last executing test programs:

483.549604ms ago: executing program 0 (id=84):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000086dd0000aa0f00000000000060ec97000f982c00fb8000000000000000000000000000aaff02000000000000000000000810000189"], 0xfce)

361.01939ms ago: executing program 2 (id=87):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10)
sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x68, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_INNER_NUM={0x8}, @NFTA_INNER_EXPR={0x34, 0x5, 0x0, 0x1, @payload={{0xc, 0x20}, @val={0xd, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x5, 0x4, 0x1, 0x0, 0x56}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0xb9}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x4}]}}}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xc0}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x4c080}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, 0x24, 0x301, 0x0, 0x80, {0x11}}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0)
unshare(0x22020400)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETFLOWTABLE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x2c, 0x17, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000440)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2c}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x64}}, 0x800)

359.67857ms ago: executing program 2 (id=88):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r0, &(0x7f00000052c0)=[{{0x0, 0x0, 0x0}, 0x200001}, {{0x0, 0x0, 0x0}, 0x419}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, 0x0}, 0x2046}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000540)=""/127, 0x7f}, {&(0x7f0000006080)=""/4074, 0xfea}, {&(0x7f0000000840)=""/119, 0x77}, {&(0x7f0000000a40)=""/126, 0x7e}, {&(0x7f0000000140)=""/55, 0x37}, {&(0x7f0000000340)=""/107, 0x6b}, {&(0x7f00000003c0)=""/100, 0x64}, {&(0x7f0000000440)=""/188, 0xbc}, {&(0x7f00000001c0)=""/54, 0x36}], 0x9}, 0x4db}, {{0x0, 0x0, 0x0}, 0x20008}, {{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000780)=""/132, 0x84}, {&(0x7f0000000fc0)=""/158, 0x9e}, {&(0x7f0000000900)=""/220, 0xdc}, {&(0x7f0000000a00)=""/11, 0xb}, {&(0x7f00000006c0)=""/80, 0x50}, {&(0x7f0000000b40)=""/97, 0x61}, {&(0x7f0000000bc0)=""/123, 0x7b}, {&(0x7f0000002e00)=""/4096, 0x1000}, {&(0x7f0000000c40)=""/165, 0xa5}], 0x9, &(0x7f0000003e00)=""/4096, 0x1000, 0x200000}, 0x9}, {{&(0x7f0000000dc0)=@generic, 0x80, &(0x7f0000001400)=[{&(0x7f0000000e40)=""/223, 0xdf}, {&(0x7f00000019c0)=""/174, 0xae}, {&(0x7f0000001100)=""/212, 0xd4}, {&(0x7f0000001200)=""/104, 0x68}, {&(0x7f0000001280)=""/134, 0x86}, {&(0x7f0000001340)=""/95, 0x5f}, {&(0x7f0000000500)=""/57, 0x39}], 0x7, &(0x7f0000001480)=""/175, 0xaf}, 0x9}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f00000015c0)=""/12, 0xc}, {&(0x7f0000001640)=""/96, 0x60}, {&(0x7f00000016c0)=""/218, 0xda}], 0x3, &(0x7f0000001800)=""/222, 0xde}, 0x4}, {{&(0x7f0000001900)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000001980)=[{&(0x7f0000002a40)=""/143, 0x8f}], 0x1, &(0x7f0000004e00)=""/181, 0xb5}, 0xb68d}, {{&(0x7f0000004ec0)=@generic, 0x80, &(0x7f0000005180), 0x0, &(0x7f00000051c0)=""/247, 0xf7}, 0x6}], 0xc, 0x40002000, 0x0)

283.035308ms ago: executing program 2 (id=90):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r0}, 0x18) (async)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$alg(0x26, 0x5, 0x0) (async)
sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x1840}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x3}]}}}]}, 0x3c}}, 0x0)
sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x4000) (async, rerun: 32)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) (rerun: 32)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={<r2=>0xffffffffffffffff})
ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000180)) (async)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a60000000060a010400000000000000000200000034000580300001800e000100696d6d656469617465"], 0x88}}, 0x0) (async)
r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000), 0x31)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7050000080000a8c5000000a50000001801000020206405000000000004000f7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70400000000000085000000a700000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r4, 0x0, 0x0, 0xfffffffffffffdf3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
unshare(0x6a040000) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r5, 0x89f3, &(0x7f0000001a80)={'syztnl0\x00', 0x0}) (async)
bpf$MAP_CREATE(0x0, 0x0, 0x48) (async, rerun: 64)
socket$xdp(0x2c, 0x3, 0x0) (async, rerun: 64)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async)
r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000000280), 0x9) (async)
r7 = openat$cgroup_procs(r6, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0)
write$cgroup_pid(r7, &(0x7f0000000c40), 0x12)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r9 = openat$cgroup_subtree(r8, &(0x7f0000000200), 0x2, 0x0)
write$cgroup_subtree(r9, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5)

282.860133ms ago: executing program 1 (id=91):
bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8)
bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3, 0x0, &(0x7f0000000c40)=[{0x0, 0x2000001, 0xa, 0xa}, {0x1, 0x100001, 0xffffffff}, {0x0, 0x80004, 0x810104, 0x4}], 0x10, 0x1}, 0x94)
r0 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003e000b05d25a806c8c6f94f90324fc60100005000a000248053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0)

282.547452ms ago: executing program 0 (id=92):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="240000a1", @ANYRES16=r1, @ANYBLOB="b5af000000f90000000001000000100002800c0001800800010016000000"], 0x24}}, 0x0)

212.295036ms ago: executing program 1 (id=93):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$BTRFS_IOC_SYNC(r0, 0x9408, 0x0)
r1 = accept4(r0, &(0x7f0000000040)=@caif=@dgm, &(0x7f00000000c0)=0x80, 0x800)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r1)
sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, 0x2, 0x9, 0x101, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFCTH_TUPLE={0x10, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x2}}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x17}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x40)
recvfrom$ax25(r1, &(0x7f0000000200)=""/200, 0xc8, 0x20, 0x0, 0x0)
getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000300)={<r2=>0x0, @in={{0x2, 0x4e23, @rand_addr=0x64010102}}, 0x7, 0xfff8}, &(0x7f00000003c0)=0x90)
getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000400)={<r3=>r2, 0x21}, &(0x7f0000000440)=0x8)
r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x6)
r5 = accept4$ax25(r4, 0x0, &(0x7f0000000480), 0x0)
getsockname$l2tp6(0xffffffffffffffff, &(0x7f00000004c0)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000500)=0x20)
sendmsg$kcm(r1, &(0x7f0000001a00)={0x0, 0x0, &(0x7f0000001900)=[{&(0x7f0000000540)="6deda993b696e3c6a6583c14e8012261b939dfd08309a8aa30098b463196f32a427db9692516e398ad668d1ad7a4dfcb672fa7352945bc4ee31fe6910d0a58be6107d6af0bc4486e3e401267d65e7b712bbe60b45878c78e10e2bbb382e46d08f6baf7e1e6782bda9653b6f6f054bf8f9cf94fca954a63b7917bc45e750ef979a3974c7cf32d2cbcf19dcd111ec2de8fb94557aafeecde003b7a4bacca93a35b0022bc1c886bb508", 0xa8}, {&(0x7f0000000600)="1c33a02efdb009bfd47fdae5baf8065cf81606dd4482b2bea3df3219eb8a873dae6572b36af5b4903d420c1ef74d76ce9606d17c084c628d86312632706dbb402357ba8b3806140cca48ad8f6efd6ec669b4b2e03d8a07d64d5b2bc0e569811a61a0dd836856cf6b7dd085d231ba78ace1e5a5ae41990142ceeaa0b498fa0961b801e0e4c22d4781258f0f22fa65fb91b3bc1fe3f47cf6dbdf45344f4079dc32e30a6c6090b744ab40cd09bc9a0720ec714bb4dac59a23", 0xb7}, {&(0x7f00000006c0)="2e1919f1b740e97ffba428907ba76880bd1052396196b00cede310a04ce011b93b827adb9b1af449bbcf19f41efb041952e4561f092dad081b885693dc502e3f26e181bcd6a8a49f8e8b6fccae2789086339fcc6dbc47a1e3972a941121a6f39da3dc6bc330af80afd393144ddee7af8dbaea44f478b441d5946c2e7560bd806c97541", 0x83}, {&(0x7f0000000780)="eed57bac0e487d6b6a47b7096dd999f3002f7345534dd16872763af089e5a93b3fab52e69f71808aa05f096230711e8fe843aee406f096305a55855ee74c", 0x3e}, {&(0x7f00000007c0)="ddb1c5ec220e95d094998905770f3c1bed67492fcfe6d0680c6d65210d69f3a4bfa18ca81e524cd4bab39496569088af778115", 0x33}, {&(0x7f0000000800)="d862d6b1d062f34434d5726d1594ff79f4f9442bd849227cfd717f7226e6a64ae4cc7e6355beb9c77c6d54ecb84a3f48820956768a6699c22c27fea2793121cace06c861c022973270040b838db415f490a9a707b4f164778a2a890c968129c490", 0x61}, {&(0x7f0000000880)="3ecf507cd1b5cfddc80ea291dcb0b99d91ce41819180070476ddc9915ae1a82498a0421d59aa07fce800083e0009c4e4cab0bc", 0x33}, {&(0x7f00000008c0)="8179d7ad30059af4d5", 0x9}, {&(0x7f0000000900)="e590b527a05d70f55c0da5e74d5bf5e98f41a252468997685230246ad278f5ecb7aeccf45bf718d9bb81d37267737cab5e1ade85055ab9124fb094c6f7c70af7c1b83394d6789f4f43dcb019159bdb6390d3d2a756a0df16b0f5a0a7ff7a99fd1770f2288dfae96c9ceadea8e7a8e28adb9f261a7a20afae954147de99f9c4d2528434fe526435532e276f73dca15dbbba4a7b388d37e035401b27c73ea5b70343cca637945e333175cc0a9c1085fcc84384a4bcb8e64927d78a2f14d7c120a6a8a4600a262d3527fdd12c10cb12867731e62cdea2b2ed695b83a296ec3c176d6a5c76db3bd61e6bfcc49673338c7bb8a970ca61c68f527bdc596d4030a665868764cf42980ce9a45c588ea2570ff98683a90bd3601306b208767cdfc18a22b11c9939ac4f7fbbdc4640aa1c45811d443343f3ea4da1b9ff2fc659d93cdcb55ba19d09b301b168028fba1adc7e0134e390b5b862071bcbed20ac4e27540525c00ccb137efa3d4051973a96ffb161ab0b1ca75836d77101d902cc45342e45902ed25ad304cc3f0dd1bc2a12dc7723fe3ce28ea021669b930539ff907ce142c36b24adee3ad91adfff888cefe27bd23b0d94cb7b1db8aa2cb1924d2ee04de0e8f00d785a162acd7a48a1cb847340b00a4323a616e07d4d13db72e19dab7321d13f3ead5480ca5bfc2db2de8cf90d76a3b02f9683747eb5073f36cacb5fd5f4af13ea1974d6e45343686f6d021547e597cafd118f584e2e8e1268ec6690d695df4902555edbb12821a943e527367c52596333ae1a41b1c65d846ea0215241dd215f628cedfae736a2c23e30d01ebe068d728643a68a2dd85f99082aaeefd93ea9197446dc59bf781127fac6939c8249efb502ae1d590892a59281bba56878a64e62b9e99cb32def4abc5ad63faca7abf0ee49b0e0d85e86515c8151f109a3811bbff51522769a06ead7e1ea18a518bda5533ff75545dab9308ff52834ee5d15d0537d86f40917a117c89b71f516892f6ac3903392d437d97c0f8ae8a91e6c04835cc858a56844b2a04203e2557a4cd1dd8b8ab9e6e1b8aa913c48daa5cb9ec47ae67cd5cd18d3b1e77d0b4167dbe4d2bcf2988fd52dbc2d7b1af29e81dad6688b406e5d1bb68683568be394fc32a35d0c11302f33018d9f927d2ce67b137293c0c3bfa9895617cf315949041455dfbd96cacf2ceeb38a3ab17f1cac7000c4248c14d656863e97167cbbf296cc05ffd3c42dc3801a3c6cc62a199e77a55427a4fb0c4f3c5b6dd9c36fecd22cd8eae995eb82a6add4ea55e7ef7982b4b07b895c06928b5264e189c688e1179b2d6f0ad865ab75ae772a9265f40a8330116dab3e7eb21e527550821b0ac8ca8b27e5500820ecfad5bccb7a187b1a94e0a5235b1a5e3d1e63375f1445aa393a9cc521426a4165eb687a0c04d8b7da41935f37bc0f3c023879f4c0fb97aa19c937bc219ddad10eb1f8f386c3ff6379ca3a22b4bbccc2c96bf2a5fffb36761ce67711c18ae1acafe6853e9903995fc86d813f7053749d4bbe84affe5d8acc445bb9df89891544ef5a431e080b1f0e67231463e9498ed081e44402d207cda220ec1fc1b8e65cee892666aed46d2529e5a75927a39adf1cc683225bcc658e6f6efec5ad22a780082eba697d0c333648dd8df37e1ac80bf54d0f93a8bb20f7a92daa53d36f8216ce8dd632dc91bae860900cc58b07adb4f1daf2510737a2a38deed117cc94b69af381603cac7de228ad8c846ff3a08b9e6bd9d59789e9bac5d4d6f0d38d4ccf4c09a7edfe3b95e566a12c8a2ba668a35d2a367b0edf1412eeb099c55a3877f562637cf98ebecf792c279f42fd261a366d2e4f95a5010a28dac8ffebbf51abe4269052fcfec7ddd97846000490957dc60d3e74078ced834ba3db62aac3fb8c4230002705a46567a8efc7151e01847d4e03fcc1c5285cf2b9f39c1aa98bef48bc05816910ba72be0082e895bf6ef99821729c5de7421c3458c3b10d79a48bcb00a7f04df5b624e96bf70c9c547ad820b66744c8d744bf95dc658f91e2a1495ed75ed6c57afd4732f5d177c6da1a5498930f2ba5e35c7174a836a45327d8cb8bda71e1b55a0c8d74fecdbc2b66776bf338b1a742bdbca9854152157fb85d5add3577211187a981ded0aa3e578ba14f16a9d6de95fa51dfc55c6d48b9c8b89bb04108099fe5f338717a06f934c9d6c7e3b5741481cf6fde41ea84f5f12a69e277225759292552707c23a3f55ce090e3adc64363aeb5345ddc2283b1819dc9b1d7e8087329dc8198f15b037e1df509fbb89c7f3239a0fa6461ff5308904cdb2321582012adb9b8ae20f21d6d6655cb3fab157ecfec5bb5ba6ef5779ece0cd1308379cd2183e226db20ceb88c1f8fb914df409df2afd1a5b48273383c685634036236fa579f0bf54ccbb4eacdb3a5468b92eca8dfba0a7ccf4eff98f263e59bd33af48299510b9231de9ad21b4bac4f7c666af73864d8b6d8f3036d3cbbf11399137441df61ab3bc8ddbc892fa273377722e82bc430a52f65a1d67ad8e8aa5e10d12d7863b4c7d7e399aebdfe547f54bf496533e2fbf1ed2adb1407f5ca4b956b7d7ea8f674be7bedc06a971079601e096e168e312fc0ae3c2b41f87ae62f6dddb3f9cfeb50acf1c94243c4b03bad43325434133fee38bb95aae00c9c43772d81f11afffb2cc75fc9de8e26f24b8d73f55a8f866fa752bbc3d6fbba1c5826a67624d1a5d1cceb239393e63c77a35ea24ef690b742280fd0a927c4aa1a37e38b45561040c5f854370d5d713a4d5a69dbb1516632bc1dc768e806be5105763e958e47976e11ef747d3bd0d0e72db2d2de34f4ac90df809328c78aa24bdf95f0381a7d0d5a442d1bfc9f44eb0f0a9135ca33507ab909b7a66ad0a5424c1b1243bc954e81bff13e2ded615a734d40b203fef6a4e0581e4711394b8cd05210262d4adf99ba46e83d087f6228a9d1335b41b789a42f25eab43168012e127f17c8d7bafb3fe637a0b8d9418d0dd5804f05877f848689d864e5a28cb626b08b7d78f348f4735d3db324e2712d0fb1da40661a3e1137652f81ca9ba5a1b46283171cb470ea18b1e9af94f9c338e77af016fce80a533c673454870048ffb51797bd146d107937fe03e11ea9a7c1042a42c70f40de43e2d6437965f2b9990cb07acb9a368dfc0a7178df75d57688da242bb75a417e40a3c5665b6da52feb31476fb63a830261aec2cd13c2a66f4896422e6b6e4f05175b1a000915d3d07e127c277760c5392c694bd25815adf335859010ffc058ce4e82f66179fcbbfd3b60f366b1254ed739ea2679aa2ada4218e55eec9ebc76a9b04990f3abc0f3e0726596e58c246fdbcafee50f8796effa45bdb742228aff4edde46bab6746e73ee36487ad69fa639850b2ffec8d2cbc852664e3afe0fccdb39159a64039a4110d4c4217a6a48cfb85bc90e05ba43f4688650b4c73fd783abedf00a7e2186f4335ee79dff5d6466ac5bd4d0c52850178ca8a4279c7d36a58a065ae4a3ef219da3f52a211c7853f3dc2d05ee1d16f40c5bc972733a3c5590d2be78c90e1203231994d83944083de01b8a212499732469038c2d26dbf1315dcd2f9f26504f623924f960c415c654ffa955b279be0f95d4ce02eef4dca82e13b778b939c07ef207d95f9f4d695863e56e615e6f00851ee79f7cd0c482018840482cbe57b06fa3e53a1ccba313e828ef59026bea4d421c6bd92255e75a176c2efa32b45b7eec62d00c09f8809d2546547949c5fa35cea9433489956b1c85f6df95a3c310b1d349e650811f7b7f3d50d47ac4c4c9f8f7d41237335f5134a02e6448529ebb6ca0fd5a847b6788b633bd43336fec638479af1b1d042c4fa2efa5ec5ef4c46257038278e2ef03acdf740c7b34c14c2ecfd62d48a074f047c522d9f7d4ff9358d639c0ae66671faab4bc07acaf8449875407619f66980c774ab3d6ce954f50a479e1e338e8feed96a2bd480255609f8f64722a0cb5354c04f096ca62e3d77326a1545eb16e6eddf691864b86e3881fd0b7c7dc596056f1e1f8eefc7bd978adb4d4c75f71d6528157cff5a9c8665308db38fc8a1ad9b380fe99dadd1930dec41beadeaf4973ba5a185ec023bfb1c0d77171003742136452f980993ad34961793c11d58a5916ea98cbd63eeae44324562aab5480ee07ded70e455b04bb7f7f6dd3f4b50712195d9ccdba06f72c20f830ffa3d60ffcfee056ebbadee3b22111a69719f8d82309435ca7263295ef616a14b33b29cf4adb593d4e9aef30d7a44a5ba0225a174e1d74a67aa21de29243adfd99131a3e2934c72be6da8c4fb38a9f9eb7a8db0b94fe5e35fbd4af2a831a6a1015ccca096fd19d167a03d952c208b045436e860fde01df66688d448aa69fe9c5903da560ba8ae0d20822f7272e455c512de2caeae5ee389045fa36cf1805fa9d47280930530df3795d58f14376e80589691a9b25af143a8796c4feca766ef358721b70b37d4c52bf36c08ce3eb287afa97e073081091a2a1bc41f48ea944a7c079c130bd29c5f7bf2add6e7f2300f18c169a5f49bafad371eae66e3a6dcdeb59ab260120d0447f34e6e51625e15ed553bfdc16b61bf6e760f41101336d0bf71bec65b33c0cbc9ebe692d1d022b83247ad69675001fdbeac4ac8bfbc3ab9c790454a8066c5e817cd5db1ad0723ae4e2595a4a1074b294ac4fd22a87df73137703133157f618a92a9dd8eb7a8b7987dedc77294f42ec5ee549f5ee1054878344df15299bdeb052f2172b8b574c6f963332abc9fe53c711aa8b86c42a93c6a28ee3a525545a517dfabfdaf9d0f5545756af07291b322951eb9a2c0a9103a8d78784eddb4497dae4504f782d8f61ae5dd21a09c67a3221dc2a4950cd0c03d773484bb25fbccc68779394aa9b4e705811e26ca54110a2937c474f7f108726e58619dcb503146a137e7bc21bc5b3877b3c82074489c54a949a9e8793b718d5e7a22656c4b01368c98049e0f18d5bd47cce75332db1f01c52f7456a94a817f1455fe95f263b175317fea2e909f790a7432b0a4d0909af2885bc1e4a8fe201fc932325d20d205a0d6392eb980aa10e4a0094ca1e1d0c097aff6bf5c1b40b8159ece3ac921790f89a1e359c23d4d52ef7f8d1eef5017f40d9ec34f96cc9497df9900d83dc55c5f817888e3d81561303ee1e6631468c8030e958afb3f6848a14540fce776c6bd1228b13b66855adf56d630c592ccaf373eb2299ba4ac8cccca8260188137257af2724cd02be327c47e43a5933c4663e7d4a92ba9107d98ed16a567642af3994ae7173a096f5a4a86063fe0eeb0f72e75028b37e5df612970a8029e67e850422c53d4296f759d54810aaf40e629cbe3747b833fa7c220622f60bf519249efef45e7f29d24aa67037f3273b0246dbffe97574c25dfb609ddf7831fe752e84a5630a3a8f6cf4e1053fa617f34b7876d5be23e676045b03dfa90be47b4607a0b673c04816279e2a6efed11dbced116e73288ca1186608fa38afd0a8ca9471d633ad17db9f5b691ad487a9cba8ee7266ee16763aaabc34ce0fabede286f195694477e4864992734d8ce20f059ddbeeaaee85bb141ed9f8f06e43be59f4f6513831f48f42ab759bc17644240917cc34cacf3c45f2fe46679e34f6a6dbaadce817799b82d79c10a550e2c35fc6bebdccf1b652afe09ac58c2111bf39641cd5867ffd5e3be7f3a7de9d7e30167c2e87c8888edaad076f1eb140ba925424726746be5f0de40420ab9e00dca1716654170b81343014f1029", 0x1000}], 0x9, &(0x7f00000019c0)=[{0x40, 0x10e, 0x6, "def9830d9cd8c5382ffbd2b0735c92f3854cf2a0b8c84bc488bff9561df4b95d18caff65e3c056d04e06139cb3ace6"}], 0x40}, 0x40801)
r6 = socket(0x27, 0x4, 0x5)
getsockopt$IP_VS_SO_GET_TIMEOUT(r5, 0x0, 0x486, &(0x7f0000001a40), &(0x7f0000001a80)=0xc)
r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r7, 0x8982, &(0x7f0000001ac0))
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001b80)={0xffffffffffffffff, 0x58, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, <r8=>0x0}}, 0x10)
pipe(&(0x7f0000001bc0)={<r9=>0xffffffffffffffff, <r10=>0xffffffffffffffff})
bpf$MAP_CREATE(0x0, &(0x7f0000001c00)=@bloom_filter={0x1e, 0x5, 0x6, 0x7f, 0x0, 0x1, 0x8, '\x00', r8, r9, 0x4, 0x1, 0x3}, 0x50)
r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000001cc0), r6)
sendmsg$TIPC_CMD_GET_BEARER_NAMES(r6, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x1c, r11, 0x400, 0x70bd26, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r6, 0x89f7, &(0x7f0000001e40)={'sit0\x00', &(0x7f0000001dc0)={@rand_addr=0x64010100, 0x1, 0x0, 0x50, 0x0, [{@initdev}, {@multicast1}, {@dev}, {@loopback}, {@remote}]}})
r12 = syz_genetlink_get_family_id$tipc(&(0x7f0000001ec0), r1)
sendmsg$TIPC_CMD_SET_LINK_WINDOW(r6, &(0x7f0000001fc0)={&(0x7f0000001e80)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f00)={0x68, r12, 0x10, 0x70bd2a, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0xb, @link='broadcast-link\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x8014}, 0x804)
ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r10, 0x8982, &(0x7f0000002000))
setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000002040)=r10, 0x4)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r6, &(0x7f0000002140)={&(0x7f0000002080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000002100)={&(0x7f00000020c0)={0x10, 0x1404, 0x10, 0x70bd2a, 0x25dfdbff}, 0x10}, 0x1, 0x0, 0x0, 0x24000000}, 0x0)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000002180)={<r13=>r3, @in6={{0xa, 0x4e20, 0x1, @loopback, 0x58}}, 0x0, 0x4, 0x30000000, 0x6, 0x5}, &(0x7f0000002240)=0x98)
setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000002280)={r13, 0x3, 0xffff, 0x9, 0x6, 0x7}, 0x14)
sendmsg$NL80211_CMD_GET_SURVEY(r1, &(0x7f00000023c0)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, 0x0, 0x8, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x7, 0x75}}}}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x24000024}, 0x4000000)

212.050061ms ago: executing program 0 (id=94):
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="f00000001000000328bd700000000000ac1e4101000000000000000000000000ac1414aa0000000000000001000000000a0000002c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe880000000000000000000000000001000000003200000020010000000000000000000000000001ffffffffffffffff000000000000000008000000000000000100"], 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r0, 0x0, 0x8000000000000000}, 0x18)
socket$nl_netfilter(0x10, 0x3, 0xc)
syz_emit_ethernet(0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6000ed6a000b2c00fe8000000000000000000000000000bbfe8000000000000000000400000000aa2c"], 0x0)

211.880693ms ago: executing program 0 (id=95):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000200)=ANY=[], 0x32600) (async)
r1 = socket$packet(0x11, 0x3, 0x300) (async)
r2 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r2, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
listen(r2, 0x0) (async)
shutdown(r2, 0x0)
accept(r2, 0x0, 0x0) (async)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r3=>0x0})
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000000", @ANYRES32=r3, @ANYBLOB="06a000000087f91a62b440e8c0f6bf820000001c001a801800058014000180080001000008595023117196e235f99607000000bd06c0dc72aa60f45d881c4e90536201e4b02b6de00101000000000000ccdc0f2555645c9b8342650dcabf4afc639bb6e4c970c349a98e9fc1f21aa660c5bfa01e8c5ee144f94999fab69bf675a31b5fb3543337c7f9990327d95d8cf786000096e2254854ceb494eac895a2975aef95c1f0c083de4954e4095265bcd4f1e7cdd77b583ee8c46775b9c5ab3e31f08fc9e641a2792ad26e7f9bc020b23fecb646fdb34d1c4e58ee5e1b"], 0x3c}}, 0x0) (async)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) (async)
r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008000000000000000000000000000000d40800000000000093f5", @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES16=r4, @ANYRES32, @ANYRES32], 0x50)
unshare(0x2a020400) (async)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r5, &(0x7f0000000040), &(0x7f0000000280)=""/144}, 0x20)
r6 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x83, &(0x7f0000000540)={0xa, 0x20a, 0xe1f, 0x2}, &(0x7f0000000580)=0x10) (async)
r7 = socket$can_j1939(0x1d, 0x2, 0x7)
getsockopt$SO_J1939_ERRQUEUE(r7, 0x6b, 0x4, 0x0, &(0x7f0000000040))

143.549385ms ago: executing program 1 (id=96):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x7, 0x4, 0x100, 0x5, 0x28}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000010300b70300000000faff840000001b000000b7000000000000009500000000000000"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

143.310915ms ago: executing program 2 (id=97):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@generic={0x71, 0x0, 0x1, 0x4a}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000400070001"], 0x50)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={<r1=>0x0}, &(0x7f0000000080)=0xc)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x1c, 0x15, 0x301, 0x0, 0x0, {0xc}, [@typed={0x8, 0x4, 0x0, 0x0, @pid=r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x0)
syz_emit_ethernet(0x9a, &(0x7f0000000540)=ANY=[@ANYBLOB="0180c2000000ffffffffffff86dd6000008000641100fe80000000f0ffffffffffffff0000bbff02000000000000000000000000000100004e22004d9078020000000000000000000000eaf12af8010d4894322fd8f9f39c6526ece5d2603725b9cabfc2c9f4513d3dfb201f3a70a41ef6c2fca06a9bd768d5f176c198150020000000000000000010009514b06796dbf2ea9e520f1475c8f65b13efcfbfc9b1d0e5c58b4be6608c9608e393ff14c36c9c3390f375043be439a02b275fa5b79c00e7ae925b94dcc6a70a1afb34cb5cb991a40a2f23322648ac95f7"], 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b400000000000000791028000000000069004200000000009500740000000000", @ANYRESDEC], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/164, 0x0, 0x25, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff8f}, 0x48)
sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc)

141.416392ms ago: executing program 1 (id=98):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r0, &(0x7f00000052c0)=[{{0x0, 0x0, 0x0}, 0x3262}, {{0x0, 0x0, 0x0}, 0x41d}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, 0x0}, 0x2046}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000580)=""/127, 0x7f}, {&(0x7f0000006080)=""/4074, 0xfea}, {&(0x7f0000000840)=""/119, 0x77}, {&(0x7f0000000a40)=""/126, 0x7e}, {&(0x7f0000000540)=""/55, 0x37}, {&(0x7f0000000340)=""/102, 0x66}, {&(0x7f00000003c0)=""/89, 0x59}, {&(0x7f0000000440)=""/188, 0xbc}, {&(0x7f00000001c0)=""/54, 0x36}], 0x9}, 0x4db}, {{0x0, 0x0, 0x0}, 0x20008}, {{0x0, 0x0, &(0x7f0000000d00), 0x0, &(0x7f00000019c0)=""/4109, 0x100d}, 0x6}, {{&(0x7f0000000dc0)=@generic, 0x80, &(0x7f0000001400), 0x0, &(0x7f0000000ac0)=""/175, 0xaf}, 0x9}, {{0x0, 0x0, &(0x7f00000017c0), 0x0, &(0x7f00000006c0)=""/237, 0xed, 0x41000000}, 0x4}, {{&(0x7f0000001900)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000001980)=[{&(0x7f0000002a40)=""/142, 0x8e}], 0x1, &(0x7f0000004e00)=""/181, 0xb5}, 0xb68d}, {{&(0x7f0000004ec0)=@generic, 0x80, &(0x7f0000005180), 0x0, &(0x7f0000000b80)=""/248, 0xf8}, 0x6}], 0xc, 0x40002000, 0x0)

83.531628ms ago: executing program 0 (id=99):
r0 = socket$l2tp6(0xa, 0x2, 0x73)
getsockopt$inet6_int(r0, 0x29, 0x35, 0x0, &(0x7f00000002c0))
socket$xdp(0x2c, 0x3, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x4}, 0x6)
r2 = socket$nl_crypto(0x10, 0x3, 0x15)
ioctl$EXT4_IOC_MIGRATE(r2, 0x6609)
write$bt_hci(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="0000020008"], 0xe)

82.371463ms ago: executing program 1 (id=100):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000001f00010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003", @ANYBLOB="af8e6cd7bb964e93492461953e62dbe71defb13264987a5b2ba8b4160b0446e72dbe555d63ef46c3dd109c478a87eb423d1fbdbe075aa5fdbd39c36f4f82885883d20e11dff1018c19f3519a74142219b5f6a14ae57b90a2717b1a052d8eea3f1855089e5a1b218c1ce5992fca59cfc9f109b4f7e883d08c351dc0bce76ff18742d1b83f1616901615a3498f2c8cb6", @ANYRES64=r0, @ANYRESHEX=r0, @ANYRES8=0x0], 0xec}}, 0x0)

82.164151ms ago: executing program 2 (id=101):
socket$tipc(0x1e, 0x5, 0x0) (async)
r0 = socket$tipc(0x1e, 0x5, 0x0)
setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x4}, 0x10)
r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000500)={0x0, 0xffffffff, 0x8}, 0xc)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) (async)
setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r3)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002dbd7000000000002e0000000a0001007770616e3100000005002e007f0000000c0005000201aada92afc3aa05002b"], 0x3c}}, 0x0)
connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c)
sendto$inet6(r2, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56)
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x200000e, 0x12, r2, 0x604ab000) (async)
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x200000e, 0x12, r2, 0x604ab000)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r1, &(0x7f0000000540)="14df6cca7fb0a6b1e444638663c8128927554446af8af25f561dfcef53518ddaa680673f05b125dc49fb9121763d840c31c251b3caf45649ca5d6a5d7bfa66bfc0f733832a5594302cce8ef1e0ece2007d1a23bd987a1a1cbab682c7d66122fa738bc936f0ef6d22c84ecc7b782e", &(0x7f00000005c0)=@tcp6=r2, 0x1}, 0x20)
r6 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) (async)
setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='pids.current\x00', 0x275a, 0x0)
mmap(&(0x7f00008b7000/0x4000)=nil, 0x4000, 0x0, 0xb4013, r7, 0x0)
sendmsg$tipc(r7, &(0x7f00000004c0)={&(0x7f0000000000)=@id={0x1e, 0x3, 0x3, {0x4e24, 0x3}}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000140)="20374a37ff2867e2bf9809fb426f2357736cccf9ed754e11c2c1d32c5cffdcdaa6bb9912794808b3719bcf9bb075ceb86415dc9a996b99b2f2d7cf64075a949027edf8943f52ecc3602ee942390a7bfe5093d6fe87b36357ebddd52ce1411f2a01c2f7002b247474edd2e8e5dca94725be8d78d86319a8aa643b01bdc288e98d61c9c87f85c428ddcf99567fc027ad22705f66aea4b4feb490501cbab0e3d5c68e4accbfc346a7cf0a8373305bc3621cd13c4f440cdbc1ed14a06a86cad3829881adee1aeee225937ccc4f9f662ca0d5c0a1ab", 0xd3}, {&(0x7f00000002c0)="e59d4f7266ae5653f34153be8c10c89f112060943cbf9631413a2b56d17732f746822beb21d65965af494b44396d19d04146461643fbd3", 0x37}, {&(0x7f0000000300)="384566ab0166ae534a1ae7fa1744e0eceef99cfc1063edbdb5b0b56e58870a891a3d2d52f23fe51027de841309c00fbf54629578bd05f62573b9abe993f7a2aba925115d565eb94b9cbb46f8abc9c158edc790f69b766da77b0a78ef53db39eae686f76fabfcde89aa82c56f25cf1647e3be4d9d0f891349a1628488d7d5f82dc24f32bb87f4aa44fc2cdad5f0cc2f1cd0b35d91ff2f78ea3d5c4513251baec8fa5e2bf8887b667ea4f5c9d6201a4623ac03e5e2e9761201834f6f396825692b8ec945984280ab61103f00d08661baf52d81881a903c4f9cc645cc374ef60a2f4e5cf770dbf8ccddafca18c7671a1eb31ddebc720b8e638eacf4e6eb", 0xfc}], 0x3, &(0x7f0000000440)="37db22e9f0732faf2d6bacb9bd1bfb5db381adf874300213d4b7db6c4a8e1b5655c67e2bacd783e8739d1cecf4410475db1d814eebf052abdf6fbff526b7a5d7451a0a0c7c6ba6a8eb3fe1d90de2cac3e2f45c1085be4079e3a6b68868ce2034c5b9c07e6be9", 0x66, 0x20004000}, 0x40000)
sendmsg$tipc(r6, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x0, 0x4}, 0x1}}, 0x10, 0x0}, 0x0)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETSET(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000000a0a050000004eb98ad05cce0a010009090001"], 0x2c}, 0x1, 0x0, 0x0, 0x24048014}, 0x81) (async)
sendmsg$NFT_MSG_GETSET(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000000a0a050000004eb98ad05cce0a010009090001"], 0x2c}, 0x1, 0x0, 0x0, 0x24048014}, 0x81)

80.861509ms ago: executing program 1 (id=102):
socket$nl_route(0x10, 0x3, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x42, 0x6, 0x8, 0x0, 0x1}, 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r0}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xb, &(0x7f0000000940)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2d00000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000300)='kmem_cache_free\x00', r1}, 0x18)
r2 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4)
sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000001a0001000080ff00000000000a008000", @ANYRES32=0x0, @ANYBLOB="0000000008001f00000000001400", @ANYRES64=r2], 0x38}}, 0x0)

182.098µs ago: executing program 0 (id=103):
r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 64)
unshare(0x20000400) (rerun: 64)
r1 = socket$netlink(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff)
r3 = syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/net\x00')
sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="3c000000a69775dacfe4a9c8fa098460c314a88ce2611da30c0dfe20af5588bab4270d9b47ab1d4218ec12b0f681e9077b44b8daa0d77fa149c45a6ba6e15a451b550d88b64b71243de2efda88c916066cc9ab0700ab69285ba074b00bbd0e7e461f3eb1445af793980cc10863db2e446835bd100e14b808022cc3241929e16677ad0378", @ANYRES16=r2, @ANYBLOB="010026bd700000000000250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008a00", @ANYRES32=r3, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x80) (async)
sendmsg$inet(r0, &(0x7f0000000540)={&(0x7f0000000300)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000003c0)}, 0x20008090) (async)
bind$can_j1939(0xffffffffffffffff, &(0x7f0000000340)={0x1d, 0x0, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x23, &(0x7f00000002c0)=0x4a, 0x4) (async, rerun: 32)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa1000000000000070100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200009b1aecb60000000000000000850000007500000095"], 0x0}, 0x94) (async)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xb1)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='timer_start\x00', r5}, 0x10) (async, rerun: 32)
bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 32)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000003c0)='ext4_da_write_pages\x00', r4}, 0x18)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0))
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)}, 0x4048081) (async)
setsockopt$SO_J1939_FILTER(0xffffffffffffffff, 0x6b, 0x1, 0x0, 0x0) (async)
socket$packet(0x11, 0x3, 0x300) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=0x0, @ANYBLOB="0524060000000000300012800b0001006272696467650000200002800c002e00fffff6ffffffffff050007001f000000060027"], 0x6c}}, 0x0)
r6 = socket(0x10, 0x3, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x0) (async)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1e00000006000000090000003700000080020400", @ANYRES32=r1, @ANYBLOB="0900000000700000000080000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300000004000000050000000300"/28], 0x50)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r7, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000500)={r7, &(0x7f0000000380), &(0x7f0000000400)=""/236}, 0x20)
sendmmsg$alg(r6, &(0x7f0000000140), 0x4924b68, 0x0)
r8 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) (async, rerun: 64)
syz_emit_ethernet(0x2e, &(0x7f0000000380)=ANY=[@ANYRES64], 0x0) (async, rerun: 64)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x1, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94)

0s ago: executing program 2 (id=104):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000086dd0000120000000000000060ec97000f982c00fb8000000000000000000000000000aaff02000000000000000000000009000189"], 0xfce)

kernel console output (not intermixed with test programs):

syzkaller login: [   45.936432][ T5822] sshd (5822) used greatest stack depth: 19880 bytes left
Warning: Permanently added '[localhost]:2029' (ED25519) to the list of known hosts.
[   48.428117][ T5831] cgroup: Unknown subsys name 'net'
[   48.535771][ T5831] cgroup: Unknown subsys name 'cpuset'
[   48.539543][ T5831] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.121851][ T5831] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   54.080827][ T5843] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   54.093078][ T5843] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   54.095908][ T5843] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   54.101229][ T5234] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   54.104261][ T5234] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   54.106573][ T5234] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   54.109561][ T5234] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   54.112600][ T5234] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   54.120376][ T5847] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   54.124402][ T5847] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   54.152095][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   54.159743][ T5851] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   54.170019][ T5851] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   54.173482][ T5851] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   54.176219][ T5851] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   54.401994][ T5844] chnl_net:caif_netlink_parms(): no params data found
[   54.426020][ T5840] chnl_net:caif_netlink_parms(): no params data found
[   54.455923][ T5848] chnl_net:caif_netlink_parms(): no params data found
[   54.536183][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.538605][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.541197][ T5844] bridge_slave_0: entered allmulticast mode
[   54.544965][ T5844] bridge_slave_0: entered promiscuous mode
[   54.559103][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.561542][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.564079][ T5844] bridge_slave_1: entered allmulticast mode
[   54.566789][ T5844] bridge_slave_1: entered promiscuous mode
[   54.580089][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.583588][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.586367][ T5840] bridge_slave_0: entered allmulticast mode
[   54.589341][ T5840] bridge_slave_0: entered promiscuous mode
[   54.625608][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.628030][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.630413][ T5840] bridge_slave_1: entered allmulticast mode
[   54.633535][ T5840] bridge_slave_1: entered promiscuous mode
[   54.645340][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.648633][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.651832][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.656615][ T5848] bridge_slave_0: entered allmulticast mode
[   54.660492][ T5848] bridge_slave_0: entered promiscuous mode
[   54.672796][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.676950][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.680098][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.682795][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.685210][ T5848] bridge_slave_1: entered allmulticast mode
[   54.687921][ T5848] bridge_slave_1: entered promiscuous mode
[   54.691972][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.736970][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.740924][ T5844] team0: Port device team_slave_0 added
[   54.744346][ T5840] team0: Port device team_slave_0 added
[   54.747860][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.751702][ T5840] team0: Port device team_slave_1 added
[   54.761592][ T5844] team0: Port device team_slave_1 added
[   54.793222][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.795546][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.804312][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.815887][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.818194][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.827107][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.831707][ T5848] team0: Port device team_slave_0 added
[   54.834308][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.836662][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.851382][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.856158][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.858477][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.867788][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.873451][ T5848] team0: Port device team_slave_1 added
[   54.932085][ T5840] hsr_slave_0: entered promiscuous mode
[   54.934839][ T5840] hsr_slave_1: entered promiscuous mode
[   54.938186][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.940494][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.950102][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.968748][ T5844] hsr_slave_0: entered promiscuous mode
[   54.971677][ T5844] hsr_slave_1: entered promiscuous mode
[   54.975012][ T5844] debugfs: 'hsr0' already exists in 'hsr'
[   54.976976][ T5844] Cannot create hsr debugfs directory
[   54.979313][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.981991][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.993331][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.062405][ T5848] hsr_slave_0: entered promiscuous mode
[   55.065576][ T5848] hsr_slave_1: entered promiscuous mode
[   55.067752][ T5848] debugfs: 'hsr0' already exists in 'hsr'
[   55.069604][ T5848] Cannot create hsr debugfs directory
[   55.270013][ T5840] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   55.293382][ T5840] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   55.297955][ T5840] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   55.308683][ T5840] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   55.328105][ T5844] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   55.336568][ T5844] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   55.354140][ T5844] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   55.358798][ T5844] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   55.378815][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.381837][ T5840] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.385346][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.388243][ T5840] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.402747][ T4269] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.407612][ T4269] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.423465][ T5848] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   55.435479][ T5848] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   55.442274][ T5848] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   55.453378][ T5848] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   55.537611][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.561194][ T5840] 8021q: adding VLAN 0 to HW filter on device team0
[   55.567244][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.579288][ T4269] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.582127][ T4269] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.592238][ T5844] 8021q: adding VLAN 0 to HW filter on device team0
[   55.596475][ T4269] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.599232][ T4269] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.618900][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.624512][   T64] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.626897][   T64] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.640493][ T4269] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.642962][ T4269] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.666985][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[   55.685926][   T64] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.688302][   T64] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.707664][   T64] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.710028][   T64] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.892419][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.915086][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.941025][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.996458][ T5840] veth0_vlan: entered promiscuous mode
[   56.001766][ T5848] veth0_vlan: entered promiscuous mode
[   56.012743][ T5848] veth1_vlan: entered promiscuous mode
[   56.015467][ T5840] veth1_vlan: entered promiscuous mode
[   56.025291][ T5844] veth0_vlan: entered promiscuous mode
[   56.049364][ T5844] veth1_vlan: entered promiscuous mode
[   56.059045][ T5840] veth0_macvtap: entered promiscuous mode
[   56.063937][ T5848] veth0_macvtap: entered promiscuous mode
[   56.068890][ T5848] veth1_macvtap: entered promiscuous mode
[   56.075858][ T5840] veth1_macvtap: entered promiscuous mode
[   56.096709][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.106591][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.111162][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.120297][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.141995][ T5844] veth0_macvtap: entered promiscuous mode
[   56.146593][ T5885] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.149615][ T5885] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.162089][ T5844] veth1_macvtap: entered promiscuous mode
[   56.165902][ T5885] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.181888][ T5885] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.185177][ T5885] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.188204][ T5885] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.191064][ T5885] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.193845][ T5234] Bluetooth: hci1: command tx timeout
[   56.194463][ T5851] Bluetooth: hci2: command tx timeout
[   56.196504][ T5234] Bluetooth: hci0: command tx timeout
[   56.201827][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.217006][ T5885] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.236289][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.270301][ T5856] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.275227][ T5856] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.299266][ T5856] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.303375][ T5856] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.308614][ T4269] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.311300][ T4269] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.346471][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.351337][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.384334][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.387824][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.404885][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.407501][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.438503][   T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.441193][   T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.461064][ T5848] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   56.468978][   T52] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.484901][   T52] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.532321][ T5913] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3'.
[   56.536432][ T5913] netlink: 'syz.2.3': attribute type 12 has an invalid length.
[   56.551511][ T5912] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1'.
[   56.551619][ T5913] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3'.
[   56.556905][ T5912] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1340
[   56.559110][ T5885] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   56.568414][ T5913] netlink: 'syz.2.3': attribute type 12 has an invalid length.
[   56.569147][ T5885] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   56.579328][ T5885] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   56.579377][ T5913] Zero length message leads to an empty skb
[   56.584125][ T5916] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3'.
[   56.586535][ T5912] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   56.588356][ T5885] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   56.645534][ T5917] syzkaller0: entered promiscuous mode
[   56.647770][ T5917] syzkaller0: entered allmulticast mode
[   56.651237][   T12] syzkaller0: tun_net_xmit 70
[   56.707081][ T5919] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4'.
[   56.715465][ T5915] syzkaller0: tun_chr_ioctl cmd 1074025677
[   56.717797][ T5915] syzkaller0: Linktype set failed because interface is up
[   56.811496][ T5925] tipc: Started in network mode
[   56.814152][ T5925] tipc: Node identity 02d316de8e6c, cluster identity 4711
[   56.820372][ T5925] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   56.830497][ T5925] syzkaller0: entered promiscuous mode
[   56.834050][ T5925] syzkaller0: entered allmulticast mode
[   56.853726][ T5925] tipc: Resetting bearer <eth:syzkaller0>
[   56.863827][ T5924] tipc: Resetting bearer <eth:syzkaller0>
[   56.877023][ T5924] tipc: Disabling bearer <eth:syzkaller0>
[   57.002616][ T5938] syz.0.13 uses obsolete (PF_INET,SOCK_PACKET)
[   57.115810][ T5945] netlink: 16 bytes leftover after parsing attributes in process `syz.0.16'.
[   57.278191][ T5953] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20'.
[   57.374127][ T5958] netlink: 4 bytes leftover after parsing attributes in process `syz.2.21'.
[   57.519338][ T5967] netlink: 'syz.2.24': attribute type 5 has an invalid length.
[   57.684846][ T5979] netlink: 12 bytes leftover after parsing attributes in process `syz.2.29'.
[   57.758804][ T5987] netlink: 'syz.1.31': attribute type 21 has an invalid length.
[   57.761451][ T5987] netlink: 156 bytes leftover after parsing attributes in process `syz.1.31'.
[   57.921326][ T5996] 8021q: VLANs not supported on ipvlan1
[   58.237426][ T6009] netlink: 'syz.2.41': attribute type 10 has an invalid length.
[   58.247330][ T6009] team0: Port device geneve0 added
[   58.272764][ T5234] Bluetooth: hci0: command tx timeout
[   58.275758][ T5234] Bluetooth: hci2: command tx timeout
[   58.277346][ T5845] Bluetooth: hci1: command tx timeout
[   58.344787][ T6016] ieee802154 phy0 wpan0: encryption failed: -90
[   58.350492][ T6016] atomic_op ffff8880282e9198 conn xmit_atomic 0000000000000000
[   58.407127][ T6020] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   58.494121][ T6029] netlink: 'syz.2.49': attribute type 10 has an invalid length.
[   58.531247][ T6026] nbd: must specify at least one socket
[   58.639156][ T6047] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   58.679602][ T6047] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5
[   58.885690][ T6072] netlink: 'syz.2.64': attribute type 3 has an invalid length.
[   59.102069][ T6101] netlink: 'syz.2.71': attribute type 3 has an invalid length.
[   59.218989][ T6115] 8021q: VLANs not supported on ip_vti0
[   59.275321][ T1271] cfg80211: failed to load regulatory.db
[   59.296490][ T6125] netlink: 'syz.1.79': attribute type 11 has an invalid length.
Connection to localhost closed by remote host.
[   60.197469][ T6052] ==================================================================
[   60.200545][ T6052] BUG: KASAN: slab-use-after-free in __mutex_lock+0x7fc/0x1360
[   60.202914][ T6052] Read of size 8 at addr ffff8881100300a0 by task khidpd_15c25886/6052
[   60.206525][ T6052] 
[   60.207342][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: khidpd_15c25886 Not tainted syzkaller #0 PREEMPT(full) 
[   60.207353][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   60.207358][ T6052] Call Trace:
[   60.207363][ T6052]  <TASK>
[   60.207367][ T6052]  dump_stack_lvl+0x189/0x250
[   60.207379][ T6052]  ? __kasan_check_byte+0x12/0x40
[   60.207391][ T6052]  ? __pfx_dump_stack_lvl+0x10/0x10
[   60.207399][ T6052]  ? lock_release+0x4b/0x3e0
[   60.207411][ T6052]  ? __virt_addr_valid+0x4a5/0x5c0
[   60.207422][ T6052]  print_report+0xca/0x240
[   60.207429][ T6052]  ? __mutex_lock+0x7fc/0x1360
[   60.207438][ T6052]  kasan_report+0x118/0x150
[   60.207448][ T6052]  ? __mutex_lock+0x7fc/0x1360
[   60.207458][ T6052]  __mutex_lock+0x7fc/0x1360
[   60.207468][ T6052]  ? __mutex_lock+0x5b6/0x1360
[   60.207478][ T6052]  ? l2cap_unregister_user+0x6a/0x1b0
[   60.207488][ T6052]  ? __pfx___mutex_lock+0x10/0x10
[   60.207497][ T6052]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   60.207509][ T6052]  l2cap_unregister_user+0x6a/0x1b0
[   60.207517][ T6052]  hidp_session_thread+0x3c9/0x410
[   60.207526][ T6052]  ? __pfx_hidp_session_thread+0x10/0x10
[   60.207534][ T6052]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   60.207542][ T6052]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   60.207551][ T6052]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   60.207559][ T6052]  ? __kthread_parkme+0x7b/0x200
[   60.207567][ T6052]  ? __kthread_parkme+0x1a1/0x200
[   60.207574][ T6052]  kthread+0x711/0x8a0
[   60.207583][ T6052]  ? __pfx_hidp_session_thread+0x10/0x10
[   60.207611][ T6052]  ? __pfx_kthread+0x10/0x10
[   60.207621][ T6052]  ? _raw_spin_unlock_irq+0x23/0x50
[   60.207629][ T6052]  ? lockdep_hardirqs_on+0x9c/0x150
[   60.207638][ T6052]  ? __pfx_kthread+0x10/0x10
[   60.207646][ T6052]  ret_from_fork+0x3fc/0x770
[   60.207655][ T6052]  ? __pfx_ret_from_fork+0x10/0x10
[   60.207662][ T6052]  ? __switch_to_asm+0x39/0x70
[   60.207671][ T6052]  ? __switch_to_asm+0x33/0x70
[   60.207679][ T6052]  ? __pfx_kthread+0x10/0x10
[   60.207687][ T6052]  ret_from_fork_asm+0x1a/0x30
[   60.207698][ T6052]  </TASK>
[   60.207701][ T6052] 
[   60.273438][ T6052] Allocated by task 5848:
[   60.274837][ T6052]  kasan_save_track+0x3e/0x80
[   60.276356][ T6052]  __kasan_kmalloc+0x93/0xb0
[   60.277855][ T6052]  __kmalloc_noprof+0x27a/0x4f0
[   60.279489][ T6052]  hci_alloc_dev_priv+0x28/0x2060
[   60.281145][ T6052]  vhci_create_device+0x120/0x6e0
[   60.282805][ T6052]  vhci_write+0x3ce/0x4a0
[   60.284423][ T6052]  vfs_write+0x5c9/0xb30
[   60.285831][ T6052]  ksys_write+0x145/0x250
[   60.287243][ T6052]  do_syscall_64+0xfa/0x3b0
[   60.288720][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   60.290757][ T6052] 
[   60.291573][ T6052] Freed by task 5848:
[   60.292923][ T6052]  kasan_save_track+0x3e/0x80
[   60.294505][ T6052]  kasan_save_free_info+0x46/0x50
[   60.296210][ T6052]  __kasan_slab_free+0x5b/0x80
[   60.297766][ T6052]  kfree+0x18e/0x440
[   60.299119][ T6052]  bt_host_release+0x82/0x90
[   60.300630][ T6052]  device_release+0x9c/0x1c0
[   60.302180][ T6052]  kobject_put+0x22b/0x480
[   60.303679][ T6052]  vhci_release+0x88/0xd0
[   60.305114][ T6052]  __fput+0x44c/0xa70
[   60.306431][ T6052]  task_work_run+0x1d4/0x260
[   60.307953][ T6052]  do_exit+0x6b5/0x2300
[   60.309332][ T6052]  do_group_exit+0x21c/0x2d0
[   60.310843][ T6052]  __x64_sys_exit_group+0x3f/0x40
[   60.312468][ T6052]  x64_sys_call+0x21f7/0x2200
[   60.313985][ T6052]  do_syscall_64+0xfa/0x3b0
[   60.315503][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   60.317426][ T6052] 
[   60.318210][ T6052] Last potentially related work creation:
[   60.320229][ T6052]  kasan_save_stack+0x3e/0x60
[   60.321807][ T6052]  kasan_record_aux_stack+0xbd/0xd0
[   60.323491][ T6052]  insert_work+0x3d/0x330
[   60.324957][ T6052]  __queue_work+0xbaf/0xfb0
[   60.326775][ T6052]  queue_work_on+0x181/0x270
[   60.328622][ T6052]  process_scheduled_works+0xae1/0x17b0
[   60.330524][ T6052]  worker_thread+0x8a0/0xda0
[   60.332199][ T6052]  kthread+0x711/0x8a0
[   60.333727][ T6052]  ret_from_fork+0x3fc/0x770
[   60.335248][ T6052]  ret_from_fork_asm+0x1a/0x30
[   60.336969][ T6052] 
[   60.337843][ T6052] Second to last potentially related work creation:
[   60.340139][ T6052]  kasan_save_stack+0x3e/0x60
[   60.341721][ T6052]  kasan_record_aux_stack+0xbd/0xd0
[   60.343439][ T6052]  insert_work+0x3d/0x330
[   60.344872][ T6052]  __queue_work+0xcd2/0xfb0
[   60.346423][ T6052]  call_timer_fn+0x17e/0x5f0
[   60.347938][ T6052]  __run_timer_base+0x646/0x860
[   60.349518][ T6052]  run_timer_softirq+0xb7/0x180
[   60.351121][ T6052]  handle_softirqs+0x286/0x870
[   60.352673][ T6052]  run_ksoftirqd+0x9b/0x100
[   60.354139][ T6052]  smpboot_thread_fn+0x542/0xa60
[   60.355825][ T6052]  kthread+0x711/0x8a0
[   60.357316][ T6052]  ret_from_fork+0x3fc/0x770
[   60.359081][ T6052]  ret_from_fork_asm+0x1a/0x30
[   60.360969][ T6052] 
[   60.361914][ T6052] The buggy address belongs to the object at ffff888110030000
[   60.361914][ T6052]  which belongs to the cache kmalloc-8k of size 8192
[   60.366656][ T6052] The buggy address is located 160 bytes inside of
[   60.366656][ T6052]  freed 8192-byte region [ffff888110030000, ffff888110032000)
[   60.371011][ T6052] 
[   60.371807][ T6052] The buggy address belongs to the physical page:
[   60.374098][ T6052] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110030
[   60.377101][ T6052] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   60.379914][ T6052] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   60.382406][ T6052] page_type: f5(slab)
[   60.383731][ T6052] raw: 057ff00000000040 ffff88801a442280 ffffea00007d4e00 dead000000000002
[   60.386469][ T6052] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   60.389231][ T6052] head: 057ff00000000040 ffff88801a442280 ffffea00007d4e00 dead000000000002
[   60.392189][ T6052] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   60.394993][ T6052] head: 057ff00000000003 ffffea0004400c01 00000000ffffffff 00000000ffffffff
[   60.397769][ T6052] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   60.400538][ T6052] page dumped because: kasan: bad access detected
[   60.402670][ T6052] page_owner tracks the page as allocated
[   60.404649][ T6052] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5586, tgid 5586 (start-stop-daem), ts 30126955008, free_ts 28035098318
[   60.411355][ T6052]  post_alloc_hook+0x240/0x2a0
[   60.412926][ T6052]  get_page_from_freelist+0x21e4/0x22c0
[   60.414719][ T6052]  __alloc_frozen_pages_noprof+0x181/0x370
[   60.416629][ T6052]  alloc_pages_mpol+0x232/0x4a0
[   60.418228][ T6052]  allocate_slab+0x8a/0x370
[   60.419810][ T6052]  ___slab_alloc+0xbeb/0x1410
[   60.421352][ T6052]  __kmalloc_cache_noprof+0x296/0x3d0
[   60.423148][ T6052]  tomoyo_init_log+0x111f/0x1f70
[   60.424781][ T6052]  tomoyo_supervisor+0x340/0x1480
[   60.426653][ T6052]  tomoyo_find_next_domain+0x488/0x1aa0
[   60.428779][ T6052]  tomoyo_bprm_check_security+0x11c/0x180
[   60.430841][ T6052]  security_bprm_check+0x89/0x270
[   60.432509][ T6052]  bprm_execve+0x8ee/0x1450
[   60.434132][ T6052]  do_execveat_common+0x510/0x6a0
[   60.436035][ T6052]  __x64_sys_execve+0x94/0xb0
[   60.437831][ T6052]  do_syscall_64+0xfa/0x3b0
[   60.439323][ T6052] page last free pid 5551 tgid 5551 stack trace:
[   60.441377][ T6052]  __free_frozen_pages+0xbc4/0xd30
[   60.443097][ T6052]  __put_partials+0x156/0x1a0
[   60.444656][ T6052]  put_cpu_partial+0x17c/0x250
[   60.446222][ T6052]  __slab_free+0x2d5/0x3c0
[   60.447699][ T6052]  qlist_free_all+0x97/0x140
[   60.449404][ T6052]  kasan_quarantine_reduce+0x148/0x160
[   60.451176][ T6052]  __kasan_slab_alloc+0x22/0x80
[   60.452827][ T6052]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[   60.454635][ T6052]  vm_area_alloc+0x24/0x140
[   60.456132][ T6052]  mmap_region+0xdc7/0x20c0
[   60.457938][ T6052]  do_mmap+0xc45/0x10d0
[   60.459584][ T6052]  vm_mmap_pgoff+0x2a6/0x4d0
[   60.461614][ T6052]  ksys_mmap_pgoff+0x51f/0x760
[   60.463370][ T6052]  do_syscall_64+0xfa/0x3b0
[   60.465035][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   60.467287][ T6052] 
[   60.468116][ T6052] Memory state around the buggy address:
[   60.470096][ T6052]  ffff88811002ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   60.472845][ T6052]  ffff888110030000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   60.475732][ T6052] >ffff888110030080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   60.478446][ T6052]                                ^
[   60.480336][ T6052]  ffff888110030100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   60.482876][ T6052]  ffff888110030180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   60.485428][ T6052] ==================================================================
[   60.488512][ T6052] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   60.490875][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: khidpd_15c25886 Not tainted syzkaller #0 PREEMPT(full) 
[   60.493926][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   60.497130][ T6052] Call Trace:
[   60.498337][ T6052]  <TASK>
[   60.499374][ T6052]  dump_stack_lvl+0x99/0x250
[   60.501109][ T6052]  ? __asan_memcpy+0x40/0x70
[   60.503075][ T6052]  ? __pfx_dump_stack_lvl+0x10/0x10
[   60.504858][ T6052]  ? __pfx__printk+0x10/0x10
[   60.506607][ T6052]  vpanic+0x281/0x750
[   60.508138][ T6052]  ? __pfx_vpanic+0x10/0x10
[   60.510092][ T6052]  ? irqentry_exit+0x74/0x90
[   60.511866][ T6052]  panic+0xb9/0xc0
[   60.513085][ T6052]  ? __pfx_panic+0x10/0x10
[   60.514699][ T6052]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[   60.516915][ T6052]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   60.519004][ T6052]  ? __mutex_lock+0x7fc/0x1360
[   60.520888][ T6052]  check_panic_on_warn+0x89/0xb0
[   60.522888][ T6052]  ? __mutex_lock+0x7fc/0x1360
[   60.524639][ T6052]  end_report+0x78/0x160
[   60.526016][ T6052]  kasan_report+0x129/0x150
[   60.527505][ T6052]  ? __mutex_lock+0x7fc/0x1360
[   60.529048][ T6052]  __mutex_lock+0x7fc/0x1360
[   60.530531][ T6052]  ? __mutex_lock+0x5b6/0x1360
[   60.532095][ T6052]  ? l2cap_unregister_user+0x6a/0x1b0
[   60.533824][ T6052]  ? __pfx___mutex_lock+0x10/0x10
[   60.535461][ T6052]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   60.537374][ T6052]  l2cap_unregister_user+0x6a/0x1b0
[   60.539114][ T6052]  hidp_session_thread+0x3c9/0x410
[   60.540820][ T6052]  ? __pfx_hidp_session_thread+0x10/0x10
[   60.542766][ T6052]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   60.544745][ T6052]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   60.546968][ T6052]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   60.549148][ T6052]  ? __kthread_parkme+0x7b/0x200
[   60.551005][ T6052]  ? __kthread_parkme+0x1a1/0x200
[   60.552839][ T6052]  kthread+0x711/0x8a0
[   60.554345][ T6052]  ? __pfx_hidp_session_thread+0x10/0x10
[   60.556429][ T6052]  ? __pfx_kthread+0x10/0x10
[   60.558100][ T6052]  ? _raw_spin_unlock_irq+0x23/0x50
[   60.559928][ T6052]  ? lockdep_hardirqs_on+0x9c/0x150
[   60.561743][ T6052]  ? __pfx_kthread+0x10/0x10
[   60.563282][ T6052]  ret_from_fork+0x3fc/0x770
[   60.564826][ T6052]  ? __pfx_ret_from_fork+0x10/0x10
[   60.566904][ T6052]  ? __switch_to_asm+0x39/0x70
[   60.568961][ T6052]  ? __switch_to_asm+0x33/0x70
[   60.570525][ T6052]  ? __pfx_kthread+0x10/0x10
[   60.572067][ T6052]  ret_from_fork_asm+0x1a/0x30
[   60.573672][ T6052]  </TASK>
[   60.575518][ T6052] Kernel Offset: disabled
[   60.577138][ T6052] Rebooting in 86400 seconds..

VM DIAGNOSIS:
04:32:48  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000066 RBX=0000000000000066 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000432f370
R8 =ffff888108210237 R9 =1ffff11021042046 R10=dffffc0000000000 R11=ffffffff854eff70
R12=dffffc0000000000 R13=ffffffff99af98f1 R14=ffffffff99dee3a0 R15=0000000000000000
RIP=ffffffff854effec RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fa41ece7d60 CR3=000000010fa54000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00000000ff000000 0000000000000000 XMM05=3f3f3f3f3f3f3f3f 3f3f3f3f3f3f3f3f
XMM06=9999999999999999 9999999999999999 XMM07=2020202020202020 2020202020202020
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000000 RBX=ffffffff8b7bebf7 RCX=d5164dd95ccc4100 RDX=0000000000000000
RSI=ffffffff8b7bebf7 RDI=1ffffffff33aad98 RBP=ffffffff84d01d0a RSP=ffffc9000319f6c0
R8 =0000000000000001 R9 =0000000000000000 R10=dffffc0000000000 R11=fffffbfff1f46fc7
R12=0000000000000000 R13=ffffffff99d56cc0 R14=ffffffff99d56cc0 R15=0000000000000001
RIP=ffffffff8222ffd6 RFL=00000802 [-O-----] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555557b52500 ffffffff 00c00000
GS =0000 ffff8881a3c1c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f01f02e7d60 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00007f01ef7876c3 00007f01ef7876c3 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 00ff000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=0000000000000000 00007f01ef612e53
XMM06=0000000000000000 00007f01ef612e4d XMM07=0000000000000000 00007f01ef612e61
XMM08=0000000000000000 00007f01ef612ee7 XMM09=0000000000000000 00007f01ef612fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
