last executing test programs:

747.817898ms ago: executing program 1 (id=189):
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20)
setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r1, 0x0)
mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r1, 0x913e0000)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r4, 0x0)
mmap(&(0x7f0000497000/0x3000)=nil, 0x3000, 0x0, 0x13, r3, 0x0)

600.228372ms ago: executing program 1 (id=193):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000002090000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1}, 0xc)

549.303065ms ago: executing program 1 (id=194):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0)
getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800)
sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x30, 0x66, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xfff2, 0xffff}, {0xffe0, 0x998cdee8ad3e83e9}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8}, 0x0)

480.42841ms ago: executing program 1 (id=197):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000008c0)=ANY=[@ANYBLOB="98000000", @ANYRES16=r1, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r2, @ANYBLOB="7c005a807400008005000700020000001e0001000a300c9f4816161b091b030430300109093006220b5112093003000007000100182418"], 0x98}, 0x1, 0x0, 0x0, 0x40080}, 0x20008840)

428.237138ms ago: executing program 2 (id=200):
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendmmsg$inet6(r0, &(0x7f0000001340)=[{{&(0x7f0000000140)={0xa, 0x4e21, 0x8, @dev={0xfe, 0x80, '\x00', 0xa}}, 0x1c, 0x0}}], 0x1, 0xc040)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4)

369.129608ms ago: executing program 1 (id=201):
r0 = socket$inet6(0xa, 0x3, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}}, 0x4044004)
recvmmsg(r1, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x4008101}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f00000000c0)=""/177, 0xb1}, {&(0x7f0000000dc0)=""/273, 0x111}, {&(0x7f0000000040)=""/43, 0x2b}, {&(0x7f0000000440)=""/84, 0x54}, {&(0x7f0000003bc0)=""/4109, 0x100d}, {&(0x7f00000017c0)=""/227, 0xe3}, {&(0x7f0000000340)=""/219, 0xdb}], 0x7}, 0x80000000}], 0x4, 0x0, 0x0)
syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[], 0x0)
pipe(&(0x7f0000000680)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
writev(r2, &(0x7f0000000200)=[{&(0x7f00000006c0)="e6", 0x1}], 0x1)
writev(r2, &(0x7f0000000600)=[{&(0x7f0000000280)="a1818522bafd0096cd3ff43a463d18d07d5466584c20dbc1c17d6e5c30d25719899852afdd71d81c8eaa", 0x2a}, {0x0}, {&(0x7f0000000840)}, {0x0}], 0x4)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x6, 0x25, &(0x7f0000000b40)=@framed={{0x18, 0x0, 0x0, 0x0, 0xae36, 0x0, 0x0, 0x0, 0xed}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffd}}, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x5}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3ff}, @initr0={0x18, 0x0, 0x0, 0x0, 0xfffeffff, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000000)='syzkaller\x00', 0x9, 0x7d, &(0x7f0000000280)=""/125, 0x0, 0x84922a1886785c5c, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000080)={0x1, 0xb, 0x4, 0x7fffffff}, 0x10, 0x0, 0xffffffffffffffff, 0x4, &(0x7f00000001c0)=[0x1, 0x1], &(0x7f0000000c80)=[{0x0, 0x3, 0x1, 0xb}, {0x2, 0x3, 0x9, 0xb}, {0x2, 0x5, 0x6, 0xf}, {0x4, 0x1, 0xd, 0x6}], 0x10, 0x5}, 0x94)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYRES64=r1], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r5, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="0100040000000000001f28000000180001801400020067656e65766530"], 0x2c}}, 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000740)={@fallback=r4, 0xc, 0x1, 0x2, &(0x7f0000000500)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, &(0x7f0000000700)=[0x0], <r7=>0x0}, 0x40)
bpf$BPF_PROG_DETACH(0x1c, &(0x7f00000004c0)=ANY=[@ANYRES32=r6, @ANYRES32=r4, @ANYBLOB="06030092ed00000000000000", @ANYRES32=r6, @ANYBLOB, @ANYRES64=r7], 0x20)
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000d80)={@fallback=r0, r3, 0x4, 0x10, 0x0, @void, @value, @void, @void, r7}, 0x20)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
r8 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000001fc0)=@filter={'filter\x00', 0x42, 0x4, 0x520, 0xffffffff, 0x0, 0x0, 0xb0, 0xffffffff, 0xffffffff, 0x488, 0x488, 0x488, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x0, 0x70, 0xb0, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "6b07000000000000005b4809088400ed0000006c0000040500"}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x29}, @multicast2, 0x0, 0x0, 'bond_slave_1\x00', 'batadv_slave_1\x00', {0x836b636e4bafbd70}, {}, 0x62, 0x2, 0x6}, 0x287, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0xd, [{0x5, 0x7, 0x40, 0x1000}, {0x2, 0x6, 0x10, 0x1}, {0x9, 0x3, 0x81, 0x3}, {0x8, 0x41, 0x4, 0x1}, {0x6, 0x6, 0xe, 0x1}, {0x8001, 0x10, 0x1, 0x4}, {0xa2, 0x0, 0x7f, 0xa}, {0x7fff, 0x5, 0x5, 0x3}, {0x3ff, 0xe8, 0x2, 0x80}, {0x5, 0x9, 0x7}, {0x4, 0x40, 0x4}, {0xfffb, 0x1, 0xf3, 0x6}, {0x3, 0x8, 0x6, 0x2}, {0x3, 0x8, 0x3, 0x10000}, {0x31, 0x80, 0xd, 0x800}, {0xc, 0xff, 0x1c, 0x4}, {0x6, 0x0, 0xc, 0xf}, {0x7, 0xb5, 0x6, 0x80576}, {0x3, 0xc, 0x6, 0x9}, {0x2, 0x8, 0xf8, 0xfffffff2}, {0x7ff, 0xca, 0xc, 0x4e14}, {0x76, 0x7, 0xcb, 0x7}, {0x8, 0x1, 0x1c, 0xfff}, {0x1, 0x2, 0x2}, {0x0, 0x3, 0x80, 0x9}, {0x400, 0x0, 0x4, 0x8}, {0x1, 0x1, 0x1, 0xa}, {0xc7b8, 0x57, 0xfc, 0x6}, {0x7, 0x7, 0x3, 0x8}, {0x10, 0x7, 0xd, 0xfffffffe}, {0x8, 0xfc, 0x2, 0x6}, {0x3, 0x9, 0x6, 0x9}, {0x2, 0x8, 0x8}, {0x2f1c, 0xfd, 0x8}, {0x400, 0x0, 0x4, 0x7}, {0x7d, 0x8, 0x4, 0x1}, {0x4, 0x1a, 0x80, 0x7}, {0x1, 0x4, 0x8, 0xfffff000}, {0x1ff, 0x2, 0x9, 0xc}, {0xc30f, 0x1, 0x3, 0x3}, {0x4, 0x1, 0xbf}, {0x7, 0xc, 0x5, 0x3}, {0x2, 0x1, 0x5, 0x1}, {0xdf, 0x3, 0x4, 0xfa98}, {0x800, 0x3, 0x5, 0x6}, {0x200, 0x9, 0x81, 0x1}, {0x7, 0x0, 0x6d}, {0x3, 0x4, 0xea, 0xa0c4}, {0x40, 0x38, 0x3, 0x91e2}, {0x9, 0x91, 0xfd, 0xfffff001}, {0x2, 0x6, 0x10, 0xfffffff9}, {0x5, 0x1, 0x4, 0xd8b}, {0x6, 0x2, 0x9, 0x3}, {0x1, 0xe0, 0x5, 0x6}, {0x2, 0x8, 0x1, 0x6}, {0x5, 0xfb, 0x0, 0x9}, {0x100, 0xf8, 0xf5, 0xfd}, {0xff, 0xf1, 0x0, 0x1ff}, {0x5, 0x1, 0x9c, 0x8}, {0x1000, 0xe, 0x2, 0x3}, {0xa, 0x1, 0x2, 0x9}, {0x5e1, 0x8e, 0x7, 0x5}, {0x6, 0x8, 0xe, 0x6}, {0x9, 0x67, 0xfd, 0x8}], {0x2}}}, @common=@unspec=@statistic={{0x38}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xd8, 0x0, {}, [@common=@inet=@set1={{0x28}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x6, 0x34, "9c4b4435910fbfcf24e0fae0e0bfd3b900"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x580)
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})

299.002879ms ago: executing program 2 (id=204):
r0 = socket$vsock_stream(0x28, 0x1, 0x0)
getsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000040), &(0x7f0000000080)=0x52)

215.404328ms ago: executing program 2 (id=206):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r0, 0x2000000, 0xfe7f, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

214.96289ms ago: executing program 0 (id=207):
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x10, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000010000000000000000000000711212000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

149.230991ms ago: executing program 0 (id=208):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r0)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000080)={'wpan0\x00', <r2=>0x0})
sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000680)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fedbdf251500000008002c000400000014002b800500020002000000080001000200000008002a000100000008000300", @ANYRES32=r2, @ANYBLOB="1c002b8008"], 0x6c}, 0x1, 0x0, 0x0, 0x20000001}, 0x10)

149.019744ms ago: executing program 0 (id=209):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56561, 0x4, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x28, 0x2, [@TCA_CAKE_WASH={0x8}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x9}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x2}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x80000001}]}}]}, 0x58}}, 0x4040010)

70.525479ms ago: executing program 2 (id=210):
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, &(0x7f0000000180))

70.055792ms ago: executing program 0 (id=211):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="06000000040000000400000004"], 0x48)
close(0x3)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000500000008040000cd00000001"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r1, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000400)='itimer_state\x00', r2}, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8ae8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000140)='sys_exit\x00', r3}, 0x18)

26.585894ms ago: executing program 2 (id=212):
r0 = socket$can_raw(0x1d, 0x3, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', <r1=>0x0})
setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000180)=0x1, 0x4)
sendmsg$can_raw(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x1d, r1}, 0x10, &(0x7f0000000000)={&(0x7f00000001c0)=@canfd={{}, 0x6e, 0x0, 0x0, 0x0, "4e4e488e419039dda425818c34de45852abd1372621b404219373c9a72cdb611ef256a70bf66c39d7082f2809cbc3da9bb3c86e0c5e53cff15d561c53fe9ae3a"}, 0x48}}, 0x0)

26.248182ms ago: executing program 0 (id=213):
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$SIOCRSGL2CALL(r0, 0x89e5, &(0x7f0000000180)=@netrom)

26.023397ms ago: executing program 2 (id=214):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x2c, r1, 0x1, 0x0, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HT={0x4}]}]}]}, 0x2c}}, 0x0)

4.064547ms ago: executing program 0 (id=215):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x40000}, 0x1c)
sendto$inet6(r0, &(0x7f0000000100)="a6", 0x1, 0x40840, 0x0, 0x0)
setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000340)=0x20000000, 0x4)
poll(&(0x7f00000003c0)=[{r0, 0x7004}], 0x1, 0x80)

0s ago: executing program 1 (id=216):
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0xa1, @mcast1, 0x6}, 0x1c)
setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000080)={@private0}, 0x14)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:10748' (ED25519) to the list of known hosts.
syzkaller login: [   49.163843][ T5752] cgroup: Unknown subsys name 'net'
[   49.236267][ T5752] cgroup: Unknown subsys name 'cpuset'
[   49.242794][ T5752] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   51.461204][ T5752] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   56.611369][ T5822] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   56.614806][ T5822] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   56.618084][ T5822] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   56.621709][ T5822] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   56.624554][ T5822] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   56.790802][ T5217] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   56.793868][ T5217] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   56.797074][ T5217] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   56.799997][ T5217] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   56.802951][ T5217] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   56.816059][ T5217] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   56.818838][ T5217] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   56.822549][ T5217] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   56.826363][ T5217] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   56.829367][ T5217] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   56.852333][ T5820] chnl_net:caif_netlink_parms(): no params data found
[   56.954209][ T5820] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.957256][ T5820] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.959727][ T5820] bridge_slave_0: entered allmulticast mode
[   56.962587][ T5820] bridge_slave_0: entered promiscuous mode
[   56.972004][ T5820] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.974632][ T5820] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.977588][ T5820] bridge_slave_1: entered allmulticast mode
[   56.980363][ T5820] bridge_slave_1: entered promiscuous mode
[   57.038498][ T5820] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   57.054530][ T5820] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   57.104097][ T5820] team0: Port device team_slave_0 added
[   57.110279][ T5820] team0: Port device team_slave_1 added
[   57.145825][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_0
[   57.148547][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.158868][ T5820] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   57.181227][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_1
[   57.183995][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.194746][ T5820] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   57.339396][ T5820] hsr_slave_0: entered promiscuous mode
[   57.342598][ T5820] hsr_slave_1: entered promiscuous mode
[   57.352132][ T5830] chnl_net:caif_netlink_parms(): no params data found
[   57.417483][ T5828] chnl_net:caif_netlink_parms(): no params data found
[   57.489355][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.492193][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.494863][ T5830] bridge_slave_0: entered allmulticast mode
[   57.499168][ T5830] bridge_slave_0: entered promiscuous mode
[   57.520698][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.523433][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.526230][ T5830] bridge_slave_1: entered allmulticast mode
[   57.529382][ T5830] bridge_slave_1: entered promiscuous mode
[   57.573574][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   57.588512][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   57.673486][ T5828] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.676906][ T5828] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.679763][ T5828] bridge_slave_0: entered allmulticast mode
[   57.683519][ T5828] bridge_slave_0: entered promiscuous mode
[   57.690692][ T5830] team0: Port device team_slave_0 added
[   57.700143][ T5828] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.703138][ T5828] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.706246][ T5828] bridge_slave_1: entered allmulticast mode
[   57.710366][ T5828] bridge_slave_1: entered promiscuous mode
[   57.718031][ T5830] team0: Port device team_slave_1 added
[   57.773411][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0
[   57.776264][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.787969][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   57.825922][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1
[   57.828670][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.838685][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   57.851721][ T5828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   57.859857][ T5828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   57.953155][ T5828] team0: Port device team_slave_0 added
[   57.976342][ T5828] team0: Port device team_slave_1 added
[   57.983960][ T5830] hsr_slave_0: entered promiscuous mode
[   57.989887][ T5830] hsr_slave_1: entered promiscuous mode
[   57.992766][ T5830] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   57.996299][ T5830] Cannot create hsr debugfs directory
[   58.068413][ T5820] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   58.078775][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_0
[   58.081436][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   58.093204][ T5828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   58.103820][ T5820] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   58.111006][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_1
[   58.113653][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   58.122436][ T5828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   58.130848][ T5820] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   58.153263][ T5820] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   58.229225][ T5828] hsr_slave_0: entered promiscuous mode
[   58.232399][ T5828] hsr_slave_1: entered promiscuous mode
[   58.235101][ T5828] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   58.238203][ T5828] Cannot create hsr debugfs directory
[   58.383864][ T5830] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   58.447138][ T5830] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   58.474098][ T5830] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   58.483286][ T5830] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   58.625695][ T5828] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   58.631681][ T5828] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   58.641610][ T5820] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.650381][ T5828] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   58.658264][ T5828] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   58.676393][ T5820] 8021q: adding VLAN 0 to HW filter on device team0
[   58.696879][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.699216][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.707370][ T5217] Bluetooth: hci0: command tx timeout
[   58.721195][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.723417][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.764362][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.788258][ T5820] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   58.818141][ T5830] 8021q: adding VLAN 0 to HW filter on device team0
[   58.833194][ T1224] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.835453][ T1224] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.848728][ T1224] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.851081][ T1224] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.866554][ T5217] Bluetooth: hci2: command tx timeout
[   58.869026][ T5217] Bluetooth: hci1: command tx timeout
[   58.881166][ T5828] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.924637][ T5828] 8021q: adding VLAN 0 to HW filter on device team0
[   58.941148][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.944023][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.973883][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.976656][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   59.032795][ T5820] 8021q: adding VLAN 0 to HW filter on device batadv0
[   59.062428][ T5828] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   59.113651][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0
[   59.131118][ T5820] veth0_vlan: entered promiscuous mode
[   59.151203][ T5820] veth1_vlan: entered promiscuous mode
[   59.215129][ T5820] veth0_macvtap: entered promiscuous mode
[   59.237181][ T5820] veth1_macvtap: entered promiscuous mode
[   59.240677][ T5830] veth0_vlan: entered promiscuous mode
[   59.260765][ T5830] veth1_vlan: entered promiscuous mode
[   59.271146][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_0
[   59.283070][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_1
[   59.292556][ T5828] 8021q: adding VLAN 0 to HW filter on device batadv0
[   59.304144][ T5820] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.310533][ T5820] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.314019][ T5820] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.319025][ T5820] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.358730][ T5830] veth0_macvtap: entered promiscuous mode
[   59.377962][ T5830] veth1_macvtap: entered promiscuous mode
[   59.410238][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0
[   59.428034][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1
[   59.441118][ T5830] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.444494][ T5830] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.448405][ T5830] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.451729][ T5830] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.498932][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.502120][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.505019][ T5828] veth0_vlan: entered promiscuous mode
[   59.550189][ T5828] veth1_vlan: entered promiscuous mode
[   59.564173][   T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.576661][   T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.595728][ T1224] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.598789][ T1224] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.630675][ T5828] veth0_macvtap: entered promiscuous mode
[   59.664795][ T5820] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   59.672096][ T5828] veth1_macvtap: entered promiscuous mode
[   59.694554][   T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.698457][   T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.700603][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_0
[   59.731987][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_1
[   59.748924][ T5828] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.752392][ T5828] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.766029][ T5828] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.769438][ T5828] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.893493][ T5894] warning: `syz.0.1' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   59.904533][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.915726][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.984132][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.995158][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.072944][ T5903] netlink: 60 bytes leftover after parsing attributes in process `syz.0.7'.
[   60.086756][ T5903] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7'.
[   60.110275][ T5905] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   60.164406][ T5909] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.9'.
[   60.172314][ T5909] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[   60.180305][ T5909] openvswitch: netlink: Message has 1 unknown bytes.
[   60.491972][ T5924] netlink: 83 bytes leftover after parsing attributes in process `syz.2.16'.
[   60.575423][ T5928] netlink: 1 bytes leftover after parsing attributes in process `syz.0.18'.
[   60.593102][ T5930] tipc: Started in network mode
[   60.594797][ T5930] tipc: Node identity ac14140f, cluster identity 4711
[   60.598599][ T5930] tipc: New replicast peer: 255.255.255.255
[   60.601654][ T5930] tipc: Enabled bearer <udp:syz2>, priority 10
[   60.623288][ T5930] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19'.
[   60.634007][ T5930] tipc: Disabling bearer <udp:syz2>
[   60.694253][ T5936] syzkaller0: refused to change device tx_queue_len
[   60.785812][ T5822] Bluetooth: hci0: command tx timeout
[   60.946380][ T5822] Bluetooth: hci1: command tx timeout
[   60.946526][ T5217] Bluetooth: hci2: command tx timeout
[   60.984673][ T5946] netlink: 'syz.2.25': attribute type 3 has an invalid length.
[   61.084314][ T5952] IPv6: sit1: Disabled Multicast RS
[   62.000934][ T5961] netlink: 'syz.1.31': attribute type 1 has an invalid length.
[   62.003993][ T5961] netlink: 228 bytes leftover after parsing attributes in process `syz.1.31'.
[   62.119926][ T5889] IPVS: starting estimator thread 0...
[   62.215509][ T5971] IPVS: using max 51 ests per chain, 122400 per kthread
[   62.290902][ T5983] netlink: 224 bytes leftover after parsing attributes in process `syz.0.40'.
[   62.372394][ T5987] netlink: 'syz.1.42': attribute type 1 has an invalid length.
[   62.381910][ T5987] netlink: 172 bytes leftover after parsing attributes in process `syz.1.42'.
[   62.794678][ T6018] syz.1.58 uses obsolete (PF_INET,SOCK_PACKET)
[   62.868297][ T5217] Bluetooth: hci0: command tx timeout
[   62.983144][ T6022] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.987393][ T6022] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.026848][ T5217] Bluetooth: hci2: command tx timeout
[   63.028931][ T5822] Bluetooth: hci1: command tx timeout
[   63.122726][ T6022] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   63.133320][ T6022] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   63.201334][ T6022] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   63.205055][ T6022] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   63.210261][ T6022] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   63.213950][ T6022] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   63.269656][ T6035] Zero length message leads to an empty skb
[   63.348632][ T6022] syz.2.60 (6022) used greatest stack depth: 20632 bytes left
[   63.380048][ T6039] syz_tun: entered allmulticast mode
[   63.394824][ T6038] syz_tun: left allmulticast mode
[   63.561944][ T6051] netlink: 16 bytes leftover after parsing attributes in process `syz.1.70'.
[   63.703653][ T6052] netlink: 'syz.0.68': attribute type 1 has an invalid length.
[   63.704248][ T6059] netlink: 'syz.2.74': attribute type 1 has an invalid length.
[   63.719477][ T6059] netlink: 'syz.2.74': attribute type 2 has an invalid length.
[   63.795153][ T6064] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   64.678248][ T6113] netlink: 'syz.0.100': attribute type 12 has an invalid length.
[   64.681959][ T6113] netlink: 'syz.0.100': attribute type 11 has an invalid length.
[   64.940145][ T6129] (unnamed net_device) (uninitialized): option active_slave: mode dependency failed, not supported in mode balance-xor(2)
[   64.946494][ T5217] Bluetooth: hci0: command tx timeout
[   65.106884][ T5217] Bluetooth: hci1: command tx timeout
[   65.109122][ T5217] Bluetooth: hci2: command tx timeout
[   65.191710][ T6144] IPVS: Scheduler module ip_vs_sip not found
[   65.194300][ T6144] IPVS: length: 8 != 446622349272
[   65.565053][ T6152] ipt_rpfilter: unknown options
[   65.582839][ T6159] netlink: 'syz.0.120': attribute type 1 has an invalid length.
[   65.634298][ T6159] 8021q: adding VLAN 0 to HW filter on device bond1
[   65.672332][ T6164] bond1: (slave veth3): Enslaving as an active interface with a down link
[   65.721097][ T6159] vlan2: entered allmulticast mode
[   65.722796][ T6159] bond1: entered allmulticast mode
[   65.736290][ T6159] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[   65.768838][ T6171] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   65.821179][ T6171] syzkaller0: entered promiscuous mode
[   65.822859][ T6171] syzkaller0: entered allmulticast mode
[   65.827277][ T6171] tipc: Resetting bearer <eth:syzkaller0>
[   65.847755][ T6170] tipc: Resetting bearer <eth:syzkaller0>
[   66.034503][ T6188] __nla_validate_parse: 6 callbacks suppressed
[   66.034514][ T6188] netlink: 32 bytes leftover after parsing attributes in process `syz.1.131'.
[   66.128264][ T6192] netlink: 20 bytes leftover after parsing attributes in process `syz.1.133'.
[   66.827214][   T10] tipc: Node number set to 2886997007
[   66.893172][ T6170] tipc: Disabling bearer <eth:syzkaller0>
[   67.196962][ T6214] syz.2.144 (6214) used greatest stack depth: 20472 bytes left
[   67.524555][ T6244] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   68.217605][ T6280] raw_sendmsg: syz.0.174 forgot to set AF_INET. Fix it!
[   68.266558][ T6292] netlink: 16 bytes leftover after parsing attributes in process `syz.2.180'.
[   68.609013][ T6321] netlink: 'syz.2.192': attribute type 1 has an invalid length.
[   68.611872][ T6321] netlink: 168864 bytes leftover after parsing attributes in process `syz.2.192'.
[   68.799562][ T6337] netlink: 64 bytes leftover after parsing attributes in process `syz.1.197'.
[   68.894000][ T6346] xt_hashlimit: size too large, truncated to 1048576
[   68.966215][ T6352] xt_bpf: check failed: parse error
[   69.072014][ T6359] netlink: 16 bytes leftover after parsing attributes in process `syz.0.208'.
[   69.077175][ T6359] netlink: 16 bytes leftover after parsing attributes in process `syz.0.208'.
[   69.333499][ T6381] 
[   69.334495][ T6381] =============================
[   69.337105][ T6381] WARNING: suspicious RCU usage
[   69.339049][ T6381] 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 Not tainted
[   69.343953][ T6381] -----------------------------
[   69.346346][ T6381] net/core/netclassid_cgroup.c:24 suspicious rcu_dereference_check() usage!
[   69.349901][ T6381] 
[   69.349901][ T6381] other info that might help us debug this:
[   69.349901][ T6381] 
[   69.353743][ T6381] 
[   69.353743][ T6381] rcu_scheduler_active = 2, debug_locks = 1
[   69.357152][ T6381] 1 lock held by syz.0.219/6381:
[   69.359081][ T6381]  #0: ffffffff8e13f340 (rcu_read_lock_trace){....}-{0:0}, at: rcu_read_lock_trace+0x38/0x80
[   69.362620][ T6381] 
[   69.362620][ T6381] stack backtrace:
[   69.364425][ T6381] CPU: 0 UID: 0 PID: 6381 Comm: syz.0.219 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   69.364437][ T6381] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   69.364444][ T6381] Call Trace:
[   69.364450][ T6381]  <TASK>
[   69.364455][ T6381]  dump_stack_lvl+0x189/0x250
[   69.364472][ T6381]  ? __pfx_dump_stack_lvl+0x10/0x10
[   69.364483][ T6381]  ? __pfx__printk+0x10/0x10
[   69.364498][ T6381]  ? print_lock_name+0xde/0x100
[   69.364518][ T6381]  lockdep_rcu_suspicious+0x140/0x1d0
[   69.364539][ T6381]  task_cls_state+0x1a5/0x1d0
[   69.364577][ T6381]  bpf_get_cgroup_classid_curr+0x18/0x60
[   69.364588][ T6381]  bpf_prog_841aec7193f618b3+0x1b/0x21
[   69.364597][ T6381]  bpf_prog_run_pin_on_cpu+0x6a/0x150
[   69.364610][ T6381]  bpf_prog_test_run_syscall+0x312/0x4b0
[   69.364622][ T6381]  ? __pfx_bpf_prog_test_run_syscall+0x10/0x10
[   69.364632][ T6381]  ? __fget_files+0x2a/0x420
[   69.364645][ T6381]  ? __pfx_bpf_prog_test_run_syscall+0x10/0x10
[   69.364656][ T6381]  bpf_prog_test_run+0x2c7/0x340
[   69.364666][ T6381]  __sys_bpf+0x4a4/0x860
[   69.364674][ T6381]  ? __pfx___sys_bpf+0x10/0x10
[   69.364687][ T6381]  ? exc_page_fault+0x76/0xf0
[   69.364700][ T6381]  ? rcu_is_watching+0x15/0xb0
[   69.364713][ T6381]  __x64_sys_bpf+0x7c/0x90
[   69.364726][ T6381]  do_syscall_64+0xfa/0x3b0
[   69.364733][ T6381]  ? lockdep_hardirqs_on+0x9c/0x150
[   69.364745][ T6381]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   69.364752][ T6381]  ? exc_page_fault+0x9f/0xf0
[   69.364765][ T6381]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   69.364773][ T6381] RIP: 0033:0x7fe8f378e929
[   69.364782][ T6381] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   69.364789][ T6381] RSP: 002b:00007fe8f4620038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[   69.364797][ T6381] RAX: ffffffffffffffda RBX: 00007fe8f39b5fa0 RCX: 00007fe8f378e929
[   69.364804][ T6381] RDX: 0000000000000039 RSI: 0000200000000500 RDI: 000000000000000a
[   69.364809][ T6381] RBP: 00007fe8f3810b39 R08: 0000000000000000 R09: 0000000000000000
[   69.364813][ T6381] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   69.364818][ T6381] R13: 0000000000000000 R14: 00007fe8f39b5fa0 R15: 00007ffdc4af9af8
[   69.364831][ T6381]  </TASK>
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   70.175956][ T5839] bridge_slave_1: left allmulticast mode
[   70.177934][ T5839] bridge_slave_1: left promiscuous mode
[   70.180713][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state
[   70.188361][ T5839] bridge_slave_0: left allmulticast mode
[   70.190737][ T5839] bridge_slave_0: left promiscuous mode
[   70.193895][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.384761][ T5839] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   70.396144][ T5839] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   70.400302][ T5839] bond0 (unregistering): Released all slaves
[   70.474692][ T5839] tipc: Left network mode
[   70.649717][ T5839] hsr_slave_0: left promiscuous mode
[   70.652502][ T5839] hsr_slave_1: left promiscuous mode
[   70.654778][ T5839] batman_adv: batadv0: Removing interface: batadv_slave_0
[   70.660417][ T5839] batman_adv: batadv0: Removing interface: batadv_slave_1
[   70.923958][ T5839] team0 (unregistering): Port device team_slave_1 removed
[   70.954116][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   70.957813][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   70.960860][ T5839] team0 (unregistering): Port device team_slave_0 removed
[   71.653975][ T5839] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.724393][ T5839] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.799393][ T5839] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.857475][ T5839] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.943606][ T5839] bridge_slave_1: left allmulticast mode
[   71.951943][ T5839] bridge_slave_1: left promiscuous mode
[   71.956122][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.961746][ T5839] bridge_slave_0: left allmulticast mode
[   71.963494][ T5839] bridge_slave_0: left promiscuous mode
[   71.965748][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state
[   72.229994][ T5839] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   72.235055][ T5839] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   72.239648][ T5839] bond0 (unregistering): Released all slaves
[   72.498633][ T5839] hsr_slave_0: left promiscuous mode
[   72.501604][ T5839] hsr_slave_1: left promiscuous mode
[   72.504342][ T5839] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   72.508077][ T5839] batman_adv: batadv0: Removing interface: batadv_slave_0
[   72.511847][ T5839] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   72.514761][ T5839] batman_adv: batadv0: Removing interface: batadv_slave_1
[   72.533464][ T5839] veth1_macvtap: left promiscuous mode
[   72.539856][ T5839] veth0_macvtap: left promiscuous mode
[   72.542178][ T5839] veth1_vlan: left promiscuous mode
[   72.544408][ T5839] veth0_vlan: left promiscuous mode
[   72.861728][ T5839] team0 (unregistering): Port device team_slave_1 removed
[   72.892589][ T5839] team0 (unregistering): Port device team_slave_0 removed

VM DIAGNOSIS:
08:01:33  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000030 RBX=0000000000000030 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000f4c RDI=0000000000000f4d RBP=00000000000003f8 RSP=ffffc900064df550
R8 =ffff888021728237 R9 =1ffff110042e5046 R10=dffffc0000000000 R11=ffffffff85478780
R12=dffffc0000000000 R13=ffffffff99af98ae R14=ffffffff99dfe6e0 R15=0000000000000000
RIP=ffffffff854787fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fe8f46206c0 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2f91fffc CR3=000000010892a000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fe8f3985478 00007fe8f3985450 XMM03=00007fe8f3985488 00007fe8f3985480
XMM04=00007fe8f44ed100 00007fe8f3985440 XMM05=00007fe8f3985458 00007fe8f39854a0
XMM06=00007fe8f3985498 00007fe8f3985490 XMM07=00007fe8f3985488 00007fe8f3985480
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 00007fe8f3811c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000001 RBX=0000000000000000 RCX=a01a61e37983ab00 RDX=0000000000000000
RSI=ffffffff8db865a0 RDI=ffffffff8be29dc0 RBP=ffffffff8172aae5 RSP=ffffc900069ff038
R8 =0000000000000000 R9 =ffffffff8172aae5 R10=ffffc900069ff1f8 R11=ffffffff81ad03a0
R12=0000000000000002 R13=ffffffff8e13f160 R14=0000000000000000 R15=0000000000000246
RIP=ffffffff819e3f64 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fc2f12006c0 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fff23833000 CR3=000000010ddfc000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 00007fe8f3811c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
