/238, 0xee}, {&(0x7f000000f780)=""/4096, 0x1000}, {&(0x7f0000010780)=""/121, 0x79}, {&(0x7f0000010800)}, {&(0x7f0000010840)=""/4096, 0x1000}, {&(0x7f0000011840)=""/194, 0xc2}, {&(0x7f0000011940)=""/4096, 0x1000}, {&(0x7f0000012940)=""/176, 0xb0}], 0x9, &(0x7f0000012ac0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [<r8=>0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x98}}], 0x3, 0x60, &(0x7f0000012c40)={0x0, 0x989680})
sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), r7)
r10 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=r2, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r9], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000)
r11 = socket$nl_route(0x10, 0x3, 0x0)
socket(0x1, 0x803, 0x0)
getsockname$packet(r8, &(0x7f0000000500)={0x11, 0x0, <r12=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14)
r13 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(r13, 0x8004f50c, &(0x7f0000000240))
r14 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_netrom_SIOCDELRT(r6, 0x890c, &(0x7f00000003c0)={0x0, @default, @rose={'rose', 0x0}, 0x9, 'syz0\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xd2, 0x7, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]})
ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000100)={'veth1\x00', <r15=>0x0})
sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c000000100003041b00"/20, @ANYRES32=0x0, @ANYBLOB="46060900000000001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r15, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r12], 0x4c}, 0x1, 0x0, 0x0, 0x600}, 0x0)

189.434898ms ago: executing program 2 (id=1674):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) (async, rerun: 32)
r1 = socket$inet(0x2, 0x4000000000000001, 0x0) (rerun: 32)
setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000080)="441f0800", 0x4)
getsockopt$inet_opts(r1, 0x0, 0x4, 0x0, &(0x7f0000000280))
sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x1c, 0x2d, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x4, 0x800}, @nested={0x6, 0x11, 0x0, 0x1, [@generic="2fe5"]}]}, 0x1c}], 0x1}, 0x0)

140.212024ms ago: executing program 2 (id=1675):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000002d000000000070000000000004000000040019000c00090000000080"], 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x84)

139.830322ms ago: executing program 2 (id=1676):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000002d00010026bdf000fcdbdf25041a0000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
socket$packet(0x11, 0x2, 0x300) (async)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r2 = socket(0x10, 0x803, 0x1000) (async)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x200, 0x70bd2a, 0x1, {0x0, 0x0, 0x0, r4, {0xfff3, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0) (async)
r5 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001380)=@newtfilter={0x24, 0x2c, 0x800, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r6, {0x4, 0x4}, {0x6}, {0x1, 0xf}}}, 0x24}}, 0x60814)
r7 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0}) (async)
r9 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r9, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x58) (async)
setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, 0x0, 0x0) (async)
r10 = accept4(r9, 0x0, 0x0, 0x800)
sendmmsg$alg(r10, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)='\x00\x00\x00', 0x3}], 0x1, &(0x7f0000000340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000240)=""/238, 0xee}], 0x1}, 0x40000000)
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x100, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0xfffffffe}, @TCA_RATE={0x6, 0x5, {0x3c, 0x3}}]}, 0x48}}, 0x0)
r11 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00'}) (async)
socket(0x2, 0x80805, 0x0)
close(0x3) (async)
r12 = socket$packet(0x11, 0x2, 0x300)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2, 0x13, r12, 0x0)
r13 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
setsockopt$X25_QBITINCL(r13, 0x106, 0x1, &(0x7f0000000000), 0x4)

47.359776ms ago: executing program 0 (id=1677):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0400001800010000000000000000000200800000010009000000000600150001000000080416800404010000000000000000002b0004000500be1efc00000000000000000000000000000020010000000000000000000000000002fe880000000000000000000000000001ff010000000000000000000000000001fc02000000000000000000000000000100000000000000000000ffffac1414aaff020000000000000000000000000001fc010000000000000000000000000000fe8000000000000000000000000000aa00000000000000000000000000000000fe880000000000000000000000000001fc01000000000000000000000000000000000000000000000000ffff64010100ff010000000000000000000000000001fe88000000000000000000000000010100000000000000000000000000000001fc020000000000000000000000000000fe80000000000000000000000000003f20010000000000000000000000000001ff020000000000000000000000000001fe8000000000000000000000000000aafe880000000000000000000000000001fc010000000000000000000000000000ff010000000000000000000000000001fc020000000000000000000000000001ff020000000000000000000000000001000000000000000000000000000000010000000000000000000000000000000000000000000000000000ffff00000000fc000000000000000000000000000001fe8000000000000000000000000000aafc000000000000000000000000000000fc010000000000000000000000000001fc010000000000000000000000000001fe8000000000000000000000000000bbfc020000000000000000000000000001fe8000000000000000000000000000aafe8000000000000000000000000000bb00000000000000000000000000000000fe8000000000000000000000000000aaff010000000000000000000000000001fc010000000000000000000000000000ff010000000000000000000000000001fe800000000000000000000000000027fc000000000000000000000000000000fe880000000000000000000000000001ff02000000000000000000000000000100000000000000000000ffffac1414bbfe8000000000000000000000000000bbfe8000000000000000000000000000aafe880000000000000000000000000101fc000000000000000000000000000001fe880000000000000000000000000001ff020000000000000000000000000001fc01000000000000000000000000000000000000000000000000000000000000fe8000000000000000000000000000aa00000000000000000000000000000001fe8000000000000000000000000000aa00000000000000000000c49b59f606fe3eb7f37ce9000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aafe8000000000000000000000000000aa"], 0x42c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000)
sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x403, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x48, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x38, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x24, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c70000000000000000"}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LOG\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000002d00090027bd70000000000004000000040019000c00090000000080"], 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x84)

0s ago: executing program 1 (id=1678):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r1 = socket$rxrpc(0x21, 0x2, 0xa)
sendmsg$inet(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x14, 0x110, 0x1, 0xfffffffc}}], 0x18, 0x4c00}, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_int(r3, 0x0, 0x15, 0x0, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, 0x0, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)
r5 = socket$inet_sctp(0x2, 0x1, 0x84)
ioctl$sock_inet_SIOCGIFDSTADDR(r5, 0x8917, &(0x7f0000000100)={'ip_vti0\x00', {0x2, 0x0, @dev}})
socket$inet6_sctp(0xa, 0x5, 0x84)
r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r7}, 0x10)
ppoll(&(0x7f0000000500)=[{r6}], 0x1, 0x0, 0x0, 0x0)
pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4)
sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4004441)
shutdown(r2, 0x0)
recvmmsg(r2, &(0x7f00000055c0), 0x400023c, 0x300, 0x0)
connect$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0xe429, @none, 0x401}, 0xe)
socket(0x2b, 0x6, 0x8000)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0)
sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000000000)=[{&(0x7f00000002c0)={0x4c, 0x2d, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x800}, @nested={0x35, 0x11, 0x0, 0x1, [@generic="9e15c00619065e963eba3ef94d765eb501e2e4bea6b8d14b16632741a5bb965fe09b7844e4b103706a1038bc955454ed2f"]}]}, 0x4c}], 0x1}, 0x300)

kernel console output (not intermixed with test programs):

tover after parsing attributes in process `syz.0.580'.
[  105.911929][ T8627] netlink: 'syz.2.581': attribute type 2 has an invalid length.
[  105.924411][ T8624] netlink: 116 bytes leftover after parsing attributes in process `syz.0.580'.
[  105.938747][ T8624] bond2: option mode: unable to set because the bond device is up
[  106.230036][ T8648] netlink: 24 bytes leftover after parsing attributes in process `syz.0.586'.
[  106.253819][ T8648] netlink: 248 bytes leftover after parsing attributes in process `syz.0.586'.
[  106.308790][ T8655] netlink: 'syz.1.587': attribute type 6 has an invalid length.
[  106.417349][ T8668] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[  106.420439][ T8668] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  106.455388][ T8673] netlink: 'syz.1.590': attribute type 1 has an invalid length.
[  106.458050][ T8673] netlink: 'syz.1.590': attribute type 1 has an invalid length.
[  106.559895][ T8678] netlink: 'syz.1.590': attribute type 1 has an invalid length.
[  106.585573][ T8678] 8021q: adding VLAN 0 to HW filter on device bond11
[  106.596249][ T8673] netlink: 28 bytes leftover after parsing attributes in process `syz.1.590'.
[  106.602749][ T8673] netlink: 44 bytes leftover after parsing attributes in process `syz.1.590'.
[  106.825920][ T8692] netlink: 8 bytes leftover after parsing attributes in process `syz.0.593'.
[  106.877825][ T8695] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0
[  107.092866][ T8715] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  107.167932][ T8719] netlink: 8 bytes leftover after parsing attributes in process `syz.0.600'.
[  107.175949][ T8717] netlink: 80 bytes leftover after parsing attributes in process `syz.1.602'.
[  107.181774][ T8719] netlink: 'syz.0.600': attribute type 10 has an invalid length.
[  107.235492][ T8717] netlink: 72 bytes leftover after parsing attributes in process `syz.1.602'.
[  107.303993][ T8727] netlink: 'syz.2.603': attribute type 10 has an invalid length.
[  107.580308][ T8740] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  107.597205][ T8740] xt_HMARK: proto mask must be zero with L3 mode
[  108.001377][ T8751] vlan0: left promiscuous mode
[  108.005571][ T8751] mac80211_hwsim hwsim6 wlan0: left promiscuous mode
[  108.014946][ T8751] vti1: left promiscuous mode
[  108.124491][ T8768] netlink: 'syz.0.614': attribute type 9 has an invalid length.
[  108.255215][ T8775] netlink: 'syz.0.618': attribute type 6 has an invalid length.
[  109.152963][ T8840] Unsupported ieee802154 address type: 0
[  109.344852][ T8850] x_tables: ip_tables: connmark.1 match: invalid size 16 (kernel) != (user) 80
[  109.611825][ T8862] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  109.797668][ T8869] 8021q: adding VLAN 0 to HW filter on device bond0
[  109.865115][ T8874] (unnamed net_device) (uninitialized): option lacp_rate: mode dependency failed, not supported in mode balance-rr(0)
[  110.087953][ T8895] mac80211_hwsim hwsim2 wlan0: left promiscuous mode
[  110.383109][ T8910] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[  110.386449][ T8910] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  110.507111][ T8921] can: request_module (can-proto-3) failed.
[  110.939127][ T8941] __nla_validate_parse: 15 callbacks suppressed
[  110.939143][ T8941] netlink: 248 bytes leftover after parsing attributes in process `syz.0.660'.
[  111.098105][ T8948] validate_nla: 5 callbacks suppressed
[  111.098114][ T8948] netlink: 'syz.1.662': attribute type 7 has an invalid length.
[  111.111277][ T8948] netlink: 8 bytes leftover after parsing attributes in process `syz.1.662'.
[  111.156019][ T8948] bridge1: port 1(bond12) entered blocking state
[  111.160588][ T8948] bridge1: port 1(bond12) entered disabled state
[  111.168572][ T8948] bond12: entered allmulticast mode
[  111.276893][ T8945] netlink: 'syz.0.661': attribute type 12 has an invalid length.
[  111.279748][ T8945] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.661'.
[  111.370576][ T5848] cgroup: fork rejected by pids controller in /syz1
[  111.474820][ T5848] syz_tun (unregistering): left allmulticast mode
[  111.498845][ T1088] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  111.501806][ T1088] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.548578][ T8969] netlink: 8 bytes leftover after parsing attributes in process `syz.0.666'.
[  111.558264][ T8969] netlink: 24 bytes leftover after parsing attributes in process `syz.0.666'.
[  111.596031][ T8972] netlink: 'syz.2.665': attribute type 10 has an invalid length.
[  111.984244][ T5851] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  111.988593][ T5851] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  111.993675][ T5851] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  112.005774][ T5851] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  112.010029][ T5851] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  112.307436][ T8996] chnl_net:caif_netlink_parms(): no params data found
[  112.453800][ T9025] netlink: 8 bytes leftover after parsing attributes in process `syz.0.673'.
[  112.464778][ T8996] bridge0: port 1(bridge_slave_0) entered blocking state
[  112.467908][ T8996] bridge0: port 1(bridge_slave_0) entered disabled state
[  112.476967][ T8996] bridge_slave_0: entered allmulticast mode
[  112.481397][ T8996] bridge_slave_0: entered promiscuous mode
[  112.487862][ T8996] bridge0: port 2(bridge_slave_1) entered blocking state
[  112.495377][ T8996] bridge0: port 2(bridge_slave_1) entered disabled state
[  112.499090][ T8996] bridge_slave_1: entered allmulticast mode
[  112.504992][ T8996] bridge_slave_1: entered promiscuous mode
[  112.558608][ T8996] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  112.575411][ T8996] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  112.627220][ T8996] team0: Port device team_slave_0 added
[  112.636906][ T8996] team0: Port device team_slave_1 added
[  112.732533][ T8996] batman_adv: batadv0: Adding interface: batadv_slave_0
[  112.735348][ T8996] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  112.761410][ T8996] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  112.767782][ T8996] batman_adv: batadv0: Adding interface: batadv_slave_1
[  112.770806][ T8996] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  112.782390][ T8996] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  112.836973][ T8996] hsr_slave_0: entered promiscuous mode
[  112.840369][ T8996] hsr_slave_1: entered promiscuous mode
[  113.207342][ T9068] netlink: 'syz.2.678': attribute type 10 has an invalid length.
[  113.299055][ T9071] veth5: entered promiscuous mode
[  113.325614][ T8996] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  113.332964][ T8996] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  113.339208][ T8996] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  113.347118][ T8996] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  113.356593][ T9073] netlink: 14 bytes leftover after parsing attributes in process `syz.0.681'.
[  113.431855][ T9081] netlink: 56 bytes leftover after parsing attributes in process `syz.0.682'.
[  113.437319][ T8996] 8021q: adding VLAN 0 to HW filter on device bond0
[  113.459117][ T8996] 8021q: adding VLAN 0 to HW filter on device team0
[  113.466344][ T2167] bridge0: port 1(bridge_slave_0) entered blocking state
[  113.469090][ T2167] bridge0: port 1(bridge_slave_0) entered forwarding state
[  113.475487][ T9081] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  113.479647][ T9081] CPU: 0 UID: 0 PID: 9081 Comm: syz.0.682 Not tainted syzkaller #0 PREEMPT(full) 
[  113.479659][ T9081] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  113.479663][ T9081] Call Trace:
[  113.479666][ T9081]  <TASK>
[  113.479670][ T9081]  dump_stack_lvl+0x189/0x250
[  113.479684][ T9081]  ? __pfx_dump_stack_lvl+0x10/0x10
[  113.479693][ T9081]  ? __pfx__printk+0x10/0x10
[  113.479705][ T9081]  ? kernfs_path_from_node+0x2f/0x290
[  113.479714][ T9081]  ? kernfs_path_from_node+0x250/0x290
[  113.479721][ T9081]  ? kernfs_path_from_node+0x2f/0x290
[  113.479731][ T9081]  sysfs_warn_dup+0x8e/0xa0
[  113.479739][ T9081]  sysfs_do_create_link_sd+0xc0/0x110
[  113.479747][ T9081]  device_add_class_symlinks+0x1cf/0x240
[  113.479757][ T9081]  device_add+0x475/0xb50
[  113.479766][ T9081]  wiphy_register+0x1ba6/0x28d0
[  113.479783][ T9081]  ? __pfx_wiphy_register+0x10/0x10
[  113.479791][ T9081]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  113.479802][ T9081]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  113.479812][ T9081]  ieee80211_register_hw+0x3425/0x4080
[  113.479828][ T9081]  ? ieee80211_register_hw+0x1461/0x4080
[  113.479839][ T9081]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  113.479848][ T9081]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  113.479860][ T9081]  ? __hrtimer_setup+0x187/0x210
[  113.479866][ T9081]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  113.479878][ T9081]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  113.479898][ T9081]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  113.479906][ T9081]  ? trace_kmalloc+0x1f/0xd0
[  113.479914][ T9081]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  113.479923][ T9081]  ? kstrndup+0xbf/0x160
[  113.479935][ T9081]  hwsim_new_radio_nl+0xea4/0x1b10
[  113.479945][ T9081]  ? __pfx___nla_validate_parse+0x10/0x10
[  113.479960][ T9081]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  113.479974][ T9081]  ? __nla_parse+0x40/0x60
[  113.479984][ T9081]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  113.479996][ T9081]  genl_family_rcv_msg_doit+0x215/0x300
[  113.480007][ T9081]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  113.480020][ T9081]  ? bpf_lsm_capable+0x9/0x20
[  113.480028][ T9081]  ? security_capable+0x7e/0x2e0
[  113.480042][ T9081]  genl_rcv_msg+0x60e/0x790
[  113.480052][ T9081]  ? __pfx_genl_rcv_msg+0x10/0x10
[  113.480061][ T9081]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  113.480075][ T9081]  netlink_rcv_skb+0x208/0x470
[  113.480084][ T9081]  ? __lock_acquire+0xab9/0xd20
[  113.480094][ T9081]  ? __pfx_genl_rcv_msg+0x10/0x10
[  113.480103][ T9081]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  113.480120][ T9081]  ? down_read+0x1ad/0x2e0
[  113.480127][ T9081]  genl_rcv+0x28/0x40
[  113.480134][ T9081]  netlink_unicast+0x82f/0x9e0
[  113.480147][ T9081]  ? __pfx_netlink_unicast+0x10/0x10
[  113.480156][ T9081]  ? netlink_sendmsg+0x642/0xb30
[  113.480161][ T9081]  ? skb_put+0x11b/0x210
[  113.480170][ T9081]  netlink_sendmsg+0x805/0xb30
[  113.480180][ T9081]  ? __pfx_netlink_sendmsg+0x10/0x10
[  113.480187][ T9081]  ? aa_sock_msg_perm+0xf1/0x1d0
[  113.480195][ T9081]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  113.480201][ T9081]  ? __pfx_netlink_sendmsg+0x10/0x10
[  113.480208][ T9081]  __sock_sendmsg+0x21c/0x270
[  113.480218][ T9081]  ____sys_sendmsg+0x505/0x830
[  113.480228][ T9081]  ? __pfx_____sys_sendmsg+0x10/0x10
[  113.480239][ T9081]  ? import_iovec+0x74/0xa0
[  113.480248][ T9081]  ___sys_sendmsg+0x21f/0x2a0
[  113.480256][ T9081]  ? __pfx____sys_sendmsg+0x10/0x10
[  113.480277][ T9081]  ? __fget_files+0x2a/0x420
[  113.480283][ T9081]  ? __fget_files+0x3a0/0x420
[  113.480293][ T9081]  __x64_sys_sendmsg+0x19b/0x260
[  113.480301][ T9081]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  113.480313][ T9081]  ? rcu_is_watching+0x15/0xb0
[  113.480322][ T9081]  ? do_syscall_64+0xbe/0x3b0
[  113.480330][ T9081]  do_syscall_64+0xfa/0x3b0
[  113.480335][ T9081]  ? lockdep_hardirqs_on+0x9c/0x150
[  113.480344][ T9081]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  113.480350][ T9081]  ? exc_page_fault+0x9f/0xf0
[  113.480360][ T9081]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  113.480366][ T9081] RIP: 0033:0x7f172af8ebe9
[  113.480373][ T9081] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  113.480378][ T9081] RSP: 002b:00007f172bedc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  113.480396][ T9081] RAX: ffffffffffffffda RBX: 00007f172b1c5fa0 RCX: 00007f172af8ebe9
[  113.480401][ T9081] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000004
[  113.480405][ T9081] RBP: 00007f172b011e19 R08: 0000000000000000 R09: 0000000000000000
[  113.480410][ T9081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  113.480414][ T9081] R13: 00007f172b1c6038 R14: 00007f172b1c5fa0 R15: 00007ffcd6b5ab08
[  113.480426][ T9081]  </TASK>
[  113.519429][ T8996] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  113.671118][ T8996] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  113.678986][ T2167] bridge0: port 2(bridge_slave_1) entered blocking state
[  113.682282][ T2167] bridge0: port 2(bridge_slave_1) entered forwarding state
[  113.824004][ T8996] 8021q: adding VLAN 0 to HW filter on device batadv0
[  113.874538][ T8996] veth0_vlan: entered promiscuous mode
[  113.883063][ T8996] veth1_vlan: entered promiscuous mode
[  113.916031][ T8996] veth0_macvtap: entered promiscuous mode
[  113.930813][ T8996] veth1_macvtap: entered promiscuous mode
[  113.946439][ T9097] netlink: 248 bytes leftover after parsing attributes in process `syz.0.686'.
[  113.952433][ T8996] batman_adv: batadv0: Interface activated: batadv_slave_0
[  114.013473][ T8996] batman_adv: batadv0: Interface activated: batadv_slave_1
[  114.031600][ T5890] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  114.035186][ T5890] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  114.038581][ T5890] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  114.042901][ T5847] Bluetooth: hci1: command tx timeout
[  114.051896][ T5890] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  114.074631][ T9099] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.687'.
[  114.237062][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  114.250197][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  114.257612][ T1087] wlan0: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID
[  114.297050][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  114.304288][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  114.356941][ T9108] netlink: 'syz.2.690': attribute type 10 has an invalid length.
[  114.628346][ T9133] netlink: 'syz.1.694': attribute type 3 has an invalid length.
[  114.763548][ T9141] netlink: 'syz.2.695': attribute type 10 has an invalid length.
[  114.813342][ T9144] netlink: 'syz.0.696': attribute type 6 has an invalid length.
[  114.992204][ T9165] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  114.996110][ T9165] CPU: 1 UID: 0 PID: 9165 Comm: syz.2.700 Not tainted syzkaller #0 PREEMPT(full) 
[  114.996130][ T9165] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  114.996137][ T9165] Call Trace:
[  114.996143][ T9165]  <TASK>
[  114.996149][ T9165]  dump_stack_lvl+0x189/0x250
[  114.996170][ T9165]  ? __pfx_dump_stack_lvl+0x10/0x10
[  114.996184][ T9165]  ? __pfx__printk+0x10/0x10
[  114.996203][ T9165]  ? kernfs_path_from_node+0x2f/0x290
[  114.996215][ T9165]  ? kernfs_path_from_node+0x250/0x290
[  114.996226][ T9165]  ? kernfs_path_from_node+0x2f/0x290
[  114.996239][ T9165]  sysfs_warn_dup+0x8e/0xa0
[  114.996250][ T9165]  sysfs_do_create_link_sd+0xc0/0x110
[  114.996264][ T9165]  device_add_class_symlinks+0x1cf/0x240
[  114.996279][ T9165]  device_add+0x475/0xb50
[  114.996293][ T9165]  wiphy_register+0x1ba6/0x28d0
[  114.996322][ T9165]  ? __pfx_wiphy_register+0x10/0x10
[  114.996336][ T9165]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  114.996358][ T9165]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  114.996372][ T9165]  ieee80211_register_hw+0x3425/0x4080
[  114.996393][ T9165]  ? ieee80211_register_hw+0x1461/0x4080
[  114.996412][ T9165]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  114.996427][ T9165]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  114.996472][ T9165]  ? __hrtimer_setup+0x187/0x210
[  114.996479][ T9165]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  114.996491][ T9165]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  114.996512][ T9165]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  114.996521][ T9165]  ? trace_kmalloc+0x1f/0xd0
[  114.996530][ T9165]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  114.996538][ T9165]  ? kstrndup+0xbf/0x160
[  114.996549][ T9165]  hwsim_new_radio_nl+0xea4/0x1b10
[  114.996559][ T9165]  ? __pfx___nla_validate_parse+0x10/0x10
[  114.996576][ T9165]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  114.996589][ T9165]  ? __nla_parse+0x40/0x60
[  114.996605][ T9165]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  114.996626][ T9165]  genl_family_rcv_msg_doit+0x215/0x300
[  114.996644][ T9165]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  114.996667][ T9165]  ? bpf_lsm_capable+0x9/0x20
[  114.996678][ T9165]  ? security_capable+0x7e/0x2e0
[  114.996691][ T9165]  genl_rcv_msg+0x60e/0x790
[  114.996708][ T9165]  ? __pfx_genl_rcv_msg+0x10/0x10
[  114.996721][ T9165]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  114.996745][ T9165]  netlink_rcv_skb+0x208/0x470
[  114.996760][ T9165]  ? __lock_acquire+0xab9/0xd20
[  114.996770][ T9165]  ? __pfx_genl_rcv_msg+0x10/0x10
[  114.996779][ T9165]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  114.996809][ T9165]  ? down_read+0x1ad/0x2e0
[  114.996822][ T9165]  genl_rcv+0x28/0x40
[  114.996834][ T9165]  netlink_unicast+0x82f/0x9e0
[  114.996855][ T9165]  ? __pfx_netlink_unicast+0x10/0x10
[  114.996871][ T9165]  ? netlink_sendmsg+0x642/0xb30
[  114.996879][ T9165]  ? skb_put+0x11b/0x210
[  114.996888][ T9165]  netlink_sendmsg+0x805/0xb30
[  114.996898][ T9165]  ? __pfx_netlink_sendmsg+0x10/0x10
[  114.996907][ T9165]  ? aa_sock_msg_perm+0xf1/0x1d0
[  114.996919][ T9165]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  114.996930][ T9165]  ? __pfx_netlink_sendmsg+0x10/0x10
[  114.996941][ T9165]  __sock_sendmsg+0x21c/0x270
[  114.996958][ T9165]  ____sys_sendmsg+0x505/0x830
[  114.996974][ T9165]  ? __pfx_____sys_sendmsg+0x10/0x10
[  114.996992][ T9165]  ? import_iovec+0x74/0xa0
[  114.997008][ T9165]  ___sys_sendmsg+0x21f/0x2a0
[  114.997022][ T9165]  ? __pfx____sys_sendmsg+0x10/0x10
[  114.997059][ T9165]  ? __fget_files+0x2a/0x420
[  114.997068][ T9165]  ? __fget_files+0x3a0/0x420
[  114.997086][ T9165]  __x64_sys_sendmsg+0x19b/0x260
[  114.997100][ T9165]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  114.997126][ T9165]  ? rcu_is_watching+0x15/0xb0
[  114.997141][ T9165]  ? do_syscall_64+0xbe/0x3b0
[  114.997155][ T9165]  do_syscall_64+0xfa/0x3b0
[  114.997164][ T9165]  ? lockdep_hardirqs_on+0x9c/0x150
[  114.997181][ T9165]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.997191][ T9165]  ? exc_page_fault+0x9f/0xf0
[  114.997209][ T9165]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.997221][ T9165] RIP: 0033:0x7fe05cf8ebe9
[  114.997233][ T9165] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  114.997243][ T9165] RSP: 002b:00007fe05dee1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  114.997255][ T9165] RAX: ffffffffffffffda RBX: 00007fe05d1c5fa0 RCX: 00007fe05cf8ebe9
[  114.997260][ T9165] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000004
[  114.997265][ T9165] RBP: 00007fe05d011e19 R08: 0000000000000000 R09: 0000000000000000
[  114.997269][ T9165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  114.997274][ T9165] R13: 00007fe05d1c6038 R14: 00007fe05d1c5fa0 R15: 00007ffe53b92ce8
[  114.997293][ T9165]  </TASK>
[  115.422061][ T9196] team0: Unable to change to the same mode the team is in
[  115.428656][ T9196] tipc: Enabling of bearer <eth:team0> rejected, already enabled
[  115.545049][ T9208] vlan0: left promiscuous mode
[  115.554204][ T9208] mac80211_hwsim hwsim4 wlan0: left promiscuous mode
[  115.568838][ T9208] veth3: left promiscuous mode
[  115.615486][ T9206] veth5: left promiscuous mode
[  115.671593][ T9206] hsr_slave_0: left promiscuous mode
[  115.675133][ T9206] hsr_slave_1: left promiscuous mode
[  115.750339][ T9216] syzkaller1: entered promiscuous mode
[  115.776327][ T9216] syzkaller1: entered allmulticast mode
[  115.850360][ T9219] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  115.877839][ T9219] netlink: 'syz.1.711': attribute type 4 has an invalid length.
[  116.121588][ T5847] Bluetooth: hci1: command tx timeout
[  116.254646][ T9219] bridge0: port 2(bridge_slave_1) entered disabled state
[  116.258773][ T9219] bridge0: port 1(bridge_slave_0) entered disabled state
[  116.696482][ T9219] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  116.709867][ T9219] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  116.876363][ T5714] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  116.891492][ T5714] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  116.895351][ T5714] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  116.898998][ T5714] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  116.908256][ T9248] __nla_validate_parse: 12 callbacks suppressed
[  116.908269][ T9248] netlink: 16 bytes leftover after parsing attributes in process `syz.0.713'.
[  116.950375][ T9251] netlink: 16 bytes leftover after parsing attributes in process `syz.1.714'.
[  116.968679][ T9254] IPVS: sync thread started: state = BACKUP, mcast_ifn = batadv0, syncid = 0, id = 0
[  116.981984][ T9251] netlink: 4 bytes leftover after parsing attributes in process `syz.1.714'.
[  117.097330][ T9265] netlink: 'syz.0.717': attribute type 9 has an invalid length.
[  117.138587][ T9268] netlink: 'syz.2.715': attribute type 10 has an invalid length.
[  117.819690][ T9302] netlink: 'syz.0.722': attribute type 12 has an invalid length.
[  117.822678][ T9302] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.722'.
[  117.867231][ T9306] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[  117.869725][ T9306] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[  117.873901][ T9306] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  117.934840][ T9311] netlink: 'syz.0.724': attribute type 6 has an invalid length.
[  118.017912][ T9320] netlink: 'syz.2.725': attribute type 10 has an invalid length.
[  118.029756][ T9320] netlink: 4 bytes leftover after parsing attributes in process `syz.2.725'.
[  118.144246][ T9329] netlink: 'syz.0.728': attribute type 12 has an invalid length.
[  118.156287][ T9330] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  118.201176][ T5847] Bluetooth: hci1: command tx timeout
[  118.576155][ T9348] bridge_slave_0: left allmulticast mode
[  118.578345][ T9348] bridge_slave_0: left promiscuous mode
[  118.580649][ T9348] bridge0: port 1(bridge_slave_0) entered disabled state
[  118.585867][ T9348] bridge_slave_1: left allmulticast mode
[  118.588029][ T9348] bridge_slave_1: left promiscuous mode
[  118.590280][ T9348] bridge0: port 2(bridge_slave_1) entered disabled state
[  118.598038][ T9348] bond0: (slave bond_slave_0): Releasing backup interface
[  118.604610][ T9348] bond0: (slave bond_slave_1): Releasing backup interface
[  118.610111][ T9348] team0: Port device team_slave_0 removed
[  118.614578][ T9348] team0: Port device team_slave_1 removed
[  118.617211][ T9348] batman_adv: batadv0: Removing interface: batadv_slave_0
[  118.620491][ T9348] batman_adv: batadv0: Removing interface: batadv_slave_1
[  118.765081][ T9366] netlink: 248 bytes leftover after parsing attributes in process `syz.0.738'.
[  118.991605][ T9372] netlink: 'syz.1.739': attribute type 2 has an invalid length.
[  119.110615][ T9379] netlink: 64 bytes leftover after parsing attributes in process `syz.1.739'.
[  119.835332][ T9383] netlink: 'syz.0.742': attribute type 1 has an invalid length.
[  119.838823][ T9383] netlink: 'syz.0.742': attribute type 1 has an invalid length.
[  120.281242][ T5847] Bluetooth: hci1: command tx timeout
[  120.918008][ T9402] netdevsim netdevsim1 netdevsim0: entered allmulticast mode
[  120.921737][ T9402] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  121.196662][ T9430] netlink: 20 bytes leftover after parsing attributes in process `syz.1.750'.
[  121.217219][ T9432] sctp: [Deprecated]: syz.0.751 (pid 9432) Use of int in max_burst socket option.
[  121.217219][ T9432] Use struct sctp_assoc_value instead
[  121.265758][ T9432] netlink: 16 bytes leftover after parsing attributes in process `syz.0.751'.
[  121.543232][ T9451] 8021q: adding VLAN 0 to HW filter on device bond1
[  121.612819][ T9458] netlink: 'syz.1.759': attribute type 10 has an invalid length.
[  121.617109][ T9458] mac80211_hwsim hwsim157 wlan1: entered allmulticast mode
[  121.716047][ T9465] netlink: 16 bytes leftover after parsing attributes in process `syz.2.762'.
[  121.965644][ T9469] netlink: 64 bytes leftover after parsing attributes in process `syz.1.763'.
[  121.973652][ T9469] netlink: 40 bytes leftover after parsing attributes in process `syz.1.763'.
[  122.209409][ T9480] validate_nla: 1 callbacks suppressed
[  122.209423][ T9480] netlink: 'syz.1.765': attribute type 8 has an invalid length.
[  122.628388][ T9502] ieee802154 phy0 wpan0: encryption failed: -22
[  123.217756][ T9515] netlink: 'syz.0.774': attribute type 1 has an invalid length.
[  123.221141][ T9516] netlink: 'syz.0.774': attribute type 1 has an invalid length.
[  123.238785][ T9516] bond4: (slave ip6gretap2): Enslaving as a backup interface with an up link
[  123.249263][ T9516] 8021q: adding VLAN 0 to HW filter on device bond4
[  123.252232][   T12] bond4: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  123.275404][ T9516] veth7: entered promiscuous mode
[  123.280525][ T9516] bond4: (slave veth7): Enslaving as a backup interface with a down link
[  123.288452][ T9515] bond4: (slave ip6gretap2): Removing an active aggregator
[  123.294256][ T9515] bond4: (slave ip6gretap2): Releasing backup interface
[  123.297304][ T9515] bond4: (slave ip6gretap2): the permanent HWaddr of slave - ea:84:9b:d9:4e:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  123.308901][ T9515] bond4: (slave veth7): Releasing backup interface
[  123.345140][ T9521] mac80211_hwsim hwsim157 wlan1: left allmulticast mode
[  123.350854][ T9521] netlink: 'syz.1.776': attribute type 10 has an invalid length.
[  123.374781][ T9521] mac80211_hwsim hwsim157 wlan1: entered allmulticast mode
[  123.483509][ T9526] netlink: 4 bytes leftover after parsing attributes in process `syz.1.778'.
[  123.490065][ T9528] netlink: 4 bytes leftover after parsing attributes in process `syz.1.778'.
[  123.698689][ T9533] netlink: 'syz.0.779': attribute type 8 has an invalid length.
[  123.863162][ T9548] netlink: 'syz.0.783': attribute type 32 has an invalid length.
[  123.872282][ T9548] netlink: 4 bytes leftover after parsing attributes in process `syz.0.783'.
[  124.017521][ T9567] netlink: 14 bytes leftover after parsing attributes in process `syz.0.787'.
[  124.042567][ T9573] syz_tun: entered allmulticast mode
[  124.083452][ T9573] netlink: 20 bytes leftover after parsing attributes in process `syz.1.784'.
[  124.222861][ T9595] netlink: 'syz.2.786': attribute type 10 has an invalid length.
[  124.809159][ T9598] 8021q: adding VLAN 0 to HW filter on device bond1
[  124.969819][ T9603] netlink: 24 bytes leftover after parsing attributes in process `syz.1.794'.
[  125.034024][ T9604] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  125.037379][ T9604] syzkaller0: entered promiscuous mode
[  125.041627][ T9604] syzkaller0: entered allmulticast mode
[  125.090416][ T9604] tipc: Resetting bearer <eth:syzkaller0>
[  125.098092][ T9604] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[  125.102419][ T9604] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  125.111385][ T9602] tipc: Resetting bearer <eth:syzkaller0>
[  125.129409][ T9602] tipc: Disabling bearer <eth:syzkaller0>
[  125.132531][ T9609] netlink: 'syz.2.795': attribute type 8 has an invalid length.
[  125.247071][ T9607] veth5: entered promiscuous mode
[  125.305429][ T9622] netlink: 'syz.0.800': attribute type 6 has an invalid length.
[  125.312854][ T9622] netlink: 'syz.0.800': attribute type 12 has an invalid length.
[  125.316152][ T9622] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.800'.
[  125.376132][ T9618] netlink: 4 bytes leftover after parsing attributes in process `syz.2.799'.
[  125.516539][ T9629] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  125.658689][   T28] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  125.662182][   T28] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  125.680381][ T9643] mac80211_hwsim hwsim157 wlan1: left allmulticast mode
[  126.430769][ T9705] mac80211_hwsim hwsim157 wlan1: entered allmulticast mode
[  126.499596][ T9712] 8021q: adding VLAN 0 to HW filter on device bond5
[  126.520348][ T9712] 8021q: adding VLAN 0 to HW filter on device macvlan5
[  126.525240][ T9712] bond2: (slave macvlan5): Enslaving as a backup interface with a down link
[  126.535593][ T9712] bond2: (slave macvlan5): Releasing backup interface
[  127.260347][ T9758] validate_nla: 6 callbacks suppressed
[  127.260361][ T9758] netlink: 'syz.1.825': attribute type 9 has an invalid length.
[  127.414250][ T9771] netlink: 'syz.2.829': attribute type 1 has an invalid length.
[  127.423079][ T9771] netlink: 'syz.2.829': attribute type 1 has an invalid length.
[  127.436436][ T9771] netlink: 'syz.2.829': attribute type 1 has an invalid length.
[  127.492692][ T9771] vlan2: entered allmulticast mode
[  127.494386][ T9771] veth1: entered allmulticast mode
[  127.841676][ T9793] __nla_validate_parse: 1 callbacks suppressed
[  127.841689][ T9793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.834'.
[  127.856277][ T9797] netlink: 'syz.0.835': attribute type 1 has an invalid length.
[  127.862184][ T9793] netlink: 'syz.2.834': attribute type 10 has an invalid length.
[  127.880656][ T9797] netlink: 80 bytes leftover after parsing attributes in process `syz.0.835'.
[  128.120273][ T9808] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  128.215079][ T9810] netlink: 'syz.0.839': attribute type 10 has an invalid length.
[  128.215139][ T9811] netlink: 'syz.0.839': attribute type 10 has an invalid length.
[  128.226705][ T9811] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  128.230734][ T9811] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  128.735653][ T9816] netlink: 248 bytes leftover after parsing attributes in process `syz.1.840'.
[  129.115320][ T9831] netlink: 76 bytes leftover after parsing attributes in process `syz.0.842'.
[  129.119104][ T9831] nbd: illegal input index 65508
[  129.595712][ T9827] netlink: 'syz.2.841': attribute type 2 has an invalid length.
[  129.617653][ T9827] netlink: 64 bytes leftover after parsing attributes in process `syz.2.841'.
[  129.667690][ T9857] netlink: 14 bytes leftover after parsing attributes in process `syz.0.845'.
[  130.092898][ T9889] netlink: 8 bytes leftover after parsing attributes in process `syz.0.849'.
[  130.236490][ T9897] netlink: 'syz.1.850': attribute type 1 has an invalid length.
[  130.393800][ T9874] netlink: 64 bytes leftover after parsing attributes in process `syz.2.847'.
[  130.456390][ T9913] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  130.469970][ T9913] tipc: Resetting bearer <eth:syzkaller0>
[  130.479483][ T9909] tipc: Disabling bearer <eth:syzkaller0>
[  130.798865][ T9933] netlink: 120 bytes leftover after parsing attributes in process `syz.1.857'.
[  130.887431][ T9939] team0: Device gtp0 is up. Set it down before adding it as a team port
[  131.041378][ T9945] syzkaller0: entered promiscuous mode
[  131.043732][ T9945] syzkaller0: entered allmulticast mode
[  131.053298][ T9944] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  131.133984][ T9954] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  131.138223][ T9954] CPU: 0 UID: 0 PID: 9954 Comm: syz.2.860 Not tainted syzkaller #0 PREEMPT(full) 
[  131.138238][ T9954] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  131.138245][ T9954] Call Trace:
[  131.138251][ T9954]  <TASK>
[  131.138256][ T9954]  dump_stack_lvl+0x189/0x250
[  131.138301][ T9954]  ? __pfx_dump_stack_lvl+0x10/0x10
[  131.138315][ T9954]  ? __pfx__printk+0x10/0x10
[  131.138333][ T9954]  ? kernfs_path_from_node+0x2f/0x290
[  131.138345][ T9954]  ? kernfs_path_from_node+0x250/0x290
[  131.138355][ T9954]  ? kernfs_path_from_node+0x2f/0x290
[  131.138370][ T9954]  sysfs_warn_dup+0x8e/0xa0
[  131.138382][ T9954]  sysfs_do_create_link_sd+0xc0/0x110
[  131.138396][ T9954]  device_add_class_symlinks+0x1cf/0x240
[  131.138412][ T9954]  device_add+0x475/0xb50
[  131.138428][ T9954]  wiphy_register+0x1ba6/0x28d0
[  131.138457][ T9954]  ? __pfx_wiphy_register+0x10/0x10
[  131.138472][ T9954]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  131.138491][ T9954]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  131.138508][ T9954]  ieee80211_register_hw+0x3425/0x4080
[  131.138533][ T9954]  ? ieee80211_register_hw+0x1461/0x4080
[  131.138551][ T9954]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  131.138567][ T9954]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  131.138587][ T9954]  ? __hrtimer_setup+0x187/0x210
[  131.138598][ T9954]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  131.138616][ T9954]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  131.138652][ T9954]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  131.138664][ T9954]  ? trace_kmalloc+0x1f/0xd0
[  131.138676][ T9954]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  131.138690][ T9954]  ? kstrndup+0xbf/0x160
[  131.138709][ T9954]  hwsim_new_radio_nl+0xea4/0x1b10
[  131.138727][ T9954]  ? __pfx___nla_validate_parse+0x10/0x10
[  131.138753][ T9954]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  131.138776][ T9954]  ? __nla_parse+0x40/0x60
[  131.138794][ T9954]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  131.138815][ T9954]  genl_family_rcv_msg_doit+0x215/0x300
[  131.138833][ T9954]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  131.138856][ T9954]  ? bpf_lsm_capable+0x9/0x20
[  131.138869][ T9954]  ? security_capable+0x7e/0x2e0
[  131.138891][ T9954]  genl_rcv_msg+0x60e/0x790
[  131.138910][ T9954]  ? __pfx_genl_rcv_msg+0x10/0x10
[  131.138922][ T9954]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  131.138947][ T9954]  netlink_rcv_skb+0x208/0x470
[  131.138962][ T9954]  ? __lock_acquire+0xab9/0xd20
[  131.138978][ T9954]  ? __pfx_genl_rcv_msg+0x10/0x10
[  131.138992][ T9954]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  131.139029][ T9954]  ? down_read+0x1ad/0x2e0
[  131.139042][ T9954]  genl_rcv+0x28/0x40
[  131.139053][ T9954]  netlink_unicast+0x82f/0x9e0
[  131.139075][ T9954]  ? __pfx_netlink_unicast+0x10/0x10
[  131.139090][ T9954]  ? netlink_sendmsg+0x642/0xb30
[  131.139100][ T9954]  ? skb_put+0x11b/0x210
[  131.139114][ T9954]  netlink_sendmsg+0x805/0xb30
[  131.139132][ T9954]  ? __pfx_netlink_sendmsg+0x10/0x10
[  131.139145][ T9954]  ? aa_sock_msg_perm+0xf1/0x1d0
[  131.139158][ T9954]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  131.139170][ T9954]  ? __pfx_netlink_sendmsg+0x10/0x10
[  131.139181][ T9954]  __sock_sendmsg+0x21c/0x270
[  131.139198][ T9954]  ____sys_sendmsg+0x505/0x830
[  131.139215][ T9954]  ? __pfx_____sys_sendmsg+0x10/0x10
[  131.139235][ T9954]  ? import_iovec+0x74/0xa0
[  131.139251][ T9954]  ___sys_sendmsg+0x21f/0x2a0
[  131.139289][ T9954]  ? __pfx____sys_sendmsg+0x10/0x10
[  131.139331][ T9954]  ? __fget_files+0x2a/0x420
[  131.139340][ T9954]  ? __fget_files+0x3a0/0x420
[  131.139358][ T9954]  __x64_sys_sendmsg+0x19b/0x260
[  131.139372][ T9954]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  131.139392][ T9954]  ? rcu_is_watching+0x15/0xb0
[  131.139410][ T9954]  ? do_syscall_64+0xbe/0x3b0
[  131.139424][ T9954]  do_syscall_64+0xfa/0x3b0
[  131.139433][ T9954]  ? lockdep_hardirqs_on+0x9c/0x150
[  131.139449][ T9954]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  131.139459][ T9954]  ? exc_page_fault+0x9f/0xf0
[  131.139476][ T9954]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  131.139487][ T9954] RIP: 0033:0x7fe05cf8ebe9
[  131.139499][ T9954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  131.139508][ T9954] RSP: 002b:00007fe05dee1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  131.139520][ T9954] RAX: ffffffffffffffda RBX: 00007fe05d1c5fa0 RCX: 00007fe05cf8ebe9
[  131.139528][ T9954] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000005
[  131.139534][ T9954] RBP: 00007fe05d011e19 R08: 0000000000000000 R09: 0000000000000000
[  131.139540][ T9954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  131.139546][ T9954] R13: 00007fe05d1c6038 R14: 00007fe05d1c5fa0 R15: 00007ffe53b92ce8
[  131.139567][ T9954]  </TASK>
[  131.365931][ T9945] tipc: Resetting bearer <eth:syzkaller0>
[  131.376988][ T9945] tipc: Disabling bearer <eth:syzkaller0>
[  131.496320][ T9964] netlink: 14 bytes leftover after parsing attributes in process `syz.2.862'.
[  132.028466][ T9982] 8021q: adding VLAN 0 to HW filter on device bond6
[  132.032377][ T9982] mac80211_hwsim hwsim6 wlan0: left promiscuous mode
[  132.037465][ T9982] bond6: (slave wlan0): Enslaving as an active interface with a down link
[  132.047223][ T9982] vlan2: entered allmulticast mode
[  132.049288][ T9982] bond6: (slave vlan2): Opening slave failed
[  132.388491][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  132.393188][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  132.615433][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[  132.618128][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[  132.631135][T10066] mac80211_hwsim hwsim157 wlan1: left allmulticast mode
[  132.643283][T10066] validate_nla: 6 callbacks suppressed
[  132.643292][T10066] netlink: 'syz.1.880': attribute type 10 has an invalid length.
[  132.649221][T10068] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  132.655687][T10068] CPU: 0 UID: 0 PID: 10068 Comm: syz.2.881 Not tainted syzkaller #0 PREEMPT(full) 
[  132.655698][T10068] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  132.655703][T10068] Call Trace:
[  132.655706][T10068]  <TASK>
[  132.655709][T10068]  dump_stack_lvl+0x189/0x250
[  132.655725][T10068]  ? __pfx_dump_stack_lvl+0x10/0x10
[  132.655734][T10068]  ? __pfx__printk+0x10/0x10
[  132.655747][T10068]  ? kernfs_path_from_node+0x2f/0x290
[  132.655755][T10068]  ? kernfs_path_from_node+0x250/0x290
[  132.655762][T10068]  ? kernfs_path_from_node+0x2f/0x290
[  132.655771][T10068]  sysfs_warn_dup+0x8e/0xa0
[  132.655780][T10068]  sysfs_do_create_link_sd+0xc0/0x110
[  132.655788][T10068]  device_add_class_symlinks+0x1cf/0x240
[  132.655798][T10068]  device_add+0x475/0xb50
[  132.655808][T10068]  wiphy_register+0x1ba6/0x28d0
[  132.655829][T10068]  ? __pfx_wiphy_register+0x10/0x10
[  132.655843][T10068]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  132.655860][T10068]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  132.655875][T10068]  ieee80211_register_hw+0x3425/0x4080
[  132.655898][T10068]  ? ieee80211_register_hw+0x1461/0x4080
[  132.655918][T10068]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  132.655935][T10068]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  132.655957][T10068]  ? __hrtimer_setup+0x187/0x210
[  132.655967][T10068]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  132.655987][T10068]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  132.656022][T10068]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  132.656035][T10068]  ? trace_kmalloc+0x1f/0xd0
[  132.656048][T10068]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  132.656060][T10068]  ? kstrndup+0xbf/0x160
[  132.656080][T10068]  hwsim_new_radio_nl+0xea4/0x1b10
[  132.656098][T10068]  ? __pfx___nla_validate_parse+0x10/0x10
[  132.656127][T10068]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  132.656151][T10068]  ? __nla_parse+0x40/0x60
[  132.656170][T10068]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  132.656192][T10068]  genl_family_rcv_msg_doit+0x215/0x300
[  132.656220][T10068]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  132.656242][T10068]  ? bpf_lsm_capable+0x9/0x20
[  132.656276][T10068]  ? security_capable+0x7e/0x2e0
[  132.656291][T10068]  genl_rcv_msg+0x60e/0x790
[  132.656302][T10068]  ? __pfx_genl_rcv_msg+0x10/0x10
[  132.656309][T10068]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  132.656325][T10068]  netlink_rcv_skb+0x208/0x470
[  132.656334][T10068]  ? __lock_acquire+0xab9/0xd20
[  132.656345][T10068]  ? __pfx_genl_rcv_msg+0x10/0x10
[  132.656356][T10068]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  132.656374][T10068]  ? down_read+0x1ad/0x2e0
[  132.656382][T10068]  genl_rcv+0x28/0x40
[  132.656389][T10068]  netlink_unicast+0x82f/0x9e0
[  132.656402][T10068]  ? __pfx_netlink_unicast+0x10/0x10
[  132.656411][T10068]  ? netlink_sendmsg+0x642/0xb30
[  132.656417][T10068]  ? skb_put+0x11b/0x210
[  132.656426][T10068]  netlink_sendmsg+0x805/0xb30
[  132.656436][T10068]  ? __pfx_netlink_sendmsg+0x10/0x10
[  132.656443][T10068]  ? aa_sock_msg_perm+0xf1/0x1d0
[  132.656451][T10068]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  132.656458][T10068]  ? __pfx_netlink_sendmsg+0x10/0x10
[  132.656464][T10068]  __sock_sendmsg+0x21c/0x270
[  132.656475][T10068]  ____sys_sendmsg+0x505/0x830
[  132.656484][T10068]  ? __pfx_____sys_sendmsg+0x10/0x10
[  132.656495][T10068]  ? import_iovec+0x74/0xa0
[  132.656505][T10068]  ___sys_sendmsg+0x21f/0x2a0
[  132.656513][T10068]  ? __pfx____sys_sendmsg+0x10/0x10
[  132.656536][T10068]  ? __fget_files+0x2a/0x420
[  132.656542][T10068]  ? __fget_files+0x3a0/0x420
[  132.656552][T10068]  __x64_sys_sendmsg+0x19b/0x260
[  132.656561][T10068]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  132.656572][T10068]  ? rcu_is_watching+0x15/0xb0
[  132.656581][T10068]  ? do_syscall_64+0xbe/0x3b0
[  132.656589][T10068]  do_syscall_64+0xfa/0x3b0
[  132.656595][T10068]  ? lockdep_hardirqs_on+0x9c/0x150
[  132.656603][T10068]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  132.656610][T10068]  ? exc_page_fault+0x9f/0xf0
[  132.656620][T10068]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  132.656626][T10068] RIP: 0033:0x7fe05cf8ebe9
[  132.656634][T10068] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  132.656640][T10068] RSP: 002b:00007fe05dee1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  132.656648][T10068] RAX: ffffffffffffffda RBX: 00007fe05d1c5fa0 RCX: 00007fe05cf8ebe9
[  132.656653][T10068] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000004
[  132.656658][T10068] RBP: 00007fe05d011e19 R08: 0000000000000000 R09: 0000000000000000
[  132.656662][T10068] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  132.656666][T10068] R13: 00007fe05d1c6038 R14: 00007fe05d1c5fa0 R15: 00007ffe53b92ce8
[  132.656677][T10068]  </TASK>
[  132.876012][T10072] netlink: 'syz.2.882': attribute type 9 has an invalid length.
[  132.918880][T10076] __nla_validate_parse: 1 callbacks suppressed
[  132.918894][T10076] netlink: 12440 bytes leftover after parsing attributes in process `syz.1.883'.
[  133.028845][T10085] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  133.080620][T10089] netlink: 11 bytes leftover after parsing attributes in process `syz.1.887'.
[  133.293991][T10086] netlink: 1284 bytes leftover after parsing attributes in process `syz.2.884'.
[  133.707182][T10119] syzkaller0: entered promiscuous mode
[  133.711563][T10119] syzkaller0: entered allmulticast mode
[  133.745109][T10129] netlink: 'syz.1.891': attribute type 8 has an invalid length.
[  134.034290][T10152] netlink: 28 bytes leftover after parsing attributes in process `syz.0.895'.
[  134.039388][T10152] netlink: 28 bytes leftover after parsing attributes in process `syz.0.895'.
[  134.068441][T10152] syz_tun: entered promiscuous mode
[  134.084123][T10152] syz_tun: left promiscuous mode
[  134.257346][T10148] netlink: 4 bytes leftover after parsing attributes in process `syz.2.894'.
[  134.496048][T10171] netlink: 'syz.0.898': attribute type 10 has an invalid length.
[  134.505115][T10171] mac80211_hwsim hwsim195 wlan1: entered allmulticast mode
[  134.595494][T10184] netlink: 12 bytes leftover after parsing attributes in process `syz.1.901'.
[  134.599409][T10180] netlink: 12 bytes leftover after parsing attributes in process `syz.1.901'.
[  134.696389][T10183] bond0: default FDB implementation only supports local addresses
[  134.786410][T10198] netdevsim netdevsim1 netdevsim0: left allmulticast mode
[  134.804156][T10199] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  134.876118][T10202] netlink: 14 bytes leftover after parsing attributes in process `syz.1.904'.
[  134.977438][T10202] bond0 (unregistering): Released all slaves
[  135.090603][T10212] netlink: 4 bytes leftover after parsing attributes in process `syz.1.905'.
[  135.289724][T10217] netlink: 'syz.2.907': attribute type 2 has an invalid length.
[  136.122955][T10225] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  136.125441][T10225] Bluetooth: hci1: Error when powering off device on rfkill (-4)
[  136.469964][T10278] netlink: 'syz.2.915': attribute type 10 has an invalid length.
[  136.476953][T10278] mac80211_hwsim hwsim97 wlan1: entered allmulticast mode
[  136.559017][T10290] netlink: 'syz.1.918': attribute type 1 has an invalid length.
[  136.563430][T10290] netlink: 'syz.1.918': attribute type 1 has an invalid length.
[  136.563787][T10287] netlink: 'syz.2.917': attribute type 10 has an invalid length.
[  136.573904][T10288] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  136.577470][T10288] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  137.568799][T10357] mac80211_hwsim hwsim195 wlan1: left allmulticast mode
[  137.636574][T10361] netlink: 'syz.2.927': attribute type 11 has an invalid length.
[  137.723252][T10360] netlink: 'syz.2.927': attribute type 11 has an invalid length.
[  137.883729][T10386] ip6gre1: entered allmulticast mode
[  137.927815][T10390] __nla_validate_parse: 6 callbacks suppressed
[  137.927829][T10390] netlink: 56 bytes leftover after parsing attributes in process `syz.1.933'.
[  138.009472][T10397] netlink: 8 bytes leftover after parsing attributes in process `syz.1.933'.
[  138.014312][T10397] netlink: 24 bytes leftover after parsing attributes in process `syz.1.933'.
[  138.244696][T10419] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[  138.247753][T10419] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  138.309536][T10431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.942'.
[  138.323595][T10432] mac80211_hwsim hwsim97 wlan1: left allmulticast mode
[  138.327240][T10431] netlink: 'syz.0.942': attribute type 10 has an invalid length.
[  138.330753][T10432] netlink: 'syz.2.941': attribute type 10 has an invalid length.
[  138.391271][T10440] netlink: 8 bytes leftover after parsing attributes in process `syz.0.944'.
[  138.472072][T10446] netlink: 14 bytes leftover after parsing attributes in process `syz.2.945'.
[  138.959571][T10459] tipc: Enabling <ib:lo> not permitted
[  138.962211][T10459] tipc: Enabling of bearer <ib:lo> rejected, failed to enable media
[  139.767927][T10476] netlink: 132 bytes leftover after parsing attributes in process `syz.0.951'.
[  139.775601][T10476] netlink: 248 bytes leftover after parsing attributes in process `syz.0.951'.
[  139.829632][T10478] netlink: 48 bytes leftover after parsing attributes in process `syz.1.952'.
[  140.372846][T10486] netlink: 16 bytes leftover after parsing attributes in process `syz.2.953'.
[  140.663750][T10502] lo speed is unknown, defaulting to 1000
[  140.666448][T10502] lo speed is unknown, defaulting to 1000
[  140.674320][T10502] lo speed is unknown, defaulting to 1000
[  140.686086][T10502] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[  140.709846][T10502] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  140.769222][T10502] lo speed is unknown, defaulting to 1000
[  140.775659][T10502] lo speed is unknown, defaulting to 1000
[  140.782209][T10502] lo speed is unknown, defaulting to 1000
[  140.785277][T10502] lo speed is unknown, defaulting to 1000
[  140.857627][T10515] lo speed is unknown, defaulting to 1000
[  141.385700][T10542] netlink: 'syz.1.968': attribute type 10 has an invalid length.
[  141.652697][T10547] lo speed is unknown, defaulting to 1000
[  142.053834][T10553] netlink: 'syz.0.971': attribute type 10 has an invalid length.
[  142.337959][T10571] netlink: 'syz.0.973': attribute type 12 has an invalid length.
[  142.455650][T10578] netlink: 'syz.1.977': attribute type 1 has an invalid length.
[  142.458914][T10578] netlink: 'syz.1.977': attribute type 1 has an invalid length.
[  142.462697][T10579] netlink: 'syz.1.977': attribute type 1 has an invalid length.
[  142.466025][T10579] netlink: 'syz.1.977': attribute type 1 has an invalid length.
[  142.480841][T10583] netlink: 'syz.0.978': attribute type 1 has an invalid length.
[  142.511356][T10581] 8021q: adding VLAN 0 to HW filter on device bond7
[  142.526449][T10581] veth9: entered promiscuous mode
[  142.558969][T10579] 8021q: adding VLAN 0 to HW filter on device bond0
[  142.563572][T10578] bond0: (slave wlan0): Opening slave failed
[  142.566543][T10579] bond0: (slave wlan0): Opening slave failed
[  142.569639][T10589] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[  142.583611][T10578] vlan2: entered allmulticast mode
[  142.585805][T10578] veth1: entered allmulticast mode
[  142.588331][T10578] bond0: (slave vlan2): Opening slave failed
[  142.602504][T10579] vlan2: entered allmulticast mode
[  142.604965][T10579] bond0: (slave vlan2): Opening slave failed
[  143.212034][T10610] __nla_validate_parse: 6 callbacks suppressed
[  143.212049][T10610] netlink: 8 bytes leftover after parsing attributes in process `syz.2.985'.
[  143.679289][T10616] 8021q: adding VLAN 0 to HW filter on device bond2
[  143.703813][T10616] 8021q: adding VLAN 0 to HW filter on device macvlan6
[  143.712929][T10616] bond2: (slave macvlan6): Enslaving as a backup interface with a down link
[  143.727942][T10616] bond6: (slave wlan0): Releasing active interface
[  143.728621][T10624] validate_nla: 2 callbacks suppressed
[  143.728633][T10624] netlink: 'syz.2.989': attribute type 12 has an invalid length.
[  143.745492][T10616] bond2: (slave macvlan6): Releasing backup interface
[  143.772948][T10629] tipc: Can't bind to reserved service type 1
[  143.803977][T10619] netlink: 4 bytes leftover after parsing attributes in process `syz.1.988'.
[  143.917534][T10640] netlink: 14 bytes leftover after parsing attributes in process `syz.1.992'.
[  143.993597][T10644] lo speed is unknown, defaulting to 1000
[  144.074149][T10652] lo speed is unknown, defaulting to 1000
[  144.297912][T10644] netlink: 'syz.2.993': attribute type 2 has an invalid length.
[  144.306922][T10644] netlink: 64 bytes leftover after parsing attributes in process `syz.2.993'.
[  144.317187][T10664] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.996'.
[  144.412805][T10666] netlink: 'syz.1.997': attribute type 8 has an invalid length.
[  144.440476][T10668] tap0: tun_chr_ioctl cmd 1074812118
[  144.632689][T10682] netlink: 'syz.1.1004': attribute type 6 has an invalid length.
[  144.662421][T10682] netlink: 'syz.1.1004': attribute type 12 has an invalid length.
[  144.672328][T10682] netlink: 9472 bytes leftover after parsing attributes in process `syz.1.1004'.
[  144.871694][T10695] lo speed is unknown, defaulting to 1000
[  144.883842][T10696] lo speed is unknown, defaulting to 1000
[  145.126202][T10695] netlink: 'syz.1.1005': attribute type 2 has an invalid length.
[  145.135911][T10695] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1005'.
[  145.418545][T10714] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1007'.
[  145.719323][T10726] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1009'.
[  145.813678][T10731] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT
[  145.826571][T10732] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT
[  145.900252][T10742] netlink: 'syz.1.1013': attribute type 1 has an invalid length.
[  145.916228][T10742] netlink: 'syz.1.1013': attribute type 1 has an invalid length.
[  145.999978][T10753] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1014'.
[  146.078350][T10742] netlink: 'syz.1.1013': attribute type 1 has an invalid length.
[  146.099260][T10742] 8021q: adding VLAN 0 to HW filter on device bond3
[  146.106704][T10742] bond3: (slave wlan0): Opening slave failed
[  146.275028][T10769] netlink: 'syz.0.1018': attribute type 12 has an invalid length.
[  146.760785][T10788] 8021q: adding VLAN 0 to HW filter on device bond4
[  146.805264][T10791] netdevsim netdevsim1 netdevsim0: entered allmulticast mode
[  146.899504][T10795] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  146.903220][T10795] syzkaller0: entered promiscuous mode
[  146.905496][T10795] syzkaller0: entered allmulticast mode
[  146.914277][T10795] tipc: Resetting bearer <eth:syzkaller0>
[  146.924777][T10794] tipc: Resetting bearer <eth:syzkaller0>
[  146.935530][T10794] tipc: Disabling bearer <eth:syzkaller0>
[  147.039686][T10806] lo speed is unknown, defaulting to 1000
[  147.429667][T10826] mac80211_hwsim hwsim144 wlan0: entered promiscuous mode
[  147.436935][T10826] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  147.514637][T10829] ieee802154 phy0 wpan0: encryption failed: -22
[  147.534284][T10829] team0: Mode changed to "loadbalance"
[  147.556528][T10835] netlink: ct family unspecified
[  147.558645][T10835] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  147.888012][T10866] mac80211_hwsim hwsim222 wlan1: entered allmulticast mode
[  148.099477][T10886] veth11: entered promiscuous mode
[  148.129614][T10882] netdevsim netdevsim2 netdevsim0: left promiscuous mode
[  148.135680][T10882] netdevsim netdevsim2 netdevsim0: left allmulticast mode
[  148.138367][T10882] mac80211_hwsim hwsim4 wlan0: left promiscuous mode
[  148.143729][T10882] vlan2: left allmulticast mode
[  148.145342][T10882] veth1: left allmulticast mode
[  148.147236][T10882] ip6gre1: left allmulticast mode
[  148.204689][T10895] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  148.249363][T10902] __nla_validate_parse: 10 callbacks suppressed
[  148.249377][T10902] netlink: 248 bytes leftover after parsing attributes in process `syz.1.1054'.
[  148.267624][T10905] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1055'.
[  148.275105][T10905] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1055'.
[  148.376691][T10913] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1056'.
[  148.384064][T10915] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  148.817850][T10936] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  148.873299][T10939] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1063'.
[  148.935233][T10944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1064'.
[  148.973771][T10944] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1064'.
[  148.986681][T10944] hsr_slave_0: left promiscuous mode
[  148.990468][T10944] hsr_slave_1: left promiscuous mode
[  149.269906][T10964] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1068'.
[  149.513505][T10976] ieee802154 phy0 wpan0: encryption failed: -22
[  149.650577][T10986] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1073'.
[  149.683495][T10989] mac80211_hwsim hwsim222 wlan1: left allmulticast mode
[  149.690501][T10989] validate_nla: 12 callbacks suppressed
[  149.690515][T10989] netlink: 'syz.0.1074': attribute type 10 has an invalid length.
[  149.698059][T10989] mac80211_hwsim hwsim222 wlan1: entered allmulticast mode
[  149.731526][T10991] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1075'.
[  149.740552][T10993] netlink: 'syz.1.1076': attribute type 1 has an invalid length.
[  149.799382][T10994] bond5: (slave ip6gretap1): Enslaving as a backup interface with an up link
[  149.813787][T10994] netlink: 'syz.1.1076': attribute type 30 has an invalid length.
[  149.888792][T11002] netlink: 'syz.0.1077': attribute type 8 has an invalid length.
[  150.325692][T11036] mac80211_hwsim hwsim222 wlan1: left allmulticast mode
[  150.340522][T11036] netlink: 'syz.0.1084': attribute type 10 has an invalid length.
[  150.355876][T11036] mac80211_hwsim hwsim222 wlan1: entered allmulticast mode
[  150.499952][T11051] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  150.545398][T11051] can: request_module (can-proto-0) failed.
[  150.548620][T11051] openvswitch: netlink: IP tunnel dst address not specified
[  150.584970][T11054] 8021q: adding VLAN 0 to HW filter on device bond8
[  150.776231][T11068] netlink: 'syz.1.1090': attribute type 10 has an invalid length.
[  150.783952][T11068] mac80211_hwsim hwsim157 wlan1: entered allmulticast mode
[  150.989263][T11077] lo speed is unknown, defaulting to 1000
[  151.401258][T11110] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  151.403851][T11110] CPU: 0 UID: 0 PID: 11110 Comm: syz.1.1101 Not tainted syzkaller #0 PREEMPT(full) 
[  151.403862][T11110] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  151.403867][T11110] Call Trace:
[  151.403870][T11110]  <TASK>
[  151.403875][T11110]  dump_stack_lvl+0x189/0x250
[  151.403890][T11110]  ? __pfx_dump_stack_lvl+0x10/0x10
[  151.403899][T11110]  ? __pfx__printk+0x10/0x10
[  151.403910][T11110]  ? kernfs_path_from_node+0x2f/0x290
[  151.403920][T11110]  ? kernfs_path_from_node+0x250/0x290
[  151.403927][T11110]  ? kernfs_path_from_node+0x2f/0x290
[  151.403936][T11110]  sysfs_warn_dup+0x8e/0xa0
[  151.403943][T11110]  sysfs_do_create_link_sd+0xc0/0x110
[  151.403952][T11110]  device_add_class_symlinks+0x1cf/0x240
[  151.403962][T11110]  device_add+0x475/0xb50
[  151.403972][T11110]  wiphy_register+0x1ba6/0x28d0
[  151.403988][T11110]  ? trace_irq_disable+0x37/0x110
[  151.404004][T11110]  ? __pfx_wiphy_register+0x10/0x10
[  151.404017][T11110]  ? ieee80211_register_hw+0x3023/0x4080
[  151.404028][T11110]  ieee80211_register_hw+0x3425/0x4080
[  151.404043][T11110]  ? ieee80211_register_hw+0x1461/0x4080
[  151.404078][T11110]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  151.404088][T11110]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  151.404101][T11110]  ? __hrtimer_setup+0x187/0x210
[  151.404109][T11110]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  151.404120][T11110]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  151.404141][T11110]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  151.404150][T11110]  ? trace_kmalloc+0x1f/0xd0
[  151.404157][T11110]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  151.404166][T11110]  ? kstrndup+0xbf/0x160
[  151.404177][T11110]  hwsim_new_radio_nl+0xea4/0x1b10
[  151.404188][T11110]  ? __pfx___nla_validate_parse+0x10/0x10
[  151.404204][T11110]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  151.404220][T11110]  ? __nla_parse+0x40/0x60
[  151.404232][T11110]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  151.404244][T11110]  genl_family_rcv_msg_doit+0x215/0x300
[  151.404255][T11110]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  151.404268][T11110]  ? bpf_lsm_capable+0x9/0x20
[  151.404276][T11110]  ? security_capable+0x7e/0x2e0
[  151.404288][T11110]  genl_rcv_msg+0x60e/0x790
[  151.404299][T11110]  ? __pfx_genl_rcv_msg+0x10/0x10
[  151.404306][T11110]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  151.404320][T11110]  netlink_rcv_skb+0x208/0x470
[  151.404329][T11110]  ? __lock_acquire+0xab9/0xd20
[  151.404339][T11110]  ? __pfx_genl_rcv_msg+0x10/0x10
[  151.404347][T11110]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  151.404364][T11110]  ? down_read+0x1ad/0x2e0
[  151.404372][T11110]  genl_rcv+0x28/0x40
[  151.404379][T11110]  netlink_unicast+0x82f/0x9e0
[  151.404391][T11110]  ? __pfx_netlink_unicast+0x10/0x10
[  151.404401][T11110]  ? netlink_sendmsg+0x642/0xb30
[  151.404406][T11110]  ? skb_put+0x11b/0x210
[  151.404414][T11110]  netlink_sendmsg+0x805/0xb30
[  151.404424][T11110]  ? __pfx_netlink_sendmsg+0x10/0x10
[  151.404432][T11110]  ? aa_sock_msg_perm+0xf1/0x1d0
[  151.404439][T11110]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  151.404446][T11110]  ? __pfx_netlink_sendmsg+0x10/0x10
[  151.404452][T11110]  __sock_sendmsg+0x21c/0x270
[  151.404463][T11110]  ____sys_sendmsg+0x505/0x830
[  151.404473][T11110]  ? __pfx_____sys_sendmsg+0x10/0x10
[  151.404484][T11110]  ? import_iovec+0x74/0xa0
[  151.404493][T11110]  ___sys_sendmsg+0x21f/0x2a0
[  151.404502][T11110]  ? __pfx____sys_sendmsg+0x10/0x10
[  151.404523][T11110]  ? __fget_files+0x2a/0x420
[  151.404529][T11110]  ? __fget_files+0x3a0/0x420
[  151.404539][T11110]  __x64_sys_sendmsg+0x19b/0x260
[  151.404548][T11110]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  151.404563][T11110]  ? do_syscall_64+0xbe/0x3b0
[  151.404571][T11110]  do_syscall_64+0xfa/0x3b0
[  151.404576][T11110]  ? lockdep_hardirqs_on+0x9c/0x150
[  151.404585][T11110]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  151.404592][T11110]  ? exc_page_fault+0x9f/0xf0
[  151.404602][T11110]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  151.404608][T11110] RIP: 0033:0x7fcf0738ebe9
[  151.404616][T11110] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  151.404622][T11110] RSP: 002b:00007fcf08147038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  151.404630][T11110] RAX: ffffffffffffffda RBX: 00007fcf075c5fa0 RCX: 00007fcf0738ebe9
[  151.404635][T11110] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005
[  151.404640][T11110] RBP: 00007fcf07411e19 R08: 0000000000000000 R09: 0000000000000000
[  151.404644][T11110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  151.404647][T11110] R13: 00007fcf075c6038 R14: 00007fcf075c5fa0 R15: 00007fffe81f2708
[  151.404659][T11110]  </TASK>
[  151.891821][T11123] bond5: (slave ip6gretap1): Releasing backup interface
[  151.918981][T11125] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  151.922100][T11125] CPU: 1 UID: 0 PID: 11125 Comm: syz.0.1107 Not tainted syzkaller #0 PREEMPT(full) 
[  151.922111][T11125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  151.922116][T11125] Call Trace:
[  151.922119][T11125]  <TASK>
[  151.922122][T11125]  dump_stack_lvl+0x189/0x250
[  151.922138][T11125]  ? __pfx_dump_stack_lvl+0x10/0x10
[  151.922147][T11125]  ? __pfx__printk+0x10/0x10
[  151.922159][T11125]  ? kernfs_path_from_node+0x2f/0x290
[  151.922168][T11125]  ? kernfs_path_from_node+0x250/0x290
[  151.922175][T11125]  ? kernfs_path_from_node+0x2f/0x290
[  151.922185][T11125]  sysfs_warn_dup+0x8e/0xa0
[  151.922193][T11125]  sysfs_do_create_link_sd+0xc0/0x110
[  151.922201][T11125]  device_add_class_symlinks+0x1cf/0x240
[  151.922212][T11125]  device_add+0x475/0xb50
[  151.922221][T11125]  wiphy_register+0x1ba6/0x28d0
[  151.922238][T11125]  ? __pfx_wiphy_register+0x10/0x10
[  151.922247][T11125]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  151.922259][T11125]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  151.922270][T11125]  ieee80211_register_hw+0x3425/0x4080
[  151.922286][T11125]  ? ieee80211_register_hw+0x1461/0x4080
[  151.922297][T11125]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  151.922306][T11125]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  151.922319][T11125]  ? __hrtimer_setup+0x187/0x210
[  151.922327][T11125]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  151.922339][T11125]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  151.922359][T11125]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  151.922367][T11125]  ? trace_kmalloc+0x1f/0xd0
[  151.922374][T11125]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  151.922383][T11125]  ? kstrndup+0xbf/0x160
[  151.922394][T11125]  hwsim_new_radio_nl+0xea4/0x1b10
[  151.922404][T11125]  ? __pfx___nla_validate_parse+0x10/0x10
[  151.922420][T11125]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  151.922434][T11125]  ? __nla_parse+0x40/0x60
[  151.922445][T11125]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  151.922457][T11125]  genl_family_rcv_msg_doit+0x215/0x300
[  151.922467][T11125]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  151.922481][T11125]  ? bpf_lsm_capable+0x9/0x20
[  151.922489][T11125]  ? security_capable+0x7e/0x2e0
[  151.922503][T11125]  genl_rcv_msg+0x60e/0x790
[  151.922514][T11125]  ? __pfx_genl_rcv_msg+0x10/0x10
[  151.922521][T11125]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  151.922536][T11125]  netlink_rcv_skb+0x208/0x470
[  151.922545][T11125]  ? __lock_acquire+0xab9/0xd20
[  151.922555][T11125]  ? __pfx_genl_rcv_msg+0x10/0x10
[  151.922563][T11125]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  151.922580][T11125]  ? down_read+0x1ad/0x2e0
[  151.922588][T11125]  genl_rcv+0x28/0x40
[  151.922594][T11125]  netlink_unicast+0x82f/0x9e0
[  151.922607][T11125]  ? __pfx_netlink_unicast+0x10/0x10
[  151.922617][T11125]  ? netlink_sendmsg+0x642/0xb30
[  151.922622][T11125]  ? skb_put+0x11b/0x210
[  151.922631][T11125]  netlink_sendmsg+0x805/0xb30
[  151.922641][T11125]  ? __pfx_netlink_sendmsg+0x10/0x10
[  151.922648][T11125]  ? aa_sock_msg_perm+0xf1/0x1d0
[  151.922656][T11125]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  151.922663][T11125]  ? __pfx_netlink_sendmsg+0x10/0x10
[  151.922669][T11125]  __sock_sendmsg+0x21c/0x270
[  151.922680][T11125]  ____sys_sendmsg+0x505/0x830
[  151.922690][T11125]  ? __pfx_____sys_sendmsg+0x10/0x10
[  151.922701][T11125]  ? import_iovec+0x74/0xa0
[  151.922711][T11125]  ___sys_sendmsg+0x21f/0x2a0
[  151.922719][T11125]  ? __pfx____sys_sendmsg+0x10/0x10
[  151.922749][T11125]  ? __fget_files+0x2a/0x420
[  151.922756][T11125]  ? __fget_files+0x3a0/0x420
[  151.922767][T11125]  __x64_sys_sendmsg+0x19b/0x260
[  151.922777][T11125]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  151.922789][T11125]  ? rcu_is_watching+0x15/0xb0
[  151.922799][T11125]  ? do_syscall_64+0xbe/0x3b0
[  151.922807][T11125]  do_syscall_64+0xfa/0x3b0
[  151.922813][T11125]  ? lockdep_hardirqs_on+0x9c/0x150
[  151.922823][T11125]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  151.922830][T11125]  ? exc_page_fault+0x9f/0xf0
[  151.922840][T11125]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  151.922846][T11125] RIP: 0033:0x7f172af8ebe9
[  151.922854][T11125] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  151.922860][T11125] RSP: 002b:00007f172bedc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  151.922869][T11125] RAX: ffffffffffffffda RBX: 00007f172b1c5fa0 RCX: 00007f172af8ebe9
[  151.922874][T11125] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000a
[  151.922878][T11125] RBP: 00007f172b011e19 R08: 0000000000000000 R09: 0000000000000000
[  151.922882][T11125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  151.922886][T11125] R13: 00007f172b1c6038 R14: 00007f172b1c5fa0 R15: 00007ffcd6b5ab08
[  151.922898][T11125]  </TASK>
[  151.960712][T11126] ieee802154 phy0 wpan0: encryption failed: -22
[  152.156755][T11130] netlink: 'syz.0.1108': attribute type 8 has an invalid length.
[  152.224449][T11132] netdevsim netdevsim1 netdevsim0: left allmulticast mode
[  152.227631][T11132] mac80211_hwsim hwsim144 wlan0: left promiscuous mode
[  152.229977][T11132] mac80211_hwsim hwsim157 wlan1: left allmulticast mode
[  152.445120][T11149] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  152.489307][T11153] netlink: 'syz.1.1111': attribute type 10 has an invalid length.
[  153.257544][T11169] __nla_validate_parse: 13 callbacks suppressed
[  153.257559][T11169] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1117'.
[  153.629512][T11179] lo speed is unknown, defaulting to 1000
[  153.674278][T11181] lo speed is unknown, defaulting to 1000
[  153.692681][T11105] Set syz1 is full, maxelem 65536 reached
[  153.733934][T11184] netlink: 'syz.1.1120': attribute type 10 has an invalid length.
[  153.858226][T11195] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1123'.
[  153.863254][T11198] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1124'.
[  153.867222][T11195] netlink: 'syz.1.1123': attribute type 10 has an invalid length.
[  154.178824][T11233] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1126'.
[  154.270391][T11239] mac80211_hwsim hwsim157 wlan1: entered allmulticast mode
[  154.507905][T11256] lo speed is unknown, defaulting to 1000
[  154.638636][T11265] netlink: 11 bytes leftover after parsing attributes in process `syz.0.1135'.
[  154.682678][T11265] veth7: left promiscuous mode
[  154.685964][T11265] veth9: left promiscuous mode
[  154.688252][T11265] mac80211_hwsim hwsim222 wlan1: left allmulticast mode
[  154.693675][T11260] validate_nla: 2 callbacks suppressed
[  154.693686][T11260] netlink: 'syz.1.1134': attribute type 1 has an invalid length.
[  154.699804][T11265] veth11: left promiscuous mode
[  154.724407][T11260] 8021q: adding VLAN 0 to HW filter on device bond6
[  154.739501][T11260] vlan2: entered allmulticast mode
[  154.785364][T11270] team0: Mode changed to "broadcast"
[  154.788149][T11270] vlan0: entered promiscuous mode
[  154.844493][T11278] mac80211_hwsim hwsim157 wlan1: left allmulticast mode
[  154.875716][T11278] netlink: 'syz.1.1138': attribute type 10 has an invalid length.
[  154.890471][T11278] mac80211_hwsim hwsim157 wlan1: entered allmulticast mode
[  154.976852][T11288] IPVS: set_ctl: invalid protocol: 51 0.0.0.0:20001
[  155.838515][T11306] netlink: 'syz.2.1146': attribute type 1 has an invalid length.
[  155.851459][T11306] netlink: 'syz.2.1146': attribute type 1 has an invalid length.
[  155.856721][T11306] netlink: 'syz.2.1146': attribute type 1 has an invalid length.
[  155.888661][T11306] 8021q: adding VLAN 0 to HW filter on device bond4
[  155.913239][T11306] bond4: (slave wlan0): Opening slave failed
[  155.923200][T11312] netlink: 'syz.1.1147': attribute type 1 has an invalid length.
[  156.068479][T11321] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  156.153317][T11320] tipc: Disabling bearer <eth:syzkaller0>
[  156.295473][T11332] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1152'.
[  156.303631][T11332] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1152'.
[  156.355504][T11335] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1152'.
[  156.411288][T11332] netlink: 'syz.2.1152': attribute type 8 has an invalid length.
[  156.601885][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1155'.
[  156.605699][T11343] netlink: 'syz.1.1155': attribute type 1 has an invalid length.
[  156.618600][T11343] 8021q: adding VLAN 0 to HW filter on device bond8
[  156.633668][T11343] bond8: (slave geneve2): making interface the new active one
[  156.637571][T11343] bond8: (slave geneve2): Enslaving as an active interface with an up link
[  156.640546][   T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  156.651915][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  156.670737][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  156.675793][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  156.789186][T11341] netlink: 'syz.2.1156': attribute type 12 has an invalid length.
[  156.798380][T11341] netlink: 9472 bytes leftover after parsing attributes in process `syz.2.1156'.
[  156.964797][T11360] netlink: 'syz.1.1161': attribute type 7 has an invalid length.
[  157.024667][T11362] sctp: [Deprecated]: syz.1.1161 (pid 11362) Use of struct sctp_assoc_value in delayed_ack socket option.
[  157.024667][T11362] Use struct sctp_sack_info instead
[  157.644687][T11389] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  157.651109][T11389] CPU: 0 UID: 0 PID: 11389 Comm: syz.1.1164 Not tainted syzkaller #0 PREEMPT(full) 
[  157.651123][T11389] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  157.651128][T11389] Call Trace:
[  157.651132][T11389]  <TASK>
[  157.651135][T11389]  dump_stack_lvl+0x189/0x250
[  157.651150][T11389]  ? __pfx_dump_stack_lvl+0x10/0x10
[  157.651160][T11389]  ? __pfx__printk+0x10/0x10
[  157.651172][T11389]  ? kernfs_path_from_node+0x2f/0x290
[  157.651181][T11389]  ? kernfs_path_from_node+0x250/0x290
[  157.651188][T11389]  ? kernfs_path_from_node+0x2f/0x290
[  157.651197][T11389]  sysfs_warn_dup+0x8e/0xa0
[  157.651206][T11389]  sysfs_do_create_link_sd+0xc0/0x110
[  157.651214][T11389]  device_add_class_symlinks+0x1cf/0x240
[  157.651224][T11389]  device_add+0x475/0xb50
[  157.651233][T11389]  wiphy_register+0x1ba6/0x28d0
[  157.651250][T11389]  ? __pfx_wiphy_register+0x10/0x10
[  157.651259][T11389]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  157.651271][T11389]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  157.651280][T11389]  ieee80211_register_hw+0x3425/0x4080
[  157.651296][T11389]  ? ieee80211_register_hw+0x1461/0x4080
[  157.651308][T11389]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  157.651318][T11389]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  157.651331][T11389]  ? __hrtimer_setup+0x187/0x210
[  157.651338][T11389]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  157.651349][T11389]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  157.651370][T11389]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  157.651378][T11389]  ? trace_kmalloc+0x1f/0xd0
[  157.651387][T11389]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  157.651396][T11389]  ? kstrndup+0xbf/0x160
[  157.651407][T11389]  hwsim_new_radio_nl+0xea4/0x1b10
[  157.651417][T11389]  ? __pfx___nla_validate_parse+0x10/0x10
[  157.651434][T11389]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  157.651447][T11389]  ? __nla_parse+0x40/0x60
[  157.651458][T11389]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  157.651470][T11389]  genl_family_rcv_msg_doit+0x215/0x300
[  157.651481][T11389]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  157.651494][T11389]  ? bpf_lsm_capable+0x9/0x20
[  157.651502][T11389]  ? security_capable+0x7e/0x2e0
[  157.651515][T11389]  genl_rcv_msg+0x60e/0x790
[  157.651526][T11389]  ? __pfx_genl_rcv_msg+0x10/0x10
[  157.651533][T11389]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  157.651548][T11389]  netlink_rcv_skb+0x208/0x470
[  157.651557][T11389]  ? __lock_acquire+0xab9/0xd20
[  157.651566][T11389]  ? __pfx_genl_rcv_msg+0x10/0x10
[  157.651575][T11389]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  157.651592][T11389]  ? down_read+0x1ad/0x2e0
[  157.651600][T11389]  genl_rcv+0x28/0x40
[  157.651607][T11389]  netlink_unicast+0x82f/0x9e0
[  157.651620][T11389]  ? __pfx_netlink_unicast+0x10/0x10
[  157.651629][T11389]  ? netlink_sendmsg+0x642/0xb30
[  157.651635][T11389]  ? skb_put+0x11b/0x210
[  157.651644][T11389]  netlink_sendmsg+0x805/0xb30
[  157.651654][T11389]  ? __pfx_netlink_sendmsg+0x10/0x10
[  157.651661][T11389]  ? aa_sock_msg_perm+0xf1/0x1d0
[  157.651669][T11389]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  157.651676][T11389]  ? __pfx_netlink_sendmsg+0x10/0x10
[  157.651682][T11389]  __sock_sendmsg+0x21c/0x270
[  157.651708][T11389]  ____sys_sendmsg+0x505/0x830
[  157.651719][T11389]  ? __pfx_____sys_sendmsg+0x10/0x10
[  157.651732][T11389]  ? import_iovec+0x74/0xa0
[  157.651742][T11389]  ___sys_sendmsg+0x21f/0x2a0
[  157.651752][T11389]  ? __pfx____sys_sendmsg+0x10/0x10
[  157.651776][T11389]  ? __fget_files+0x2a/0x420
[  157.651783][T11389]  ? __fget_files+0x3a0/0x420
[  157.651794][T11389]  __x64_sys_sendmsg+0x19b/0x260
[  157.651803][T11389]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  157.651815][T11389]  ? rcu_is_watching+0x15/0xb0
[  157.651827][T11389]  ? do_syscall_64+0xbe/0x3b0
[  157.651835][T11389]  do_syscall_64+0xfa/0x3b0
[  157.651841][T11389]  ? lockdep_hardirqs_on+0x9c/0x150
[  157.651850][T11389]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  157.651856][T11389]  ? exc_page_fault+0x9f/0xf0
[  157.651866][T11389]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  157.651873][T11389] RIP: 0033:0x7fcf0738ebe9
[  157.651880][T11389] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  157.651886][T11389] RSP: 002b:00007fcf08147038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  157.651895][T11389] RAX: ffffffffffffffda RBX: 00007fcf075c5fa0 RCX: 00007fcf0738ebe9
[  157.651899][T11389] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  157.651904][T11389] RBP: 00007fcf07411e19 R08: 0000000000000000 R09: 0000000000000000
[  157.651908][T11389] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  157.651912][T11389] R13: 00007fcf075c6038 R14: 00007fcf075c5fa0 R15: 00007fffe81f2708
[  157.651923][T11389]  </TASK>
[  157.849267][T11391] 8021q: adding VLAN 0 to HW filter on device bond2
[  157.858826][T11391] 8021q: adding VLAN 0 to HW filter on device macvlan7
[  157.862707][T11391] bond2: (slave macvlan7): Enslaving as a backup interface with a down link
[  157.869088][T11391] bond2: (slave macvlan7): Releasing backup interface
[  157.900624][T11393] lo speed is unknown, defaulting to 1000
[  158.044236][T11400] 8021q: adding VLAN 0 to HW filter on device bond9
[  158.046787][T11406] mac80211_hwsim hwsim157 wlan1: left allmulticast mode
[  158.106416][T11412] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  158.110191][T11409] syzkaller0: entered promiscuous mode
[  158.113742][T11409] syzkaller0: entered allmulticast mode
[  158.122297][T11411] tipc: Resetting bearer <eth:syzkaller0>
[  158.134139][T11407] tipc: Resetting bearer <eth:syzkaller0>
[  158.146197][T11407] tipc: Disabling bearer <eth:syzkaller0>
[  158.186326][T11413] 8021q: adding VLAN 0 to HW filter on device bond9
[  158.191085][T11413] bond9: (slave wlan0): Opening slave failed
[  158.265352][T11422] 8021q: adding VLAN 0 to HW filter on device bond1
[  158.289412][T11419] vlan0: left promiscuous mode
[  158.307844][T11419] vlan2: left allmulticast mode
[  158.320346][   T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  158.336027][   T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  158.339775][   T13] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  158.344396][   T13] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  158.418755][T11433] netlink: 'syz.1.1177': attribute type 11 has an invalid length.
[  158.484104][T11439] __nla_validate_parse: 8 callbacks suppressed
[  158.484114][T11439] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1181'.
[  158.492620][T11439] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1181'.
[  158.645817][T11451] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  159.455895][T11475] 8021q: adding VLAN 0 to HW filter on device bond1
[  159.473391][T11475] 8021q: adding VLAN 0 to HW filter on device macvlan2
[  159.480754][T11475] bond1: (slave macvlan2): Enslaving as a backup interface with a down link
[  159.494988][T11475] bond8: (slave geneve2): Releasing active interface
[  159.500452][T11475] bond1: (slave macvlan2): Releasing backup interface
[  159.597801][T11480] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  159.619398][T11482] 8021q: adding VLAN 0 to HW filter on device bond2
[  159.705588][T11493] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1194'.
[  159.803506][T11488] validate_nla: 12 callbacks suppressed
[  159.803520][T11488] netlink: 'syz.1.1193': attribute type 1 has an invalid length.
[  159.838702][T11488] 8021q: adding VLAN 0 to HW filter on device bond10
[  159.856994][T11488] bond10: (slave wlan0): Opening slave failed
[  160.014949][T11510] sctp: [Deprecated]: syz.1.1199 (pid 11510) Use of struct sctp_assoc_value in delayed_ack socket option.
[  160.014949][T11510] Use struct sctp_sack_info instead
[  160.017089][T11511] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR
[  160.525091][T11549] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1207'.
[  160.584293][T11556] netlink: 'syz.0.1209': attribute type 10 has an invalid length.
[  160.588627][T11556] mac80211_hwsim hwsim222 wlan1: entered allmulticast mode
[  160.621083][T11559] netlink: 'syz.2.1206': attribute type 10 has an invalid length.
[  160.652024][T11561] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1210'.
[  160.714376][T11563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1211'.
[  160.726257][T11563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1211'.
[  160.829727][T11579] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[  160.838816][T11579] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  161.356725][T11604] netlink: 264 bytes leftover after parsing attributes in process `syz.0.1220'.
[  161.379448][T11604] netlink: 'syz.0.1220': attribute type 22 has an invalid length.
[  161.383904][T11604] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1220'.
[  161.393633][T11602] netlink: 'syz.2.1219': attribute type 8 has an invalid length.
[  161.402368][ T5890] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  161.403621][T11604] netlink: 'syz.0.1220': attribute type 22 has an invalid length.
[  161.408932][T11604] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1220'.
[  161.417474][ T5890] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  161.421896][ T5890] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  161.426560][T11605] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  161.430354][ T5890] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  161.598492][T11617] lo speed is unknown, defaulting to 1000
[  161.609608][T11619] mac80211_hwsim hwsim222 wlan1: left allmulticast mode
[  161.628519][T11619] netlink: 'syz.0.1224': attribute type 10 has an invalid length.
[  161.713277][T11623] syzkaller0: entered promiscuous mode
[  161.716388][T11623] syzkaller0: entered allmulticast mode
[  161.759542][T11626] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  161.811335][T11630] ieee802154 phy0 wpan0: encryption failed: -22
[  161.813620][T11631] ieee802154 phy0 wpan0: encryption failed: -22
[  161.827165][T11631] team0: Mode changed to "loadbalance"
[  162.765366][T11630] team0: Unable to change to the same mode the team is in
[  162.956367][T11643] netlink: 'syz.2.1230': attribute type 12 has an invalid length.
[  162.967770][T11653] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  163.022785][T11655] netlink: 'syz.0.1234': attribute type 1 has an invalid length.
[  163.030061][T11655] netlink: 'syz.0.1234': attribute type 2 has an invalid length.
[  163.325521][T11678] veth12: entered allmulticast mode
[  163.387484][T11682] mac80211_hwsim hwsim6 wlan0: left promiscuous mode
[  163.408329][   T13] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0
[  163.416409][   T13] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0
[  163.468167][T11682] veth12: entered allmulticast mode
[  163.487248][   T13] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0
[  163.493819][   T13] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0
[  163.579357][T11698] lo speed is unknown, defaulting to 1000
[  163.633530][T11701] syzkaller0: entered promiscuous mode
[  163.635585][T11701] syzkaller0: entered allmulticast mode
[  163.673521][T11701] __nla_validate_parse: 9 callbacks suppressed
[  163.673531][T11701] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1245'.
[  163.770273][T11698] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1244'.
[  164.876959][T11715] validate_nla: 3 callbacks suppressed
[  164.876975][T11715] netlink: 'syz.1.1247': attribute type 9 has an invalid length.
[  164.981229][T11730] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1250'.
[  164.986238][T11731] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  164.993713][T11730] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1250'.
[  165.004864][T11733] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1248'.
[  165.142210][T11737] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1252'.
[  165.229594][T11741] netlink: 'syz.2.1253': attribute type 9 has an invalid length.
[  165.343979][T11752] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1255'.
[  165.405807][T11752] ieee802154 phy0 wpan0: encryption failed: -22
[  165.422667][T11752] team0: Mode changed to "loadbalance"
[  165.509819][T11768] netlink: 'syz.1.1257': attribute type 10 has an invalid length.
[  165.525743][T11768] mac80211_hwsim hwsim157 wlan1: entered allmulticast mode
[  166.086474][T11783] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1262'.
[  166.097582][T11783] netlink: 'syz.0.1262': attribute type 10 has an invalid length.
[  166.555972][T11804] netlink: 'syz.0.1267': attribute type 10 has an invalid length.
[  166.576428][T11806] netlink: 'syz.2.1268': attribute type 9 has an invalid length.
[  166.670174][T11808] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  166.679125][T11808] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  166.782149][T11816] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1271'.
[  166.940950][T11821] lo speed is unknown, defaulting to 1000
[  167.051429][T11821] netlink: 'syz.2.1272': attribute type 2 has an invalid length.
[  167.364296][T11840] mac80211_hwsim hwsim157 wlan1: left allmulticast mode
[  167.410484][T11847] syzkaller1: entered allmulticast mode
[  167.639749][T11860] 8021q: adding VLAN 0 to HW filter on device bond1
[  167.656991][T11860] 8021q: adding VLAN 0 to HW filter on device macvlan3
[  167.664232][T11860] bond1: (slave macvlan3): Enslaving as a backup interface with a down link
[  167.927929][T11865] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1282'.
[  167.969831][T11865] lo speed is unknown, defaulting to 1000
[  168.827078][T11893] __nla_validate_parse: 1 callbacks suppressed
[  168.827092][T11893] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1287'.
[  168.927488][T11897] lo speed is unknown, defaulting to 1000
[  169.017039][T11897] netlink: 'syz.1.1288': attribute type 2 has an invalid length.
[  169.024742][T11902] syzkaller0: entered promiscuous mode
[  169.026702][T11902] syzkaller0: entered allmulticast mode
[  169.122839][T11897] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1288'.
[  170.119942][T11912] netlink: 'syz.2.1292': attribute type 1 has an invalid length.
[  170.157710][T11912] openvswitch: netlink: Actions may not be safe on all matching packets
[  170.163194][T11912] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1292'.
[  170.165684][T11915] netlink: 'syz.0.1293': attribute type 1 has an invalid length.
[  170.169631][T11915] netlink: 'syz.0.1293': attribute type 1 has an invalid length.
[  170.177157][T11912] veth5: entered promiscuous mode
[  170.178872][T11915] netlink: 'syz.0.1293': attribute type 1 has an invalid length.
[  170.207648][T11915] 8021q: adding VLAN 0 to HW filter on device bond10
[  170.216914][T11915] bond10: (slave wlan0): Opening slave failed
[  170.224980][T11916] bond10: (slave wlan0): Opening slave failed
[  170.243260][T11915] vlan2: entered allmulticast mode
[  170.246104][T11915] bond10: (slave vlan2): Opening slave failed
[  170.251258][T11920] netlink: 'syz.2.1294': attribute type 9 has an invalid length.
[  170.254557][T11920] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1294'.
[  170.257517][T11916] vlan2: entered allmulticast mode
[  170.262120][T11916] bond10: (slave vlan2): Opening slave failed
[  170.477014][T11938] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1298'.
[  170.603163][T11947] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1298'.
[  170.658947][T11938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1298'.
[  170.737913][T11970] netlink: 'syz.2.1302': attribute type 7 has an invalid length.
[  170.744732][T11970] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1302'.
[  170.763298][T11970] netlink: 'syz.2.1302': attribute type 1 has an invalid length.
[  170.771376][T11965] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1301'.
[  170.788796][T11965] netlink: 'syz.0.1301': attribute type 10 has an invalid length.
[  170.790307][T11974] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1303'.
[  170.792216][T11965] mac80211_hwsim hwsim222 wlan1: entered allmulticast mode
[  170.851674][T11976] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN
[  170.859760][T11979] 8021q: adding VLAN 0 to HW filter on device bond6
[  170.897878][T11978] lo speed is unknown, defaulting to 1000
[  170.915182][T11981] netlink: 'syz.0.1306': attribute type 4 has an invalid length.
[  172.153995][T12016] netlink: 'syz.0.1314': attribute type 16 has an invalid length.
[  172.166717][T12017] bond1: (slave macvlan3): Releasing backup interface
[  172.548907][T12042] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  172.561431][T12042] CPU: 1 UID: 0 PID: 12042 Comm: syz.2.1318 Not tainted syzkaller #0 PREEMPT(full) 
[  172.561444][T12042] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  172.561449][T12042] Call Trace:
[  172.561452][T12042]  <TASK>
[  172.561456][T12042]  dump_stack_lvl+0x189/0x250
[  172.561470][T12042]  ? __pfx_dump_stack_lvl+0x10/0x10
[  172.561478][T12042]  ? __pfx__printk+0x10/0x10
[  172.561491][T12042]  ? kernfs_path_from_node+0x2f/0x290
[  172.561499][T12042]  ? kernfs_path_from_node+0x250/0x290
[  172.561505][T12042]  ? kernfs_path_from_node+0x2f/0x290
[  172.561515][T12042]  sysfs_warn_dup+0x8e/0xa0
[  172.561523][T12042]  sysfs_do_create_link_sd+0xc0/0x110
[  172.561533][T12042]  device_add_class_symlinks+0x1cf/0x240
[  172.561542][T12042]  device_add+0x475/0xb50
[  172.561557][T12042]  wiphy_register+0x1ba6/0x28d0
[  172.561575][T12042]  ? __pfx_wiphy_register+0x10/0x10
[  172.561584][T12042]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  172.561596][T12042]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  172.561606][T12042]  ieee80211_register_hw+0x3425/0x4080
[  172.561622][T12042]  ? ieee80211_register_hw+0x1461/0x4080
[  172.561634][T12042]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  172.561643][T12042]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  172.561657][T12042]  ? __hrtimer_setup+0x187/0x210
[  172.561663][T12042]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  172.561674][T12042]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  172.561695][T12042]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  172.561703][T12042]  ? trace_kmalloc+0x1f/0xd0
[  172.561710][T12042]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  172.561719][T12042]  ? kstrndup+0xbf/0x160
[  172.561730][T12042]  hwsim_new_radio_nl+0xea4/0x1b10
[  172.561740][T12042]  ? __pfx___nla_validate_parse+0x10/0x10
[  172.561757][T12042]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  172.561771][T12042]  ? __nla_parse+0x40/0x60
[  172.561783][T12042]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  172.561795][T12042]  genl_family_rcv_msg_doit+0x215/0x300
[  172.561808][T12042]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  172.561843][T12042]  ? bpf_lsm_capable+0x9/0x20
[  172.561855][T12042]  ? security_capable+0x7e/0x2e0
[  172.561868][T12042]  genl_rcv_msg+0x60e/0x790
[  172.561879][T12042]  ? __pfx_genl_rcv_msg+0x10/0x10
[  172.561887][T12042]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  172.561902][T12042]  netlink_rcv_skb+0x208/0x470
[  172.561912][T12042]  ? __lock_acquire+0xab9/0xd20
[  172.561923][T12042]  ? __pfx_genl_rcv_msg+0x10/0x10
[  172.561933][T12042]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  172.561950][T12042]  ? down_read+0x1ad/0x2e0
[  172.561958][T12042]  genl_rcv+0x28/0x40
[  172.561965][T12042]  netlink_unicast+0x82f/0x9e0
[  172.561978][T12042]  ? __pfx_netlink_unicast+0x10/0x10
[  172.561987][T12042]  ? netlink_sendmsg+0x642/0xb30
[  172.561992][T12042]  ? skb_put+0x11b/0x210
[  172.562001][T12042]  netlink_sendmsg+0x805/0xb30
[  172.562011][T12042]  ? __pfx_netlink_sendmsg+0x10/0x10
[  172.562019][T12042]  ? aa_sock_msg_perm+0xf1/0x1d0
[  172.562026][T12042]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  172.562034][T12042]  ? __pfx_netlink_sendmsg+0x10/0x10
[  172.562041][T12042]  __sock_sendmsg+0x21c/0x270
[  172.562052][T12042]  ____sys_sendmsg+0x505/0x830
[  172.562061][T12042]  ? __pfx_____sys_sendmsg+0x10/0x10
[  172.562072][T12042]  ? import_iovec+0x74/0xa0
[  172.562081][T12042]  ___sys_sendmsg+0x21f/0x2a0
[  172.562090][T12042]  ? __pfx____sys_sendmsg+0x10/0x10
[  172.562111][T12042]  ? __fget_files+0x2a/0x420
[  172.562118][T12042]  ? __fget_files+0x3a0/0x420
[  172.562128][T12042]  __x64_sys_sendmsg+0x19b/0x260
[  172.562140][T12042]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  172.562162][T12042]  ? do_syscall_64+0xbe/0x3b0
[  172.562175][T12042]  do_syscall_64+0xfa/0x3b0
[  172.562185][T12042]  ? lockdep_hardirqs_on+0x9c/0x150
[  172.562203][T12042]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  172.562214][T12042]  ? exc_page_fault+0x9f/0xf0
[  172.562232][T12042]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  172.562244][T12042] RIP: 0033:0x7fe05cf8ebe9
[  172.562256][T12042] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  172.562267][T12042] RSP: 002b:00007fe05dee1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  172.562281][T12042] RAX: ffffffffffffffda RBX: 00007fe05d1c5fa0 RCX: 00007fe05cf8ebe9
[  172.562287][T12042] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000006
[  172.562292][T12042] RBP: 00007fe05d011e19 R08: 0000000000000000 R09: 0000000000000000
[  172.562296][T12042] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  172.562301][T12042] R13: 00007fe05d1c6038 R14: 00007fe05d1c5fa0 R15: 00007ffe53b92ce8
[  172.562313][T12042]  </TASK>
[  172.929015][T12058] lo speed is unknown, defaulting to 1000
[  173.017982][T12065] lo speed is unknown, defaulting to 1000
[  173.344376][T12089] sctp: [Deprecated]: syz.1.1329 (pid 12089) Use of struct sctp_assoc_value in delayed_ack socket option.
[  173.344376][T12089] Use struct sctp_sack_info instead
[  173.527455][T12104] lo speed is unknown, defaulting to 1000
[  174.199306][T12151] 8021q: adding VLAN 0 to HW filter on device bond7
[  174.216521][T12151] veth7: entered promiscuous mode
[  174.222751][T12151] bond7: (slave veth7): Enslaving as a backup interface with a down link
[  174.231621][T12151] bond7: (slave veth7): Releasing backup interface
[  174.357624][T12159] can: request_module (can-proto-4) failed.
[  174.419215][T12168] mac80211_hwsim hwsim242 wlan1: entered allmulticast mode
[  174.471658][T12170] __nla_validate_parse: 12 callbacks suppressed
[  174.471673][T12170] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1344'.
[  174.478342][T12170] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1344'.
[  174.809680][T12192] lo speed is unknown, defaulting to 1000
[  174.852763][T12191] af_packet: tpacket_rcv: packet too big, clamped from 2 to 4294967272. macoff=96
[  174.959134][T12201] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1351'.
[  175.000426][T12203] lo speed is unknown, defaulting to 1000
[  175.311489][T12212] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1353'.
[  175.430044][T12216] netlink: 232 bytes leftover after parsing attributes in process `syz.0.1355'.
[  175.436307][T12216] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1355'.
[  175.483323][T12216] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1355'.
[  175.615187][T12235] validate_nla: 5 callbacks suppressed
[  175.615203][T12235] netlink: 'syz.2.1359': attribute type 1 has an invalid length.
[  175.655943][T12235] netlink: 'syz.2.1359': attribute type 12 has an invalid length.
[  175.717100][T12239] netlink: 'syz.1.1360': attribute type 4 has an invalid length.
[  175.728391][T12239] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1360'.
[  175.736812][T12239] netlink: 'syz.1.1360': attribute type 10 has an invalid length.
[  175.747309][T12239] mac80211_hwsim hwsim157 wlan1: entered allmulticast mode
[  175.757341][T12231] netlink: 'syz.0.1358': attribute type 10 has an invalid length.
[  175.767536][T12244] netlink: 'syz.2.1361': attribute type 1 has an invalid length.
[  175.771045][T12244] netlink: 'syz.2.1361': attribute type 1 has an invalid length.
[  175.848256][T12251] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1363'.
[  175.851631][T12254] netlink: 'syz.0.1364': attribute type 1 has an invalid length.
[  175.854257][T12254] netlink: 'syz.0.1364': attribute type 1 has an invalid length.
[  175.880531][T12251] netlink: 'syz.2.1363': attribute type 10 has an invalid length.
[  175.892876][T12251] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  175.896528][T12251] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  175.909625][T12256] syz.1.1365 (12256) used obsolete PPPIOCDETACH ioctl
[  175.938580][T12258] 8021q: adding VLAN 0 to HW filter on device bond11
[  175.947727][T12254] bond11: (slave wlan0): Opening slave failed
[  175.985068][T12263] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1366'.
[  176.192928][T12283] syz.1.1370 uses old SIOCAX25GETINFO
[  176.927224][T12319] mac80211_hwsim hwsim157 wlan1: left allmulticast mode
[  177.038538][T12326] 8021q: adding VLAN 0 to HW filter on device bond8
[  177.047483][T12326] 8021q: adding VLAN 0 to HW filter on device bond8
[  177.051603][T12326] bond8: (slave wlan0): Opening slave failed
[  177.145448][T12345] netlink: 'syz.2.1386': attribute type 11 has an invalid length.
[  177.426567][T12354] mac80211_hwsim hwsim242 wlan1: left allmulticast mode
[  177.486878][T12354] mac80211_hwsim hwsim242 wlan1: entered allmulticast mode
[  177.760583][T12388] lo speed is unknown, defaulting to 1000
[  177.907986][T12409] lo speed is unknown, defaulting to 1000
[  178.007310][T12420] mac80211_hwsim hwsim242 wlan1: left allmulticast mode
[  179.008041][T12455] syzkaller1: entered promiscuous mode
[  179.010176][T12455] syzkaller1: entered allmulticast mode
[  179.234399][T12474] tipc: Started in network mode
[  179.236230][T12474] tipc: Node identity 325e6ab40183, cluster identity 4711
[  179.241470][T12474] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  179.248991][T12474] syzkaller0: entered promiscuous mode
[  179.258947][T12474] syzkaller0: entered allmulticast mode
[  179.277409][T12471] tipc: Resetting bearer <eth:syzkaller0>
[  179.297351][T12471] tipc: Disabling bearer <eth:syzkaller0>
[  179.566202][T12498] 8021q: adding VLAN 0 to HW filter on device bond11
[  179.587952][T12498] bond11: (slave wlan0): Opening slave failed
[  179.684629][T12510] bond1: option mode: unable to set because the bond device is up
[  180.044928][T12545] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[  180.047617][T12545] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  180.420375][T12585] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  180.467718][T12589] __nla_validate_parse: 24 callbacks suppressed
[  180.467727][T12589] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1431'.
[  180.651774][T12598] validate_nla: 29 callbacks suppressed
[  180.651784][T12598] netlink: 'syz.0.1433': attribute type 1 has an invalid length.
[  180.668506][T12598] 8021q: adding VLAN 0 to HW filter on device bond12
[  180.743463][T12607] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1434'.
[  180.873397][T12617] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1437'.
[  180.985889][T12629] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1439'.
[  181.020235][T12632] batadv_slave_0: entered promiscuous mode
[  181.023774][T12632] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check.
[  181.094084][T12634] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1441'.
[  181.173080][T12639] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1443'.
[  181.412154][T12650] netlink: 'syz.0.1445': attribute type 8 has an invalid length.
[  181.495242][T12665] mac80211_hwsim hwsim328 wlan1: entered allmulticast mode
[  181.540236][T12671] netlink: 'syz.0.1448': attribute type 1 has an invalid length.
[  181.544428][T12671] netlink: 'syz.0.1448': attribute type 1 has an invalid length.
[  181.866542][T12683] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1454'.
[  182.064511][T12691] netlink: 248 bytes leftover after parsing attributes in process `syz.1.1457'.
[  182.119008][T12693] netlink: 'syz.2.1456': attribute type 27 has an invalid length.
[  182.155142][T12695] netlink: 'syz.2.1458': attribute type 38 has an invalid length.
[  182.159941][T12695] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  182.324228][T12711] lo speed is unknown, defaulting to 1000
[  182.364419][T12714] netlink: 'syz.1.1462': attribute type 4 has an invalid length.
[  182.437893][T12715] netlink: 'syz.2.1461': attribute type 2 has an invalid length.
[  182.924638][T12725] netlink: 'syz.0.1463': attribute type 10 has an invalid length.
[  183.217535][T12731] ieee802154 phy0 wpan0: encryption failed: -22
[  183.311831][T12733] netlink: 'syz.2.1467': attribute type 10 has an invalid length.
[  183.316989][T12733] mac80211_hwsim hwsim242 wlan1: entered allmulticast mode
[  183.404393][T12741] netlink: 27 bytes leftover after parsing attributes in process `syz.2.1469'.
[  183.453271][T12747] 8021q: adding VLAN 0 to HW filter on device bond1
[  183.458083][T12747] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1470'.
[  183.516318][T12751] lo speed is unknown, defaulting to 1000
[  183.787676][T12764] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048)
[  183.824190][T12768] lo speed is unknown, defaulting to 1000
[  184.445783][T12818] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  184.483685][T12818] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  184.781233][T12841] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  184.784739][T12841] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  185.371600][T12858] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[  185.374779][T12858] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  185.500579][T12863] bond9: (slave gretap1): making interface the new active one
[  185.506146][T12863] bond9: (slave gretap1): Enslaving as an active interface with an up link
[  185.514083][T12869] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  185.517416][T12869] CPU: 1 UID: 0 PID: 12869 Comm: syz.1.1499 Not tainted syzkaller #0 PREEMPT(full) 
[  185.517431][T12869] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  185.517437][T12869] Call Trace:
[  185.517441][T12869]  <TASK>
[  185.517447][T12869]  dump_stack_lvl+0x189/0x250
[  185.517467][T12869]  ? __pfx_dump_stack_lvl+0x10/0x10
[  185.517480][T12869]  ? __pfx__printk+0x10/0x10
[  185.517499][T12869]  ? kernfs_path_from_node+0x2f/0x290
[  185.517511][T12869]  ? kernfs_path_from_node+0x250/0x290
[  185.517522][T12869]  ? kernfs_path_from_node+0x2f/0x290
[  185.517536][T12869]  sysfs_warn_dup+0x8e/0xa0
[  185.517547][T12869]  sysfs_do_create_link_sd+0xc0/0x110
[  185.517560][T12869]  device_add_class_symlinks+0x1cf/0x240
[  185.517575][T12869]  device_add+0x475/0xb50
[  185.517589][T12869]  wiphy_register+0x1ba6/0x28d0
[  185.517615][T12869]  ? __pfx_wiphy_register+0x10/0x10
[  185.517628][T12869]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  185.517645][T12869]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  185.517660][T12869]  ieee80211_register_hw+0x3425/0x4080
[  185.517708][T12869]  ? ieee80211_register_hw+0x1461/0x4080
[  185.517728][T12869]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  185.517744][T12869]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  185.517765][T12869]  ? __hrtimer_setup+0x187/0x210
[  185.517774][T12869]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  185.517792][T12869]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  185.517825][T12869]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  185.517839][T12869]  ? trace_kmalloc+0x1f/0xd0
[  185.517850][T12869]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  185.517863][T12869]  ? kstrndup+0xbf/0x160
[  185.517882][T12869]  hwsim_new_radio_nl+0xea4/0x1b10
[  185.517898][T12869]  ? __pfx___nla_validate_parse+0x10/0x10
[  185.517924][T12869]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  185.517946][T12869]  ? __nla_parse+0x40/0x60
[  185.517965][T12869]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  185.517983][T12869]  genl_family_rcv_msg_doit+0x215/0x300
[  185.518000][T12869]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  185.518021][T12869]  ? bpf_lsm_capable+0x9/0x20
[  185.518034][T12869]  ? security_capable+0x7e/0x2e0
[  185.518053][T12869]  genl_rcv_msg+0x60e/0x790
[  185.518069][T12869]  ? __pfx_genl_rcv_msg+0x10/0x10
[  185.518080][T12869]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  185.518102][T12869]  netlink_rcv_skb+0x208/0x470
[  185.518116][T12869]  ? __lock_acquire+0xab9/0xd20
[  185.518130][T12869]  ? __pfx_genl_rcv_msg+0x10/0x10
[  185.518143][T12869]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  185.518170][T12869]  ? down_read+0x1ad/0x2e0
[  185.518182][T12869]  genl_rcv+0x28/0x40
[  185.518192][T12869]  netlink_unicast+0x82f/0x9e0
[  185.518212][T12869]  ? __pfx_netlink_unicast+0x10/0x10
[  185.518226][T12869]  ? netlink_sendmsg+0x642/0xb30
[  185.518234][T12869]  ? skb_put+0x11b/0x210
[  185.518247][T12869]  netlink_sendmsg+0x805/0xb30
[  185.518263][T12869]  ? __pfx_netlink_sendmsg+0x10/0x10
[  185.518275][T12869]  ? aa_sock_msg_perm+0xf1/0x1d0
[  185.518286][T12869]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  185.518296][T12869]  ? __pfx_netlink_sendmsg+0x10/0x10
[  185.518306][T12869]  __sock_sendmsg+0x21c/0x270
[  185.518322][T12869]  ____sys_sendmsg+0x505/0x830
[  185.518337][T12869]  ? __pfx_____sys_sendmsg+0x10/0x10
[  185.518354][T12869]  ? import_iovec+0x74/0xa0
[  185.518368][T12869]  ___sys_sendmsg+0x21f/0x2a0
[  185.518386][T12869]  ? __pfx____sys_sendmsg+0x10/0x10
[  185.518422][T12869]  ? __fget_files+0x2a/0x420
[  185.518431][T12869]  ? __fget_files+0x3a0/0x420
[  185.518447][T12869]  __x64_sys_sendmsg+0x19b/0x260
[  185.518460][T12869]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  185.518478][T12869]  ? rcu_is_watching+0x15/0xb0
[  185.518492][T12869]  ? do_syscall_64+0xbe/0x3b0
[  185.518504][T12869]  do_syscall_64+0xfa/0x3b0
[  185.518512][T12869]  ? lockdep_hardirqs_on+0x9c/0x150
[  185.518528][T12869]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  185.518538][T12869]  ? exc_page_fault+0x9f/0xf0
[  185.518555][T12869]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  185.518565][T12869] RIP: 0033:0x7fcf0738ebe9
[  185.518576][T12869] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  185.518585][T12869] RSP: 002b:00007fcf08147038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  185.518597][T12869] RAX: ffffffffffffffda RBX: 00007fcf075c5fa0 RCX: 00007fcf0738ebe9
[  185.518604][T12869] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  185.518611][T12869] RBP: 00007fcf07411e19 R08: 0000000000000000 R09: 0000000000000000
[  185.518617][T12869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  185.518623][T12869] R13: 00007fcf075c6038 R14: 00007fcf075c5fa0 R15: 00007fffe81f2708
[  185.518641][T12869]  </TASK>
[  185.531221][T12863] bond9: (slave gretap2): Enslaving as an active interface with an up link
[  185.729444][T12874] __nla_validate_parse: 8 callbacks suppressed
[  185.729459][T12874] netlink: 248 bytes leftover after parsing attributes in process `syz.1.1500'.
[  185.837650][T12882] validate_nla: 5 callbacks suppressed
[  185.837662][T12882] netlink: 'syz.2.1501': attribute type 8 has an invalid length.
[  185.854342][T12866] team0: Unable to change to the same mode the team is in
[  185.964216][T12885] ieee802154 phy0 wpan0: encryption failed: -22
[  185.969536][T12885] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1502'.
[  186.052616][T12899] netlink: 'syz.0.1506': attribute type 10 has an invalid length.
[  186.058826][T12899] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  186.063153][T12899] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  187.262224][T12912] netlink: 'syz.0.1508': attribute type 2 has an invalid length.
[  187.432165][T12918] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1508'.
[  187.852713][T12905] lo speed is unknown, defaulting to 1000
[  187.876296][T12920] netlink: 'syz.2.1509': attribute type 1 has an invalid length.
[  187.979449][T12922] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1510'.
[  188.207587][T12931] netlink: 'syz.1.1512': attribute type 10 has an invalid length.
[  188.518083][T12949] netlink: 'syz.0.1515': attribute type 10 has an invalid length.
[  188.885830][T12955] netlink: 'syz.2.1517': attribute type 11 has an invalid length.
[  189.011879][T12962] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  189.047005][T12965] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1520'.
[  189.052021][T12965] 8021q: adding VLAN 0 to HW filter on device bond1
[  189.058229][T12964] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1520'.
[  189.119353][T12973] netlink: 248 bytes leftover after parsing attributes in process `syz.1.1522'.
[  189.186355][T12967] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1521'.
[  189.304887][T12977] netlink: 'syz.1.1523': attribute type 1 has an invalid length.
[  189.311782][T12977] netlink: 'syz.1.1523': attribute type 1 has an invalid length.
[  189.349449][T12982] ieee802154 phy0 wpan0: encryption failed: -22
[  189.360827][T12984] netlink: 248 bytes leftover after parsing attributes in process `syz.1.1525'.
[  189.414681][T12987] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1526'.
[  189.455393][T12990] bond2: (slave macvlan8): Enslaving as a backup interface with a down link
[  189.472731][T12991] bond2: (slave macvlan8): Releasing backup interface
[  189.768817][T13008] bond9: (slave gretap1): Releasing active interface
[  189.780072][T13008] bond9: (slave gretap1): the permanent HWaddr of slave - ae:d2:bb:d3:86:3c - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  189.790726][T13008] bond9: (slave gretap2): making interface the new active one
[  189.800608][T13008] bond9: (slave gretap2): Releasing active interface
[  189.831815][T13011] lo speed is unknown, defaulting to 1000
[  189.880211][T13008] netlink: 'syz.2.1530': attribute type 10 has an invalid length.
[  190.013768][T13021] lo speed is unknown, defaulting to 1000
[  190.232168][T13033] netlink: 'syz.1.1534': attribute type 9 has an invalid length.
[  190.934957][T13078] __nla_validate_parse: 1 callbacks suppressed
[  190.934973][T13078] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1541'.
[  190.995751][T13080] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  190.999118][T13080] syzkaller0: entered promiscuous mode
[  191.002011][T13080] syzkaller0: entered allmulticast mode
[  191.013861][T13080] tipc: Resetting bearer <eth:syzkaller0>
[  191.065017][T13079] tipc: Resetting bearer <eth:syzkaller0>
[  191.078706][T13079] tipc: Disabling bearer <eth:syzkaller0>
[  191.093751][T13084] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1545'.
[  191.205430][T13087] netlink: 161716 bytes leftover after parsing attributes in process `syz.0.1546'.
[  191.209157][T13087] netlink: zone id is out of range
[  191.211308][T13087] netlink: zone id is out of range
[  191.213407][T13087] netlink: zone id is out of range
[  191.215496][T13087] netlink: zone id is out of range
[  191.217295][T13087] netlink: zone id is out of range
[  191.224420][T13087] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1546'.
[  191.409707][T13098] validate_nla: 2 callbacks suppressed
[  191.409716][T13098] netlink: 'syz.0.1549': attribute type 10 has an invalid length.
[  191.782395][T13118] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1554'.
[  191.890795][T13132] netlink: 'syz.1.1557': attribute type 1 has an invalid length.
[  191.901158][T13132] netlink: 'syz.1.1557': attribute type 1 has an invalid length.
[  192.021985][T13144] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1559'.
[  192.070527][T13140] lo speed is unknown, defaulting to 1000
[  192.209649][T13149] lo speed is unknown, defaulting to 1000
[  192.323253][T13164] lo speed is unknown, defaulting to 1000
[  192.335057][T13157] netlink: 'syz.0.1562': attribute type 12 has an invalid length.
[  192.338157][T13157] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.1562'.
[  192.401556][T13170] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1564'.
[  192.417151][T13164] netlink: 'syz.2.1563': attribute type 2 has an invalid length.
[  192.573508][T13179] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1566'.
[  192.775416][T13188] can: request_module (can-proto-0) failed.
[  192.798656][T13193] mac80211_hwsim hwsim328 wlan1: left allmulticast mode
[  192.805952][T13193] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1570'.
[  192.815942][T13193] netlink: 'syz.0.1570': attribute type 10 has an invalid length.
[  192.865287][T13204] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  192.938441][T13211] batadv_slave_1: entered allmulticast mode
[  193.044224][T13225] lo speed is unknown, defaulting to 1000
[  193.080848][T13230] gtp0: entered promiscuous mode
[  193.084647][T13230] gtp0: entered allmulticast mode
[  193.394394][T13241] netlink: 'syz.1.1583': attribute type 12 has an invalid length.
[  193.664694][T13256] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  193.794308][T13264] lo speed is unknown, defaulting to 1000
[  193.838695][T13265] gtp0: left promiscuous mode
[  193.840331][T13265] gtp0: left allmulticast mode
[  193.853936][T13268] netlink: 'syz.0.1590': attribute type 2 has an invalid length.
[  193.999306][T13277] syzkaller0: entered promiscuous mode
[  194.007420][T13277] syzkaller0: entered allmulticast mode
[  194.047510][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[  194.050238][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[  194.239715][T13289] batadv_slave_0: left promiscuous mode
[  194.245530][T13289] mac80211_hwsim hwsim6 wlan0: left promiscuous mode
[  194.385812][T13302] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  194.418067][T13305] netlink: 'syz.0.1601': attribute type 1 has an invalid length.
[  194.483342][T13305] 8021q: adding VLAN 0 to HW filter on device bond13
[  194.524652][T13305] veth13: entered promiscuous mode
[  194.530678][T13305] bond13: (slave veth13): Enslaving as a backup interface with a down link
[  194.538529][T13305] bond13: (slave veth13): Releasing backup interface
[  194.594902][T13318] netlink: 'syz.1.1604': attribute type 10 has an invalid length.
[  194.600897][T13320] tipc: Enabled bearer <eth:gre0>, priority 10
[  195.914832][T13351] lo speed is unknown, defaulting to 1000
[  196.025660][T13360] __nla_validate_parse: 8 callbacks suppressed
[  196.025674][T13360] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1612'.
[  196.162372][T13366] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1613'.
[  196.183359][T13366] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1613'.
[  196.199975][T13368] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1614'.
[  196.286657][T13370] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1615'.
[  196.303869][T13370] mac80211_hwsim hwsim353 wlan1: entered allmulticast mode
[  196.339816][T13378] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1618'.
[  196.455442][T13380] syzkaller0: entered promiscuous mode
[  196.457599][T13380] syzkaller0: entered allmulticast mode
[  196.556367][T13388] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1619'.
[  196.722018][T13393] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1620'.
[  196.726048][T13393] validate_nla: 2 callbacks suppressed
[  196.726059][T13393] netlink: 'syz.2.1620': attribute type 1 has an invalid length.
[  196.738186][T13393] netlink: 'syz.2.1620': attribute type 9 has an invalid length.
[  196.741710][T13393] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1620'.
[  197.013801][T13402] lo speed is unknown, defaulting to 1000
[  197.116284][T13402] netlink: 'syz.0.1622': attribute type 2 has an invalid length.
[  197.124092][T13402] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1622'.
[  197.307173][T13409] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms)
[  197.650336][T13425] netlink: 'syz.2.1626': attribute type 9 has an invalid length.
[  199.164068][T13468] mac80211_hwsim hwsim353 wlan1: left allmulticast mode
[  199.168874][T13468] netlink: 'syz.1.1634': attribute type 10 has an invalid length.
[  199.180161][T13474] sctp: [Deprecated]: syz.2.1635 (pid 13474) Use of struct sctp_assoc_value in delayed_ack socket option.
[  199.180161][T13474] Use struct sctp_sack_info instead
[  199.277711][T13483] lo speed is unknown, defaulting to 1000
[  199.314220][T13489] lo speed is unknown, defaulting to 1000
[  199.372452][T13494] : renamed from batadv_slave_1
[  199.396447][T13494] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  199.400400][T13494] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  199.404927][T13483] netlink: 'syz.2.1637': attribute type 2 has an invalid length.
[  199.877340][T13514] ieee802154 phy0 wpan0: encryption failed: -22
[  199.885587][T13514] team0: Unable to change to the same mode the team is in
[  200.028845][T13518] netlink: 'syz.2.1643': attribute type 10 has an invalid length.
[  200.195806][T13522] delete_channel: no stack
[  200.311761][T13536] netlink: 'syz.1.1646': attribute type 10 has an invalid length.
[  200.324506][T13539] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  200.328625][T13539] CPU: 1 UID: 0 PID: 13539 Comm: syz.2.1649 Not tainted syzkaller #0 PREEMPT(full) 
[  200.328642][T13539] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  200.328649][T13539] Call Trace:
[  200.328653][T13539]  <TASK>
[  200.328659][T13539]  dump_stack_lvl+0x189/0x250
[  200.328682][T13539]  ? __pfx_dump_stack_lvl+0x10/0x10
[  200.328695][T13539]  ? __pfx__printk+0x10/0x10
[  200.328713][T13539]  ? kernfs_path_from_node+0x2f/0x290
[  200.328726][T13539]  ? kernfs_path_from_node+0x250/0x290
[  200.328737][T13539]  ? kernfs_path_from_node+0x2f/0x290
[  200.328751][T13539]  sysfs_warn_dup+0x8e/0xa0
[  200.328761][T13539]  sysfs_do_create_link_sd+0xc0/0x110
[  200.328775][T13539]  device_add_class_symlinks+0x1cf/0x240
[  200.328791][T13539]  device_add+0x475/0xb50
[  200.328807][T13539]  wiphy_register+0x1ba6/0x28d0
[  200.328837][T13539]  ? __pfx_wiphy_register+0x10/0x10
[  200.328854][T13539]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  200.328873][T13539]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  200.328889][T13539]  ieee80211_register_hw+0x3425/0x4080
[  200.328916][T13539]  ? ieee80211_register_hw+0x1461/0x4080
[  200.328935][T13539]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  200.328951][T13539]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  200.328973][T13539]  ? __hrtimer_setup+0x187/0x210
[  200.328984][T13539]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  200.329004][T13539]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  200.329041][T13539]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  200.329056][T13539]  ? trace_kmalloc+0x1f/0xd0
[  200.329071][T13539]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  200.329087][T13539]  ? kstrndup+0xbf/0x160
[  200.329107][T13539]  hwsim_new_radio_nl+0xea4/0x1b10
[  200.329125][T13539]  ? __pfx___nla_validate_parse+0x10/0x10
[  200.329155][T13539]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  200.329213][T13539]  ? __nla_parse+0x40/0x60
[  200.329236][T13539]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  200.329259][T13539]  genl_family_rcv_msg_doit+0x215/0x300
[  200.329280][T13539]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  200.329305][T13539]  ? bpf_lsm_capable+0x9/0x20
[  200.329320][T13539]  ? security_capable+0x7e/0x2e0
[  200.329344][T13539]  genl_rcv_msg+0x60e/0x790
[  200.329363][T13539]  ? __pfx_genl_rcv_msg+0x10/0x10
[  200.329376][T13539]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  200.329402][T13539]  netlink_rcv_skb+0x208/0x470
[  200.329417][T13539]  ? __lock_acquire+0xab9/0xd20
[  200.329434][T13539]  ? __pfx_genl_rcv_msg+0x10/0x10
[  200.329448][T13539]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  200.329480][T13539]  ? down_read+0x1ad/0x2e0
[  200.329494][T13539]  genl_rcv+0x28/0x40
[  200.329506][T13539]  netlink_unicast+0x82f/0x9e0
[  200.329561][T13539]  ? __pfx_netlink_unicast+0x10/0x10
[  200.329580][T13539]  ? netlink_sendmsg+0x642/0xb30
[  200.329590][T13539]  ? skb_put+0x11b/0x210
[  200.329606][T13539]  netlink_sendmsg+0x805/0xb30
[  200.329624][T13539]  ? __pfx_netlink_sendmsg+0x10/0x10
[  200.329640][T13539]  ? aa_sock_msg_perm+0xf1/0x1d0
[  200.329653][T13539]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  200.329666][T13539]  ? __pfx_netlink_sendmsg+0x10/0x10
[  200.329677][T13539]  __sock_sendmsg+0x21c/0x270
[  200.329693][T13539]  ____sys_sendmsg+0x505/0x830
[  200.329711][T13539]  ? __pfx_____sys_sendmsg+0x10/0x10
[  200.329731][T13539]  ? import_iovec+0x74/0xa0
[  200.329747][T13539]  ___sys_sendmsg+0x21f/0x2a0
[  200.329762][T13539]  ? __pfx____sys_sendmsg+0x10/0x10
[  200.329800][T13539]  ? __fget_files+0x2a/0x420
[  200.329810][T13539]  ? __fget_files+0x3a0/0x420
[  200.329828][T13539]  __x64_sys_sendmsg+0x19b/0x260
[  200.329843][T13539]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  200.329864][T13539]  ? rcu_is_watching+0x15/0xb0
[  200.329880][T13539]  ? do_syscall_64+0xbe/0x3b0
[  200.329892][T13539]  do_syscall_64+0xfa/0x3b0
[  200.329901][T13539]  ? lockdep_hardirqs_on+0x9c/0x150
[  200.329918][T13539]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  200.329930][T13539]  ? exc_page_fault+0x9f/0xf0
[  200.329948][T13539]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  200.329960][T13539] RIP: 0033:0x7fe05cf8ebe9
[  200.329972][T13539] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  200.329981][T13539] RSP: 002b:00007fe05dee1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  200.329994][T13539] RAX: ffffffffffffffda RBX: 00007fe05d1c5fa0 RCX: 00007fe05cf8ebe9
[  200.330002][T13539] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  200.330009][T13539] RBP: 00007fe05d011e19 R08: 0000000000000000 R09: 0000000000000000
[  200.330016][T13539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  200.330023][T13539] R13: 00007fe05d1c6038 R14: 00007fe05d1c5fa0 R15: 00007ffe53b92ce8
[  200.330043][T13539]  </TASK>
[  200.558252][T13544] lo speed is unknown, defaulting to 1000
[  200.587326][T13546] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  200.693411][T13554] lo speed is unknown, defaulting to 1000
[  200.705423][T13557] lo speed is unknown, defaulting to 1000
[  200.813649][T13557] netlink: 'syz.0.1654': attribute type 2 has an invalid length.
[  201.017567][T13568] veth13: left promiscuous mode
[  201.089270][T13573] __nla_validate_parse: 11 callbacks suppressed
[  201.089286][T13573] netlink: 248 bytes leftover after parsing attributes in process `syz.1.1658'.
[  201.543450][T13609] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1664'.
[  201.925184][T13644] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.1670'.
[  201.929834][T13644] mac80211_hwsim hwsim4 wlan0: left promiscuous mode
[  201.935415][T13644] veth5: left promiscuous mode
[  201.937649][T13644] veth7: left promiscuous mode
[  201.990477][T13651] openvswitch: netlink: Message has 20 unknown bytes.
[  201.995698][T13651] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  202.059932][T13653] netlink: 'syz.0.1673': attribute type 1 has an invalid length.
[  202.063695][T13653] netlink: 'syz.0.1673': attribute type 1 has an invalid length.
[  202.149477][T13653] netlink: 'syz.0.1673': attribute type 1 has an invalid length.
[  202.166801][T13653] 8021q: adding VLAN 0 to HW filter on device bond14
[  202.175388][T13653] bond14: (slave wlan0): Opening slave failed
[  202.189050][T13653] vlan2: entered allmulticast mode
[  202.313194][T13667] netlink: 'syz.0.1677': attribute type 9 has an invalid length.
[  202.440025][T13672] ==================================================================
[  202.442676][T13672] BUG: KASAN: slab-use-after-free in __xfrm_state_insert+0x8af/0x1450
[  202.445188][T13672] Read of size 1 at addr ffff88810850b4b0 by task syz.0.1679/13672
[  202.449119][T13672] 
[  202.450544][T13672] CPU: 0 UID: 0 PID: 13672 Comm: syz.0.1679 Not tainted syzkaller #0 PREEMPT(full) 
[  202.450562][T13672] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  202.450570][T13672] Call Trace:
[  202.450576][T13672]  <TASK>
[  202.450582][T13672]  dump_stack_lvl+0x189/0x250
[  202.450601][T13672]  ? __kasan_check_byte+0x12/0x40
[  202.450618][T13672]  ? __pfx_dump_stack_lvl+0x10/0x10
[  202.450633][T13672]  ? lock_release+0x4b/0x3e0
[  202.450650][T13672]  ? __virt_addr_valid+0x4a5/0x5c0
[  202.450663][T13672]  print_report+0xca/0x240
[  202.450675][T13672]  ? __xfrm_state_insert+0x8af/0x1450
[  202.450687][T13672]  kasan_report+0x118/0x150
[  202.450703][T13672]  ? __xfrm_state_insert+0x8af/0x1450
[  202.450718][T13672]  __xfrm_state_insert+0x8af/0x1450
[  202.450734][T13672]  xfrm_state_insert+0x54/0x60
[  202.450745][T13672]  ipcomp6_init_state+0x655/0x900
[  202.450760][T13672]  __xfrm_init_state+0xa76/0x13f0
[  202.450774][T13672]  ? __xfrm_init_state+0x7ef/0x13f0
[  202.450789][T13672]  xfrm_init_state+0x18/0xa0
[  202.450801][T13672]  pfkey_add+0x1d38/0x2e00
[  202.450817][T13672]  ? __pfx_pfkey_add+0x10/0x10
[  202.450827][T13672]  ? kmem_cache_free+0x18f/0x400
[  202.450846][T13672]  pfkey_sendmsg+0xbfe/0x1090
[  202.450861][T13672]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  202.450879][T13672]  ? aa_sock_msg_perm+0xf1/0x1d0
[  202.450890][T13672]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  202.450903][T13672]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  202.450914][T13672]  __sock_sendmsg+0x21c/0x270
[  202.450930][T13672]  ____sys_sendmsg+0x52d/0x830
[  202.450944][T13672]  ? __pfx_____sys_sendmsg+0x10/0x10
[  202.450959][T13672]  ? import_iovec+0x74/0xa0
[  202.450974][T13672]  ___sys_sendmsg+0x21f/0x2a0
[  202.450986][T13672]  ? __pfx____sys_sendmsg+0x10/0x10
[  202.451008][T13672]  ? __fget_files+0x2a/0x420
[  202.451018][T13672]  ? __fget_files+0x3a0/0x420
[  202.451030][T13672]  __sys_sendmmsg+0x227/0x430
[  202.451044][T13672]  ? __pfx___sys_sendmmsg+0x10/0x10
[  202.451055][T13672]  ? do_futex+0x333/0x420
[  202.451071][T13672]  ? fdget+0x184/0x1e0
[  202.451087][T13672]  ? rcu_is_watching+0x15/0xb0
[  202.451100][T13672]  __x64_sys_sendmmsg+0xa0/0xc0
[  202.451113][T13672]  do_syscall_64+0xfa/0x3b0
[  202.451123][T13672]  ? lockdep_hardirqs_on+0x9c/0x150
[  202.451139][T13672]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.451150][T13672]  ? exc_page_fault+0x9f/0xf0
[  202.451167][T13672]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.451177][T13672] RIP: 0033:0x7f172af8ebe9
[  202.451188][T13672] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  202.451198][T13672] RSP: 002b:00007f172bedc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  202.451213][T13672] RAX: ffffffffffffffda RBX: 00007f172b1c5fa0 RCX: 00007f172af8ebe9
[  202.451221][T13672] RDX: 000000000400008a RSI: 0000200000000180 RDI: 0000000000000005
[  202.451229][T13672] RBP: 00007f172b011e19 R08: 0000000000000000 R09: 0000000000000000
[  202.451236][T13672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  202.451243][T13672] R13: 00007f172b1c6038 R14: 00007f172b1c5fa0 R15: 00007ffcd6b5ab08
[  202.451256][T13672]  </TASK>
[  202.451262][T13672] 
[  202.573599][T13672] Allocated by task 10870:
[  202.575244][T13672]  kasan_save_track+0x3e/0x80
[  202.576939][T13672]  __kasan_slab_alloc+0x6c/0x80
[  202.578568][T13672]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  202.580363][T13672]  xfrm_state_alloc+0x24/0x2f0
[  202.582081][T13672]  __find_acq_core+0x8a7/0x1c00
[  202.583980][T13672]  xfrm_find_acq+0x78/0xa0
[  202.585518][T13672]  xfrm_alloc_userspi+0x6b3/0xc90
[  202.587267][T13672]  xfrm_user_rcv_msg+0x7a3/0xab0
[  202.589184][T13672]  netlink_rcv_skb+0x208/0x470
[  202.590987][T13672]  xfrm_netlink_rcv+0x79/0x90
[  202.592522][T13672]  netlink_unicast+0x82f/0x9e0
[  202.594214][T13672]  netlink_sendmsg+0x805/0xb30
[  202.596064][T13672]  __sock_sendmsg+0x21c/0x270
[  202.597914][T13672]  ____sys_sendmsg+0x505/0x830
[  202.599780][T13672]  ___sys_sendmsg+0x21f/0x2a0
[  202.601523][T13672]  __x64_sys_sendmsg+0x19b/0x260
[  202.603149][T13672]  do_syscall_64+0xfa/0x3b0
[  202.604824][T13672]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.607142][T13672] 
[  202.608063][T13672] Freed by task 47:
[  202.609430][T13672]  kasan_save_track+0x3e/0x80
[  202.611281][T13672]  kasan_save_free_info+0x46/0x50
[  202.613267][T13672]  __kasan_slab_free+0x5b/0x80
[  202.615079][T13672]  kmem_cache_free+0x18f/0x400
[  202.616915][T13672]  xfrm_state_gc_task+0x52d/0x6b0
[  202.619002][T13672]  process_scheduled_works+0xae1/0x17b0
[  202.621109][T13672]  worker_thread+0x8a0/0xda0
[  202.622731][T13672]  kthread+0x711/0x8a0
[  202.624414][T13672]  ret_from_fork+0x3fc/0x770
[  202.626367][T13672]  ret_from_fork_asm+0x1a/0x30
[  202.628431][T13672] 
[  202.629527][T13672] The buggy address belongs to the object at ffff88810850b180
[  202.629527][T13672]  which belongs to the cache xfrm_state of size 928
[  202.634978][T13672] The buggy address is located 816 bytes inside of
[  202.634978][T13672]  freed 928-byte region [ffff88810850b180, ffff88810850b520)
[  202.639817][T13672] 
[  202.640678][T13672] The buggy address belongs to the physical page:
[  202.643053][T13672] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810850ba80 pfn:0x108508
[  202.646406][T13672] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  202.649314][T13672] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  202.651799][T13672] page_type: f5(slab)
[  202.653112][T13672] raw: 057ff00000000040 ffff88801d32b3c0 dead000000000122 0000000000000000
[  202.655864][T13672] raw: ffff88810850ba80 00000000800e0008 00000000f5000000 0000000000000000
[  202.658961][T13672] head: 057ff00000000040 ffff88801d32b3c0 dead000000000122 0000000000000000
[  202.662529][T13672] head: ffff88810850ba80 00000000800e0008 00000000f5000000 0000000000000000
[  202.666261][T13672] head: 057ff00000000002 ffffea0004214201 00000000ffffffff 00000000ffffffff
[  202.669767][T13672] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  202.673313][T13672] page dumped because: kasan: bad access detected
[  202.675860][T13672] page_owner tracks the page as allocated
[  202.678239][T13672] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 7790, tgid 7788 (syz.2.374), ts 90641483168, free_ts 90571403928
[  202.684805][T13672]  post_alloc_hook+0x240/0x2a0
[  202.686431][T13672]  get_page_from_freelist+0x21e4/0x22c0
[  202.688317][T13672]  __alloc_frozen_pages_noprof+0x181/0x370
[  202.690272][T13672]  alloc_pages_mpol+0x232/0x4a0
[  202.691903][T13672]  allocate_slab+0x8a/0x370
[  202.693473][T13672]  ___slab_alloc+0xbeb/0x1410
[  202.695129][T13672]  kmem_cache_alloc_noprof+0x283/0x3c0
[  202.696975][T13672]  xfrm_state_alloc+0x24/0x2f0
[  202.698521][T13672]  __find_acq_core+0x8a7/0x1c00
[  202.700205][T13672]  xfrm_find_acq+0x78/0xa0
[  202.701792][T13672]  xfrm_alloc_userspi+0x6b3/0xc90
[  202.703785][T13672]  xfrm_user_rcv_msg+0x7a3/0xab0
[  202.705664][T13672]  netlink_rcv_skb+0x208/0x470
[  202.707583][T13672]  xfrm_netlink_rcv+0x79/0x90
[  202.709165][T13672]  netlink_unicast+0x82f/0x9e0
[  202.710968][T13672]  netlink_sendmsg+0x805/0xb30
[  202.712623][T13672] page last free pid 7779 tgid 7778 stack trace:
[  202.714970][T13672]  __free_frozen_pages+0xbc4/0xd30
[  202.716747][T13672]  free_large_kmalloc+0x13a/0x1f0
[  202.718752][T13672]  device_release+0x9c/0x1c0
[  202.720492][T13672]  kobject_put+0x22b/0x480
[  202.722268][T13672]  netdev_run_todo+0xd2e/0xea0
[  202.723989][T13672]  tun_chr_close+0x13c/0x1c0
[  202.725798][T13672]  __fput+0x44c/0xa70
[  202.727121][T13672]  task_work_run+0x1d4/0x260
[  202.728840][T13672]  do_exit+0x6b5/0x2300
[  202.730449][T13672]  do_group_exit+0x21c/0x2d0
[  202.732111][T13672]  get_signal+0x1286/0x1340
[  202.733844][T13672]  arch_do_signal_or_restart+0x9a/0x750
[  202.736077][T13672]  exit_to_user_mode_loop+0x75/0x110
[  202.737981][T13672]  do_syscall_64+0x2bd/0x3b0
[  202.739715][T13672]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.742073][T13672] 
[  202.743058][T13672] Memory state around the buggy address:
[  202.745224][T13672]  ffff88810850b380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  202.748414][T13672]  ffff88810850b400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  202.751488][T13672] >ffff88810850b480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  202.754451][T13672]                                      ^
[  202.756571][T13672]  ffff88810850b500: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[  202.759327][T13672]  ffff88810850b580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  202.762212][T13672] ==================================================================
[  202.765517][T13672] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  202.767981][T13672] CPU: 0 UID: 0 PID: 13672 Comm: syz.0.1679 Not tainted syzkaller #0 PREEMPT(full) 
[  202.771491][T13672] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  202.775285][T13672] Call Trace:
[  202.776666][T13672]  <TASK>
[  202.777864][T13672]  dump_stack_lvl+0x99/0x250
[  202.779702][T13672]  ? __asan_memcpy+0x40/0x70
[  202.781412][T13672]  ? __pfx_dump_stack_lvl+0x10/0x10
[  202.783140][T13672]  ? __pfx__printk+0x10/0x10
[  202.784946][T13672]  vpanic+0x281/0x750
[  202.786410][T13672]  ? __pfx_vpanic+0x10/0x10
[  202.787917][T13672]  ? irqentry_exit+0x74/0x90
[  202.789519][T13672]  panic+0xb9/0xc0
[  202.790891][T13672]  ? __pfx_panic+0x10/0x10
[  202.792654][T13672]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  202.794954][T13672]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  202.797274][T13672]  ? __xfrm_state_insert+0x8af/0x1450
[  202.799245][T13672]  check_panic_on_warn+0x89/0xb0
[  202.801224][T13672]  ? __xfrm_state_insert+0x8af/0x1450
[  202.803037][T13672]  end_report+0x78/0x160
[  202.804378][T13672]  kasan_report+0x129/0x150
[  202.805836][T13672]  ? __xfrm_state_insert+0x8af/0x1450
[  202.807570][T13672]  __xfrm_state_insert+0x8af/0x1450
[  202.809233][T13672]  xfrm_state_insert+0x54/0x60
[  202.810782][T13672]  ipcomp6_init_state+0x655/0x900
[  202.812413][T13672]  __xfrm_init_state+0xa76/0x13f0
[  202.814073][T13672]  ? __xfrm_init_state+0x7ef/0x13f0
[  202.816076][T13672]  xfrm_init_state+0x18/0xa0
[  202.817786][T13672]  pfkey_add+0x1d38/0x2e00
[  202.819292][T13672]  ? __pfx_pfkey_add+0x10/0x10
[  202.820943][T13672]  ? kmem_cache_free+0x18f/0x400
[  202.822530][T13672]  pfkey_sendmsg+0xbfe/0x1090
[  202.824020][T13672]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  202.825854][T13672]  ? aa_sock_msg_perm+0xf1/0x1d0
[  202.827811][T13672]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  202.829680][T13672]  ? __pfx_pfkey_sendmsg+0x10/0x10
[  202.831735][T13672]  __sock_sendmsg+0x21c/0x270
[  202.833581][T13672]  ____sys_sendmsg+0x52d/0x830
[  202.835399][T13672]  ? __pfx_____sys_sendmsg+0x10/0x10
[  202.837426][T13672]  ? import_iovec+0x74/0xa0
[  202.839046][T13672]  ___sys_sendmsg+0x21f/0x2a0
[  202.840848][T13672]  ? __pfx____sys_sendmsg+0x10/0x10
[  202.843052][T13672]  ? __fget_files+0x2a/0x420
[  202.844979][T13672]  ? __fget_files+0x3a0/0x420
[  202.846881][T13672]  __sys_sendmmsg+0x227/0x430
[  202.848606][T13672]  ? __pfx___sys_sendmmsg+0x10/0x10
[  202.850218][T13672]  ? do_futex+0x333/0x420
[  202.851898][T13672]  ? fdget+0x184/0x1e0
[  202.853327][T13672]  ? rcu_is_watching+0x15/0xb0
[  202.855123][T13672]  __x64_sys_sendmmsg+0xa0/0xc0
[  202.856852][T13672]  do_syscall_64+0xfa/0x3b0
[  202.858269][T13672]  ? lockdep_hardirqs_on+0x9c/0x150
[  202.860015][T13672]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.862306][T13672]  ? exc_page_fault+0x9f/0xf0
[  202.864166][T13672]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  202.866336][T13672] RIP: 0033:0x7f172af8ebe9
[  202.868087][T13672] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  202.874484][T13672] RSP: 002b:00007f172bedc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  202.877611][T13672] RAX: ffffffffffffffda RBX: 00007f172b1c5fa0 RCX: 00007f172af8ebe9
[  202.880383][T13672] RDX: 000000000400008a RSI: 0000200000000180 RDI: 0000000000000005
[  202.883208][T13672] RBP: 00007f172b011e19 R08: 0000000000000000 R09: 0000000000000000
[  202.885813][T13672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  202.888656][T13672] R13: 00007f172b1c6038 R14: 00007f172b1c5fa0 R15: 00007ffcd6b5ab08
[  202.891404][T13672]  </TASK>
[  202.893229][T13672] Kernel Offset: disabled
[  202.895012][T13672] Rebooting in 86400 seconds..

VM DIAGNOSIS:
12:23:12  Registers:
info registers vcpu 0

CPU#0
RAX=1ffffffff33be460 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd
RSI=0000000000001302 RDI=0000000000001303 RBP=ffffffff99df26b0 RSP=ffffc9000e1b6c50
R8 =ffff888021330237 R9 =1ffff11004266046 R10=dffffc0000000000 R11=ffffffff854f3a30
R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff99df2420 R15=0000000000000000
RIP=ffffffff854f3aa7 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f172bedc6c0 ffffffff 00c00000
GS =0000 ffff8880b8618000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000180 CR3=0000000106cac000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f172b197498 00007f172b197470 XMM03=00007f172b1974a8 00007f172b1974a0
XMM04=00007f172bcfd100 00007f172b197460 XMM05=00007f172b197478 00007f172b1974c0
XMM06=00007f172b1974b8 00007f172b1974b0 XMM07=00007f172b1974a8 00007f172b1974a0
XMM08=0000000000000000 00007f172b012ee7 XMM09=0000000000000000 00007f172b012fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffc90007400000 RBX=1ffff11020f7e25a RCX=ffff888105ef8000 RDX=0000000000010000
RSI=ffff888107bf0000 RDI=0000000000000017 RBP=0000000000000080 RSP=ffffc900001e0dc0
R8 =ffffffff8fa39037 R9 =1ffffffff1f47206 R10=dffffc0000000000 R11=ffffffff8699e0a0
R12=dffffc0000000000 R13=ffff888107bf12d0 R14=ffff888107bf0000 R15=dffffc0000000000
RIP=ffffffff8699e0e8 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555590d0d500 ffffffff 00c00000
GS =0000 ffff8881a3c18000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000562ea15e2000 CR3=00000001096b8000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f172b012e53
XMM06=0000000000000000 00007f172b012e4d XMM07=0000000000000000 00007f172b012e61
XMM08=0000000000000000 00007f172b012ee7 XMM09=0000000000000000 00007f172b012fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
