last executing test programs:

1.029105858s ago: executing program 2 (id=1463):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000040000000000d0000000000005f00"], 0x0, 0x34, 0x0, 0x0, 0xfffffffc}, 0x28)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x21018}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve0\x00'}]}, 0x50}}, 0x80)
r1 = socket$nl_route(0x10, 0x3, 0x0)
getsockopt$IP_SET_OP_GET_FNAME(r1, 0x1, 0x53, &(0x7f0000000240)={0x8, 0x7, 0x0, 'syz2\x00'}, 0x0)
r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
getsockname(r2, 0x0, &(0x7f0000000a80))
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge0\x00', <r4=>0x0})
r5 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0)
r6 = socket(0x10, 0x800, 0x0)
write(r6, &(0x7f0000000800)="240000001e005f0314f90408faac47000200000001000000000008", 0x1b)
sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xfff3}}}, 0x24}}, 0x0)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$igmp6(0xa, 0x3, 0x2)
setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000001280)=@mangle={'mangle\x00', 0x8, 0x6, 0x520, 0x120, 0x0, 0x1f0, 0x1f0, 0x120, 0x510, 0x510, 0x510, 0x510, 0x510, 0x6, 0x0, {[{{@ipv6={@local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xff000000, 0x0, 0xffffff00, 0xff000000], [0xff, 0xff, 0xff000000, 0xffffffff], 'ipvlan1\x00', 'ipvlan1\x00', {}, {}, 0x0, 0x9, 0x2, 0x2}, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @HL={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0, 0x0, {0x5002}}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv4=@private=0xa010100, 0x0, 0x32, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@dev, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, 0xff}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x0, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x580)
syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000340), r7)
syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000000c0), r7)
pipe(&(0x7f0000000000))
r9 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r9, &(0x7f0000000380)={0xa, 0x14e24}, 0x1c)
connect$inet6(r9, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c)
r10 = socket$inet6(0xa, 0x1, 0x8010000000000084)
sendto$inet6(r10, &(0x7f0000000100)="15", 0x1, 0x1, &(0x7f0000000140)={0xa, 0x4e23, 0x7ff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3}, 0x1c)
sendmsg$inet6(r10, &(0x7f0000000380)={&(0x7f0000000180)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000000340)=[{&(0x7f0000000480)='y', 0x1}], 0x1}, 0x0)
shutdown(r10, 0x1)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r10, 0x84, 0x9, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, 0x0, 0x0, 0x4}, &(0x7f0000000080)=0x9c)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10)

489.948957ms ago: executing program 0 (id=1471):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)={0x1c, 0x3e, 0x107, 0xfffffffc, 0x25dfdbfd, {0x3, 0x7c}, [@nested={0x8, 0xa8, 0x0, 0x1, [@nested={0x4, 0x8}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000)

489.697629ms ago: executing program 0 (id=1472):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722", 0x44}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/69, 0x45}, {&(0x7f0000000840)=""/83, 0x53}], 0x2}, 0x2000)

428.740057ms ago: executing program 0 (id=1473):
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0xb, &(0x7f0000000580)=@framed={{}, [@printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x20008000}, {0x85, 0x0, 0x0, 0x8b}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

428.50664ms ago: executing program 0 (id=1474):
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201})
write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd05"], 0xfdef)

329.002564ms ago: executing program 1 (id=1477):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8)
setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000080), 0x8)
sendto$inet6(r0, &(0x7f0000000180)="b8", 0x1, 0x40, &(0x7f0000000140)={0xa, 0x4e23, 0x800, @loopback, 0xffffffff}, 0x1c)

328.656381ms ago: executing program 0 (id=1478):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x50)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000b40)={r0, &(0x7f0000000a80), 0x0}, 0x20)

268.127823ms ago: executing program 1 (id=1479):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='tlb_flush\x00', r0}, 0x10)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x5, 0x5, 0x9fd, 0x85, 0x41}, 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x7fc, r1}, 0x38)
bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000680), &(0x7f0000000540), 0x6c, r1}, 0x38)

267.921238ms ago: executing program 0 (id=1480):
r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
preadv(r0, &(0x7f00000019c0)=[{&(0x7f0000002fc0)=""/140, 0x8c}], 0x1, 0x80000001, 0x100)
ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=<r1=>0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3)
sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010028bd7000070000000200000008000100", @ANYRES32=r1], 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004)

182.863286ms ago: executing program 2 (id=1481):
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000000080)=[{&(0x7f00000000c0)="480000001500257f09004b01fcfc8c860a881300f217e0060000e3323909b8f8896e33719fe3bb036e0bc90900000000000000000000ffff5bf1090000d0bd5e000000006203005b", 0x48}], 0x1)

116.946393ms ago: executing program 2 (id=1482):
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000880)={@map, 0xffffffffffffffff, 0x15, 0x4006}, 0x20)

115.638076ms ago: executing program 1 (id=1483):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000280)="db", 0x1}], 0x1}, 0x41)
recvmsg(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x10001)
sendmsg$inet(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="04", 0x1}], 0x1}, 0x41)
recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x61)

115.491578ms ago: executing program 2 (id=1484):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x1}, 0x4000000)

115.39852ms ago: executing program 1 (id=1485):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r2 = openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0)
preadv(r2, &(0x7f0000002880)=[{&(0x7f00000000c0)=""/91, 0x5b}], 0x1, 0xa2e1, 0xc)
r3 = openat$cgroup_procs(r1, &(0x7f0000000080)='tasks\x00', 0x2, 0x0)
preadv(r3, &(0x7f00000039c0)=[{&(0x7f0000000140)=""/142, 0x8e}], 0x1, 0x4, 0x3)
r4 = openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0)
sendfile(r4, r4, 0x0, 0x10001)

72.014192ms ago: executing program 2 (id=1486):
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x2}, 0x28)
unshare(0x2c020400)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae2acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a3053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456391cffdef93e29f10f4a11f0cfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d984ecb91e6683a5f522d536e2f3c43b89823659d1945258fc668950e5aacfffffffffffffff7f7a266c90e64efc8d8f730867202a9ee94e6a00"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={r1, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000001a00), 0x0, 0xfeffffff, 0x10, 0x8, 0x0, 0x0}}, 0x10)

67.846622ms ago: executing program 2 (id=1487):
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newsa={0x158, 0x10, 0x413, 0x70bd28, 0x0, {{@in=@multicast1, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x4e24, 0x0, 0x2, 0x20, 0x20}, {@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x40000040, 0x32}, @in=@private=0xa010100, {0x4, 0x7, 0x3, 0x40000000000004, 0xffffffffffffffff, 0xffffffffffffffff, 0x7f}, {0x0, 0x8, 0xcc}, {0xf6}, 0x0, 0x0, 0x2, 0x1, 0xfe}, [@algo_aead={0x67, 0x12, {{'rfc4309(ccm(aes))\x00'}, 0xd8, 0x60, "6fc3070b4f8f7330202b93875f2d67a6a77871db764ec62c9599d2"}}]}, 0x158}}, 0x804)

66.235765ms ago: executing program 1 (id=1488):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000003f40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="08040000000000000100000001"], 0x408}}], 0x2, 0x0)

0s ago: executing program 1 (id=1489):
pipe(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f0000000340), 0x11000)
socket(0x10, 0x803, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1, 0x4, 0x7fe2, 0x1}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10)
socket$kcm(0x21, 0x2, 0x2)
socket$nl_route(0x10, 0x3, 0x0)
vmsplice(r1, &(0x7f0000000280)=[{&(0x7f0000000680)="85", 0x1}], 0x1, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:37054' (ED25519) to the list of known hosts.
syzkaller login: [   48.243870][ T5784] cgroup: Unknown subsys name 'net'
[   48.352688][ T5784] cgroup: Unknown subsys name 'cpuset'
[   48.359786][ T5784] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   49.752598][ T5784] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   58.119841][ T5873] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   58.123544][ T5873] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   58.126159][ T5873] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   58.145945][ T5878] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   58.150797][ T5873] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   58.150855][ T5878] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   58.156870][ T5878] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   58.162394][ T5878] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   58.164209][ T5873] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   58.165611][ T5878] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   58.188351][ T5233] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   58.194852][ T5233] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   58.198529][ T5233] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   58.202304][ T5233] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   58.205315][ T5233] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   58.496541][ T5872] chnl_net:caif_netlink_parms(): no params data found
[   58.620886][ T5875] chnl_net:caif_netlink_parms(): no params data found
[   58.671551][ T5872] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.674840][ T5872] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.677548][ T5872] bridge_slave_0: entered allmulticast mode
[   58.681411][ T5872] bridge_slave_0: entered promiscuous mode
[   58.693730][ T5872] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.696598][ T5872] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.699414][ T5872] bridge_slave_1: entered allmulticast mode
[   58.703022][ T5872] bridge_slave_1: entered promiscuous mode
[   58.706921][ T5879] chnl_net:caif_netlink_parms(): no params data found
[   58.769469][ T5872] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   58.793295][ T5872] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   58.838476][ T5875] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.842891][ T5875] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.845817][ T5875] bridge_slave_0: entered allmulticast mode
[   58.849479][ T5875] bridge_slave_0: entered promiscuous mode
[   58.855133][ T5872] team0: Port device team_slave_0 added
[   58.868409][ T5875] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.870891][ T5875] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.873210][ T5875] bridge_slave_1: entered allmulticast mode
[   58.876253][ T5875] bridge_slave_1: entered promiscuous mode
[   58.880949][ T5872] team0: Port device team_slave_1 added
[   58.893606][ T5879] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.896124][ T5879] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.898998][ T5879] bridge_slave_0: entered allmulticast mode
[   58.902076][ T5879] bridge_slave_0: entered promiscuous mode
[   58.939283][ T5879] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.943263][ T5879] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.946370][ T5879] bridge_slave_1: entered allmulticast mode
[   58.950133][ T5879] bridge_slave_1: entered promiscuous mode
[   58.980844][ T5875] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   58.984825][ T5872] batman_adv: batadv0: Adding interface: batadv_slave_0
[   58.987396][ T5872] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   58.997527][ T5872] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   59.013678][ T5875] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   59.017501][ T5872] batman_adv: batadv0: Adding interface: batadv_slave_1
[   59.020192][ T5872] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   59.030166][ T5872] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   59.036854][ T5879] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   59.071688][ T5875] team0: Port device team_slave_0 added
[   59.075894][ T5875] team0: Port device team_slave_1 added
[   59.091144][ T5879] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   59.141593][ T5875] batman_adv: batadv0: Adding interface: batadv_slave_0
[   59.144042][ T5875] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   59.154373][ T5875] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   59.172829][ T5872] hsr_slave_0: entered promiscuous mode
[   59.175766][ T5872] hsr_slave_1: entered promiscuous mode
[   59.179408][ T5875] batman_adv: batadv0: Adding interface: batadv_slave_1
[   59.182584][ T5875] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   59.192286][ T5875] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   59.199378][ T5879] team0: Port device team_slave_0 added
[   59.211267][ T5879] team0: Port device team_slave_1 added
[   59.291539][ T5879] batman_adv: batadv0: Adding interface: batadv_slave_0
[   59.294118][ T5879] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   59.304174][ T5879] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   59.316663][ T5875] hsr_slave_0: entered promiscuous mode
[   59.319480][ T5875] hsr_slave_1: entered promiscuous mode
[   59.322322][ T5875] debugfs: 'hsr0' already exists in 'hsr'
[   59.324518][ T5875] Cannot create hsr debugfs directory
[   59.335205][ T5879] batman_adv: batadv0: Adding interface: batadv_slave_1
[   59.337592][ T5879] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   59.347511][ T5879] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   59.439019][ T5879] hsr_slave_0: entered promiscuous mode
[   59.443616][ T5879] hsr_slave_1: entered promiscuous mode
[   59.446500][ T5879] debugfs: 'hsr0' already exists in 'hsr'
[   59.448949][ T5879] Cannot create hsr debugfs directory
[   59.597993][ T5872] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   59.623790][ T5872] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   59.643634][ T5872] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   59.665626][ T5872] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   59.714793][ T5875] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   59.726573][ T5875] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   59.748914][ T5875] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   59.765679][ T5875] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   59.807251][ T5879] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   59.822922][ T5879] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   59.832337][ T5879] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   59.844331][ T5879] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   59.894271][ T5872] 8021q: adding VLAN 0 to HW filter on device bond0
[   59.926840][ T5872] 8021q: adding VLAN 0 to HW filter on device team0
[   59.942892][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   59.945933][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   59.960010][   T68] bridge0: port 2(bridge_slave_1) entered blocking state
[   59.962538][   T68] bridge0: port 2(bridge_slave_1) entered forwarding state
[   60.006794][ T5875] 8021q: adding VLAN 0 to HW filter on device bond0
[   60.038414][ T5879] 8021q: adding VLAN 0 to HW filter on device bond0
[   60.043527][ T5875] 8021q: adding VLAN 0 to HW filter on device team0
[   60.054319][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.057075][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   60.074754][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.077277][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   60.088427][ T5879] 8021q: adding VLAN 0 to HW filter on device team0
[   60.113833][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.116528][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   60.144005][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.146899][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state
[   60.195277][ T5872] 8021q: adding VLAN 0 to HW filter on device batadv0
[   60.241077][ T5233] Bluetooth: hci1: command tx timeout
[   60.250977][ T5233] Bluetooth: hci2: command tx timeout
[   60.251200][ T5878] Bluetooth: hci0: command tx timeout
[   60.277887][ T5872] veth0_vlan: entered promiscuous mode
[   60.297921][ T5872] veth1_vlan: entered promiscuous mode
[   60.328042][ T5875] 8021q: adding VLAN 0 to HW filter on device batadv0
[   60.348329][ T5872] veth0_macvtap: entered promiscuous mode
[   60.356177][ T5872] veth1_macvtap: entered promiscuous mode
[   60.379935][ T5872] batman_adv: batadv0: Interface activated: batadv_slave_0
[   60.391571][ T5872] batman_adv: batadv0: Interface activated: batadv_slave_1
[   60.408354][ T5879] 8021q: adding VLAN 0 to HW filter on device batadv0
[   60.415034][ T5922] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   60.428523][ T5922] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   60.433127][ T5922] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   60.439105][ T5875] veth0_vlan: entered promiscuous mode
[   60.449770][ T5922] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   60.467142][ T5875] veth1_vlan: entered promiscuous mode
[   60.524980][ T5879] veth0_vlan: entered promiscuous mode
[   60.528262][ T5875] veth0_macvtap: entered promiscuous mode
[   60.534004][  T994] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.535107][ T5879] veth1_vlan: entered promiscuous mode
[   60.536538][  T994] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.560195][ T5875] veth1_macvtap: entered promiscuous mode
[   60.570828][  T994] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.573841][  T994] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.582715][ T5879] veth0_macvtap: entered promiscuous mode
[   60.587957][ T5875] batman_adv: batadv0: Interface activated: batadv_slave_0
[   60.594822][ T5879] veth1_macvtap: entered promiscuous mode
[   60.616119][ T5875] batman_adv: batadv0: Interface activated: batadv_slave_1
[   60.628160][ T5879] batman_adv: batadv0: Interface activated: batadv_slave_0
[   60.637092][ T5872] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   60.638932][ T5879] batman_adv: batadv0: Interface activated: batadv_slave_1
[   60.655006][ T5885] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   60.657809][ T5885] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   60.666967][ T5885] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   60.685047][ T5922] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   60.688245][ T5922] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   60.703831][ T5922] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   60.727813][ T5922] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   60.732303][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   60.774117][  T994] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.777238][  T994] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.815481][  T994] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.818114][  T994] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.874048][  T994] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.877280][  T994] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.891771][  T994] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.898521][  T994] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   61.017550][ T5954] netlink: 8 bytes leftover after parsing attributes in process `syz.1.26'.
[   61.032845][ T5954] netlink: 8 bytes leftover after parsing attributes in process `syz.1.26'.
[   61.148788][ T5964] netlink: 32 bytes leftover after parsing attributes in process `syz.1.32'.
[   61.950912][ T6039] syz.0.66 uses obsolete (PF_INET,SOCK_PACKET)
[   62.043809][ T6043] netlink: 96 bytes leftover after parsing attributes in process `syz.2.68'.
[   62.243394][ T6058] delete_channel: no stack
[   62.324245][ T5878] Bluetooth: hci2: command tx timeout
[   62.324555][ T5233] Bluetooth: hci1: command tx timeout
[   62.326083][ T5878] Bluetooth: hci0: command tx timeout
[   62.328232][ T6065] netlink: 12 bytes leftover after parsing attributes in process `syz.1.79'.
[   62.771701][ T6105] netlink: 12 bytes leftover after parsing attributes in process `syz.1.98'.
[   62.785502][ T5922] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   62.785554][ T6105] netlink: 12 bytes leftover after parsing attributes in process `syz.1.98'.
[   62.789833][ T5922] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   62.799652][ T5922] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   62.799702][ T6105] Zero length message leads to an empty skb
[   62.809798][ T5922] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   62.859124][ T6107] tipc: Started in network mode
[   62.861314][ T6107] tipc: Node identity 7, cluster identity 4711
[   62.863839][ T6107] tipc: Node number set to 7
[   63.594403][ T6150] TCP: tcp_parse_options: Illegal window scaling value 254 > 14 received
[   63.779512][ T6166] warning: `syz.0.127' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   64.039330][ T6189] netlink: 8 bytes leftover after parsing attributes in process `syz.2.138'.
[   64.043276][ T6189] netlink: 4 bytes leftover after parsing attributes in process `syz.2.138'.
[   64.052108][ T6189] netlink: 'syz.2.138': attribute type 1 has an invalid length.
[   64.055162][ T6189] netlink: 10 bytes leftover after parsing attributes in process `syz.2.138'.
[   64.080675][ T6189] nbd: socks must be embedded in a SOCK_ITEM attr
[   64.083079][ T6189] block nbd0: shutting down sockets
[   64.085116][ T6194] Driver unsupported XDP return value 0 on prog  (id 16) dev N/A, expect packet loss!
[   64.285316][ T6206] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   64.288586][ T6206] IPv6: NLM_F_CREATE should be set when creating new route
[   64.291635][ T6206] IPv6: NLM_F_CREATE should be set when creating new route
[   64.406070][   T54] Bluetooth: hci0: command tx timeout
[   64.408420][   T54] Bluetooth: hci1: command tx timeout
[   64.411173][ T5878] Bluetooth: hci2: command tx timeout
[   64.420637][ T6215] netlink: 'syz.1.145': attribute type 1 has an invalid length.
[   64.694425][ T6227] sctp: [Deprecated]: syz.0.153 (pid 6227) Use of int in max_burst socket option deprecated.
[   64.694425][ T6227] Use struct sctp_assoc_value instead
[   65.055519][ T6250] syzkaller1: entered promiscuous mode
[   65.057386][ T6250] syzkaller1: entered allmulticast mode
[   65.736839][ T6293] netlink: 'syz.1.183': attribute type 6 has an invalid length.
[   65.775433][ T6295] (unnamed net_device) (uninitialized): option active_slave: mode dependency failed, not supported in mode broadcast(3)
[   65.784491][ T6297] tipc: Started in network mode
[   65.788384][ T6297] tipc: Node identity ac1414aa, cluster identity 4711
[   65.796672][ T6297] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[   65.929169][ T6309] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) !
[   66.132278][ T6328] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   66.162968][ T6332] netlink: 'syz.1.202': attribute type 1 has an invalid length.
[   66.165734][ T6332] netlink: 'syz.1.202': attribute type 2 has an invalid length.
[   66.169473][ T6332] netlink: 'syz.1.202': attribute type 1 has an invalid length.
[   66.174513][ T6332] netlink: 'syz.1.202': attribute type 2 has an invalid length.
[   66.294280][ T6345] netlink: 'syz.1.206': attribute type 21 has an invalid length.
[   66.297748][ T6345] __nla_validate_parse: 9 callbacks suppressed
[   66.297761][ T6345] netlink: 132 bytes leftover after parsing attributes in process `syz.1.206'.
[   66.480921][ T5878] Bluetooth: hci2: command tx timeout
[   66.481229][ T5233] Bluetooth: hci0: command tx timeout
[   66.483347][   T54] Bluetooth: hci1: command tx timeout
[   66.766298][ T6366] netlink: 'syz.0.215': attribute type 1 has an invalid length.
[   66.769659][ T6366] netlink: 224 bytes leftover after parsing attributes in process `syz.0.215'.
[   67.473910][ T6386] netlink: 132 bytes leftover after parsing attributes in process `syz.0.223'.
[   67.946238][ T6405] netlink: 8 bytes leftover after parsing attributes in process `syz.1.231'.
[   67.950008][ T6405] netlink: 12 bytes leftover after parsing attributes in process `syz.1.231'.
[   67.956877][ T6405] netlink: 'syz.1.231': attribute type 20 has an invalid length.
[   68.156129][ T6417] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   68.453342][ T6434] netlink: 24 bytes leftover after parsing attributes in process `syz.1.243'.
[   68.522877][ T6434] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.243'.
[   68.544329][ T6435] bridge0: port 3(erspan0) entered blocking state
[   68.546602][ T6435] bridge0: port 3(erspan0) entered disabled state
[   68.549134][ T6435] erspan0: entered allmulticast mode
[   68.552962][ T6435] erspan0: entered promiscuous mode
[   68.555198][ T6435] bridge0: port 3(erspan0) entered blocking state
[   68.557473][ T6435] bridge0: port 3(erspan0) entered forwarding state
[   68.578509][ T6435] erspan0: left allmulticast mode
[   68.597889][ T6435] erspan0: left promiscuous mode
[   68.600593][ T6435] bridge0: port 3(erspan0) entered disabled state
[   68.771291][ T6451] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check.
[   68.919685][ T6471] RDS: rds_bind could not find a transport for fec0:ffff::1, load rds_tcp or rds_rdma?
[   68.976389][ T6478] RDS: rds_bind could not find a transport for fc02::1, load rds_tcp or rds_rdma?
[   69.074169][ T6489] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   69.262147][ T6509] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   69.393561][ T6528] Bluetooth: MGMT ver 1.23
[   69.459527][ T6540] netlink: 8 bytes leftover after parsing attributes in process `syz.2.291'.
[   69.463370][ T6540] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[   69.803227][ T6561] netlink: 8 bytes leftover after parsing attributes in process `syz.2.300'.
[   69.875428][ T6561] bridge0: port 2(bridge_slave_1) entered disabled state
[   69.879762][ T6561] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.011443][ T6561] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   70.016817][ T6561] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   70.164086][ T6561] netdevsim netdevsim2 netdevsim0: left allmulticast mode
[   70.208319][   T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   70.212578][   T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   70.218835][   T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   70.223111][   T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   70.518250][ T6590] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   70.543812][ T6590] batman_adv: batadv0: Removing interface: batadv_slave_1
[   70.602756][ T6596] netlink: 32 bytes leftover after parsing attributes in process `syz.2.315'.
[   71.204095][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   71.814496][ T6648] netlink: 36 bytes leftover after parsing attributes in process `syz.1.338'.
[   71.818214][ T6648] netlink: 16 bytes leftover after parsing attributes in process `syz.1.338'.
[   71.823698][ T6648] netlink: 36 bytes leftover after parsing attributes in process `syz.1.338'.
[   71.827327][ T6648] netlink: 36 bytes leftover after parsing attributes in process `syz.1.338'.
[   71.927260][ T6653] netlink: 4 bytes leftover after parsing attributes in process `syz.2.341'.
[   72.344143][ T6686] netlink: 56 bytes leftover after parsing attributes in process `syz.2.356'.
[   73.138485][ T6706] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[   73.141752][ T6704] netdevsim netdevsim2 netdevsim0: left promiscuous mode
[   73.930179][ T6756] xt_limit: Overflow, try lower: 604147548/4200216962
[   74.110075][ T6770] netlink: 'syz.2.392': attribute type 9 has an invalid length.
[   74.117224][ T6770] netlink: 'syz.2.392': attribute type 7 has an invalid length.
[   74.122665][ T6770] netlink: 'syz.2.392': attribute type 8 has an invalid length.
[   74.718886][ T6813] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   75.166215][ T6843] tipc: Can't bind to reserved service type 2
[   75.774661][ T6879] netlink: 8 bytes leftover after parsing attributes in process `syz.2.440'.
[   75.777837][ T6879] netlink: 24 bytes leftover after parsing attributes in process `syz.2.440'.
[   75.806762][ T6883] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) !
[   75.978271][ T6907] netlink: 8 bytes leftover after parsing attributes in process `syz.0.454'.
[   76.117363][ T6920] netlink: 24 bytes leftover after parsing attributes in process `syz.2.459'.
[   76.736437][ T6938] tipc: Started in network mode
[   76.738775][ T6938] tipc: Node identity ac14140f, cluster identity 4711
[   76.743943][ T6938] tipc: New replicast peer: 255.127.0.0
[   76.746870][ T6938] tipc: Enabled bearer <udp:s>, priority 10
[   77.125027][ T6967] __nla_validate_parse: 1 callbacks suppressed
[   77.125043][ T6967] netlink: 16 bytes leftover after parsing attributes in process `syz.1.481'.
[   77.277060][ T6985] netlink: 'syz.2.489': attribute type 1 has an invalid length.
[   77.280104][ T6985] netlink: 'syz.2.489': attribute type 1 has an invalid length.
[   77.354285][ T6985] netlink: 'syz.2.489': attribute type 1 has an invalid length.
[   77.365286][ T6992] tls_set_device_offload_rx: netdev not found
[   77.378028][ T6985] 8021q: adding VLAN 0 to HW filter on device bond1
[   77.402362][ T6985] bond1: (slave wlan0): Enslaving as an active interface with a down link
[   77.405846][ T6996] vlan0: entered promiscuous mode
[   77.419138][ T6985] vlan2: entered allmulticast mode
[   77.425315][ T6985] veth1: entered allmulticast mode
[   77.427931][ T6985] bond1: (slave vlan2): Opening slave failed
[   77.536998][ T7007] netlink: 4 bytes leftover after parsing attributes in process `syz.1.499'.
[   77.627463][ T7016] netlink: 'syz.2.505': attribute type 10 has an invalid length.
[   77.631056][ T7016] netlink: 40 bytes leftover after parsing attributes in process `syz.2.505'.
[   77.645653][ T7016] team0: Port device geneve0 added
[   77.648552][ T5922] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   77.660496][ T5922] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   77.664399][ T5922] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   77.676126][ T5922] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   77.765792][ T7031] netlink: 8 bytes leftover after parsing attributes in process `syz.2.511'.
[   77.861840][  T792] tipc: Node number set to 2886997007
[   77.946111][ T7051] netlink: 'syz.0.519': attribute type 32 has an invalid length.
[   77.949401][ T7051] netlink: 8 bytes leftover after parsing attributes in process `syz.0.519'.
[   77.953415][ T7051] (unnamed net_device) (uninitialized): option coupled_control: invalid value (192)
[   78.059826][ T7061] macvtap1: entered allmulticast mode
[   78.061952][ T7061] veth0_macvtap: entered allmulticast mode
[   78.208140][ T7075] netlink: 8 bytes leftover after parsing attributes in process `syz.1.530'.
[   78.322431][ T7090] netlink: 'syz.1.539': attribute type 6 has an invalid length.
[   78.347885][ T7090] bond1: entered promiscuous mode
[   78.481588][ T7111] netlink: 14 bytes leftover after parsing attributes in process `syz.0.548'.
[   78.488742][ T7111] hsr_slave_0: left promiscuous mode
[   78.497810][ T7111] hsr_slave_1: left promiscuous mode
[   78.609495][ T7120] af_packet: tpacket_rcv: packet too big, clamped from 64989 to 3952. macoff=96
[   78.733499][ T7133] netlink: 8 bytes leftover after parsing attributes in process `syz.1.559'.
[   78.737222][ T7133] netlink: 12 bytes leftover after parsing attributes in process `syz.1.559'.
[   78.743906][ T7133] netlink: 'syz.1.559': attribute type 7 has an invalid length.
[   78.804024][ T7141] netlink: 204 bytes leftover after parsing attributes in process `syz.0.562'.
[   79.543821][ T7214] 8021q: adding VLAN 0 to HW filter on device bond2
[   79.565122][ T7214] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link
[   79.661754][ T5922] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond
[   79.770919][ T5922] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond
[   80.062161][ T7223] validate_nla: 2 callbacks suppressed
[   80.062177][ T7223] netlink: 'syz.0.596': attribute type 1 has an invalid length.
[   80.094911][ T7223] 8021q: adding VLAN 0 to HW filter on device bond1
[   80.109906][ T7223] 8021q: adding VLAN 0 to HW filter on device bond1
[   80.114670][ T7223] bond1: (slave vcan1): The slave device specified does not support setting the MAC address
[   80.121161][ T7223] bond1: (slave vcan1): Error -95 calling set_mac_address
[   80.161782][ T7225] gretap1: entered promiscuous mode
[   80.168101][ T7225] bond1: (slave gretap1): making interface the new active one
[   80.173453][ T7225] bond1: (slave gretap1): Enslaving as an active interface with an up link
[   80.184373][ T7223] macvlan2: entered promiscuous mode
[   80.186284][ T7223] macvlan2: entered allmulticast mode
[   80.188549][ T7223] bond1: entered promiscuous mode
[   80.191312][ T7223] 8021q: adding VLAN 0 to HW filter on device macvlan2
[   80.195238][ T7223] bond1: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1
[   80.203156][ T7223] bond1: left promiscuous mode
[   80.628814][ T7253] netlink: 'syz.0.609': attribute type 41 has an invalid length.
[   80.713060][ T7260] (unnamed net_device) (uninitialized): option all_slaves_active: invalid value (7)
[   80.785670][ T7262] block nbd0: server does not support multiple connections per device.
[   80.790287][ T7262] block nbd0: shutting down sockets
[   81.200463][ T5233] Bluetooth: hci2: command 0x0405 tx timeout
[   81.441610][   T10] cfg80211: failed to load regulatory.db
[   82.122013][ T5922] bond2: (slave ip6gretap1): link status up again after 0 ms
[   82.127605][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   82.199043][ T7330] __nla_validate_parse: 6 callbacks suppressed
[   82.199056][ T7330] netlink: 24 bytes leftover after parsing attributes in process `syz.2.640'.
[   82.241910][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   82.351785][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   82.426367][ T7359] veth1_to_team: entered allmulticast mode
[   82.460576][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   82.570587][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   82.681579][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   82.790891][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   82.900431][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   83.196711][ T7383] netlink: 24 bytes leftover after parsing attributes in process `syz.1.658'.
[   83.986627][ T7424] netlink: 4 bytes leftover after parsing attributes in process `syz.2.677'.
[   84.434379][ T7442] netlink: 7986 bytes leftover after parsing attributes in process `syz.2.685'.
[   84.482612][ T7444] netlink: 4 bytes leftover after parsing attributes in process `syz.2.686'.
[   84.844105][ T5922] net_ratelimit: 12 callbacks suppressed
[   84.844116][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   84.971410][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   85.074972][ T7455] netlink: 12 bytes leftover after parsing attributes in process `syz.0.691'.
[   85.080583][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   85.167598][ T7460] netlink: 256 bytes leftover after parsing attributes in process `syz.1.694'.
[   85.191658][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   85.301938][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   85.323894][ T7482] netlink: 64 bytes leftover after parsing attributes in process `syz.1.704'.
[   85.410341][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   85.522633][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   85.631033][   T13] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   85.753741][   T13] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   85.861501][   T13] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   86.693305][ T7536] netlink: 20 bytes leftover after parsing attributes in process `syz.1.726'.
[   86.829554][ T7550] netlink: 'syz.2.733': attribute type 5 has an invalid length.
[   87.431011][ T7577] netlink: 32 bytes leftover after parsing attributes in process `syz.2.745'.
[   87.434846][ T7577] netlink: 'syz.2.745': attribute type 32 has an invalid length.
[   87.451082][ T7577] bond0: option coupled_control: mode dependency failed, not supported in mode balance-rr(0)
[   87.508345][ T7583] netlink: 28 bytes leftover after parsing attributes in process `syz.1.748'.
[   87.605264][ T7593] netlink: 12 bytes leftover after parsing attributes in process `syz.0.751'.
[   87.922133][ T7626] netlink: 20 bytes leftover after parsing attributes in process `syz.0.768'.
[   88.228920][ T7647] netlink: 16 bytes leftover after parsing attributes in process `syz.1.777'.
[   88.397391][ T7664] netlink: 24 bytes leftover after parsing attributes in process `syz.0.786'.
[   88.509196][ T7674] netlink: 'syz.0.791': attribute type 3 has an invalid length.
[   88.514106][ T7674] netlink: 224 bytes leftover after parsing attributes in process `syz.0.791'.
[   88.670748][ T7679] netlink: 8 bytes leftover after parsing attributes in process `syz.0.793'.
[   88.678461][ T7679] netlink: 152 bytes leftover after parsing attributes in process `syz.0.793'.
[   88.685977][ T7679] netlink: 16 bytes leftover after parsing attributes in process `syz.0.793'.
[   89.055656][ T7711] veth5: entered promiscuous mode
[   89.393126][ T7737] netlink: 'syz.0.821': attribute type 4 has an invalid length.
[   89.515256][ T7750] syzkaller1: entered promiscuous mode
[   89.517160][ T7750] syzkaller1: entered allmulticast mode
[   89.910528][ T5871] net_ratelimit: 38 callbacks suppressed
[   89.910542][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   90.050531][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   90.055363][ T7804] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   90.064600][ T7804] syzkaller0: entered promiscuous mode
[   90.066882][ T7804] syzkaller0: entered allmulticast mode
[   90.092766][ T7804] tipc: Resetting bearer <eth:syzkaller0>
[   90.105792][ T7802] tipc: Resetting bearer <eth:syzkaller0>
[   90.124653][ T7802] tipc: Disabling bearer <eth:syzkaller0>
[   90.139297][ T7813] netlink: 'syz.1.857': attribute type 12 has an invalid length.
[   90.160865][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   90.270922][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   90.381229][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   90.435484][ T7836] openvswitch: netlink: Either Ethernet header or EtherType is required.
[   90.490578][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   90.601194][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   90.722508][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   90.830539][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   91.162287][ T7874] netlink: 'syz.0.885': attribute type 8 has an invalid length.
[   91.632364][ T7896] IPv6: NLM_F_CREATE should be specified when creating new route
[   92.303384][ T7960] bridge2: entered promiscuous mode
[   92.305383][ T7960] bridge2: entered allmulticast mode
[   92.308696][ T7960] team0: Port device bridge2 added
[   92.962365][ T7999] __nla_validate_parse: 16 callbacks suppressed
[   92.962483][ T7999] netlink: 40 bytes leftover after parsing attributes in process `syz.2.939'.
[   92.969798][ T7999] netlink: 40 bytes leftover after parsing attributes in process `syz.2.939'.
[   94.067518][ T8033] netlink: 176 bytes leftover after parsing attributes in process `syz.2.955'.
[   94.163143][   T54] Bluetooth: hci2: command 0x0405 tx timeout
[   94.427667][ T8061] netlink: 4 bytes leftover after parsing attributes in process `syz.2.969'.
[   94.571597][ T8075] netlink: 108 bytes leftover after parsing attributes in process `syz.1.975'.
[   94.576090][ T8075] netlink: 108 bytes leftover after parsing attributes in process `syz.1.975'.
[   94.579183][ T8075] netlink: 84 bytes leftover after parsing attributes in process `syz.1.975'.
[   94.952674][ T5871] net_ratelimit: 39 callbacks suppressed
[   94.952686][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   95.061656][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   95.155231][ T8102] bridge0: port 2(bridge_slave_1) entered disabled state
[   95.158474][ T8102] bridge0: port 1(bridge_slave_0) entered disabled state
[   95.276534][ T8106] netlink: 8 bytes leftover after parsing attributes in process `syz.2.988'.
[   95.279528][ T8106] netlink: 4 bytes leftover after parsing attributes in process `syz.2.988'.
[   95.282681][ T8106] netlink: 'syz.2.988': attribute type 1 has an invalid length.
[   95.285491][ T8106] netlink: 10 bytes leftover after parsing attributes in process `syz.2.988'.
[   95.299305][ T8102] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   95.310473][ T8106] nbd: socks must be embedded in a SOCK_ITEM attr
[   95.313100][ T8106] block nbd0: shutting down sockets
[   95.433758][ T8120] netlink: 'syz.2.995': attribute type 2 has an invalid length.
[   95.530969][ T5871] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0
[   95.550392][ T5871] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   95.554148][ T5871] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0
[   95.581468][ T5871] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   95.588393][ T5871] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0
[   95.612491][ T5871] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   95.616132][ T5871] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0
[   95.619743][ T5871] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   95.651770][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   95.718113][ T5937] IPVS: starting estimator thread 0...
[   95.761117][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   95.810496][ T8147] IPVS: using max 43 ests per chain, 103200 per kthread
[   95.881861][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   95.990599][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   96.061244][ T8175] netlink: 'syz.1.1017': attribute type 4 has an invalid length.
[   96.067589][ T8175] netlink: 'syz.1.1017': attribute type 4 has an invalid length.
[   96.100836][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   96.211237][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   96.320410][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   96.430751][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[   96.618607][ T8190] bond2: (slave geneve2): Enslaving as an active interface with an up link
[   96.623274][ T5871] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0
[   96.626439][ T5871] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0
[   96.629615][ T5871] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0
[   96.633312][ T5871] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0
[   97.028493][ T8231] netlink: 'syz.0.1043': attribute type 13 has an invalid length.
[   97.063714][ T8231] gretap0: refused to change device tx_queue_len
[   97.374674][ T8259] pim6reg1: entered promiscuous mode
[   97.376618][ T8259] pim6reg1: entered allmulticast mode
[   97.497883][ T8276] netlink: 'syz.0.1064': attribute type 13 has an invalid length.
[   98.000629][ T5233] Bluetooth: hci2: command 0x0405 tx timeout
[   98.035749][ T8315] netlink: 'syz.2.1080': attribute type 1 has an invalid length.
[   98.040153][ T8315] netlink: 'syz.2.1080': attribute type 2 has an invalid length.
[   98.175006][ T8321] netlink: 'syz.2.1083': attribute type 15 has an invalid length.
[   98.283409][ T8327] netlink: 'syz.1.1086': attribute type 2 has an invalid length.
[   98.727315][ T8361] __nla_validate_parse: 13 callbacks suppressed
[   98.727352][ T8361] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1101'.
[   98.810194][ T8369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1106'.
[   98.817417][ T8369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1106'.
[   98.961489][ T8389] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1115'.
[   99.089150][ T8408] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1124'.
[   99.274685][ T8419] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1129'.
[   99.381239][ T8423] tun0: tun_chr_ioctl cmd 2147767520
[   99.900772][ T8449] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1142'.
[   99.903866][ T8449] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1142'.
[   99.990338][ T8455] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1145'.
[  100.060796][ T5885] net_ratelimit: 32 callbacks suppressed
[  100.060810][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  100.081296][ T5233] Bluetooth: hci2: command 0x0405 tx timeout
[  100.171183][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  100.187564][ T8473] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1148'.
[  100.195356][ T8473] bond_slave_0: entered promiscuous mode
[  100.197456][ T8473] bond_slave_1: entered promiscuous mode
[  100.202922][ T8473] macvlan2: entered promiscuous mode
[  100.205206][ T8473] bond0: entered promiscuous mode
[  100.208583][ T8473] 8021q: adding VLAN 0 to HW filter on device macvlan2
[  100.292387][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  100.400448][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  100.478625][ T8496] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  100.500779][ T8496] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[  100.510382][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  100.586099][ T8499] openvswitch: netlink: IP tunnel dst address not specified
[  100.620484][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  100.730483][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  100.840508][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  100.950478][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  102.480921][ T8584] netdevsim netdevsim2: Direct firmware load for  failed with error -2
[  102.487750][ T8584] netdevsim netdevsim2: Falling back to sysfs fallback for: 
[  102.493881][ T8588] tipc: Invalid UDP bearer configuration
[  102.493904][ T8588] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  103.649358][ T8669] validate_nla: 1 callbacks suppressed
[  103.649371][ T8669] netlink: 'syz.2.1236': attribute type 19 has an invalid length.
[  103.663594][ T5885] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  103.663643][ T8669] netlink: 'syz.2.1236': attribute type 19 has an invalid length.
[  103.667436][ T5885] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  103.692877][ T5885] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  103.713755][ T5885] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  103.818459][ T8687] netlink: 'syz.0.1243': attribute type 29 has an invalid length.
[  103.826813][ T8687] __nla_validate_parse: 11 callbacks suppressed
[  103.826825][ T8687] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1243'.
[  104.114669][ T8715] bridge_slave_0: left allmulticast mode
[  104.117130][ T8715] bridge_slave_0: left promiscuous mode
[  104.125419][ T8715] bridge0: port 1(bridge_slave_0) entered disabled state
[  104.156341][ T8715] bridge_slave_1: left allmulticast mode
[  104.158230][ T8715] bridge_slave_1: left promiscuous mode
[  104.164527][ T8715] bridge0: port 2(bridge_slave_1) entered disabled state
[  104.178741][ T8715] bond0: (slave bond_slave_0): Releasing backup interface
[  104.186085][ T8715] bond0: (slave bond_slave_1): Releasing backup interface
[  104.197985][ T8715] team0: Port device team_slave_0 removed
[  104.206560][ T8715] team0: Port device team_slave_1 removed
[  104.208770][ T8715] batman_adv: batadv0: Removing interface: batadv_slave_0
[  104.284663][ T8722] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1256'.
[  104.464644][ T8739] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5
[  105.069175][ T8788] netlink: 'syz.0.1284': attribute type 22 has an invalid length.
[  105.124857][ T8792] 8021q: adding VLAN 0 to HW filter on device bond3
[  105.146255][ T8792] bond3: (slave macvlan3): Enslaving as a backup interface with an up link
[  105.149364][ T8797] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  105.154373][ T8797] tipc: Resetting bearer <eth:syzkaller0>
[  105.161326][ T8792] bridge_slave_0: left allmulticast mode
[  105.163150][ T8792] bridge_slave_0: left promiscuous mode
[  105.165039][ T8792] bridge0: port 1(bridge_slave_0) entered disabled state
[  105.169510][ T8792] bridge_slave_1: left allmulticast mode
[  105.172737][ T8792] bridge_slave_1: left promiscuous mode
[  105.175041][ T8792] bridge0: port 2(bridge_slave_1) entered disabled state
[  105.182433][ T8792] bond0: (slave bond_slave_0): Releasing backup interface
[  105.185100][ T8792] bond_slave_0: left promiscuous mode
[  105.189180][ T8792] bond0: (slave bond_slave_1): Releasing backup interface
[  105.193187][ T8792] bond_slave_1: left promiscuous mode
[  105.199997][ T8792] team0: Port device team_slave_0 removed
[  105.207226][ T8792] team0: Port device team_slave_1 removed
[  105.209547][ T8792] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  105.213491][ T8792] batman_adv: batadv0: Removing interface: batadv_slave_0
[  105.217057][ T8792] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  105.220123][ T8792] batman_adv: batadv0: Removing interface: batadv_slave_1
[  105.227855][ T8792] bond1: (slave gretap1): Releasing active interface
[  105.237616][ T8792] team0: Port device bridge2 removed
[  105.242043][ T8792] bond2: (slave geneve2): Releasing backup interface
[  105.247786][ T8792] bond3: (slave macvlan3): Removing an active aggregator
[  105.253974][ T8792] bond3: (slave macvlan3): Releasing backup interface
[  105.266918][ T5885] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0
[  105.270884][ T5885] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0
[  105.286934][ T8796] tipc: Disabling bearer <eth:syzkaller0>
[  105.295060][ T5885] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0
[  105.298188][ T5885] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0
[  105.344407][ T5871] net_ratelimit: 33 callbacks suppressed
[  105.344424][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  105.460660][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  105.511034][ T8815] netlink: 'syz.0.1297': attribute type 3 has an invalid length.
[  105.515910][ T8815] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1297'.
[  105.570699][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  105.691184][   T13] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  105.800457][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  105.879396][ T8851] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1314'.
[  105.910806][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  106.030793][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  106.140574][ T5871] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  106.251448][ T5922] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  106.370437][   T13] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  106.380127][ T8878] netlink: 'syz.1.1322': attribute type 1 has an invalid length.
[  106.384887][ T8878] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1322'.
[  106.388773][ T8878] netlink: 'syz.1.1322': attribute type 1 has an invalid length.
[  106.614200][ T8891] netlink: 'syz.0.1328': attribute type 2 has an invalid length.
[  107.006760][ T8916] netlink: 'syz.0.1339': attribute type 9 has an invalid length.
[  107.010127][ T8916] netlink: 204732 bytes leftover after parsing attributes in process `syz.0.1339'.
[  107.083247][ T8918] bond0: Error: Cannot enslave bond to itself.
[  107.547702][ T8930] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1346'.
[  108.062016][ T8939] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1348'.
[  108.405279][ T8951] netlink: 'syz.2.1352': attribute type 4 has an invalid length.
[  108.662353][ T8974] netlink: 6 bytes leftover after parsing attributes in process `syz.1.1362'.
[  108.827893][ T8978] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1364'.
[  108.834890][ T8978] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1364'.
[  108.938590][ T8987] lo speed is unknown, defaulting to 1000
[  108.951936][ T8987] lo speed is unknown, defaulting to 1000
[  108.962183][ T8987] lo speed is unknown, defaulting to 1000
[  109.027765][ T8990] 8021q: adding VLAN 0 to HW filter on device bond0
[  109.032328][ T8990] 8021q: adding VLAN 0 to HW filter on device team0
[  109.081313][ T5940] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  109.154650][ T8987] infiniband syz0: set active
[  109.157531][ T5937] lo speed is unknown, defaulting to 1000
[  109.159806][ T8987] infiniband syz0: added lo
[  109.171757][ T5940] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  109.226988][ T8987] RDS/IB: syz0: added
[  109.231617][ T8987] smc: adding ib device syz0 with port count 1
[  109.236501][ T8987] smc:    ib device syz0 port 1 has pnetid 
[  109.241094][ T5940] lo speed is unknown, defaulting to 1000
[  109.243953][ T8999] lo speed is unknown, defaulting to 1000
[  109.334053][ T8987] lo speed is unknown, defaulting to 1000
[  109.510844][ T8987] lo speed is unknown, defaulting to 1000
[  109.547599][ T9015] syzkaller0: entered promiscuous mode
[  109.549598][ T9015] syzkaller0: entered allmulticast mode
[  109.563984][ T5885] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  109.610520][ T8987] lo speed is unknown, defaulting to 1000
[  109.773635][ T9019] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1379'.
[  109.808791][ T9025] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1381'.
[  110.291005][ T9056] syzkaller0: entered promiscuous mode
[  110.293002][ T9056] syzkaller0: entered allmulticast mode
[  111.130083][   T13] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  111.135405][   T13] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  111.142480][ T9074] bridge0: port 1(ipvlan2) entered blocking state
[  111.145212][ T9074] bridge0: port 1(ipvlan2) entered disabled state
[  111.148252][ T9074] ipvlan2: entered allmulticast mode
[  111.152466][ T9074] bridge0: entered allmulticast mode
[  111.156761][ T9074] ipvlan2: left allmulticast mode
[  111.158604][ T9074] bridge0: left allmulticast mode
[  111.201210][   T13] net_ratelimit: 34 callbacks suppressed
[  111.201243][   T13] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  111.270846][   T24] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  111.320539][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  111.380075][ T9096] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1410'.
[  111.440552][   T12] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  111.550500][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  111.603510][ T9116] IPv6: addrconf: prefix option has invalid lifetime
[  111.660534][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  111.689450][ T5940] IPVS: starting estimator thread 0...
[  111.694059][ T9125] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold
[  111.753689][ T9129] lo speed is unknown, defaulting to 1000
[  111.770581][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  111.791850][   T54] Bluetooth: hci2: link tx timeout
[  111.794973][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.798877][   T54] Bluetooth: hci2: link tx timeout
[  111.801648][ T9127] IPVS: using max 79 ests per chain, 189600 per kthread
[  111.804957][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.807679][   T54] Bluetooth: hci2: link tx timeout
[  111.810924][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.814119][   T54] Bluetooth: hci2: link tx timeout
[  111.816175][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.818948][   T54] Bluetooth: hci2: link tx timeout
[  111.821103][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.824026][   T54] Bluetooth: hci2: link tx timeout
[  111.825974][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.829347][   T54] Bluetooth: hci2: link tx timeout
[  111.832334][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.835155][   T54] Bluetooth: hci2: link tx timeout
[  111.836967][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.840332][   T54] Bluetooth: hci2: link tx timeout
[  111.842159][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.845776][   T54] Bluetooth: hci2: link tx timeout
[  111.847608][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.850177][   T54] Bluetooth: hci2: link tx timeout
[  111.852176][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.854849][   T54] Bluetooth: hci2: link tx timeout
[  111.856629][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  111.880636][   T12] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  111.990476][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  112.111521][ T5885] bond2: (slave ip6gretap1): failed to get link speed/duplex
[  112.386294][ T9172] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1441'.
[  112.389838][ T9172] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1441'.
[  112.394944][ T9166] netlink: 'syz.1.1438': attribute type 3 has an invalid length.
[  112.494291][ T9179] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1445'.
[  112.526962][ T9181] x9: renamed from bridge_slave_0
[  112.531401][ T9181] netlink: 'syz.1.1444': attribute type 5 has an invalid length.
[  112.538813][ T9181] netlink: 'syz.1.1444': attribute type 12 has an invalid length.
[  112.586107][ T9183] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1446'.
[  112.589484][ T9183] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1446'.
[  112.854133][ T9206] rdma_rxe: rxe_newlink: failed to add lo
[  113.019795][ T9220] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0'
[  113.078459][ T9226] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1463'.
[  113.173680][ T9226] bridge_slave_1: left allmulticast mode
[  113.177554][ T9226] bridge_slave_1: left promiscuous mode
[  113.179951][ T9226] bridge0: port 2(bridge_slave_1) entered disabled state
[  113.185041][ T9226] bridge_slave_0: left allmulticast mode
[  113.187398][ T9226] bridge_slave_0: left promiscuous mode
[  113.190798][ T9226] bridge0: port 1(bridge_slave_0) entered disabled state
[  113.841471][   T54] Bluetooth: hci2: command 0x0405 tx timeout
[  114.084518][ T9281] ==================================================================
[  114.087962][ T9281] BUG: KASAN: slab-use-after-free in __xfrm_state_lookup+0x6ad/0x8d0
[  114.091135][ T9281] Read of size 2 at addr ffff88803b85d7c2 by task syz.2.1487/9281
[  114.094773][ T9281] 
[  114.095700][ T9281] CPU: 1 UID: 0 PID: 9281 Comm: syz.2.1487 Not tainted syzkaller #0 PREEMPT(full) 
[  114.095712][ T9281] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  114.095718][ T9281] Call Trace:
[  114.095722][ T9281]  <TASK>
[  114.095727][ T9281]  dump_stack_lvl+0x189/0x250
[  114.095743][ T9281]  ? __kasan_check_byte+0x12/0x40
[  114.095757][ T9281]  ? __pfx_dump_stack_lvl+0x10/0x10
[  114.095766][ T9281]  ? lock_release+0x4b/0x3e0
[  114.095780][ T9281]  ? __virt_addr_valid+0x4a5/0x5c0
[  114.095792][ T9281]  print_report+0xca/0x240
[  114.095801][ T9281]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  114.095812][ T9281]  kasan_report+0x118/0x150
[  114.095822][ T9281]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  114.095834][ T9281]  __xfrm_state_lookup+0x6ad/0x8d0
[  114.095846][ T9281]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  114.095858][ T9281]  xfrm_state_add+0x27d/0xc40
[  114.095867][ T9281]  xfrm_add_sa+0x35a1/0x4070
[  114.095878][ T9281]  ? __pfx_xfrm_add_sa+0x10/0x10
[  114.095885][ T9281]  ? apparmor_capable+0x137/0x1b0
[  114.095897][ T9281]  ? __nla_parse+0x40/0x60
[  114.095910][ T9281]  xfrm_user_rcv_msg+0x7a3/0xab0
[  114.095920][ T9281]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  114.095933][ T9281]  ? __pfx___mutex_trylock_common+0x10/0x10
[  114.095941][ T9281]  ? rcu_is_watching+0x15/0xb0
[  114.095949][ T9281]  ? trace_contention_end+0x39/0x120
[  114.095957][ T9281]  ? __mutex_lock+0x335/0x1360
[  114.095969][ T9281]  netlink_rcv_skb+0x208/0x470
[  114.095980][ T9281]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  114.095988][ T9281]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  114.096000][ T9281]  ? netlink_deliver_tap+0x2e/0x1b0
[  114.096009][ T9281]  ? netlink_deliver_tap+0x2e/0x1b0
[  114.096019][ T9281]  xfrm_netlink_rcv+0x79/0x90
[  114.096027][ T9281]  netlink_unicast+0x82f/0x9e0
[  114.096037][ T9281]  ? __pfx_netlink_unicast+0x10/0x10
[  114.096046][ T9281]  ? netlink_sendmsg+0x642/0xb30
[  114.096055][ T9281]  ? skb_put+0x11b/0x210
[  114.096062][ T9281]  netlink_sendmsg+0x805/0xb30
[  114.096074][ T9281]  ? __pfx_netlink_sendmsg+0x10/0x10
[  114.096084][ T9281]  ? aa_sock_msg_perm+0xf1/0x1d0
[  114.096096][ T9281]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  114.096107][ T9281]  ? __pfx_netlink_sendmsg+0x10/0x10
[  114.096117][ T9281]  __sock_sendmsg+0x21c/0x270
[  114.096127][ T9281]  ____sys_sendmsg+0x505/0x830
[  114.096135][ T9281]  ? __pfx_____sys_sendmsg+0x10/0x10
[  114.096143][ T9281]  ? import_iovec+0x74/0xa0
[  114.096152][ T9281]  ___sys_sendmsg+0x21f/0x2a0
[  114.096159][ T9281]  ? __pfx____sys_sendmsg+0x10/0x10
[  114.096171][ T9281]  ? __fget_files+0x2a/0x420
[  114.096181][ T9281]  ? __fget_files+0x3a0/0x420
[  114.096218][ T9281]  __x64_sys_sendmsg+0x19b/0x260
[  114.096228][ T9281]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  114.096238][ T9281]  ? rcu_is_watching+0x15/0xb0
[  114.096248][ T9281]  ? do_syscall_64+0xbe/0x3b0
[  114.096266][ T9281]  do_syscall_64+0xfa/0x3b0
[  114.096279][ T9281]  ? lockdep_hardirqs_on+0x9c/0x150
[  114.096293][ T9281]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.096304][ T9281]  ? exc_page_fault+0x9f/0xf0
[  114.096320][ T9281]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.096331][ T9281] RIP: 0033:0x7fd0f018ebe9
[  114.096342][ T9281] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  114.096353][ T9281] RSP: 002b:00007fd0f0f6f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  114.096367][ T9281] RAX: ffffffffffffffda RBX: 00007fd0f03b5fa0 RCX: 00007fd0f018ebe9
[  114.096378][ T9281] RDX: 0000000000000804 RSI: 0000200000000100 RDI: 0000000000000004
[  114.096386][ T9281] RBP: 00007fd0f0211e19 R08: 0000000000000000 R09: 0000000000000000
[  114.096394][ T9281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  114.096401][ T9281] R13: 00007fd0f03b6038 R14: 00007fd0f03b5fa0 R15: 00007ffc1e06e008
[  114.096410][ T9281]  </TASK>
[  114.096414][ T9281] 
[  114.231448][ T9281] Allocated by task 7401:
[  114.232870][ T9281]  kasan_save_track+0x3e/0x80
[  114.234458][ T9281]  __kasan_slab_alloc+0x6c/0x80
[  114.236074][ T9281]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  114.237951][ T9281]  xfrm_state_alloc+0x24/0x2f0
[  114.239694][ T9281]  __find_acq_core+0x8a7/0x1c00
[  114.241536][ T9281]  xfrm_find_acq+0x78/0xa0
[  114.243390][ T9281]  xfrm_alloc_userspi+0x6b3/0xc90
[  114.245485][ T9281]  xfrm_user_rcv_msg+0x7a3/0xab0
[  114.247491][ T9281]  netlink_rcv_skb+0x208/0x470
[  114.249285][ T9281]  xfrm_netlink_rcv+0x79/0x90
[  114.250861][ T9281]  netlink_unicast+0x82f/0x9e0
[  114.252504][ T9281]  netlink_sendmsg+0x805/0xb30
[  114.254088][ T9281]  __sock_sendmsg+0x21c/0x270
[  114.255745][ T9281]  ____sys_sendmsg+0x505/0x830
[  114.257362][ T9281]  ___sys_sendmsg+0x21f/0x2a0
[  114.258945][ T9281]  __x64_sys_sendmsg+0x19b/0x260
[  114.260767][ T9281]  do_syscall_64+0xfa/0x3b0
[  114.262356][ T9281]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.264368][ T9281] 
[  114.265288][ T9281] Freed by task 5940:
[  114.266634][ T9281]  kasan_save_track+0x3e/0x80
[  114.268170][ T9281]  kasan_save_free_info+0x46/0x50
[  114.269796][ T9281]  __kasan_slab_free+0x5b/0x80
[  114.271320][ T9281]  kmem_cache_free+0x18f/0x400
[  114.272859][ T9281]  xfrm_state_gc_task+0x52d/0x6b0
[  114.274468][ T9281]  process_scheduled_works+0xae1/0x17b0
[  114.276293][ T9281]  worker_thread+0x8a0/0xda0
[  114.277829][ T9281]  kthread+0x711/0x8a0
[  114.279228][ T9281]  ret_from_fork+0x3fc/0x770
[  114.280748][ T9281]  ret_from_fork_asm+0x1a/0x30
[  114.282542][ T9281] 
[  114.283512][ T9281] The buggy address belongs to the object at ffff88803b85d680
[  114.283512][ T9281]  which belongs to the cache xfrm_state of size 928
[  114.288923][ T9281] The buggy address is located 322 bytes inside of
[  114.288923][ T9281]  freed 928-byte region [ffff88803b85d680, ffff88803b85da20)
[  114.294325][ T9281] 
[  114.295340][ T9281] The buggy address belongs to the physical page:
[  114.297988][ T9281] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803b85cd80 pfn:0x3b85c
[  114.301900][ T9281] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  114.304866][ T9281] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  114.307937][ T9281] page_type: f5(slab)
[  114.309455][ T9281] raw: 00fff00000000040 ffff88801c338c80 dead000000000122 0000000000000000
[  114.312260][ T9281] raw: ffff88803b85cd80 00000000800e000a 00000000f5000000 0000000000000000
[  114.315216][ T9281] head: 00fff00000000040 ffff88801c338c80 dead000000000122 0000000000000000
[  114.318731][ T9281] head: ffff88803b85cd80 00000000800e000a 00000000f5000000 0000000000000000
[  114.322458][ T9281] head: 00fff00000000002 ffffea0000ee1701 00000000ffffffff 00000000ffffffff
[  114.326026][ T9281] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  114.329259][ T9281] page dumped because: kasan: bad access detected
[  114.331402][ T9281] page_owner tracks the page as allocated
[  114.333336][ T9281] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6052, tgid 6051 (syz.2.72), ts 62172434168, free_ts 62031464865
[  114.339956][ T9281]  post_alloc_hook+0x240/0x2a0
[  114.341579][ T9281]  get_page_from_freelist+0x21e4/0x22c0
[  114.343434][ T9281]  __alloc_frozen_pages_noprof+0x181/0x370
[  114.345383][ T9281]  alloc_pages_mpol+0x232/0x4a0
[  114.347038][ T9281]  allocate_slab+0x8a/0x370
[  114.348635][ T9281]  ___slab_alloc+0xbeb/0x1410
[  114.350216][ T9281]  kmem_cache_alloc_noprof+0x283/0x3c0
[  114.351983][ T9281]  xfrm_state_alloc+0x24/0x2f0
[  114.353554][ T9281]  xfrm_add_sa+0x17d1/0x4070
[  114.355152][ T9281]  xfrm_user_rcv_msg+0x7a3/0xab0
[  114.356829][ T9281]  netlink_rcv_skb+0x208/0x470
[  114.358409][ T9281]  xfrm_netlink_rcv+0x79/0x90
[  114.359991][ T9281]  netlink_unicast+0x82f/0x9e0
[  114.361603][ T9281]  netlink_sendmsg+0x805/0xb30
[  114.363156][ T9281]  __sock_sendmsg+0x21c/0x270
[  114.364855][ T9281]  ____sys_sendmsg+0x505/0x830
[  114.366658][ T9281] page last free pid 6038 tgid 6038 stack trace:
[  114.369031][ T9281]  __free_frozen_pages+0xbc4/0xd30
[  114.370890][ T9281]  free_large_kmalloc+0x13a/0x1f0
[  114.372787][ T9281]  device_release+0x9c/0x1c0
[  114.374434][ T9281]  kobject_put+0x22b/0x480
[  114.375935][ T9281]  netdev_run_todo+0xd2e/0xea0
[  114.377734][ T9281]  tun_chr_close+0x13c/0x1c0
[  114.379459][ T9281]  __fput+0x44c/0xa70
[  114.380989][ T9281]  task_work_run+0x1d4/0x260
[  114.382892][ T9281]  exit_to_user_mode_loop+0xec/0x110
[  114.384858][ T9281]  do_syscall_64+0x2bd/0x3b0
[  114.386658][ T9281]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.388790][ T9281] 
[  114.389709][ T9281] Memory state around the buggy address:
[  114.391845][ T9281]  ffff88803b85d680: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  114.394826][ T9281]  ffff88803b85d700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  114.397681][ T9281] >ffff88803b85d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  114.400299][ T9281]                                            ^
[  114.402459][ T9281]  ffff88803b85d800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  114.405110][ T9281]  ffff88803b85d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  114.407858][ T9281] ==================================================================
[  114.411464][ T9281] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  114.414324][ T9281] CPU: 1 UID: 0 PID: 9281 Comm: syz.2.1487 Not tainted syzkaller #0 PREEMPT(full) 
[  114.418080][ T9281] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  114.421536][ T9281] Call Trace:
[  114.422936][ T9281]  <TASK>
[  114.424277][ T9281]  dump_stack_lvl+0x99/0x250
[  114.426309][ T9281]  ? __asan_memcpy+0x40/0x70
[  114.428260][ T9281]  ? __pfx_dump_stack_lvl+0x10/0x10
[  114.429928][ T9281]  ? __pfx__printk+0x10/0x10
[  114.431472][ T9281]  vpanic+0x281/0x750
[  114.433105][ T9281]  ? __pfx_vpanic+0x10/0x10
[  114.434688][ T9281]  ? irqentry_exit+0x74/0x90
[  114.436589][ T9281]  panic+0xb9/0xc0
[  114.438227][ T9281]  ? __pfx_panic+0x10/0x10
[  114.440108][ T9281]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  114.442625][ T9281]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  114.445149][ T9281]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  114.447480][ T9281]  check_panic_on_warn+0x89/0xb0
[  114.449651][ T9281]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  114.451966][ T9281]  end_report+0x78/0x160
[  114.453791][ T9281]  kasan_report+0x129/0x150
[  114.455678][ T9281]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  114.457952][ T9281]  __xfrm_state_lookup+0x6ad/0x8d0
[  114.460110][ T9281]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  114.462476][ T9281]  xfrm_state_add+0x27d/0xc40
[  114.464426][ T9281]  xfrm_add_sa+0x35a1/0x4070
[  114.466339][ T9281]  ? __pfx_xfrm_add_sa+0x10/0x10
[  114.468372][ T9281]  ? apparmor_capable+0x137/0x1b0
[  114.470556][ T9281]  ? __nla_parse+0x40/0x60
[  114.472492][ T9281]  xfrm_user_rcv_msg+0x7a3/0xab0
[  114.474603][ T9281]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  114.476954][ T9281]  ? __pfx___mutex_trylock_common+0x10/0x10
[  114.479395][ T9281]  ? rcu_is_watching+0x15/0xb0
[  114.481465][ T9281]  ? trace_contention_end+0x39/0x120
[  114.483725][ T9281]  ? __mutex_lock+0x335/0x1360
[  114.485890][ T9281]  netlink_rcv_skb+0x208/0x470
[  114.487999][ T9281]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  114.490331][ T9281]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  114.492624][ T9281]  ? netlink_deliver_tap+0x2e/0x1b0
[  114.494915][ T9281]  ? netlink_deliver_tap+0x2e/0x1b0
[  114.497163][ T9281]  xfrm_netlink_rcv+0x79/0x90
[  114.499114][ T9281]  netlink_unicast+0x82f/0x9e0
[  114.501085][ T9281]  ? __pfx_netlink_unicast+0x10/0x10
[  114.503349][ T9281]  ? netlink_sendmsg+0x642/0xb30
[  114.505484][ T9281]  ? skb_put+0x11b/0x210
[  114.507334][ T9281]  netlink_sendmsg+0x805/0xb30
[  114.509307][ T9281]  ? __pfx_netlink_sendmsg+0x10/0x10
[  114.511434][ T9281]  ? aa_sock_msg_perm+0xf1/0x1d0
[  114.513532][ T9281]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  114.515762][ T9281]  ? __pfx_netlink_sendmsg+0x10/0x10
[  114.518017][ T9281]  __sock_sendmsg+0x21c/0x270
[  114.520046][ T9281]  ____sys_sendmsg+0x505/0x830
[  114.522287][ T9281]  ? __pfx_____sys_sendmsg+0x10/0x10
[  114.524598][ T9281]  ? import_iovec+0x74/0xa0
[  114.526542][ T9281]  ___sys_sendmsg+0x21f/0x2a0
[  114.528557][ T9281]  ? __pfx____sys_sendmsg+0x10/0x10
[  114.530791][ T9281]  ? __fget_files+0x2a/0x420
[  114.532783][ T9281]  ? __fget_files+0x3a0/0x420
[  114.534841][ T9281]  __x64_sys_sendmsg+0x19b/0x260
[  114.537000][ T9281]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  114.539345][ T9281]  ? rcu_is_watching+0x15/0xb0
[  114.541427][ T9281]  ? do_syscall_64+0xbe/0x3b0
[  114.543477][ T9281]  do_syscall_64+0xfa/0x3b0
[  114.545448][ T9281]  ? lockdep_hardirqs_on+0x9c/0x150
[  114.547668][ T9281]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.550250][ T9281]  ? exc_page_fault+0x9f/0xf0
[  114.552343][ T9281]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.554916][ T9281] RIP: 0033:0x7fd0f018ebe9
[  114.556841][ T9281] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  114.564672][ T9281] RSP: 002b:00007fd0f0f6f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  114.568139][ T9281] RAX: ffffffffffffffda RBX: 00007fd0f03b5fa0 RCX: 00007fd0f018ebe9
[  114.571490][ T9281] RDX: 0000000000000804 RSI: 0000200000000100 RDI: 0000000000000004
[  114.574902][ T9281] RBP: 00007fd0f0211e19 R08: 0000000000000000 R09: 0000000000000000
[  114.578348][ T9281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  114.581791][ T9281] R13: 00007fd0f03b6038 R14: 00007fd0f03b5fa0 R15: 00007ffc1e06e008
[  114.585247][ T9281]  </TASK>
[  114.587353][ T9281] Kernel Offset: disabled
[  114.589260][ T9281] Rebooting in 86400 seconds..

VM DIAGNOSIS:
03:59:29  Registers:
info registers vcpu 0

CPU#0
RAX=f8908d55f299c900 RBX=ffffffff819683a8 RCX=f8908d55f299c900 RDX=0000000000000001
RSI=ffffffff8d9b69f6 RDI=ffffffff8be33300 RBP=ffffffff8de07eb8 RSP=ffffffff8de07d80
R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4
R12=ffffffff8fa37e30 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a20
RIP=ffffffff8b7953f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fc01810a440 CR3=0000000114efe000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=d299952cc64e76db 7178a7a6672d5f87
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00007fd0f0eed100 00007fd0f0387460 XMM05=00007fd0f0387478 00007fd0f03874c0
XMM06=00007fd0f03874b8 00007fd0f03874b0 XMM07=00007fd0f03874a8 00007fd0f03874a0
XMM08=0000000000000000 00007fd0f0212ee7 XMM09=0000000000000000 00007fd0f0212fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000061 RBX=0000000000000061 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000003185 RDI=0000000000003186 RBP=00000000000003f8 RSP=ffffc900079569d0
R8 =ffff888106ba0237 R9 =1ffff11020d74046 R10=dffffc0000000000 R11=ffffffff854eff70
R12=dffffc0000000000 R13=ffffffff99af9904 R14=ffffffff99dee3a0 R15=0000000000000000
RIP=ffffffff854effec RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fd0f0f6f6c0 ffffffff 00c00000
GS =0000 ffff8881a3c1c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000010000 CR3=0000000114efe000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0001000800000002 000000070070bd28
XMM02=00007fe58eb87498 00007fe58eb87470 XMM03=00007fe58eb874a8 00007fe58eb874a0
XMM04=00007fe58f6ed100 00007fe58eb87460 XMM05=00007fe58eb87478 00007fe58eb874c0
XMM06=00007fe58eb874b8 00007fe58eb874b0 XMM07=00007fe58eb874a8 00007fe58eb874a0
XMM08=0000000000000000 00007fe58ea12ee7 XMM09=0000000000000000 00007fe58ea12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
