last executing test programs:

3m38.418374096s ago: executing program 0 (id=328):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
sendmsg$NFT_MSG_GETSET(r0, &(0x7f00000019c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000001940)={0x14, 0xa, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000)

3m38.354552178s ago: executing program 0 (id=330):
r0 = socket$kcm(0x2, 0x1, 0x84)
setsockopt$sock_attach_bpf(r0, 0x84, 0x5, 0x0, 0x0)

3m38.301057705s ago: executing program 0 (id=331):
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2)
openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0)
r3 = socket$kcm(0x1e, 0x1, 0x0)
sendmsg$kcm(r3, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x4}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000000)="d5", 0x101d0}], 0x1}, 0x0)

3m38.11010431s ago: executing program 0 (id=334):
socketpair$unix(0x1, 0x2, 0x0, 0x0)
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
r2 = socket$kcm(0x10, 0x3, 0x10)
recvmsg(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x10000)
sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000380)="1400000036000b63d25a595c779f10ce0630fc60", 0x14}], 0x1}, 0x0)

3m37.990903935s ago: executing program 1 (id=336):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41c6eee84309e7a23c19a39484809539fcb4e0b6eab1aa7d55545a34effa077faa5916b8f67ba24828e8b476090bef25c59e88254f54077f799bf408301000000bf2255d6a0244d35b213bda84cc1722fd8cc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b090121754e90bf0649fae26f7d599a32eef6cb22f84135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f824cf796b07a6ff61c5552417fd703f7f14d8b7897bfca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea132dfba30bd0f6ea508000000a0c548552b571bed5647323c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151fcda6cb799c6e924966a7f90b01fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ecec37e83efceefd7ca2533659edc825e8ed9be8796831aaa48099c75753ebbe05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d350000000000000000e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a2946501559335781092cf8ce987c56cd31121624d7455f2a3666276c7c0e812b28e2f30d035cee5d0e77a3c72208ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463aaf28345bde0c195bc9f022ca8ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262d0af3246eb4fc4bda345360200000001fbddeacd3adaa4d2715e21c71f4d578455d1d118d372ad6e9326b98ac67658ae791ee8b479a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b700056b5af553d18a6cc50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5631820420b75b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff201000000000000002e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20ba2ab083430f87af976a46f9a9a1ac7dea1ea6845f9aa66237e0dacc107f532348cc2116473381e961f3d9c8c21578fe3245097c280abe51427b9f6cd72e65731b7ca661eb5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f715303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d174b0000000000000000000000fa08ad0731ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce694181a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6812fae0533496b6d58da50ee80a6b9a7438978c5465113f668eb4484350048289d07dbef325d3221a7cb35f812f257941a9781e3214c2a3228f52e33e9362fabae396ce087cc5dcf89d99844b762a9cf17548c54fccad2c7ae8072b82e0880815daf966bd5343c1635e123f868a7167cfcff33384253af570f4ef9c0254afdd89c73943562b530dd88da8a94013bbaf204bebc38055adc39f07f7c22711f4d1f6dcc928d1578a093c072e0b92babc76f47ee367e745a024a2278319d9a4d1378482b70304669c447c71ca4d54c82395a3958d576c42c08a5e5adfb58306164cc7bb212f36468f40ce185a63c6b05292186095c1f407ce74297d16470988f1647f7b6f6cdc6ab8be3cacc325df963c2cb80cfe07ded6d55f556be0a3dfa85f0aa2b336faa53b8b0a2dafe0840fff03ead2c4a07dbffeb4ae7617c8eed2f8c12883592538aab23f465ce974729aedb4ae550da3f7f180c6f6fd91c653a77e9304b05dd7ada7fcb8277acac71ed37d4ef8a5885a208b34ac5c34d61fbcee2c9be9af7c7685c7d2f302b0601c3672710098d3d9dfc14f346ff7e1f89a3249254edffbd22aec008810fb9fc59f5c39fc7fa52358506d2557e12c8c3e3b0e9d924c50051383a4c9f6a1bb4187c1168d52ce26659325ce4fd7759c4f84d1fd8652cfecc60d590bff108ecef2d51d8fbd095ed7c1688a8898f8bd19ead4be1eb5797e6aef9cf6d9ca92e52106e03d29b669c0096b37c976b5889dc15c7803422a15f54da7901c2f6e894cd48dfe7e82d79a0943fc133d1605303a2a93361400"/2165], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48)
socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={<r1=>0x0, 0x0})
close(r1)
socket$kcm(0x10, 0x2, 0x10)
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)={[{0x2b, 'devices'}]}, 0x9)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407ffb, 0x20000000aea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
r2 = socket$kcm(0x2, 0x1000000000000002, 0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48)
sendmsg$inet(r2, &(0x7f0000000680)={&(0x7f0000000040)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10, 0x0, 0x0, &(0x7f0000000800)=[@ip_retopts={{0x14, 0x0, 0x7, {[@timestamp={0x44, 0x4, 0x3, 0x0, 0x5}]}}}], 0x18}, 0x40)
socket$kcm(0x10, 0x2, 0x0)
setsockopt$sock_attach_bpf(r1, 0x10e, 0x2, &(0x7f0000000300)=r0, 0x4)
r3 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000a80)="d80000001d0081044e81f782db44b904021d080201000000040000a1bc0002000000000000000e1208000f01", 0x2c}, {&(0x7f00000006c0)}, {&(0x7f0000000980)="027a64c0072ebbb1512b328dda11b4efd4ba07fc642b7e012bea071dbbdea51e41958755533ccce04d3e635cbe848495e723490d8e93db224d82d4fbfe76bd22fd358cd467795ad7febfc220d72f", 0x4e}], 0x3, 0x0, 0x0, 0x7400}, 0x10)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0, 0x52}, 0x28)

3m37.92543677s ago: executing program 2 (id=337):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000095"], &(0x7f0000000440)='GPL\x00', 0x4}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r0, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)

3m37.080271945s ago: executing program 0 (id=338):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x100000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x2, '\x00', 0x0, 0x0}, 0x50)
mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff)
r0 = socket$kcm(0xa, 0x922000000003, 0x11)
close(r0)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0xa4706, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x2300, 0x0, 0x0, 0x2}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x52f600, 0x0)
r1 = socket$kcm(0x21, 0x2, 0xa)
sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0xfffc, 0x2, 0x1c, {0xa, 0xfffc, 0x4, @dev}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, "dc"}], 0x18}, 0xfc00)

3m37.079998779s ago: executing program 2 (id=339):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, 0x0, 0x0, 0x2}, 0x94)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
r0 = socket$kcm(0x10, 0x400000002, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33)
recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000004700)=""/4084, 0xff4}, {&(0x7f0000002080)=""/4078, 0xfee}, {&(0x7f0000001040)=""/4128, 0x1020}, {&(0x7f0000000000)=""/110, 0x6e}, {&(0x7f0000000440)=""/209, 0xd1}, {&(0x7f0000000580)=""/176, 0xb0}], 0x6}, 0x0)

3m36.976339023s ago: executing program 2 (id=340):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x1, 0x5, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = socket$kcm(0x1e, 0x4, 0x0)
setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, &(0x7f00000008c0), 0x43)
r1 = socket$kcm(0x1e, 0x4, 0x0)
setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43)
write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0xfdef)
recvmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000001500)=""/4098, 0x1002}, {&(0x7f0000000680)=""/240}], 0x221}, 0x1c1)

3m36.975946669s ago: executing program 1 (id=341):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0x12, 0x6, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x7}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r1}, &(0x7f0000000180), &(0x7f0000000100)=r0}, 0x20)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r1, &(0x7f0000000300), 0x0}, 0x20)

3m36.901162193s ago: executing program 1 (id=342):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a0003402e60000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x60044084)

3m36.702603555s ago: executing program 2 (id=343):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="b4050000200080006110600000000000c6000000000000009500"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x7, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000000000000000fdffffff18000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

3m35.679088839s ago: executing program 2 (id=344):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x21, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x1000000, 0xe, 0x0, &(0x7f0000000280)="63eced8e0200000000000000b98604b37cff2ffe660500f4de769b40e49f3815b01ac07fcd0119b50d4766ad54a9e35b854e6106b68aa546ca9a380a1c9235258eeb2daece984fa519af8c43e1bffe93f030f48df56b41ebf4c73fb5fa893f32175a8b6ca8f70902446e5ad84d3295f461d79e1d18780104000000000000800413d005812a9b31e70cc1da4deb5723a5", 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x1e)

3m34.256435367s ago: executing program 2 (id=345):
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
close(0xffffffffffffffff)
close(0xffffffffffffffff)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00'}, 0x10)
bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x20)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r0}, 0x10)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x103fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socket$kcm(0x2, 0x5, 0x84)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x8183, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext, 0x40, 0x0, 0x0, 0x0, 0xc360, 0xfffffffe}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs$namespace(0x0, 0x0)
openat$ppp(0xffffffffffffff9c, 0x0, 0x40100, 0x0)
r1 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1400000017000b63d25a80648c2594f92aa3c92b", 0x14}], 0x1}, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0}, 0x94)

3m27.928911409s ago: executing program 0 (id=346):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x101840, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2})
r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x418f, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2)
ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000000)=[{0x45}, {0x6, 0x3}]})

3m27.850164475s ago: executing program 1 (id=347):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x44}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002a40)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc101500000e0a010100000000000000000a0000060900020073797a31000000000900010073797a31"], 0x1574}, 0x1, 0x0, 0x0, 0x4000850}, 0x840)

3m21.241231472s ago: executing program 1 (id=348):
r0 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)="89000000120081ae08060cdc030000017f03e3f7000000006ee2ffca1b1f00ff0f00000000000050375ed08a56331dbf9ed78105001ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00123d000100090008000000000000bc7a46e39a54cbbda812176679df069163ce955fed0009d78f0a947ee2b49e33538afaeb2713f450ebd010a20ff27fff", 0x89}], 0x1, 0x0, 0x0, 0x7}, 0x240008d4)

3m19.67302919s ago: executing program 32 (id=345):
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
close(0xffffffffffffffff)
close(0xffffffffffffffff)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00'}, 0x10)
bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x20)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r0}, 0x10)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x103fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socket$kcm(0x2, 0x5, 0x84)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x8183, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext, 0x40, 0x0, 0x0, 0x0, 0xc360, 0xfffffffe}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs$namespace(0x0, 0x0)
openat$ppp(0xffffffffffffff9c, 0x0, 0x40100, 0x0)
r1 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1400000017000b63d25a80648c2594f92aa3c92b", 0x14}], 0x1}, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0}, 0x94)

3m19.672890522s ago: executing program 1 (id=350):
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x10)

3m10.381510346s ago: executing program 33 (id=346):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x101840, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2})
r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x418f, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2)
ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000000)=[{0x45}, {0x6, 0x3}]})

3m6.310135636s ago: executing program 34 (id=350):
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x10)

1.008882016s ago: executing program 3 (id=2273):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@struct={0x8, 0x1, 0x0, 0xf, 0x0, 0x5, [{0x7, 0x1, 0x80000001}]}]}, {0x0, [0x0, 0x0, 0x0, 0x61, 0x0, 0x0, 0x61, 0x5f]}}, &(0x7f0000000040)=""/249, 0x3a, 0xf9, 0xa}, 0x28)

929.307343ms ago: executing program 3 (id=2277):
socket$kcm(0x23, 0x5, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
sendmsg$unix(r0, 0x0, 0x2404c855)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x2}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair(0x1d, 0x3, 0x1, &(0x7f00000014c0))

808.015221ms ago: executing program 3 (id=2282):
perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x91c, 0x4156, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xfffffffffffffffc, 0x1}, 0x18404, 0x10, 0xfffffffe, 0x6, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000004cc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x20400, 0x6, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0xaf1d, 0x1, @perf_config_ext={0x8, 0x101}, 0x2200, 0x200, 0x2, 0x1, 0x9, 0x9, 0x1, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)

650.729702ms ago: executing program 3 (id=2283):
perf_event_open(&(0x7f00000004c0)={0x2, 0x80, 0xe8, 0x1, 0x0, 0x0, 0x0, 0x0, 0x208, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events.local\x00', 0x26e1, 0x0)

570.116536ms ago: executing program 5 (id=2287):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x182d, 0x0, 0x0, 0x1, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
r0 = socket$kcm(0x29, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000200)={<r1=>0xffffffffffffffff})
close(r0)
ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000040))

501.143735ms ago: executing program 3 (id=2288):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x43, 0x0, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000404000000000000000000611233000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_PROG_DETACH(0x9, 0x0, 0x20)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000200)=0xffffffffffffffff, 0x4)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x6, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xff}, [@exit, @cb_func={0x18, 0x1, 0x4, 0x0, 0x8}]}, &(0x7f00000001c0)='syzkaller\x00', 0x200, 0x0, 0x0, 0x41100, 0x68, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f0000000440)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000480)={0x5, 0xf, 0x6, 0x200}, 0x10, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000600)=[{0x4, 0x3, 0xd, 0x8}, {0x1, 0x4, 0xd, 0x8}, {0x3, 0x2, 0x10, 0xc}, {0x5, 0x2, 0xb, 0x1}, {0x1, 0x2, 0xe, 0x2}, {0x1, 0x4, 0x10, 0x8}, {0x0, 0x2, 0x3, 0x4}, {0x2, 0x3, 0xb}, {0x5, 0x4, 0x1, 0xc}], 0x10, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1d, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @lsm=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x9, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94)
socket$kcm(0x29, 0x7, 0x0)
bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0)
socket$kcm(0xa, 0x5, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="020000000400000008000000010000008000000096c709b16707be355d6a49d11ed0fe29c6bc4fd2953dfe525a731595e6f2c6641666decbbaa436acadd29bd407ed07f6146787f0d84b3aa0", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0xe)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x2})
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079d})
openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x159300, 0x0)
socketpair(0x1, 0x1, 0x1, &(0x7f00000002c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x30a)
ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000080))
close(0x3)
close(r3)

438.458304ms ago: executing program 5 (id=2290):
perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0xfffffffffffffffa, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)

380.780717ms ago: executing program 5 (id=2292):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x1, 0x42, 0x40, 0xc2}, 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000ac0), &(0x7f0000000bc0), 0x4, r0}, 0x38)
bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x7, r0}, 0x38)

279.456939ms ago: executing program 5 (id=2293):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000180a0500000000000000000002000000300003802c00038014000100776732000000000000000000000000001400010076657468315f746f5f627269646765000900020073797a300000000009000100"], 0x84}, 0x1, 0x0, 0x0, 0x24040089}, 0x20008000)

278.717837ms ago: executing program 5 (id=2295):
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x2}, [@alu={0x4, 0x1, 0x4, 0x760cda05bcf95fa0}]}, &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

241.335352ms ago: executing program 3 (id=2296):
bpf$LINK_GET_NEXT_ID(0x1f, 0x0, 0x0)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0xc220, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$kcm(0xa, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000002dc0)={&(0x7f0000001580)=@l2tp6={0xa, 0x0, 0xffffffff, @loopback, 0x2}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001480)="89", 0x1}], 0x1}, 0x20000054)
recvmsg(r0, &(0x7f0000000280)={&(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, 0x0, 0x0, &(0x7f0000000740)=""/251, 0xfb}, 0x1)
setsockopt$sock_attach_bpf(r0, 0x29, 0x6, 0x0, 0x33)
bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8)
bpf$PROG_BIND_MAP(0x23, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)

228.738144ms ago: executing program 5 (id=2297):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
r0 = socket$kcm(0x29, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, &(0x7f00000020c0)=ANY=[], 0xff0}, 0x80)
sendmsg$kcm(r0, 0x0, 0x0)
close(r0)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x2, 0x0, 0x0, 0x0, 0x4, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50)
r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0x7, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xf1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x9, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6c, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

147.637722ms ago: executing program 4 (id=2298):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x54, 0x2, 0x6, 0x201, 0x0, 0x6000, {}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}]}, 0x54}}, 0x0)

147.393893ms ago: executing program 4 (id=2299):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002680)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000003c000000210000000200000008000000040000840700000004000000000000008200000007000000010000000600000048000000050000002b0f0000000400000000000007"], 0x0, 0x56, 0x0, 0x0, 0xfffffffc}, 0x20)
r0 = socket$kcm(0x10, 0x400000002, 0x0)
sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1c0000001e007f109e", 0x2a}, {&(0x7f0000000140)="78cafb73fc02010700000000ef02258f2e440ab8f9e6aaeb1ae2f6e8bcb5ee52dc06b6c9ad11cb5dbc249798093c5102a1bca0b6050000004f6e6b788b3219c233e60ddc36024a99a63e7238fe9f9b06f96137c8af12b6", 0x98}], 0x2}, 0x4000000)

67.301509ms ago: executing program 4 (id=2300):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r1}, &(0x7f0000000000), &(0x7f00000005c0)=r2}, 0x20)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r3, 0x18000000000002a0, 0xe, 0x20, &(0x7f0000000280)="b9ff03076804268c989e14f088a8", 0x0, 0x3f, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x21}, 0x50)

66.218168ms ago: executing program 4 (id=2301):
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00')
ioctl$TUNSETIFF(r0, 0x8004b708, 0x0)

384.932µs ago: executing program 4 (id=2302):
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xe, 0x4, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x50}, [@call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x90)

0s ago: executing program 4 (id=2303):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="f8000000160001000000000000000000e00000e4ffffffffffffff00000000007f040001000000000000001700"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x002'], 0xf8}}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:55696' (ED25519) to the list of known hosts.
syzkaller login: [   56.173340][ T5829] cgroup: Unknown subsys name 'net'
[   56.299474][ T5829] cgroup: Unknown subsys name 'cpuset'
[   56.305580][ T5829] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.071736][ T5829] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   67.513744][   T60] sched: DL replenish lagged too much
[   68.738522][ T5861] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   70.522337][ T5871] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   70.526397][ T5871] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   70.536043][ T5871] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   70.544603][ T5871] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   70.548136][ T5871] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   70.565780][   T54] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   70.573021][   T54] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   70.578338][   T54] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   70.581982][   T54] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   70.587508][   T54] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   70.687811][ T5871] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   70.691061][ T5871] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   70.694664][ T5871] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   70.698550][ T5871] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   70.701874][ T5871] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   70.881457][ T5874] chnl_net:caif_netlink_parms(): no params data found
[   70.980418][ T5870] chnl_net:caif_netlink_parms(): no params data found
[   71.038854][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[   71.043206][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[   71.061120][ T5874] bridge0: port 1(bridge_slave_0) entered blocking state
[   71.066108][ T5874] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.069042][ T5874] bridge_slave_0: entered allmulticast mode
[   71.073157][ T5874] bridge_slave_0: entered promiscuous mode
[   71.079792][ T5874] bridge0: port 2(bridge_slave_1) entered blocking state
[   71.082713][ T5874] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.087670][ T5874] bridge_slave_1: entered allmulticast mode
[   71.091568][ T5874] bridge_slave_1: entered promiscuous mode
[   71.173429][ T5874] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   71.180320][ T5874] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   71.208560][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state
[   71.211484][ T5870] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.214838][ T5870] bridge_slave_0: entered allmulticast mode
[   71.217706][ T5870] bridge_slave_0: entered promiscuous mode
[   71.256898][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state
[   71.259641][ T5870] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.261820][ T5870] bridge_slave_1: entered allmulticast mode
[   71.265156][ T5870] bridge_slave_1: entered promiscuous mode
[   71.269018][ T5874] team0: Port device team_slave_0 added
[   71.296343][ T5874] team0: Port device team_slave_1 added
[   71.316325][ T5870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   71.326173][ T5877] chnl_net:caif_netlink_parms(): no params data found
[   71.349020][ T5874] batman_adv: batadv0: Adding interface: batadv_slave_0
[   71.351778][ T5874] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.361132][ T5874] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   71.368192][ T5870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   71.372597][ T5874] batman_adv: batadv0: Adding interface: batadv_slave_1
[   71.375235][ T5874] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.383753][ T5874] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   71.467636][ T5870] team0: Port device team_slave_0 added
[   71.472566][ T5870] team0: Port device team_slave_1 added
[   71.572313][ T5874] hsr_slave_0: entered promiscuous mode
[   71.576249][ T5874] hsr_slave_1: entered promiscuous mode
[   71.579676][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_0
[   71.582237][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.592713][ T5870] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   71.598007][ T5877] bridge0: port 1(bridge_slave_0) entered blocking state
[   71.601404][ T5877] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.605967][ T5877] bridge_slave_0: entered allmulticast mode
[   71.609787][ T5877] bridge_slave_0: entered promiscuous mode
[   71.615503][ T5877] bridge0: port 2(bridge_slave_1) entered blocking state
[   71.618259][ T5877] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.620442][ T5877] bridge_slave_1: entered allmulticast mode
[   71.623182][ T5877] bridge_slave_1: entered promiscuous mode
[   71.628696][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_1
[   71.631365][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.641507][ T5870] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   71.692615][ T5877] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   71.713203][ T5877] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   71.782745][ T5870] hsr_slave_0: entered promiscuous mode
[   71.786210][ T5870] hsr_slave_1: entered promiscuous mode
[   71.790023][ T5870] debugfs: 'hsr0' already exists in 'hsr'
[   71.792101][ T5870] Cannot create hsr debugfs directory
[   71.796906][ T5877] team0: Port device team_slave_0 added
[   71.807847][ T5877] team0: Port device team_slave_1 added
[   71.900675][ T5877] batman_adv: batadv0: Adding interface: batadv_slave_0
[   71.903273][ T5877] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.912854][ T5877] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   71.942920][ T5877] batman_adv: batadv0: Adding interface: batadv_slave_1
[   71.946616][ T5877] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.956217][ T5877] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   72.062122][ T5877] hsr_slave_0: entered promiscuous mode
[   72.064638][ T5877] hsr_slave_1: entered promiscuous mode
[   72.066945][ T5877] debugfs: 'hsr0' already exists in 'hsr'
[   72.069052][ T5877] Cannot create hsr debugfs directory
[   72.176600][ T5874] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   72.189454][ T5874] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   72.203825][ T5874] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   72.228370][ T5874] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   72.320388][ T5870] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   72.327836][ T5870] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   72.353085][ T5870] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   72.364340][ T5870] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   72.460771][ T5877] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   72.471942][ T5877] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   72.478858][ T5877] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   72.490843][ T5877] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   72.559200][ T5874] 8021q: adding VLAN 0 to HW filter on device bond0
[   72.600453][ T5874] 8021q: adding VLAN 0 to HW filter on device team0
[   72.609943][ T5870] 8021q: adding VLAN 0 to HW filter on device bond0
[   72.623163][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   72.625807][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   72.634618][ T5871] Bluetooth: hci0: command tx timeout
[   72.636568][ T5871] Bluetooth: hci1: command tx timeout
[   72.652824][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   72.655152][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   72.667465][ T5870] 8021q: adding VLAN 0 to HW filter on device team0
[   72.691037][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   72.693274][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   72.701212][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   72.703446][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   72.714652][ T5871] Bluetooth: hci2: command tx timeout
[   72.759494][ T5877] 8021q: adding VLAN 0 to HW filter on device bond0
[   72.812182][ T5877] 8021q: adding VLAN 0 to HW filter on device team0
[   72.844265][ T1093] bridge0: port 1(bridge_slave_0) entered blocking state
[   72.847268][ T1093] bridge0: port 1(bridge_slave_0) entered forwarding state
[   72.865666][ T1093] bridge0: port 2(bridge_slave_1) entered blocking state
[   72.868452][ T1093] bridge0: port 2(bridge_slave_1) entered forwarding state
[   72.943274][ T5877] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   72.986541][ T5870] 8021q: adding VLAN 0 to HW filter on device batadv0
[   73.027770][ T5874] 8021q: adding VLAN 0 to HW filter on device batadv0
[   73.079930][ T5870] veth0_vlan: entered promiscuous mode
[   73.099087][ T5870] veth1_vlan: entered promiscuous mode
[   73.135896][ T5877] 8021q: adding VLAN 0 to HW filter on device batadv0
[   73.146757][ T5874] veth0_vlan: entered promiscuous mode
[   73.165310][ T5870] veth0_macvtap: entered promiscuous mode
[   73.181953][ T5874] veth1_vlan: entered promiscuous mode
[   73.188083][ T5870] veth1_macvtap: entered promiscuous mode
[   73.226731][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_0
[   73.232038][ T5877] veth0_vlan: entered promiscuous mode
[   73.238818][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_1
[   73.254795][ T5877] veth1_vlan: entered promiscuous mode
[   73.259930][   T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   73.278567][ T5874] veth0_macvtap: entered promiscuous mode
[   73.282239][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   73.287175][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   73.290511][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   73.325245][ T5874] veth1_macvtap: entered promiscuous mode
[   73.385929][ T5874] batman_adv: batadv0: Interface activated: batadv_slave_0
[   73.389902][ T5877] veth0_macvtap: entered promiscuous mode
[   73.409708][ T5874] batman_adv: batadv0: Interface activated: batadv_slave_1
[   73.413227][ T5877] veth1_macvtap: entered promiscuous mode
[   73.456343][ T5931] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   73.462497][ T1093] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.464821][ T5877] batman_adv: batadv0: Interface activated: batadv_slave_0
[   73.473928][ T1093] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.487405][ T5931] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   73.494763][ T5877] batman_adv: batadv0: Interface activated: batadv_slave_1
[   73.507698][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   73.522701][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   73.539957][ T5862] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   73.546887][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   73.550807][ T1093] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.555058][ T1093] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.570110][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   73.580216][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   73.719095][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.729423][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.805156][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.808246][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.864145][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.867220][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.908506][ T4041] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.910886][ T4041] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   74.123521][    C1] hrtimer: interrupt took 44521 ns
[   74.412547][ T5966] netlink: 'syz.1.23': attribute type 1 has an invalid length.
[   74.424784][ T5966] netlink: 17 bytes leftover after parsing attributes in process `syz.1.23'.
[   74.438282][ T5967] netlink: 164 bytes leftover after parsing attributes in process `syz.0.25'.
[   74.734277][ T5871] Bluetooth: hci1: command tx timeout
[   74.736584][ T5871] Bluetooth: hci0: command tx timeout
[   74.836170][ T5871] Bluetooth: hci2: command tx timeout
[   75.679785][ T6004] netlink: 'syz.1.41': attribute type 3 has an invalid length.
[   75.697598][ T6004] netlink: 'syz.1.41': attribute type 8 has an invalid length.
[   75.700737][ T6004] netlink: 'syz.1.41': attribute type 6 has an invalid length.
[   75.727282][ T6004] netlink: 144448 bytes leftover after parsing attributes in process `syz.1.41'.
[   75.886123][ T6009] netlink: 'syz.1.43': attribute type 21 has an invalid length.
[   75.889366][ T6009] netlink: 128 bytes leftover after parsing attributes in process `syz.1.43'.
[   75.892929][ T6009] netlink: 'syz.1.43': attribute type 5 has an invalid length.
[   75.900537][ T6009] netlink: 'syz.1.43': attribute type 6 has an invalid length.
[   75.904351][ T6009] netlink: 3 bytes leftover after parsing attributes in process `syz.1.43'.
[   76.804027][   T54] Bluetooth: hci0: command tx timeout
[   76.805838][   T54] Bluetooth: hci1: command tx timeout
[   76.817024][ T6035] warning: `syz.2.55' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   76.889714][ T5871] Bluetooth: hci2: command tx timeout
[   77.687600][ T6054] netlink: 104 bytes leftover after parsing attributes in process `syz.2.64'.
[   78.317140][ T5985] syz.2.27 (5985) used greatest stack depth: 19616 bytes left
[   78.516314][ T6086] netlink: 'syz.1.79': attribute type 2 has an invalid length.
[   78.530544][ T6086] netlink: 51 bytes leftover after parsing attributes in process `syz.1.79'.
[   78.735675][ T6100] netlink: 26 bytes leftover after parsing attributes in process `syz.1.86'.
[   78.887246][ T5871] Bluetooth: hci1: command tx timeout
[   78.889461][ T5871] Bluetooth: hci0: command tx timeout
[   78.902417][ T6112] tc_dump_action: action bad kind
[   78.954597][   T54] Bluetooth: hci2: command tx timeout
[   78.984798][ T6116] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   79.114170][ T6123] netlink: 'syz.2.97': attribute type 21 has an invalid length.
[   79.132765][ T6125] Zero length message leads to an empty skb
[   80.099999][ T6123] netlink: 'syz.2.97': attribute type 1 has an invalid length.
[   80.102608][ T6123] netlink: 144 bytes leftover after parsing attributes in process `syz.2.97'.
[   80.370097][ T6151] netlink: 'syz.0.107': attribute type 2 has an invalid length.
[   80.373371][ T6151] netlink: 17267 bytes leftover after parsing attributes in process `syz.0.107'.
[   80.713458][ T6173] netlink: 'syz.2.114': attribute type 1 has an invalid length.
[   81.301442][ T6181] netlink: 'syz.0.116': attribute type 15 has an invalid length.
[   81.846431][ T6195] netlink: 24 bytes leftover after parsing attributes in process `syz.2.123'.
[   81.850216][ T6195] netlink: 24 bytes leftover after parsing attributes in process `syz.2.123'.
[   83.979576][ T6238] veth1_macvtap: left promiscuous mode
[   83.989334][ T6238] macsec0: entered promiscuous mode
[   84.090154][ T6240] netlink: 'syz.2.141': attribute type 5 has an invalid length.
[   84.210879][ T6245] netlink: 11382 bytes leftover after parsing attributes in process `syz.1.143'.
[   84.458497][    C0] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[   85.482792][ T6296] netlink: 'syz.2.164': attribute type 6 has an invalid length.
[   85.486837][ T6296] netlink: 'syz.2.164': attribute type 7 has an invalid length.
[   85.489225][ T6296] netlink: 9 bytes leftover after parsing attributes in process `syz.2.164'.
[   85.506221][ T6296] netlink: 130080 bytes leftover after parsing attributes in process `syz.2.164'.
[   85.513612][ T6296] netlink: 'syz.2.164': attribute type 6 has an invalid length.
[   85.516041][ T6296] netlink: 'syz.2.164': attribute type 7 has an invalid length.
[   85.530769][ T6296] netlink: 9 bytes leftover after parsing attributes in process `syz.2.164'.
[   85.812903][ T6312] netlink: 'syz.2.167': attribute type 10 has an invalid length.
[   85.816206][ T6312] bridge0: port 3(macsec0) entered blocking state
[   85.818888][ T6312] bridge0: port 3(macsec0) entered disabled state
[   85.821163][ T6312] macsec0: entered allmulticast mode
[   85.823088][ T6312] veth1_macvtap: entered allmulticast mode
[   85.828150][ T6312] macsec0: entered promiscuous mode
[   85.831613][ T6312] bridge0: port 3(macsec0) entered blocking state
[   85.834592][ T6312] bridge0: port 3(macsec0) entered forwarding state
[   86.007871][ T6315] netlink: 60 bytes leftover after parsing attributes in process `syz.0.172'.
[   86.012565][ T6315] netlink: 60 bytes leftover after parsing attributes in process `syz.0.172'.
[   86.381294][   T54] Bluetooth: hci0: unexpected event 0x03 length: 15 > 11
[   86.403879][   T47] cfg80211: failed to load regulatory.db
[   90.140258][   T54] Bluetooth: hci2: SCO packet for unknown connection handle 0
[   90.691485][ T6432] syz.1.227 uses obsolete (PF_INET,SOCK_PACKET)
[   92.554798][ T6472] netlink: 10 bytes leftover after parsing attributes in process `syz.1.245'.
[   92.586257][ T6453] netlink: 'syz.2.238': attribute type 9 has an invalid length.
[   92.589546][ T6453] netlink: 61951 bytes leftover after parsing attributes in process `syz.2.238'.
[   92.867698][ T6488] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   93.080136][ T6491] netlink: 180 bytes leftover after parsing attributes in process `syz.2.253'.
[   94.264842][ T6524] veth1_macvtap: left allmulticast mode
[   94.267212][ T6524] veth1_macvtap: left promiscuous mode
[   94.293651][ T6524] bridge0: port 3(macsec0) entered disabled state
[   94.332489][ T6524] veth1_macvtap: entered promiscuous mode
[   94.334773][ T6524] veth1_macvtap: entered allmulticast mode
[   94.342587][ T4041] bridge0: port 3(macsec0) entered blocking state
[   94.344852][ T4041] bridge0: port 3(macsec0) entered forwarding state
[   94.610454][ T6532] netlink: 'syz.0.270': attribute type 12 has an invalid length.
[   94.613783][ T6532] netlink: 132 bytes leftover after parsing attributes in process `syz.0.270'.
[   94.619008][ T6532] netlink: 132 bytes leftover after parsing attributes in process `syz.0.270'.
[   95.764395][   T54] Bluetooth: hci2: ISO packet for unknown connection handle 0
[   95.768033][   T54] Bluetooth: hci2: Received unexpected HCI Event 0x00
[   96.801145][ T6605] netlink: 55631 bytes leftover after parsing attributes in process `syz.1.301'.
[   96.901815][ T6608] netlink: 12 bytes leftover after parsing attributes in process `syz.1.302'.
[   97.196063][ T6620] netlink: 136 bytes leftover after parsing attributes in process `syz.1.308'.
[   99.748510][ T6700] netlink: 'syz.1.342': attribute type 4 has an invalid length.
[   99.754844][ T6700] netlink: 152 bytes leftover after parsing attributes in process `syz.1.342'.
[   99.777724][ T6700] .`: renamed from bond0 (while UP)
[  103.322521][    C1] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 3848088691 wd_nsec: 3848088915
[  108.800237][ T6716] netlink: 5348 bytes leftover after parsing attributes in process `syz.1.347'.
[  115.458645][ T5871] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  115.463375][ T5871] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  115.468537][ T5871] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  115.473144][ T5871] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  115.477068][ T5871] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  115.682440][ T6725] chnl_net:caif_netlink_parms(): no params data found
[  117.514623][ T5871] Bluetooth: hci3: command tx timeout
[  119.593763][ T5871] Bluetooth: hci3: command tx timeout
[  121.673771][ T5871] Bluetooth: hci3: command tx timeout
[  123.753947][ T5871] Bluetooth: hci3: command tx timeout
[  124.686540][   T54] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  124.689849][   T54] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  124.692443][   T54] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  124.695554][   T54] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  124.698450][   T54] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  126.713787][   T54] Bluetooth: hci4: command tx timeout
[  129.099154][   T54] Bluetooth: hci4: command tx timeout
[  130.626904][ T5871] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  130.631024][ T5871] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  130.638422][ T5871] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  130.645115][ T5871] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  130.648942][ T5871] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  131.113920][   T54] Bluetooth: hci4: command tx timeout
[  133.396290][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  133.398968][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  133.433855][   T54] Bluetooth: hci5: command tx timeout
[  133.562399][   T54] Bluetooth: hci4: command tx timeout
[  135.513987][   T54] Bluetooth: hci5: command tx timeout
[  137.596271][   T54] Bluetooth: hci5: command tx timeout
[  139.673788][   T54] Bluetooth: hci5: command tx timeout
[  149.055730][ T6725] bridge0: port 1(bridge_slave_0) entered blocking state
[  149.058044][ T6725] bridge0: port 1(bridge_slave_0) entered disabled state
[  149.060436][ T6725] bridge_slave_0: entered allmulticast mode
[  149.074877][ T6725] bridge_slave_0: entered promiscuous mode
[  149.117023][ T6725] bridge0: port 2(bridge_slave_1) entered blocking state
[  149.120483][ T6725] bridge0: port 2(bridge_slave_1) entered disabled state
[  149.128909][ T6725] bridge_slave_1: entered allmulticast mode
[  149.139170][ T6725] bridge_slave_1: entered promiscuous mode
[  149.254736][ T6725] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  149.279479][ T6725] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  149.398438][ T6725] team0: Port device team_slave_0 added
[  149.430753][ T6725] team0: Port device team_slave_1 added
[  149.494867][   T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  149.535094][ T6725] batman_adv: batadv0: Adding interface: batadv_slave_0
[  149.537668][ T6725] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  149.549481][ T6725] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  149.572203][   T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  149.580422][ T6725] batman_adv: batadv0: Adding interface: batadv_slave_1
[  149.582637][ T6725] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  149.590735][ T6725] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  149.626181][   T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  149.636101][ T6733] chnl_net:caif_netlink_parms(): no params data found
[  149.702164][   T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  149.722728][ T6725] hsr_slave_0: entered promiscuous mode
[  149.725542][ T6725] hsr_slave_1: entered promiscuous mode
[  149.728187][ T6725] debugfs: 'hsr0' already exists in 'hsr'
[  149.730033][ T6725] Cannot create hsr debugfs directory
[  149.844633][ T6733] bridge0: port 1(bridge_slave_0) entered blocking state
[  149.847091][ T6733] bridge0: port 1(bridge_slave_0) entered disabled state
[  149.849535][ T6733] bridge_slave_0: entered allmulticast mode
[  149.852342][ T6733] bridge_slave_0: entered promiscuous mode
[  149.880003][ T6742] chnl_net:caif_netlink_parms(): no params data found
[  149.890382][ T6733] bridge0: port 2(bridge_slave_1) entered blocking state
[  149.894030][ T6733] bridge0: port 2(bridge_slave_1) entered disabled state
[  149.896380][ T6733] bridge_slave_1: entered allmulticast mode
[  149.899189][ T6733] bridge_slave_1: entered promiscuous mode
[  149.958096][ T6733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  149.999167][ T6733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  150.053787][   T13] bridge0: port 3(macsec0) entered disabled state
[  150.060327][   T13] bridge_slave_1: left allmulticast mode
[  150.062192][   T13] bridge_slave_1: left promiscuous mode
[  150.064672][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  150.071955][   T13] bridge_slave_0: left allmulticast mode
[  150.079716][   T13] bridge_slave_0: left promiscuous mode
[  150.081708][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  150.358808][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  150.365670][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  150.370341][   T13] bond0 (unregistering): Released all slaves
[  150.381838][ T6733] team0: Port device team_slave_0 added
[  150.387326][ T6733] team0: Port device team_slave_1 added
[  150.510144][ T6742] bridge0: port 1(bridge_slave_0) entered blocking state
[  150.513242][ T6742] bridge0: port 1(bridge_slave_0) entered disabled state
[  150.516911][ T6742] bridge_slave_0: entered allmulticast mode
[  150.520990][ T6742] bridge_slave_0: entered promiscuous mode
[  150.527443][ T6742] bridge0: port 2(bridge_slave_1) entered blocking state
[  150.530390][ T6742] bridge0: port 2(bridge_slave_1) entered disabled state
[  150.533448][ T6742] bridge_slave_1: entered allmulticast mode
[  150.540740][ T6742] bridge_slave_1: entered promiscuous mode
[  150.554639][ T6733] batman_adv: batadv0: Adding interface: batadv_slave_0
[  150.557496][ T6733] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  150.575482][ T6733] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  150.615316][ T6733] batman_adv: batadv0: Adding interface: batadv_slave_1
[  150.618167][ T6733] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  150.632749][ T6733] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  150.718620][ T6742] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  150.751865][ T6742] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  150.765745][   T13] hsr_slave_0: left promiscuous mode
[  150.768793][   T13] hsr_slave_1: left promiscuous mode
[  150.771641][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  150.775915][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  150.780034][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  150.787735][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  150.810668][   T13] veth1_macvtap: left allmulticast mode
[  150.813230][   T13] veth1_macvtap: left promiscuous mode
[  150.816441][   T13] veth0_macvtap: left promiscuous mode
[  150.818961][   T13] veth1_vlan: left promiscuous mode
[  150.822050][   T13] veth0_vlan: left promiscuous mode
[  151.279934][   T13] team0 (unregistering): Port device team_slave_1 removed
[  151.321022][   T13] team0 (unregistering): Port device team_slave_0 removed
[  151.798521][ T6742] team0: Port device team_slave_0 added
[  151.801491][ T6725] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  151.822742][ T6733] hsr_slave_0: entered promiscuous mode
[  151.831354][ T6733] hsr_slave_1: entered promiscuous mode
[  151.834794][ T6733] debugfs: 'hsr0' already exists in 'hsr'
[  151.837065][ T6733] Cannot create hsr debugfs directory
[  151.841321][ T6742] team0: Port device team_slave_1 added
[  151.858328][ T6725] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  151.867366][ T6725] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  151.897344][ T6725] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  151.910207][ T6742] batman_adv: batadv0: Adding interface: batadv_slave_0
[  151.913198][ T6742] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  151.927443][ T6742] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  151.946113][ T6742] batman_adv: batadv0: Adding interface: batadv_slave_1
[  151.949035][ T6742] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  151.960322][ T6742] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  152.066034][ T6742] hsr_slave_0: entered promiscuous mode
[  152.069308][ T6742] hsr_slave_1: entered promiscuous mode
[  152.072276][ T6742] debugfs: 'hsr0' already exists in 'hsr'
[  152.075502][ T6742] Cannot create hsr debugfs directory
[  152.304956][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  152.403666][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  152.507283][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  152.554567][ T6725] 8021q: adding VLAN 0 to HW filter on device bond0
[  152.576618][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  152.600108][ T6733] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  152.638057][ T6733] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  152.660699][ T6725] 8021q: adding VLAN 0 to HW filter on device team0
[  152.668680][ T6733] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  152.716895][ T6733] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  152.766051][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[  152.768492][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[  152.816022][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[  152.818579][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[  152.876079][ T6742] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  152.887348][ T6742] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  152.897234][ T6742] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  152.937272][ T6742] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  152.991280][   T13] bridge_slave_1: left allmulticast mode
[  152.994192][   T13] bridge_slave_1: left promiscuous mode
[  152.996668][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  153.002725][   T13] bridge_slave_0: left allmulticast mode
[  153.007137][   T13] bridge_slave_0: left promiscuous mode
[  153.010014][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  153.339512][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  153.347724][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  153.352850][   T13] bond0 (unregistering): Released all slaves
[  153.659028][ T6733] 8021q: adding VLAN 0 to HW filter on device bond0
[  153.700583][ T6733] 8021q: adding VLAN 0 to HW filter on device team0
[  153.738338][   T13] hsr_slave_0: left promiscuous mode
[  153.745078][   T13] hsr_slave_1: left promiscuous mode
[  153.747187][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  153.749514][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  153.757911][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  153.760191][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  153.770973][   T13] veth0_macvtap: left promiscuous mode
[  153.772862][   T13] veth1_vlan: left promiscuous mode
[  153.775954][   T13] veth0_vlan: left promiscuous mode
[  154.102121][   T13] team0 (unregistering): Port device team_slave_1 removed
[  154.127883][   T13] team0 (unregistering): Port device team_slave_0 removed
[  154.519333][   T65] bridge0: port 1(bridge_slave_0) entered blocking state
[  154.522303][   T65] bridge0: port 1(bridge_slave_0) entered forwarding state
[  154.568071][ T1093] bridge0: port 2(bridge_slave_1) entered blocking state
[  154.571005][ T1093] bridge0: port 2(bridge_slave_1) entered forwarding state
[  154.619914][ T6725] 8021q: adding VLAN 0 to HW filter on device batadv0
[  154.661470][ T6742] 8021q: adding VLAN 0 to HW filter on device bond0
[  154.708030][ T6742] 8021q: adding VLAN 0 to HW filter on device team0
[  154.726616][ T6733] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  154.749539][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[  154.751830][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[  154.779028][   T65] bridge0: port 2(bridge_slave_1) entered blocking state
[  154.781975][   T65] bridge0: port 2(bridge_slave_1) entered forwarding state
[  154.870746][ T6725] veth0_vlan: entered promiscuous mode
[  154.916220][ T6725] veth1_vlan: entered promiscuous mode
[  154.972314][ T6725] veth0_macvtap: entered promiscuous mode
[  154.997832][ T6733] 8021q: adding VLAN 0 to HW filter on device batadv0
[  155.006674][ T6725] veth1_macvtap: entered promiscuous mode
[  155.038339][ T6725] batman_adv: batadv0: Interface activated: batadv_slave_0
[  155.058646][ T6725] batman_adv: batadv0: Interface activated: batadv_slave_1
[  155.069835][   T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  155.076351][   T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  155.097002][   T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  155.106528][ T5931] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  155.160528][ T6742] 8021q: adding VLAN 0 to HW filter on device batadv0
[  155.222066][ T1097] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  155.226778][ T1097] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  155.274822][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  155.280806][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  155.429892][ T6733] veth0_vlan: entered promiscuous mode
[  155.461446][ T6733] veth1_vlan: entered promiscuous mode
[  155.535716][ T6733] veth0_macvtap: entered promiscuous mode
[  155.562391][ T6733] veth1_macvtap: entered promiscuous mode
[  155.603381][ T6733] batman_adv: batadv0: Interface activated: batadv_slave_0
[  155.629307][ T6733] batman_adv: batadv0: Interface activated: batadv_slave_1
[  155.660147][ T5931] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  155.722487][ T5931] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  155.735804][ T5931] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  155.739271][ T5931] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  155.770604][ T6742] veth0_vlan: entered promiscuous mode
[  155.821326][ T6742] veth1_vlan: entered promiscuous mode
[  155.827617][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  155.830920][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  155.882638][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  155.887199][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  155.948402][ T6742] veth0_macvtap: entered promiscuous mode
[  155.966215][ T6742] veth1_macvtap: entered promiscuous mode
[  156.038714][ T6742] batman_adv: batadv0: Interface activated: batadv_slave_0
[  156.064505][ T6742] batman_adv: batadv0: Interface activated: batadv_slave_1
[  156.110644][   T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  156.140313][   T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  156.150328][   T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  156.168824][ T6861] netlink: 20 bytes leftover after parsing attributes in process `syz.3.359'.
[  156.170199][   T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  156.171657][ T6861] netlink: 'syz.3.359': attribute type 2 has an invalid length.
[  156.187892][ T6861] netlink: 'syz.3.359': attribute type 2 has an invalid length.
[  156.190469][ T6861] netlink: 'syz.3.359': attribute type 1 has an invalid length.
[  156.192795][ T6861] netlink: 48 bytes leftover after parsing attributes in process `syz.3.359'.
[  156.206279][ T6862] netlink: 1010 bytes leftover after parsing attributes in process `syz.4.358'.
[  156.209307][ T6862] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported
[  156.387175][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  156.398285][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  156.426342][ T6873] netlink: 'syz.4.362': attribute type 10 has an invalid length.
[  156.528130][ T6873] team0: Port device geneve1 added
[  156.619885][   T65] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  156.624142][   T65] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  157.779107][ T6903] netlink: 13 bytes leftover after parsing attributes in process `syz.3.371'.
[  158.095718][ T6904] netlink: 1018 bytes leftover after parsing attributes in process `syz.4.372'.
[  159.100106][ T6909] syz.3.373 (6909) used greatest stack depth: 19256 bytes left
[  159.108659][ T6939] IPv6: Can't replace route, no match found
[  159.501951][ T6975] netlink: 22 bytes leftover after parsing attributes in process `syz.5.392'.
[  162.422852][ T7017] netlink: 24 bytes leftover after parsing attributes in process `syz.4.399'.
[  163.129686][ T7054] netlink: 24 bytes leftover after parsing attributes in process `syz.3.411'.
[  163.534644][ T7067] mac80211_hwsim hwsim9 .3c: renamed from wlan1 (while UP)
[  164.222362][ T7076] netlink: 'syz.4.416': attribute type 19 has an invalid length.
[  164.227588][ T7076] netlink: 40 bytes leftover after parsing attributes in process `syz.4.416'.
[  164.328880][ T7078] netlink: 'syz.5.417': attribute type 10 has an invalid length.
[  164.372877][ T7078] veth0_vlan: left promiscuous mode
[  164.384577][ T7078] veth0_vlan: entered promiscuous mode
[  164.401122][ T7078] team0: Device veth0_vlan failed to register rx_handler
[  164.439665][ T7083] netlink: 128 bytes leftover after parsing attributes in process `syz.5.417'.
[  164.446373][ T7083] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  164.847270][ T7095] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  164.850352][ T7095] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  164.896698][ T7096] netlink: 'syz.3.424': attribute type 21 has an invalid length.
[  164.912875][ T7096] netlink: 132 bytes leftover after parsing attributes in process `syz.3.424'.
[  164.951394][ T7096] netlink: 'syz.3.424': attribute type 5 has an invalid length.
[  165.267688][ T7110] netlink: 64 bytes leftover after parsing attributes in process `syz.5.430'.
[  165.576085][ T7116] netlink: 'syz.5.433': attribute type 3 has an invalid length.
[  165.578641][ T7116] netlink: 132 bytes leftover after parsing attributes in process `syz.5.433'.
[  165.621258][ T7118] netlink: 7 bytes leftover after parsing attributes in process `syz.5.434'.
[  165.625649][ T7118] netlink: 40 bytes leftover after parsing attributes in process `syz.5.434'.
[  166.158057][ T7144] netlink: 12 bytes leftover after parsing attributes in process `syz.4.446'.
[  166.265960][ T7150] : renamed from pim6reg1
[  167.584869][ T7214] __nla_validate_parse: 1 callbacks suppressed
[  167.584882][ T7214] netlink: 16 bytes leftover after parsing attributes in process `syz.4.478'.
[  167.727985][ T7221] netlink: 7 bytes leftover after parsing attributes in process `syz.4.480'.
[  167.738778][ T7221] netlink: 60 bytes leftover after parsing attributes in process `syz.4.480'.
[  167.742260][ T7221] netlink: 60 bytes leftover after parsing attributes in process `syz.4.480'.
[  167.895049][ T7225] Driver unsupported XDP return value 0 on prog  (id 173) dev N/A, expect packet loss!
[  168.066410][   T54] Bluetooth: hci4: unexpected event 0x06 length: 15 > 3
[  168.878218][ T7217] netlink: 'syz.5.479': attribute type 10 has an invalid length.
[  168.884070][ T7217] netlink: 40 bytes leftover after parsing attributes in process `syz.5.479'.
[  169.072875][ T7239] syzkaller0: entered promiscuous mode
[  169.075775][ T7239] syzkaller0: entered allmulticast mode
[  170.664440][ T7266] syzkaller0: entered promiscuous mode
[  170.666733][ T7266] syzkaller0: entered allmulticast mode
[  170.953432][ T7287] netlink: 'syz.4.509': attribute type 22 has an invalid length.
[  170.962928][ T7287] netlink: 168 bytes leftover after parsing attributes in process `syz.4.509'.
[  171.363777][ T7309] netlink: 'syz.3.519': attribute type 10 has an invalid length.
[  173.314826][ T7327] netlink: 132 bytes leftover after parsing attributes in process `syz.5.524'.
[  173.346565][ T7323] netlink: 212424 bytes leftover after parsing attributes in process `syz.3.523'.
[  173.408458][ T7333] netlink: 'syz.5.528': attribute type 3 has an invalid length.
[  173.410966][ T7333] netlink: 'syz.5.528': attribute type 2 has an invalid length.
[  173.424241][ T7333] netlink: 198112 bytes leftover after parsing attributes in process `syz.5.528'.
[  174.476041][   T33] audit: type=1107 audit(1755010539.741:2): pid=7355 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''
[  176.085976][ T7372] netlink: 40 bytes leftover after parsing attributes in process `syz.4.542'.
[  176.256462][ T7377] netlink: 'syz.3.546': attribute type 11 has an invalid length.
[  176.259937][ T7377] netlink: 149476 bytes leftover after parsing attributes in process `syz.3.546'.
[  176.903172][ T7376] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  179.464059][ T7394] netlink: 'syz.5.552': attribute type 21 has an invalid length.
[  179.467115][ T7394] IPv6: NLM_F_CREATE should be specified when creating new route
[  179.471730][ T7394] IPv6: Can't replace route, no match found
[  188.644794][ T7403] netlink: 56 bytes leftover after parsing attributes in process `syz.3.555'.
[  188.647531][ T7403] netlink: 120 bytes leftover after parsing attributes in process `syz.3.555'.
[  188.654819][ T7403] netlink: 16 bytes leftover after parsing attributes in process `syz.3.555'.
[  188.690405][ T7408] netlink: 'syz.3.557': attribute type 29 has an invalid length.
[  188.694526][ T7408] netlink: 'syz.3.557': attribute type 29 has an invalid length.
[  188.736897][ T7410] netlink: 'syz.4.558': attribute type 2 has an invalid length.
[  188.741242][ T7410] netlink: 17267 bytes leftover after parsing attributes in process `syz.4.558'.
[  191.016595][ T7458] netlink: 'syz.4.577': attribute type 16 has an invalid length.
[  191.027474][ T7458] netlink: 152 bytes leftover after parsing attributes in process `syz.4.577'.
[  191.396509][ T7477] netlink: 'syz.3.587': attribute type 1 has an invalid length.
[  191.451358][ T7479] netlink: 'syz.4.588': attribute type 3 has an invalid length.
[  191.457517][ T7479] netlink: 130984 bytes leftover after parsing attributes in process `syz.4.588'.
[  193.277901][ T7531] ksmbd: Daemon and kernel module version mismatch. ksmbd: 36, kernel module: 1. User-space ksmbd should terminate.
[  193.278142][ T7526] netlink: 'syz.4.608': attribute type 10 has an invalid length.
[  193.500481][ T7526] team0 (unregistering): Port device team_slave_0 removed
[  193.510792][ T7526] team0 (unregistering): Port device team_slave_1 removed
[  193.530931][ T7526] team0 (unregistering): Port device geneve1 removed
[  193.559784][ T7538] veth1_macvtap: left promiscuous mode
[  193.565395][ T7538] macsec0: entered promiscuous mode
[  194.286798][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  194.289061][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  194.348932][ T7547] netlink: 12 bytes leftover after parsing attributes in process `syz.3.617'.
[  194.447807][ T7557] netlink: 16410 bytes leftover after parsing attributes in process `syz.3.622'.
[  194.570868][ T7565] netlink: 'syz.4.626': attribute type 2 has an invalid length.
[  194.608299][ T7571] netlink: 32 bytes leftover after parsing attributes in process `syz.5.629'.
[  194.871327][ T7590] netlink: 10 bytes leftover after parsing attributes in process `syz.5.639'.
[  195.002047][ T7595] sit0: entered allmulticast mode
[  195.016722][ T7595] sit0: entered promiscuous mode
[  195.204257][   T54] Bluetooth: hci5: unexpected event 0x0f length: 151 > 4
[  195.430841][ T7602] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.643'.
[  196.541351][ T7633] netlink: 147608 bytes leftover after parsing attributes in process `syz.5.658'.
[  196.550622][ T7633] netlink: 'syz.5.658': attribute type 3 has an invalid length.
[  196.821471][ T7644] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.663'.
[  197.871824][ T7659] netlink: 'syz.4.667': attribute type 10 has an invalid length.
[  199.481336][ T7659] geneve0: entered promiscuous mode
[  199.506763][ T7659] bond0: (slave geneve0): Enslaving as an active interface with an up link
[  199.514657][ T7661] netlink: 35840 bytes leftover after parsing attributes in process `syz.5.668'.
[  200.151979][ T7680] netlink: 14548 bytes leftover after parsing attributes in process `syz.5.675'.
[  200.218644][ T7685] netlink: 132 bytes leftover after parsing attributes in process `syz.5.678'.
[  200.302018][ T7687] netlink: 'syz.3.679': attribute type 21 has an invalid length.
[  201.120312][ T7737] netlink: 'syz.4.703': attribute type 3 has an invalid length.
[  201.330402][ T7747] netlink: 61967 bytes leftover after parsing attributes in process `syz.5.707'.
[  201.648355][ T7754] netlink: 'syz.5.709': attribute type 21 has an invalid length.
[  201.825517][ T7764] netlink: 24 bytes leftover after parsing attributes in process `syz.4.714'.
[  202.617532][ T7783] netlink: 17 bytes leftover after parsing attributes in process `syz.5.722'.
[  202.620346][ T7783] netlink: zone id is out of range
[  202.621978][ T7783] netlink: zone id is out of range
[  202.631845][ T7783] netlink: zone id is out of range
[  202.634921][ T7783] netlink: zone id is out of range
[  202.638322][ T7783] netlink: zone id is out of range
[  202.640418][ T7783] netlink: zone id is out of range
[  202.648037][ T7783] netlink: zone id is out of range
[  202.650517][ T7783] netlink: zone id is out of range
[  202.653618][ T7783] netlink: zone id is out of range
[  202.656040][ T7783] netlink: zone id is out of range
[  202.790756][ T7799] netlink: 26 bytes leftover after parsing attributes in process `syz.4.729'.
[  202.828491][ T7801] netlink: 24032 bytes leftover after parsing attributes in process `syz.5.731'.
[  202.831578][ T7801] netlink: 104088 bytes leftover after parsing attributes in process `syz.5.731'.
[  202.838322][ T7801] netlink: 24032 bytes leftover after parsing attributes in process `syz.5.731'.
[  204.185204][ T7847] syzkaller0: entered promiscuous mode
[  204.187157][ T7847] syzkaller0: entered allmulticast mode
[  204.232105][ T5931] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  205.562004][ T5931] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  205.709471][ T5931] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  205.724884][   T54] Bluetooth: hci4: unexpected event 0x04 length: 15 > 10
[  205.750516][ T7881] __nla_validate_parse: 1 callbacks suppressed
[  205.750538][ T7881] netlink: 60 bytes leftover after parsing attributes in process `syz.5.768'.
[  205.760291][ T7881] netlink: 60 bytes leftover after parsing attributes in process `syz.5.768'.
[  205.786763][ T5931] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  205.822550][ T7886] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.767'.
[  205.965860][ T7887] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.769'.
[  206.771547][ T5931] bridge_slave_1: left allmulticast mode
[  206.776840][ T5931] bridge_slave_1: left promiscuous mode
[  206.779219][ T5931] bridge0: port 2(bridge_slave_1) entered disabled state
[  206.793470][ T5931] bridge_slave_0: left allmulticast mode
[  206.818864][ T5931] bridge_slave_0: left promiscuous mode
[  206.821254][ T5931] bridge0: port 1(bridge_slave_0) entered disabled state
[  206.950369][   T54] Bluetooth: hci5: unexpected subevent 0x0c length: 150 > 5
[  207.418957][ T7923] netlink: 'syz.5.784': attribute type 5 has an invalid length.
[  207.666110][ T5931] .` (unregistering): (slave bond_slave_0): Releasing backup interface
[  207.672650][ T5931] .` (unregistering): (slave bond_slave_1): Releasing backup interface
[  207.679897][ T5931] .` (unregistering): Released all slaves
[  207.753955][   T54] Bluetooth: hci4: command tx timeout
[  208.118303][ T7935] netlink: 144 bytes leftover after parsing attributes in process `syz.4.789'.
[  208.161963][ T7937] netlink: 763 bytes leftover after parsing attributes in process `syz.5.790'.
[  208.256975][ T5931] hsr_slave_0: left promiscuous mode
[  208.263046][ T5931] hsr_slave_1: left promiscuous mode
[  208.267853][ T7946] netlink: 20 bytes leftover after parsing attributes in process `syz.3.794'.
[  208.270221][ T5931] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  208.278014][ T5931] batman_adv: batadv0: Removing interface: batadv_slave_0
[  208.287411][ T5931] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  208.301112][ T5931] batman_adv: batadv0: Removing interface: batadv_slave_1
[  208.322733][ T5931] veth1_macvtap: left promiscuous mode
[  208.332952][ T5931] veth0_macvtap: left promiscuous mode
[  208.336522][ T5931] veth1_vlan: left promiscuous mode
[  208.338855][ T5931] veth0_vlan: left promiscuous mode
[  208.736467][   T54] Bluetooth: hci3: unexpected event 0x0f length: 15 > 4
[  208.901916][ T5931] team0 (unregistering): Port device team_slave_1 removed
[  208.948569][ T5931] team0 (unregistering): Port device team_slave_0 removed
[  209.897796][ T7997] netlink: 'syz.5.819': attribute type 3 has an invalid length.
[  209.900336][ T7997] netlink: 132 bytes leftover after parsing attributes in process `syz.5.819'.
[  209.996594][ T8004] netlink: 'syz.3.822': attribute type 11 has an invalid length.
[  209.999887][ T8004] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.822'.
[  210.131392][ T8003] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  210.270598][ T8017] netlink: 60 bytes leftover after parsing attributes in process `syz.3.828'.
[  210.693236][ T8040] netlink: 'syz.5.840': attribute type 21 has an invalid length.
[  210.890306][ T8050] __nla_validate_parse: 1 callbacks suppressed
[  210.890329][ T8050] netlink: 65047 bytes leftover after parsing attributes in process `syz.5.841'.
[  211.743387][ T8063] netlink: 60 bytes leftover after parsing attributes in process `syz.3.848'.
[  211.749298][ T8063] netlink: 60 bytes leftover after parsing attributes in process `syz.3.848'.
[  211.754366][ T8063] netlink: 60 bytes leftover after parsing attributes in process `syz.3.848'.
[  212.781667][ T8086] netlink: 348 bytes leftover after parsing attributes in process `syz.3.859'.
[  213.990824][ T8112] netlink: 'syz.5.870': attribute type 4 has an invalid length.
[  213.996904][ T8112] netlink: 152 bytes leftover after parsing attributes in process `syz.5.870'.
[  215.078278][ T8112] net_ratelimit: 75 callbacks suppressed
[  215.078323][ T8112] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check.
[  215.257064][   T54] Bluetooth: hci5: ACL packet for unknown connection handle 0
[  216.162698][ T8150] netlink: 14 bytes leftover after parsing attributes in process `syz.4.888'.
[  216.326643][ T8150] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  216.335538][ T8150] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  216.342414][ T8150] bond0 (unregistering): (slave geneve0): Releasing backup interface
[  216.359789][ T8150] bond0 (unregistering): Released all slaves
[  216.384691][ T5931] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  216.387572][ T5931] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  216.398764][ T5931] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  216.402321][ T5931] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  216.424846][   T54] Bluetooth: hci5: unexpected subevent 0x01 length: 150 > 18
[  216.541478][ T8165] netlink: 'syz.4.895': attribute type 27 has an invalid length.
[  216.545763][ T8165] netlink: 'syz.4.895': attribute type 3 has an invalid length.
[  216.548848][ T8165] netlink: 132 bytes leftover after parsing attributes in process `syz.4.895'.
[  216.625582][ T8169] netlink: 'syz.4.897': attribute type 2 has an invalid length.
[  216.628764][ T8169] netlink: 'syz.4.897': attribute type 8 has an invalid length.
[  216.631638][ T8169] netlink: 132 bytes leftover after parsing attributes in process `syz.4.897'.
[  219.559202][ T8178] netlink: 'syz.4.900': attribute type 21 has an invalid length.
[  219.562287][ T8178] netlink: 132 bytes leftover after parsing attributes in process `syz.4.900'.
[  219.647419][ T8186] netlink: 14 bytes leftover after parsing attributes in process `syz.4.905'.
[  220.011184][ T8208] : renamed from veth0_to_bond (while UP)
[  220.375249][ T8216] netdevsim netdevsim4 : renamed from netdevsim0 (while UP)
[  220.491500][   T54] Bluetooth: hci5: Malformed Event: 0x13
[  221.370115][ T8234] netlink: 130144 bytes leftover after parsing attributes in process `syz.5.920'.
[  221.948505][ T8249] bpf: Bad value for 'mode'
[  222.039853][ T8256] netlink: 'syz.4.938': attribute type 10 has an invalid length.
[  222.312501][ T8273] netlink: 'syz.5.946': attribute type 1 has an invalid length.
[  222.316622][ T8273] netlink: 168864 bytes leftover after parsing attributes in process `syz.5.946'.
[  222.446400][ T8281] netlink: 40 bytes leftover after parsing attributes in process `syz.3.950'.
[  222.450001][ T8281] netlink: 4 bytes leftover after parsing attributes in process `syz.3.950'.
[  222.487222][ T8285] netlink: 146936 bytes leftover after parsing attributes in process `syz.4.952'.
[  222.493177][ T8285] openvswitch: netlink: Message has 6 unknown bytes.
[  222.845548][ T8303] syzkaller0: entered promiscuous mode
[  222.847698][ T8303] syzkaller0: entered allmulticast mode
[  222.969616][ T8310] netlink: 'syz.3.963': attribute type 11 has an invalid length.
[  222.972367][ T8310] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.963'.
[  224.277664][ T8318] openvswitch: netlink: Flow actions attr not present in new flow.
[  224.453335][ T8333] netlink: 11382 bytes leftover after parsing attributes in process `syz.5.973'.
[  224.592512][ T8344] netlink: 65047 bytes leftover after parsing attributes in process `syz.4.978'.
[  224.620338][ T8346] netlink: 'syz.3.979': attribute type 21 has an invalid length.
[  224.628642][ T8346] netlink: 156 bytes leftover after parsing attributes in process `syz.3.979'.
[  224.749904][ T8355] netlink: 'syz.4.983': attribute type 3 has an invalid length.
[  224.757259][ T8355] netlink: 'syz.4.983': attribute type 2 has an invalid length.
[  224.760891][ T8355] netlink: 198112 bytes leftover after parsing attributes in process `syz.4.983'.
[  224.931240][ T8361] pim6reg0: tun_chr_ioctl cmd 1074025681
[  225.608917][ T8365] netlink: 'syz.5.989': attribute type 21 has an invalid length.
[  226.071135][ T8393] netlink: 'syz.5.1000': attribute type 1 has an invalid length.
[  226.344948][ T8394] delete_channel: no stack
[  226.457048][ T8406] netlink: 'syz.5.1006': attribute type 28 has an invalid length.
[  226.460347][ T8406] netlink: 'syz.5.1006': attribute type 4 has an invalid length.
[  226.463392][ T8406] __nla_validate_parse: 1 callbacks suppressed
[  226.463405][ T8406] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1006'.
[  226.517173][ T8410] netlink: 144 bytes leftover after parsing attributes in process `syz.5.1007'.
[  227.479173][ T8430] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[  228.266103][ T8444] syzkaller0: entered promiscuous mode
[  228.591856][ T8459] netlink: 'syz.3.1029': attribute type 3 has an invalid length.
[  228.607104][ T8459] netlink: 'syz.3.1029': attribute type 1 has an invalid length.
[  228.612396][ T8459] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.1029'.
[  229.641537][ T8491] netlink: 'syz.4.1042': attribute type 6 has an invalid length.
[  230.185825][ T8520] netlink: 61211 bytes leftover after parsing attributes in process `syz.4.1054'.
[  230.788509][ T8547] C: renamed from team_slave_0 (while UP)
[  230.808877][ T8547] netlink: 'syz.3.1068': attribute type 4 has an invalid length.
[  230.820106][ T8547] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[  230.943231][ T8555] syzkaller0: entered promiscuous mode
[  230.954575][ T8555] syzkaller0: entered allmulticast mode
[  230.970881][ T8559] netlink: 240 bytes leftover after parsing attributes in process `syz.4.1074'.
[  232.680325][ T8587] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1086'.
[  232.737397][ T8597] netlink: 'syz.4.1090': attribute type 1 has an invalid length.
[  232.856509][   T54] Bluetooth: hci4: unexpected event 0x04 length: 15 > 10
[  232.856884][   T54] Bluetooth: hci4: connection err: -111
[  232.938109][ T8608] netlink: 'syz.5.1094': attribute type 21 has an invalid length.
[  233.225435][ T8620] netlink: 'syz.5.1099': attribute type 4 has an invalid length.
[  233.228569][ T8620] netlink: 14345 bytes leftover after parsing attributes in process `syz.5.1099'.
[  233.728538][   T54] Bluetooth: hci3: adv larger than maximum supported
[  233.728600][   T54] Bluetooth: hci3: Unknown advertising packet type: 0x18
[  233.733990][   T54] Bluetooth: hci3: Malformed LE Event: 0x0d
[  234.175347][ T8668] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1120'.
[  234.246936][ T8672] tap0: tun_chr_ioctl cmd 1074025672
[  234.248826][ T8672] tap0: ignored: set checksum enabled
[  234.695161][ T8698] netlink: 137592 bytes leftover after parsing attributes in process `syz.3.1134'.
[  234.699285][ T8698] nbd: must specify a size in bytes for the device
[  234.967694][ T8720] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1144'.
[  234.971265][ T8720] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1144'.
[  234.985942][ T8720] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1144'.
[  236.034186][ T8749] IPv6: NLM_F_CREATE should be specified when creating new route
[  236.137290][ T8758] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1163'.
[  236.140729][ T8758] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1163'.
[  236.399985][ T8770] netlink: 203516 bytes leftover after parsing attributes in process `syz.5.1168'.
[  236.403444][ T8770] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[  236.454392][ T8770] openvswitch: netlink: Message has 6324 unknown bytes.
[  237.476744][ T8813] netlink: 'syz.5.1188': attribute type 25 has an invalid length.
[  237.779173][ T8821] netlink: 'syz.5.1192': attribute type 16 has an invalid length.
[  237.782299][ T8821] __nla_validate_parse: 3 callbacks suppressed
[  237.782309][ T8821] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1192'.
[  237.935593][ T8825] C: renamed from team_slave_0
[  237.945790][ T8825] netlink: 'syz.4.1194': attribute type 3 has an invalid length.
[  237.948598][ T8825] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1194'.
[  237.960215][ T8825] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[  237.979378][ T8827] netlink: 9286 bytes leftover after parsing attributes in process `syz.5.1195'.
[  238.021738][ T8831] netlink: 'syz.5.1197': attribute type 1 has an invalid length.
[  238.027501][ T8831] netlink: 'syz.5.1197': attribute type 2 has an invalid length.
[  238.071895][ T8834] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1198'.
[  238.263306][ T8846] netlink: 172 bytes leftover after parsing attributes in process `syz.3.1204'.
[  238.490501][ T8872] netlink: 'syz.3.1216': attribute type 4 has an invalid length.
[  238.492953][ T8872] netlink: 'syz.3.1216': attribute type 16 has an invalid length.
[  238.497138][ T8872] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1216'.
[  238.612094][ T8882] netlink: 'syz.4.1221': attribute type 10 has an invalid length.
[  238.615948][ T8882] netlink: 55 bytes leftover after parsing attributes in process `syz.4.1221'.
[  238.638776][ T8886] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1223'.
[  238.641623][ T8886] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1223'.
[  238.671523][ T8890] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1224'.
[  238.672305][ T8889] netlink: 'syz.5.1225': attribute type 21 has an invalid length.
[  239.336359][ T8945] netlink: 'syz.3.1251': attribute type 5 has an invalid length.
[  240.362509][ T5871] Bluetooth: hci3: unexpected subevent 0x01 length: 150 > 18
[  241.208806][   T33] audit: type=1107 audit(1755010606.491:3): pid=9017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=','
[  242.082025][ T5871] Bluetooth: hci3: command 0x0406 tx timeout
[  242.529134][ T9072] netlink: 'syz.3.1306': attribute type 21 has an invalid length.
[  242.532481][ T9072] netlink: 'syz.3.1306': attribute type 6 has an invalid length.
[  243.911005][ T9126] =======================================================
[  243.911005][ T9126] WARNING: The mand mount option has been deprecated and
[  243.911005][ T9126]          and is ignored by this kernel. Remove the mand
[  243.911005][ T9126]          option from the mount to silence this warning.
[  243.911005][ T9126] =======================================================
[  244.169943][ T9134] __nla_validate_parse: 13 callbacks suppressed
[  244.169964][ T9134] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1331'.
[  244.219318][   T54] Bluetooth: hci5: unexpected event 0x04 length: 15 > 10
[  244.347583][ T9149] netlink: 'syz.4.1338': attribute type 3 has an invalid length.
[  244.655402][ T9168] mac80211_hwsim hwsim15 O3c: renamed from wlan1
[  244.755953][ T9174] netlink: 'syz.5.1350': attribute type 29 has an invalid length.
[  244.759600][ T9174] netlink: 'syz.5.1350': attribute type 29 has an invalid length.
[  244.762724][ T9174] netlink: 'syz.5.1350': attribute type 29 has an invalid length.
[  244.766804][ T9174] netlink: 'syz.5.1350': attribute type 29 has an invalid length.
[  246.238043][   T54] Bluetooth: hci5: command tx timeout
[  246.393972][ T9193] netlink: 'syz.4.1359': attribute type 2 has an invalid length.
[  246.563337][ T9201] netlink: 'syz.3.1362': attribute type 10 has an invalid length.
[  246.567991][ T9201] geneve0: entered promiscuous mode
[  246.576593][ T9201] bond0: (slave geneve0): Enslaving as an active interface with an up link
[  247.209645][   T54] Bluetooth: hci4: command 0x0406 tx timeout
[  247.771628][ T9223] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1368'.
[  248.791019][ T9247] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1379'.
[  249.342537][ T9256] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1384'.
[  249.405617][ T9258] netlink: 'syz.3.1385': attribute type 4 has an invalid length.
[  249.793338][ T9272] netlink: 55631 bytes leftover after parsing attributes in process `syz.4.1392'.
[  249.834316][ T9275] openvswitch: netlink: IP tunnel dst address not specified
[  250.044625][ T9278] netlink: 'syz.4.1394': attribute type 12 has an invalid length.
[  250.056638][ T9278] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1394'.
[  250.159102][ T9281] syz.4.1394 (9281) used obsolete PPPIOCDETACH ioctl
[  250.524144][ T9290] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1399'.
[  250.528216][ T9290] netlink: 43 bytes leftover after parsing attributes in process `syz.5.1399'.
[  250.531140][ T9290] netlink: 'syz.5.1399': attribute type 5 has an invalid length.
[  250.542453][ T9290] netlink: 43 bytes leftover after parsing attributes in process `syz.5.1399'.
[  250.582860][ T9292] netlink: 'syz.4.1400': attribute type 27 has an invalid length.
[  250.949961][ T9312] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1410'.
[  251.069910][ T9322] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1415'.
[  251.187305][ T9330] netlink: 'syz.3.1419': attribute type 3 has an invalid length.
[  251.195912][ T9330] netlink: 'syz.3.1419': attribute type 1 has an invalid length.
[  251.198622][ T9330] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1419'.
[  251.202343][ T9330] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[  252.470329][ T9396] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.1450'.
[  252.507592][ T9398] netlink: 'syz.5.1451': attribute type 2 has an invalid length.
[  252.510072][ T9398] netlink: 'syz.5.1451': attribute type 7 has an invalid length.
[  252.512624][ T9398] netlink: 'syz.5.1451': attribute type 2 has an invalid length.
[  252.515485][ T9398] netlink: 'syz.5.1451': attribute type 7 has an invalid length.
[  253.560373][   T13] syzkaller0: tun_net_xmit 76
[  253.569169][   T13] syzkaller0: tun_net_xmit 48
[  253.579452][ T9428] syzkaller0: create flow: hash 1557164769 index 1
[  253.587461][   T47] syzkaller0: tun_net_xmit 76
[  253.659603][ T9427] syzkaller0: delete flow: hash 1557164769 index 1
[  254.469175][ T9455] __nla_validate_parse: 4 callbacks suppressed
[  254.469196][ T9455] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1475'.
[  255.362914][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  255.366749][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  256.171592][ T9457] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1476'.
[  256.181042][ T9458] veth0_vlan: entered allmulticast mode
[  256.654244][ T9504] netlink: 'syz.4.1497': attribute type 11 has an invalid length.
[  256.920530][ T9532] netlink: 'syz.5.1509': attribute type 21 has an invalid length.
[  256.923004][ T9532] netlink: 'syz.5.1509': attribute type 20 has an invalid length.
[  256.944619][ T9534] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1512'.
[  257.022033][ T9540] netlink: 'syz.3.1515': attribute type 49 has an invalid length.
[  257.223299][ T9554] netlink: 'syz.3.1522': attribute type 2 has an invalid length.
[  257.433877][   T54] Bluetooth: hci5: command 0x0406 tx timeout
[  258.550762][ T9584] net veth1_virt_wifi : renamed from virt_wifi0
[  258.621967][ T9590] netlink: 'syz.4.1535': attribute type 29 has an invalid length.
[  258.634196][ T9591] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1534'.
[  258.643340][ T9586] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1534'.
[  258.658414][ T9591] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1534'.
[  259.259049][ T9618] netlink: 'syz.5.1549': attribute type 10 has an invalid length.
[  259.261676][ T9618] netlink: 65015 bytes leftover after parsing attributes in process `syz.5.1549'.
[  259.301383][ T9620] netlink: 'syz.5.1550': attribute type 58 has an invalid length.
[  259.306028][ T9620] netlink: 144 bytes leftover after parsing attributes in process `syz.5.1550'.
[  259.830609][ T9633] netlink: 'syz.3.1555': attribute type 39 has an invalid length.
[  260.577963][ T9652] netlink: 'syz.5.1564': attribute type 2 has an invalid length.
[  260.581178][ T9652] netlink: 85 bytes leftover after parsing attributes in process `syz.5.1564'.
[  260.585845][ T9652] netlink: 130140 bytes leftover after parsing attributes in process `syz.5.1564'.
[  260.589520][ T9652] netlink: 85 bytes leftover after parsing attributes in process `syz.5.1564'.
[  260.598982][ T9654] netlink: 51563 bytes leftover after parsing attributes in process `syz.4.1565'.
[  260.698984][ T9658] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1567'.
[  260.702618][ T9658] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1567'.
[  261.380243][ T9687] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1577'.
[  262.734085][ T9714] validate_nla: 3 callbacks suppressed
[  262.734120][ T9714] netlink: 'syz.3.1590': attribute type 2 has an invalid length.
[  262.751982][ T9714] netlink: 'syz.3.1590': attribute type 3 has an invalid length.
[  262.761569][ T9714] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1590'.
[  263.681578][ T9770] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1614'.
[  263.709326][ T9770] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1614'.
[  263.766715][ T9773] netlink: 'syz.4.1615': attribute type 33 has an invalid length.
[  265.601334][ T9815] netlink: 'syz.4.1636': attribute type 2 has an invalid length.
[  265.606529][ T9815] netlink: 'syz.4.1636': attribute type 1 has an invalid length.
[  266.879442][ T9845] __nla_validate_parse: 2 callbacks suppressed
[  266.879465][ T9845] netlink: 16399 bytes leftover after parsing attributes in process `syz.3.1648'.
[  267.304643][ T9863] netlink: 203516 bytes leftover after parsing attributes in process `syz.4.1656'.
[  267.308347][ T9863] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[  267.312026][ T9863] openvswitch: netlink: Key 0 has unexpected len 3 expected 0
[  267.367130][ T9867] syzkaller0: entered allmulticast mode
[  267.535690][ T9874] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491
[  267.968671][ T9880] netlink: 'syz.5.1662': attribute type 10 has an invalid length.
[  267.971595][ T9880] netlink: 65015 bytes leftover after parsing attributes in process `syz.5.1662'.
[  268.388528][ T9891] netlink: 211 bytes leftover after parsing attributes in process `syz.4.1667'.
[  268.414676][ T9893] netlink: 'syz.4.1668': attribute type 29 has an invalid length.
[  268.417937][ T9893] netlink: 'syz.4.1668': attribute type 29 has an invalid length.
[  268.421349][ T9893] netlink: 'syz.4.1668': attribute type 29 has an invalid length.
[  268.469845][ T9896] syzkaller0: left promiscuous mode
[  268.471712][ T9896] syzkaller0: left allmulticast mode
[  268.577702][ T9889] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  268.581379][ T9902] netlink: 'syz.3.1672': attribute type 2 has an invalid length.
[  268.585076][ T9902] netlink: 'syz.3.1672': attribute type 8 has an invalid length.
[  268.588505][ T9902] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1672'.
[  268.596678][ T9889] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  269.622819][ T9920] netlink: 'syz.4.1679': attribute type 10 has an invalid length.
[  269.630280][ T9920] lo: entered promiscuous mode
[  269.710575][ T9926] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1681'.
[  269.739280][ T9926] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1681'.
[  269.750369][ T9926] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1681'.
[  269.757213][ T9930] netlink: 'syz.3.1683': attribute type 30 has an invalid length.
[  269.887981][ T9938] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1687'.
[  272.301007][T10005] netlink: 152 bytes leftover after parsing attributes in process `syz.5.1715'.
[  272.671778][T10016] netlink: 'syz.4.1719': attribute type 11 has an invalid length.
[  272.675273][T10016] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1719'.
[  272.909431][T10033] bond_slave_1: entered promiscuous mode
[  272.911368][T10033] bond_slave_1: entered allmulticast mode
[  273.767020][T10049] netlink: 731 bytes leftover after parsing attributes in process `syz.3.1734'.
[  273.873359][T10058] netlink: 26 bytes leftover after parsing attributes in process `syz.5.1738'.
[  273.935100][T10056] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1736'.
[  273.938870][T10056] netlink: 130076 bytes leftover after parsing attributes in process `syz.3.1736'.
[  273.942192][T10056] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1736'.
[  274.051647][T10067] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1742'.
[  274.702119][T10097] netlink: 'syz.3.1755': attribute type 2 has an invalid length.
[  274.704773][T10097] netlink: 12374 bytes leftover after parsing attributes in process `syz.3.1755'.
[  274.779266][T10104] netlink: 180 bytes leftover after parsing attributes in process `syz.3.1758'.
[  275.617178][T10118] netlink: 'syz.3.1765': attribute type 40 has an invalid length.
[  275.652433][T10118] bridge0: port 2(bridge_slave_1) entered disabled state
[  275.752174][ T5871] Bluetooth: hci4: unexpected event 0x0b length: 15 > 11
[  276.582860][T10143] netlink: 'syz.3.1774': attribute type 2 has an invalid length.
[  276.712138][T10147] : port 1(vlan0) entered blocking state
[  276.714655][T10147] : port 1(vlan0) entered disabled state
[  276.716678][T10147] vlan0: entered allmulticast mode
[  276.718410][T10147] veth0_vlan: entered allmulticast mode
[  276.721221][T10147] vlan0: entered promiscuous mode
[  276.747969][T10143] : port 1(vlan0) entered blocking state
[  276.750561][T10143] : port 1(vlan0) entered forwarding state
[  276.932827][T10158] netlink: 'syz.5.1778': attribute type 21 has an invalid length.
[  277.335699][T10174] pim6reg1: tun_chr_ioctl cmd 1074025680
[  278.556382][ T5871] Bluetooth: hci5: Malformed LE Event: 0x1b
[  278.559995][T10200] raw_sendmsg: syz.3.1799 forgot to set AF_INET. Fix it!
[  278.667637][T10206] ref_ctr_offset mismatch. inode: 0x8e8 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x20
[  279.188876][T10233] netlink: 'syz.4.1815': attribute type 21 has an invalid length.
[  279.192468][T10233] __nla_validate_parse: 1 callbacks suppressed
[  279.192480][T10233] netlink: 164 bytes leftover after parsing attributes in process `syz.4.1815'.
[  279.227941][T10237] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.1816'.
[  279.351471][T10251] syz.5.1822: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  279.360298][T10251] CPU: 0 UID: 0 PID: 10251 Comm: syz.5.1822 Not tainted 6.16.0-syzkaller-11113-gf3af62b6cee8-dirty #0 PREEMPT(full) 
[  279.360321][T10251] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  279.360331][T10251] Call Trace:
[  279.360338][T10251]  <TASK>
[  279.360346][T10251]  dump_stack_lvl+0x189/0x250
[  279.360375][T10251]  ? __pfx_dump_stack_lvl+0x10/0x10
[  279.360393][T10251]  ? __pfx__printk+0x10/0x10
[  279.360414][T10251]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  279.360434][T10251]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  279.360451][T10251]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  279.360469][T10251]  warn_alloc+0x214/0x310
[  279.360492][T10251]  ? stack_depot_save_flags+0x40/0x900
[  279.360519][T10251]  ? __pfx_warn_alloc+0x10/0x10
[  279.360542][T10251]  ? kasan_save_track+0x4f/0x80
[  279.360560][T10251]  ? xskq_create+0x56/0x170
[  279.360573][T10251]  ? xsk_init_queue+0xb0/0x110
[  279.360591][T10251]  ? xsk_setsockopt+0x57b/0x8d0
[  279.360608][T10251]  ? do_sock_setsockopt+0x17c/0x1b0
[  279.360625][T10251]  ? __x64_sys_setsockopt+0x13f/0x1b0
[  279.360677][T10251]  ? do_syscall_64+0xfa/0x3b0
[  279.360692][T10251]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  279.360714][T10251]  __vmalloc_node_range_noprof+0x125/0x12f0
[  279.360757][T10251]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  279.360782][T10251]  ? __kasan_kmalloc+0x93/0xb0
[  279.360802][T10251]  vmalloc_user_noprof+0xad/0xf0
[  279.360821][T10251]  ? xskq_create+0xbf/0x170
[  279.360835][T10251]  xskq_create+0xbf/0x170
[  279.360849][T10251]  xsk_init_queue+0xb0/0x110
[  279.360872][T10251]  xsk_setsockopt+0x57b/0x8d0
[  279.360894][T10251]  ? __pfx_xsk_setsockopt+0x10/0x10
[  279.360913][T10251]  ? __pfx_aa_sk_perm+0x10/0x10
[  279.360931][T10251]  ? __fget_files+0x2a/0x420
[  279.360950][T10251]  ? aa_sock_opt_perm+0x74/0x110
[  279.360969][T10251]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  279.360984][T10251]  ? __pfx_xsk_setsockopt+0x10/0x10
[  279.361005][T10251]  do_sock_setsockopt+0x17c/0x1b0
[  279.361025][T10251]  __x64_sys_setsockopt+0x13f/0x1b0
[  279.361045][T10251]  do_syscall_64+0xfa/0x3b0
[  279.361059][T10251]  ? lockdep_hardirqs_on+0x9c/0x150
[  279.361073][T10251]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  279.361087][T10251]  ? exc_page_fault+0x9f/0xf0
[  279.361102][T10251]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  279.361116][T10251] RIP: 0033:0x7fe860f8ebe9
[  279.361130][T10251] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  279.361148][T10251] RSP: 002b:00007fe861d78038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  279.361165][T10251] RAX: ffffffffffffffda RBX: 00007fe8611b5fa0 RCX: 00007fe860f8ebe9
[  279.361177][T10251] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000006
[  279.361186][T10251] RBP: 00007fe861011e19 R08: 0000000000000004 R09: 0000000000000000
[  279.361196][T10251] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000
[  279.361206][T10251] R13: 00007fe8611b6038 R14: 00007fe8611b5fa0 R15: 00007ffead0fe1f8
[  279.361230][T10251]  </TASK>
[  279.361238][T10251] Mem-Info:
[  279.384873][ T5871] Bluetooth: hci3: Malformed Event: 0x2f
[  279.389910][T10251] active_anon:10668 inactive_anon:0 isolated_anon:0
[  279.389910][T10251]  active_file:13536 inactive_file:38301 isolated_file:0
[  279.389910][T10251]  unevictable:1768 dirty:256 writeback:0
[  279.389910][T10251]  slab_reclaimable:9988 slab_unreclaimable:54191
[  279.389910][T10251]  mapped:18003 shmem:2433 pagetables:1138
[  279.389910][T10251]  sec_pagetables:0 bounce:0
[  279.389910][T10251]  kernel_misc_reclaimable:0
[  279.389910][T10251]  free:277310 free_pcp:23363 free_cma:0
[  279.509776][T10251] Node 0 active_anon:30924kB inactive_anon:0kB active_file:23292kB inactive_file:138644kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:47504kB dirty:552kB writeback:0kB shmem:4932kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:3764kB pagetables:2752kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  279.525885][T10251] Node 1 active_anon:11596kB inactive_anon:0kB active_file:30852kB inactive_file:14560kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:24516kB dirty:472kB writeback:0kB shmem:4800kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7860kB pagetables:1948kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  279.540981][T10251] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  279.567922][T10251] lowmem_reserve[]: 0 811 811 811 811
[  279.570340][T10251] Node 0 DMA32 free:232344kB boost:0kB min:33656kB low:42068kB high:50480kB reserved_highatomic:0KB free_highatomic:0KB active_anon:30848kB inactive_anon:0kB active_file:23288kB inactive_file:138644kB unevictable:3536kB writepending:568kB present:1556484kB managed:831084kB mlocked:0kB bounce:0kB free_pcp:46944kB local_pcp:27724kB free_cma:0kB
[  279.617224][T10251] lowmem_reserve[]: 0 0 0 0 0
[  279.619283][T10251] Node 1 DMA32 free:458492kB boost:0kB min:19192kB low:23988kB high:28784kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:116kB local_pcp:116kB free_cma:0kB
[  279.633431][T10251] lowmem_reserve[]: 0 0 854 854 854
[  279.660257][T10251] Node 1 Normal free:405456kB boost:0kB min:36616kB low:45768kB high:54920kB reserved_highatomic:0KB free_highatomic:0KB active_anon:11696kB inactive_anon:0kB active_file:30856kB inactive_file:14560kB unevictable:3536kB writepending:488kB present:1048576kB managed:875016kB mlocked:0kB bounce:0kB free_pcp:43316kB local_pcp:20464kB free_cma:0kB
[  279.764177][T10251] lowmem_reserve[]: 0 0 0 0 0
[  279.768383][T10251] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  279.778654][T10251] Node 0 DMA32: 1175*4kB (UE) 791*8kB (UE) 466*16kB (UE) 357*32kB (U) 300*64kB (UM) 214*128kB (UM) 83*256kB (UME) 37*512kB (UM) 15*1024kB (UME) 9*2048kB (ME) 20*4096kB (UM) = 232404kB
[  279.797647][T10251] Node 1 DMA32: 3*4kB (UM) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 3*2048kB (UM) 109*4096kB (M) = 458492kB
[  279.807026][T10251] Node 1 Normal: 494*4kB (ME) 762*8kB (UME) 666*16kB (UME) 151*32kB (M) 151*64kB (UM) 116*128kB (UM) 77*256kB (UM) 41*512kB (UM) 27*1024kB (UM) 5*2048kB (UM) 68*4096kB (UM) = 405192kB
[  279.817996][T10251] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  279.822654][T10251] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  279.825693][T10251] 54272 total pagecache pages
[  279.827440][T10251] 0 pages in swap cache
[  279.828994][T10251] Free swap  = 124996kB
[  279.830566][T10251] Total swap = 124996kB
[  279.832257][T10251] 786301 pages RAM
[  279.833968][T10251] 0 pages HighMem/MovableOnly
[  279.835869][T10251] 241282 pages reserved
[  279.837480][T10251] 0 pages cma reserved
[  280.024777][T10308] netlink: 'syz.5.1826': attribute type 2 has an invalid length.
[  280.027372][T10308] netlink: 51 bytes leftover after parsing attributes in process `syz.5.1826'.
[  280.135862][T10330] netlink: 17 bytes leftover after parsing attributes in process `syz.5.1827'.
[  280.140771][T10330] netlink: zone id is out of range
[  280.142732][T10330] netlink: zone id is out of range
[  280.144857][T10330] netlink: zone id is out of range
[  280.150519][T10330] netlink: zone id is out of range
[  280.152472][T10330] netlink: zone id is out of range
[  280.155801][T10330] netlink: zone id is out of range
[  280.158167][T10330] netlink: zone id is out of range
[  280.160357][T10330] netlink: zone id is out of range
[  280.162715][T10330] netlink: zone id is out of range
[  280.170265][T10330] netlink: zone id is out of range
[  281.320382][T10376] netdevsim netdevsim5 : renamed from netdevsim0 (while UP)
[  281.846454][T10377] delete_channel: no stack
[  282.028427][T10393] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1844'.
[  282.230182][T10409] netlink: 'syz.4.1852': attribute type 10 has an invalid length.
[  282.235036][T10409] netlink: 55 bytes leftover after parsing attributes in process `syz.4.1852'.
[  282.281797][T10415] delete_channel: no stack
[  282.283838][T10415] delete_channel: no stack
[  282.445543][T10430] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1859'.
[  282.454028][T10424] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1859'.
[  282.468580][T10424] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1859'.
[  283.142958][T10468] netlink: 'syz.3.1880': attribute type 29 has an invalid length.
[  283.246776][T10479] netlink: 'syz.4.1885': attribute type 4 has an invalid length.
[  283.250421][T10479] netlink: 140 bytes leftover after parsing attributes in process `syz.4.1885'.
[  283.392718][T10482] netlink: 'syz.4.1886': attribute type 49 has an invalid length.
[  285.137738][T10574] bridge0: port 3(syz_tun) entered blocking state
[  285.139791][T10574] bridge0: port 3(syz_tun) entered disabled state
[  285.141869][T10574] syz_tun: entered allmulticast mode
[  285.146660][T10574] syz_tun: entered promiscuous mode
[  285.148874][T10574] bridge0: port 3(syz_tun) entered blocking state
[  285.151020][T10574] bridge0: port 3(syz_tun) entered forwarding state
[  285.539584][T10601] __nla_validate_parse: 3 callbacks suppressed
[  285.539606][T10601] netlink: 276 bytes leftover after parsing attributes in process `syz.3.1938'.
[  285.678452][T10609] netlink: 151 bytes leftover after parsing attributes in process `syz.3.1942'.
[  285.817409][T10614] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1944'.
[  285.961395][T10614] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  285.974603][T10614] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  285.978885][T10614] bond0 (unregistering): Released all slaves
[  286.308562][T10630] syzkaller0: entered promiscuous mode
[  286.311035][T10630] syzkaller0: entered allmulticast mode
[  286.693243][T10645] netlink: 464 bytes leftover after parsing attributes in process `syz.5.1959'.
[  286.842121][T10653] netlink: 'syz.4.1960': attribute type 40 has an invalid length.
[  286.942202][T10661] netlink: 'syz.5.1966': attribute type 10 has an invalid length.
[  287.960484][T10653] bridge0: port 2(bridge_slave_1) entered disabled state
[  287.968983][T10661] batman_adv: batadv0: Adding interface: team0
[  287.971076][T10661] batman_adv: batadv0: The MTU of interface team0 is too small (299) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  287.979099][T10661] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active
[  288.433283][T10686] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1977'.
[  290.557302][T10739] : entered promiscuous mode
[  290.599666][T10730] netlink: 'syz.5.1993': attribute type 29 has an invalid length.
[  290.609153][T10735] netlink: 'syz.5.1993': attribute type 29 has an invalid length.
[  290.619811][T10730] netlink: 'syz.5.1993': attribute type 29 has an invalid length.
[  290.631056][T10730] netlink: 'syz.5.1993': attribute type 29 has an invalid length.
[  291.847472][T10786] netlink: 'syz.3.2016': attribute type 2 has an invalid length.
[  291.850816][T10786] netlink: 'syz.3.2016': attribute type 9 has an invalid length.
[  291.855018][T10786] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2016'.
[  291.986084][T10800] netlink: 731 bytes leftover after parsing attributes in process `syz.3.2021'.
[  293.339463][T10813] netlink: 'syz.4.2026': attribute type 2 has an invalid length.
[  293.556703][T10828] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2032'.
[  293.565746][T10826] netlink: 'syz.4.2030': attribute type 1 has an invalid length.
[  293.568293][T10826] netlink: 'syz.4.2030': attribute type 2 has an invalid length.
[  293.572739][T10826] netlink: 'syz.4.2030': attribute type 4 has an invalid length.
[  293.577016][T10826] netlink: 'syz.4.2030': attribute type 1 has an invalid length.
[  293.579535][T10826] netlink: 'syz.4.2030': attribute type 2 has an invalid length.
[  293.581831][T10826] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2030'.
[  293.586544][T10826] netlink: 130080 bytes leftover after parsing attributes in process `syz.4.2030'.
[  293.589456][T10826] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2030'.
[  293.775825][T10842] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2039'.
[  293.972136][T10857] netlink: 'syz.3.2046': attribute type 1 has an invalid length.
[  294.069135][T10861] netlink: 'syz.4.2045': attribute type 10 has an invalid length.
[  294.386831][T10879] netlink: 65039 bytes leftover after parsing attributes in process `syz.5.2056'.
[  294.492220][T10893] netlink: 948 bytes leftover after parsing attributes in process `syz.4.2063'.
[  294.651998][T10908] netlink: 713 bytes leftover after parsing attributes in process `syz.5.2069'.
[  297.721321][ T5871] Bluetooth: hci3: Malformed LE Event: 0x0d
[  297.822142][T10986] __nla_validate_parse: 3 callbacks suppressed
[  297.822179][T10986] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2106'.
[  298.141213][T11003] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2114'.
[  298.157619][T11003] caif0: entered promiscuous mode
[  298.159740][T11003] caif0: entered allmulticast mode
[  298.166592][T11003] netlink: 10 bytes leftover after parsing attributes in process `syz.5.2114'.
[  298.222457][T11009] validate_nla: 3 callbacks suppressed
[  298.222470][T11009] netlink: 'syz.3.2118': attribute type 21 has an invalid length.
[  298.351017][T11015] netlink: 'syz.4.2121': attribute type 6 has an invalid length.
[  298.358265][T11015] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.2121'.
[  298.420810][T11023] netlink: 'syz.3.2125': attribute type 2 has an invalid length.
[  298.424148][T11023] netlink: 137592 bytes leftover after parsing attributes in process `syz.3.2125'.
[  298.425385][T11019] syzkaller0: entered promiscuous mode
[  298.429599][T11019] syzkaller0: entered allmulticast mode
[  298.605905][T11030] netlink: 'syz.4.2127': attribute type 16 has an invalid length.
[  298.608629][T11030] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2127'.
[  301.767708][T11034] bpf: Bad value for 'uid'
[  302.904810][T11040] netlink: 'syz.3.2133': attribute type 25 has an invalid length.
[  303.031768][T11044] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[  303.163499][T11063] net_ratelimit: 73 callbacks suppressed
[  303.166307][T11063] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:0603:0000:0023 with DS=0x3f
[  303.350578][T11072] netlink: 'syz.3.2146': attribute type 10 has an invalid length.
[  303.369310][T11072] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2146'.
[  303.374779][T11072] batadv0: entered promiscuous mode
[  303.378111][T11072] batadv0: entered allmulticast mode
[  303.408097][T11072] bridge0: port 3(batadv0) entered blocking state
[  303.417084][T11072] bridge0: port 3(batadv0) entered disabled state
[  303.462492][T11072] bridge0: port 3(batadv0) entered blocking state
[  303.465731][T11072] bridge0: port 3(batadv0) entered forwarding state
[  303.577620][T11080] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2151'.
[  303.864240][ T5931] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled
[  303.868445][ T5931] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled
[  304.422022][T11103] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.2162'.
[  305.178746][T11125] netlink: 'syz.3.2172': attribute type 1 has an invalid length.
[  305.181779][T11125] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2172'.
[  305.188548][T11125] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[  305.540530][   T65] wlan1: Trigger new scan to find an IBSS to join
[  306.578887][ T5871] Bluetooth: hci4: unexpected event 0x06 length: 15 > 3
[  307.187261][T11188] netlink: 'syz.5.2195': attribute type 2 has an invalid length.
[  307.193449][T11188] netlink: 130532 bytes leftover after parsing attributes in process `syz.5.2195'.
[  308.187348][T11226] netlink: 'syz.3.2215': attribute type 4 has an invalid length.
[  308.331586][T11232] lo: entered allmulticast mode
[  308.352142][T11232] lo: entered promiscuous mode
[  308.356994][T11232] lo: left allmulticast mode
[  308.553853][   T65] wlan1: Trigger new scan to find an IBSS to join
[  310.565168][ T4041] wlan1: Creating new IBSS network, BSSID 00:ff:8d:00:00:00
[  310.622125][T11234] netlink: 14556 bytes leftover after parsing attributes in process `syz.4.2219'.
[  310.906470][T11257] netlink: 208 bytes leftover after parsing attributes in process `syz.4.2229'.
[  310.962418][T11259] netlink: 'syz.4.2230': attribute type 21 has an invalid length.
[  310.973364][T11259] netlink: 'syz.4.2230': attribute type 10 has an invalid length.
[  310.981274][T11259] netlink: 55 bytes leftover after parsing attributes in process `syz.4.2230'.
[  311.569865][T11295] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2247'.
[  311.569885][T11294] netlink: 'syz.4.2246': attribute type 21 has an invalid length.
[  311.572786][T11295] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2247'.
[  311.572818][T11295] netlink: 'syz.3.2247': attribute type 5 has an invalid length.
[  311.572827][T11295] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2247'.
[  311.609154][T11296] netlink: 'syz.5.2245': attribute type 10 has an invalid length.
[  312.714899][ T5871] Bluetooth: hci4: command 0x0406 tx timeout
[  315.652716][T11358] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2275'.
[  316.035016][T11379] syzkaller1: tun_chr_ioctl cmd 1074812118
[  316.182708][T11388] syzkaller0: entered promiscuous mode
[  316.185260][T11388] syzkaller0: entered allmulticast mode
[  316.353313][   T54] Bluetooth: hci4: unexpected subevent 0x0a length: 150 > 30
[  316.358137][   T54] Bluetooth: hci4: Invalid handle: 0x85b0 > 0x0eff
[  316.618429][T11418] ==================================================================
[  316.621634][T11418] BUG: KASAN: slab-use-after-free in xfrm_alloc_spi+0x570/0xf30
[  316.624567][T11418] Read of size 4 at addr ffff888037c50e44 by task syz.4.2303/11418
[  316.628531][T11418] 
[  316.629298][T11418] CPU: 1 UID: 0 PID: 11418 Comm: syz.4.2303 Not tainted 6.16.0-syzkaller-11113-gf3af62b6cee8-dirty #0 PREEMPT(full) 
[  316.629311][T11418] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  316.629317][T11418] Call Trace:
[  316.629323][T11418]  <TASK>
[  316.629328][T11418]  dump_stack_lvl+0x189/0x250
[  316.629344][T11418]  ? __kasan_check_byte+0x12/0x40
[  316.629357][T11418]  ? __pfx_dump_stack_lvl+0x10/0x10
[  316.629366][T11418]  ? lock_release+0x4b/0x3e0
[  316.629384][T11418]  ? __virt_addr_valid+0x4a5/0x5c0
[  316.629399][T11418]  print_report+0xca/0x240
[  316.629412][T11418]  ? xfrm_alloc_spi+0x570/0xf30
[  316.629430][T11418]  kasan_report+0x118/0x150
[  316.629448][T11418]  ? xfrm_alloc_spi+0x570/0xf30
[  316.629467][T11418]  xfrm_alloc_spi+0x570/0xf30
[  316.629484][T11418]  ? xfrm_alloc_spi+0x2a0/0xf30
[  316.629505][T11418]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  316.629521][T11418]  ? xfrm_find_acq+0x87/0xa0
[  316.629538][T11418]  xfrm_alloc_userspi+0x70b/0xc90
[  316.629558][T11418]  ? __pfx_aa_get_newest_label+0x10/0x10
[  316.629578][T11418]  ? apparmor_capable+0x137/0x1b0
[  316.629596][T11418]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  316.629615][T11418]  ? __nla_parse+0x40/0x60
[  316.629632][T11418]  xfrm_user_rcv_msg+0x7a3/0xab0
[  316.629650][T11418]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  316.629667][T11418]  ? __pfx___mutex_trylock_common+0x10/0x10
[  316.629677][T11418]  ? rcu_is_watching+0x15/0xb0
[  316.629687][T11418]  ? trace_contention_end+0x39/0x120
[  316.629695][T11418]  ? __mutex_lock+0x335/0x1360
[  316.629705][T11418]  netlink_rcv_skb+0x208/0x470
[  316.629715][T11418]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  316.629732][T11418]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  316.629744][T11418]  ? netlink_deliver_tap+0x2e/0x1b0
[  316.629751][T11418]  ? netlink_deliver_tap+0x2e/0x1b0
[  316.629760][T11418]  xfrm_netlink_rcv+0x79/0x90
[  316.629771][T11418]  netlink_unicast+0x82f/0x9e0
[  316.629785][T11418]  ? __pfx_netlink_unicast+0x10/0x10
[  316.629797][T11418]  ? netlink_sendmsg+0x642/0xb30
[  316.629805][T11418]  ? skb_put+0x11b/0x210
[  316.629815][T11418]  netlink_sendmsg+0x805/0xb30
[  316.629825][T11418]  ? __pfx_netlink_sendmsg+0x10/0x10
[  316.629833][T11418]  ? aa_sock_msg_perm+0x94/0x160
[  316.629843][T11418]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  316.629851][T11418]  ? __pfx_netlink_sendmsg+0x10/0x10
[  316.629859][T11418]  __sock_sendmsg+0x21c/0x270
[  316.629871][T11418]  ____sys_sendmsg+0x505/0x830
[  316.629882][T11418]  ? __pfx_____sys_sendmsg+0x10/0x10
[  316.629892][T11418]  ? import_iovec+0x74/0xa0
[  316.629903][T11418]  ___sys_sendmsg+0x21f/0x2a0
[  316.629912][T11418]  ? __pfx____sys_sendmsg+0x10/0x10
[  316.629928][T11418]  ? __fget_files+0x2a/0x420
[  316.629939][T11418]  ? __fget_files+0x3a0/0x420
[  316.629951][T11418]  __x64_sys_sendmsg+0x19b/0x260
[  316.629961][T11418]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  316.629972][T11418]  ? rcu_is_watching+0x15/0xb0
[  316.629980][T11418]  ? do_syscall_64+0xbe/0x3b0
[  316.629990][T11418]  do_syscall_64+0xfa/0x3b0
[  316.629997][T11418]  ? lockdep_hardirqs_on+0x9c/0x150
[  316.630004][T11418]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  316.630012][T11418]  ? exc_page_fault+0x9f/0xf0
[  316.630019][T11418]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  316.630027][T11418] RIP: 0033:0x7fa79df8ebe9
[  316.630036][T11418] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  316.630044][T11418] RSP: 002b:00007fa79edcc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  316.630054][T11418] RAX: ffffffffffffffda RBX: 00007fa79e1b5fa0 RCX: 00007fa79df8ebe9
[  316.630060][T11418] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003
[  316.630065][T11418] RBP: 00007fa79e011e19 R08: 0000000000000000 R09: 0000000000000000
[  316.630071][T11418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  316.630076][T11418] R13: 00007fa79e1b6038 R14: 00007fa79e1b5fa0 R15: 00007ffd9cb28328
[  316.630085][T11418]  </TASK>
[  316.630088][T11418] 
[  316.782539][T11418] Allocated by task 10538:
[  316.784409][T11418]  kasan_save_track+0x3e/0x80
[  316.786400][T11418]  __kasan_slab_alloc+0x6c/0x80
[  316.788356][T11418]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  316.790522][T11418]  xfrm_state_alloc+0x24/0x2f0
[  316.792478][T11418]  xfrm_add_sa+0x17d1/0x4070
[  316.794335][T11418]  xfrm_user_rcv_msg+0x7a3/0xab0
[  316.796408][T11418]  netlink_rcv_skb+0x208/0x470
[  316.798435][T11418]  xfrm_netlink_rcv+0x79/0x90
[  316.800436][T11418]  netlink_unicast+0x82f/0x9e0
[  316.802422][T11418]  netlink_sendmsg+0x805/0xb30
[  316.804386][T11418]  __sock_sendmsg+0x21c/0x270
[  316.806330][T11418]  ____sys_sendmsg+0x505/0x830
[  316.808353][T11418]  ___sys_sendmsg+0x21f/0x2a0
[  316.810311][T11418]  __x64_sys_sendmsg+0x19b/0x260
[  316.812377][T11418]  do_syscall_64+0xfa/0x3b0
[  316.814230][T11418]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  316.816691][T11418] 
[  316.817743][T11418] Freed by task 60:
[  316.819370][T11418]  kasan_save_track+0x3e/0x80
[  316.821270][T11418]  kasan_save_free_info+0x46/0x50
[  316.823298][T11418]  __kasan_slab_free+0x62/0x70
[  316.825247][T11418]  kmem_cache_free+0x18f/0x400
[  316.827162][T11418]  xfrm_state_gc_task+0x52d/0x6b0
[  316.829226][T11418]  process_scheduled_works+0xae1/0x17b0
[  316.831377][T11418]  worker_thread+0x8a0/0xda0
[  316.833224][T11418]  kthread+0x711/0x8a0
[  316.834855][T11418]  ret_from_fork+0x3fc/0x770
[  316.836726][T11418]  ret_from_fork_asm+0x1a/0x30
[  316.838792][T11418] 
[  316.839802][T11418] The buggy address belongs to the object at ffff888037c50d80
[  316.839802][T11418]  which belongs to the cache xfrm_state of size 928
[  316.845252][T11418] The buggy address is located 196 bytes inside of
[  316.845252][T11418]  freed 928-byte region [ffff888037c50d80, ffff888037c51120)
[  316.850494][T11418] 
[  316.851495][T11418] The buggy address belongs to the physical page:
[  316.854002][T11418] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888037c51b00 pfn:0x37c50
[  316.857922][T11418] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  316.861389][T11418] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  316.864145][T11418] page_type: f5(slab)
[  316.865749][T11418] raw: 00fff00000000040 ffff88801c2aea00 dead000000000122 0000000000000000
[  316.869148][T11418] raw: ffff888037c51b00 00000000800e0008 00000000f5000000 0000000000000000
[  316.872461][T11418] head: 00fff00000000040 ffff88801c2aea00 dead000000000122 0000000000000000
[  316.875764][T11418] head: ffff888037c51b00 00000000800e0008 00000000f5000000 0000000000000000
[  316.879129][T11418] head: 00fff00000000002 ffffea0000df1401 00000000ffffffff 00000000ffffffff
[  316.882095][T11418] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  316.884766][T11418] page dumped because: kasan: bad access detected
[  316.887287][T11418] page_owner tracks the page as allocated
[  316.889553][T11418] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6265, tgid 6258 (syz.0.149), ts 84563864975, free_ts 84469782145
[  316.896757][T11418]  post_alloc_hook+0x240/0x2a0
[  316.898678][T11418]  get_page_from_freelist+0x21e4/0x22c0
[  316.900832][T11418]  __alloc_frozen_pages_noprof+0x181/0x370
[  316.903084][T11418]  alloc_pages_mpol+0x232/0x4a0
[  316.905004][T11418]  allocate_slab+0x8a/0x370
[  316.906848][T11418]  ___slab_alloc+0xbeb/0x1410
[  316.908751][T11418]  kmem_cache_alloc_noprof+0x283/0x3c0
[  316.910818][T11418]  xfrm_state_alloc+0x24/0x2f0
[  316.912677][T11418]  pfkey_add+0x6e4/0x2e00
[  316.914369][T11418]  pfkey_sendmsg+0xbfe/0x1090
[  316.916242][T11418]  __sock_sendmsg+0x21c/0x270
[  316.918061][T11418]  ____sys_sendmsg+0x505/0x830
[  316.919992][T11418]  ___sys_sendmsg+0x21f/0x2a0
[  316.921833][T11418]  __x64_sys_sendmsg+0x19b/0x260
[  316.923824][T11418]  do_syscall_64+0xfa/0x3b0
[  316.925668][T11418]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  316.928004][T11418] page last free pid 6255 tgid 6255 stack trace:
[  316.930520][T11418]  __free_frozen_pages+0xbc4/0xd30
[  316.932499][T11418]  free_large_kmalloc+0x13a/0x1f0
[  316.934453][T11418]  free_netdev+0x3e2/0x700
[  316.936264][T11418]  netdev_run_todo+0xd0c/0xea0
[  316.938184][T11418]  tun_chr_close+0x13c/0x1c0
[  316.939980][T11418]  __fput+0x44c/0xa70
[  316.941619][T11418]  task_work_run+0x1d4/0x260
[  316.943486][T11418]  exit_to_user_mode_loop+0xec/0x110
[  316.945593][T11418]  do_syscall_64+0x2bd/0x3b0
[  316.947462][T11418]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  316.949838][T11418] 
[  316.950820][T11418] Memory state around the buggy address:
[  316.953043][T11418]  ffff888037c50d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  316.956224][T11418]  ffff888037c50d80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  316.959396][T11418] >ffff888037c50e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  316.962575][T11418]                                            ^
[  316.965014][T11418]  ffff888037c50e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  316.968149][T11418]  ffff888037c50f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  316.971332][T11418] ==================================================================
[  316.974908][T11418] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  316.977806][T11418] CPU: 1 UID: 0 PID: 11418 Comm: syz.4.2303 Not tainted 6.16.0-syzkaller-11113-gf3af62b6cee8-dirty #0 PREEMPT(full) 
[  316.982626][T11418] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  316.986636][T11418] Call Trace:
[  316.987968][T11418]  <TASK>
[  316.989183][T11418]  dump_stack_lvl+0x99/0x250
[  316.991124][T11418]  ? __asan_memcpy+0x40/0x70
[  316.993069][T11418]  ? __pfx_dump_stack_lvl+0x10/0x10
[  316.995090][T11418]  ? __pfx__printk+0x10/0x10
[  316.996960][T11418]  vpanic+0x27a/0x730
[  316.998624][T11418]  ? __pfx_vpanic+0x10/0x10
[  317.000485][T11418]  ? irqentry_exit+0x74/0x90
[  317.002322][T11418]  panic+0xb9/0xc0
[  317.003835][T11418]  ? __pfx_panic+0x10/0x10
[  317.005629][T11418]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  317.008020][T11418]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  317.010415][T11418]  ? xfrm_alloc_spi+0x570/0xf30
[  317.012437][T11418]  check_panic_on_warn+0x89/0xb0
[  317.014474][T11418]  ? xfrm_alloc_spi+0x570/0xf30
[  317.016357][T11418]  end_report+0x78/0x160
[  317.018047][T11418]  kasan_report+0x129/0x150
[  317.019854][T11418]  ? xfrm_alloc_spi+0x570/0xf30
[  317.021874][T11418]  xfrm_alloc_spi+0x570/0xf30
[  317.023743][T11418]  ? xfrm_alloc_spi+0x2a0/0xf30
[  317.025780][T11418]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  317.027904][T11418]  ? xfrm_find_acq+0x87/0xa0
[  317.029785][T11418]  xfrm_alloc_userspi+0x70b/0xc90
[  317.031826][T11418]  ? __pfx_aa_get_newest_label+0x10/0x10
[  317.034080][T11418]  ? apparmor_capable+0x137/0x1b0
[  317.036107][T11418]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  317.038331][T11418]  ? __nla_parse+0x40/0x60
[  317.040129][T11418]  xfrm_user_rcv_msg+0x7a3/0xab0
[  317.042178][T11418]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  317.044472][T11418]  ? __pfx___mutex_trylock_common+0x10/0x10
[  317.046810][T11418]  ? rcu_is_watching+0x15/0xb0
[  317.048742][T11418]  ? trace_contention_end+0x39/0x120
[  317.050870][T11418]  ? __mutex_lock+0x335/0x1360
[  317.052712][T11418]  netlink_rcv_skb+0x208/0x470
[  317.054367][T11418]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  317.056572][T11418]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  317.058696][T11418]  ? netlink_deliver_tap+0x2e/0x1b0
[  317.060771][T11418]  ? netlink_deliver_tap+0x2e/0x1b0
[  317.062598][T11418]  xfrm_netlink_rcv+0x79/0x90
[  317.064471][T11418]  netlink_unicast+0x82f/0x9e0
[  317.066182][T11418]  ? __pfx_netlink_unicast+0x10/0x10
[  317.067809][T11418]  ? netlink_sendmsg+0x642/0xb30
[  317.069354][T11418]  ? skb_put+0x11b/0x210
[  317.070676][T11418]  netlink_sendmsg+0x805/0xb30
[  317.072188][T11418]  ? __pfx_netlink_sendmsg+0x10/0x10
[  317.073822][T11418]  ? aa_sock_msg_perm+0x94/0x160
[  317.075347][T11418]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  317.076953][T11418]  ? __pfx_netlink_sendmsg+0x10/0x10
[  317.078628][T11418]  __sock_sendmsg+0x21c/0x270
[  317.080227][T11418]  ____sys_sendmsg+0x505/0x830
[  317.082084][T11418]  ? __pfx_____sys_sendmsg+0x10/0x10
[  317.083997][T11418]  ? import_iovec+0x74/0xa0
[  317.085357][T11418]  ___sys_sendmsg+0x21f/0x2a0
[  317.086773][T11418]  ? __pfx____sys_sendmsg+0x10/0x10
[  317.088381][T11418]  ? __fget_files+0x2a/0x420
[  317.089772][T11418]  ? __fget_files+0x3a0/0x420
[  317.091215][T11418]  __x64_sys_sendmsg+0x19b/0x260
[  317.092735][T11418]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  317.094407][T11418]  ? rcu_is_watching+0x15/0xb0
[  317.095868][T11418]  ? do_syscall_64+0xbe/0x3b0
[  317.097319][T11418]  do_syscall_64+0xfa/0x3b0
[  317.098716][T11418]  ? lockdep_hardirqs_on+0x9c/0x150
[  317.100312][T11418]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  317.102201][T11418]  ? exc_page_fault+0x9f/0xf0
[  317.103827][T11418]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  317.106234][T11418] RIP: 0033:0x7fa79df8ebe9
[  317.108060][T11418] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  317.114332][T11418] RSP: 002b:00007fa79edcc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  317.116934][T11418] RAX: ffffffffffffffda RBX: 00007fa79e1b5fa0 RCX: 00007fa79df8ebe9
[  317.119504][T11418] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003
[  317.121946][T11418] RBP: 00007fa79e011e19 R08: 0000000000000000 R09: 0000000000000000
[  317.124378][T11418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  317.126832][T11418] R13: 00007fa79e1b6038 R14: 00007fa79e1b5fa0 R15: 00007ffd9cb28328
[  317.129217][T11418]  </TASK>
[  317.130845][T11418] Kernel Offset: disabled
[  317.132186][T11418] Rebooting in 86400 seconds..

VM DIAGNOSIS:
14:58:02  Registers:
info registers vcpu 0

CPU#0
RAX=ffffffff81b4498b RBX=1ffff11026cc7f61 RCX=ffff88801c361cc0 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc90003857a20 RSP=ffffc900038578a0
R8 =ffffffff8fa32437 R9 =1ffffffff1f46486 R10=dffffc0000000000 R11=fffffbfff1f46487
R12=ffff88813663fb08 R13=dffffc0000000000 R14=ffff88804b03b1c0 R15=0000000000000001
RIP=ffffffff81b4498b RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055555f634500 ffffffff 00c00000
GS =0000 ffff8880b862a000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b32715ff8 CR3=00000000290ae000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000082 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffff8133c57e ffffffff8133c57e
XMM02=ffffffff8173c699 ffffffff8133c57e XMM03=ffffffff8173c48f ffffffff8173c419
XMM04=ffffffff8173c5a8 ffffffff8173c5a8 XMM05=ffffffff8173c48f ffffffff8173c48f
XMM06=ffffffff8173c419 ffffffff8173c1ff XMM07=ffffffff8173c1cf ffffffff8173c1cf
XMM08=0000000000000000 00007fe861012ee7 XMM09=0000000000000000 00007fe861012fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=000000000000000d RBX=000000000000000d RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000001460 RDI=0000000000001461 RBP=00000000000003f8 RSP=ffffc90002cae9f0
R8 =ffff888106ce0237 R9 =1ffff11020d9c046 R10=dffffc0000000000 R11=ffffffff854d32b0
R12=dffffc0000000000 R13=ffffffff99aeb937 R14=ffffffff99df0440 R15=0000000000000000
RIP=ffffffff854d332c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fa79edcc6c0 ffffffff 00c00000
GS =0000 ffff8881a3c2a000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00002000000002c0 CR3=000000011a792000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fa79e187498 00007fa79e187470 XMM03=00007fa79e1874a8 00007fa79e1874a0
XMM04=00007fa79eced100 00007fa79e187460 XMM05=00007fa79e187478 00007fa79e1874c0
XMM06=00007fa79e1874b8 00007fa79e1874b0 XMM07=00007fa79e1874a8 00007fa79e1874a0
XMM08=0000000000000000 00007fa79e012ee7 XMM09=0000000000000000 00007fa79e012fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
