last executing test programs:

1.381020417s ago: executing program 1 (id=315):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="2c002a79394364d2a2ac0000fbdbdf250a8093e3c805a1fd12654000"], 0x2c}}, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0x1, <r3=>0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r3, &(0x7f0000000180)="597ee91b26b2d3946b63a4ba2acd28067193ac6afbbb", &(0x7f00000001c0)=@tcp=r4, 0x1}, 0x20)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{}, &(0x7f00000003c0), &(0x7f0000000580)}, 0x20)
r5 = socket$packet(0x11, 0x4, 0x300)
r6 = socket(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=@newqdisc={0x154, 0x24, 0x3fe3aa0262d8c783, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x124, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x10, 0x0, 0x0, 0x1c, 0x0, 0x3}}, @TCA_CHOKE_STAB={0x104, 0x2, "1c1f15f3c5e23d27d29a00dd397b5c11d4cf201c1a0619fc314514ab71788e4079fdbe4f2a0d60b83a7d04c1d709981110401e5e10685abbad9b6f18e303e902c77244658a099a36fa486760c4941ea7df64250af29a4935de5d244f0549d93679b3d4fb358c2076bc6b1c9735ff8243f088e67455ba14975d12e5903ceeb7a23d62ecb5253ad444ef726b58a00f13f22ccc84cc06c9912b621c3ddc5f3229dc84c0880b5c6faefe33413b34a146e592fc15ae234dac030f05bb99eab08dfd2cb5659c6fc21fb7da6c380165ddde4659e75538dc864a53f691e1d785d6e6f73a03abf2120bce67e2d50075fd811b3e03a1cc2d66335bdee19738a0c1fb79b77d"}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x8}]}}]}, 0x154}}, 0x0)
recvfrom$packet(r5, &(0x7f0000000240)=""/176, 0xb0, 0x120, &(0x7f0000000380)={0x11, 0x1a, r8, 0x1, 0x6, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2d}}, 0x14)

1.240498192s ago: executing program 1 (id=319):
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
socket(0x10, 0x3, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$alg(0x26, 0x5, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0xfe, 0x4, 0x0, 0x1, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x2}]}, 0x24}, 0x1, 0x2000, 0x0, 0x4a044}, 0x4010)

1.16996374s ago: executing program 1 (id=320):
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r1=>0xffffffffffffffff})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14)
sendmsg$nl_route_sched(r0, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x4000, {0x0, 0x0, 0x6a00}, [{0x84, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x80d, 0x0, 0x10000000, 0x5, 0x4}, 0x1, r2}}]}, {0x0, 0xa}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_mpls={0x30, 0x2, 0x0, 0x0, {{0x9}, {0x1}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4008001}, 0x0)

1.169439771s ago: executing program 0 (id=321):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000006800090300ff9f00000000000a0000000000000004000b0008000100010000000f6a02d5b1ed4c2b472ed789c8e16fb93900944afee4e9d1ebe61a73338763c48514ddd87ca22aef3a27b825ca64838018e95043918cb58855cfe6fa90501c98361290a7ae06f87eb9fb2900eba0dc71daa100624d31d74d7444ba5d974fdc4fabb2da2b698b63615289fa2934243816b4e079debcbac135ae8ca0afc2d561d203082bfcd2424b91e3e69a9679830f8b5743786bf6c07fbeae45a353d1308c998d22c81c098adc916e7165e99428d86e5962886bf2e8059e743fd79f5e9bf9cec09b3261f900448a24"], 0x24}}, 0x0)

1.08897071s ago: executing program 1 (id=322):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfb, {{@in6=@private0, @in6=@loopback, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe}, 0x9, 0x0, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
r2 = socket(0x5, 0x0, 0x8001)
sendmsg$NFT_BATCH(r2, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELRULE={0x2ac, 0x8, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_RULE_EXPRESSIONS={0x198, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x56}, @NFTA_BYTEORDER_DREG={0x8}, @NFTA_BYTEORDER_DREG={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0xf8}, @NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0xaf}, @NFTA_BYTEORDER_OP={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_BYTEORDER_DREG={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, {0x34, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x15}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x8}]}}}, {0x3c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HASH_SEED={0x8, 0x5, 0x1, 0x0, 0x1bd}, @NFTA_HASH_LEN={0x8, 0x3, 0x1, 0x0, 0x98}, @NFTA_HASH_OFFSET={0x8, 0x6, 0x1, 0x0, 0x92c}, @NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0x13}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_FLAGS={0x8, 0x7, 0x1, 0x0, 0x60}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0xc}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0x4}]}}}, {0x10, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}, {0x44, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz0\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x1}]}}}, {0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x14, 0x1, 0x0, 0x1, @connlimit={{0xe}, @void}}, {0x24, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x11}]}}}, {0x10, 0x1, 0x0, 0x1, @tunnel={{0xb}, @void}}]}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x19}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFTA_RULE_EXPRESSIONS={0xb8, 0x4, 0x0, 0x1, [{0x54, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x10}, @NFTA_OBJREF_SET_ID={0x8}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_ID={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8}]}}}, {0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}, {0x10, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x4}}}, {0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_BURST={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_LIMIT_TYPE={0x8}, @NFTA_LIMIT_FLAGS={0x8}, @NFTA_LIMIT_BURST={0x8, 0x3, 0x1, 0x0, 0x9}]}}}, {0x10, 0x1, 0x0, 0x1, @dynset={{0xb}, @void}}]}, @NFTA_RULE_ID={0x8}, @NFTA_RULE_COMPAT={0x2c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0xd}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0xff}]}]}, @NFT_MSG_DELFLOWTABLE={0x20, 0x18, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x3, 0x0, 0x0, {0xa}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x1c, 0x9, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELFLOWTABLE={0xcc, 0x18, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_FLOWTABLE_HOOK={0x80, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x7c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'pim6reg\x00'}, {0x14, 0x1, 'macvtap0\x00'}, {0x14, 0x1, 'ip6_vti0\x00'}, {0x14, 0x1, 'veth0\x00'}, {0x14, 0x1, 'wg1\x00'}]}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x5}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELSETELEM={0x3c, 0xe, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x444}, 0x1, 0x0, 0x0, 0x4008080}, 0x20000000)
sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x20000000)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x0)
openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)='pids.max\x00', 0x2, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a0040"], 0xb8}}, 0x0)

1.088808129s ago: executing program 0 (id=323):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@bridge_delneigh={0x28, 0x1c, 0x1, 0x0, 0x6558, {0x7, 0x0, 0x0, r1, 0x80, 0xb2}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x40800)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=@newlink={0x50, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc, 0x1e, 0x5}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6}]}}}, @IFLA_CARRIER_CHANGES={0x8, 0x23, 0x2}]}, 0x50}}, 0x0)

990.417802ms ago: executing program 1 (id=325):
unshare(0x26020480)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001000)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a32000000009c000000060a010400000000000000000100000008000b400000000074000480340001800b000100657874686472000024000280080001400000000c0800034000000000080004400000002205000200070000003c0001800c00010062697477697365002c0002800800034000000004080001400000001408000240000000c2040005800c000480070001006eee7e000900010073797a300000"], 0x110}}, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7c00000010000305000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="15010000000000005c0012800e00010069703667726574617000000048000280060011004e23000014000700fe8000000000000000000000000000aa060018000200000006000e0000f9e61b"], 0x7c}}, 0x0)
connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1}, {0x7}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8)
sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x12}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x3, 0xa, 0x0, 0x0, 0x2f}, {0x0, 0x3f, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x6}, {0x0, 0x400000000}, 0x203, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@local, 0x1, 0x33}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0xb7, 0xfffffffc, 0x0, 0x1}}, 0xe8)

990.170001ms ago: executing program 0 (id=326):
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000dc020078000000000000000000000000ff02000000000000e26ea7250000000100000000000000000a"], 0xb8}}, 0x0)
sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x188}}, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bond0\x00', <r2=>0x0})
r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
ioctl$sock_bt_bnep_BNEPGETCONNINFO(r3, 0x800442d3, 0x0)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in=@dev={0xac, 0x14, 0x14, 0x28}, 0x0, 0x33}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {}, {}, {}, 0x0, 0x3502, 0x2}, [@offload={0xc, 0x1c, {r2, 0x6}}, @algo_auth_trunc={0x4c, 0x14, {{'sha1\x00'}}}]}, 0x148}}, 0x0)
socket$packet(0x11, 0x3, 0x300) (async)
socket$nl_xfrm(0x10, 0x3, 0x6) (async)
sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000dc020078000000000000000000000000ff02000000000000e26ea7250000000100000000000000000a"], 0xb8}}, 0x0) (async)
sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x188}}, 0x0) (async)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bond0\x00'}) (async)
syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) (async)
ioctl$sock_bt_bnep_BNEPGETCONNINFO(r3, 0x800442d3, 0x0) (async)
socket$nl_xfrm(0x10, 0x3, 0x6) (async)
sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in=@dev={0xac, 0x14, 0x14, 0x28}, 0x0, 0x33}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {}, {}, {}, 0x0, 0x3502, 0x2}, [@offload={0xc, 0x1c, {r2, 0x6}}, @algo_auth_trunc={0x4c, 0x14, {{'sha1\x00'}}}]}, 0x148}}, 0x0) (async)

908.598212ms ago: executing program 0 (id=328):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="300000001900010000009356f70f00000a0000000000020000000000140005"], 0x30}}, 0x0)
r1 = socket(0x10, 0x2, 0x0)
write(r1, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c)

908.046852ms ago: executing program 0 (id=329):
socket$inet_sctp(0x2, 0x1, 0x84)
socket$key(0xf, 0x3, 0x2)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50)
r1 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x10000802, 0x80, 0x0, 0x40000}, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000005200010004000000000000001c0000001400", @ANYRES16=r0], 0x28}}, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRES32=r2], 0xb8}}, 0x20040014)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0)
bind$packet(0xffffffffffffffff, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x2e, 0x6, @remote}, 0x14)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300020000000000fbdbdf03fc000000000000000000000000000000ffffffff00000100000000000000000000000004000000000a0060803b005846", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000400000000000000000000000000000000000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000feffffffffffffff00000000000000000000000000000000000000000000000009000000000000000001020000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50)
socket(0x22, 0x2, 0x23)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2000012, 0xa, 0x0, &(0x7f0000000440)="63eced8e46dc3f2ddf33", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
syz_genetlink_get_family_id$ethtool(0x0, r4)
sendmsg$ETHTOOL_MSG_CHANNELS_GET(r4, 0x0, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'vlan1\x00', <r6=>0x0})
r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000002c0000002c000000060000000600000000000070150000000300000001000000000000090000000006000900000c0001000000005700020100615f432e00"], &(0x7f0000000700)=""/72, 0x4a, 0x48, 0x1, 0xe, 0x10000}, 0x28)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="02000000040003000000ff7f0000000000000000", @ANYRES32, @ANYBLOB='\f\x00'/20, @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="000000000400"/28], 0x50)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_SET(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c20002eefab0008b28d4c25871cb3df884b", @ANYRES16=r9, @ANYBLOB="0100ffffffff000000002f0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000041}, 0x0)
sendmsg$DEVLINK_CMD_GET(r5, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x70, r9, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@nsim={{0xfc98}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}]}, 0x70}, 0x1, 0x0, 0x0, 0x60010}, 0x4000004)
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e00"], 0xb8}}, 0x2400c000)
socket$nl_xfrm(0x10, 0x3, 0x6)

740.820512ms ago: executing program 2 (id=331):
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x7fff, 0x0, 0xfffffffd, 0x1}, 0x10)
write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000003000000000000000800040001000000", 0x24)

669.672064ms ago: executing program 2 (id=332):
write$cgroup_int(0xffffffffffffffff, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b7030000faffffff850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000400)='rxrpc_peer\x00', r0, 0x0, 0xfffffffffffffff9}, 0x18)
socketpair(0x2a, 0xa, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r2)
r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0xa8f, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x5}, 0x50)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'erspan0\x00', &(0x7f0000000680)={'erspan0\x00', <r6=>0x0, 0x1, 0x20, 0x6, 0xfff, {{0x3d, 0x4, 0x1, 0x8, 0xf4, 0x64, 0x0, 0x3, 0x29, 0x0, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x26}, {[@cipso={0x86, 0x5a, 0x1, [{0x5, 0x12, "89c9f79914298d91f974a7b82dc69a2f"}, {0x5, 0x10, "ea491b3ba12bb44ce67bd963537c"}, {0x6, 0x5, "c78db9"}, {0x0, 0xe, "b20d364e848ab2699bd28296"}, {0x0, 0x2}, {0x6, 0x7, "9982066fe1"}, {0x2, 0xe, "383e799b96a4d1f7ac91efcb"}, {0x0, 0x8, "1145018c40e6"}]}, @timestamp={0x44, 0x14, 0xd5, 0x0, 0xd, [0x6, 0xbe33, 0x4, 0x2]}, @timestamp_addr={0x44, 0xc, 0x67, 0x1, 0x6, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}]}, @generic={0x7, 0x11, "0a23d2e67e5b8e42b4bef3a7c14ca2"}, @cipso={0x86, 0x13, 0x3, [{0x1, 0xd, "ef08c6f51ea80737c900c2"}]}, @ra={0x94, 0x4}, @cipso={0x86, 0x3c, 0x2, [{0x7, 0x12, "47bbd3083cd338e6449617d3f073039e"}, {0x6, 0x7, "202183616d"}, {0x6, 0x7, "36f4637453"}, {0x7, 0xe, "693153ec10c5ccf1bce43fb9"}, {0x1, 0x8, "e728acf2b371"}]}]}}}}})
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0)
r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000"], 0x48)
r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000540)={r9, &(0x7f0000000480), &(0x7f0000000340)=@udp6=r7}, 0x20)
r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="29bcee3fc1158b4ef045f8e964276f765f01998fd8a2bd6a3f6de8f0724389fb0206e40cc00622d5a51ce234e99c2690c94d137491d7bd6d814fd722554e40b88aa3fc7c2ff5d1ad583eb0c5e22e5ac7971e667e12a528f4b663f707a1e6503726e67b03ec806cc705d78fcf9568c6a625c5206d6f9dbd9883610806a6d0f426d6447aa33c401dca9247d54679092932870ccdb278ba0025b1b30a79e0d3ade6729a99f0f9f4ceea8b4078d48c05dfb54916a8b998075188a2ecffa10fef359729af63cb1baec8fad336f9878aa837"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r10}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000001c0)={r10, &(0x7f00000000c0), &(0x7f0000000140)=""/116}, 0x20)
r11 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
setsockopt$llc_int(r11, 0x10c, 0x6, &(0x7f00000003c0)=0x7, 0x4)
r12 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000006"], 0x50)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r12, &(0x7f00000001c0)}, 0x20)
r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r13, &(0x7f0000000100)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r13, 0x0)
r14 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000880)=@generic={&(0x7f0000000840)='./file0\x00', 0x0, 0x8}, 0x18)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000980)={0x6, 0x6, &(0x7f00000005c0)=@raw=[@map_val={0x18, 0x1, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x200}, @alu={0x7, 0x1, 0x8, 0xb, 0x9, 0x40, 0x4}, @call={0x85, 0x0, 0x0, 0x15}, @generic={0xc, 0x8, 0x1, 0x6, 0xffff98b4}, @call={0x85, 0x0, 0x0, 0xa5}], &(0x7f0000000640)='syzkaller\x00', 0x101, 0x0, 0x0, 0x41000, 0x4, '\x00', r6, 0x25, r7, 0x8, &(0x7f0000000800)={0x8, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f00000008c0)=[r10, r12, r13, 0x1, r14], &(0x7f0000000900)=[{0x2, 0x4, 0x10, 0x6}, {0x5, 0x4, 0x6, 0x1}, {0x3, 0x2, 0x1, 0x8}, {0x4, 0x1, 0x8, 0x2}, {0x2, 0x2, 0x6, 0xa}, {0x1, 0x4, 0xb, 0x8}, {0x3, 0x4, 0xd, 0xa}], 0x10, 0x3}, 0x94)
sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000500)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r4, 0x8, 0x70bd28, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x8801)
sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r3, 0x4, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x31e40e4e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4002000}, 0x40)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='rxrpc_peer\x00', r0}, 0x18)

600.277899ms ago: executing program 2 (id=333):
r0 = socket$netlink(0x10, 0x3, 0xc)
bind$netlink(r0, &(0x7f0000000280)={0x10, 0x0, 0x25dfdbfe, 0x1000000}, 0xc)
r1 = socket$inet(0x2, 0x2, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r2, 0x0, 0x0)
setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc)
ppoll(&(0x7f0000001080), 0x0, &(0x7f0000000340)={0x0, 0xff}, 0x0, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)
r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x7e}]}, &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendto(r4, &(0x7f0000000c00)="c0dd72d2c6234f5b17b09c9bf4c9f018a8eb5db8ecbf0c6dbc51e18cdbb7418937ba8c201daa96eb6f2b44e9e36ce82e3dd0c9fcfe253d72080930726094a1b1895145cabc4c203454ea5af174cc6a5da37bb4647e94163a801dabfdb0ff29878837eb452a76a2968dae77ece167def5ebee7e0f95afd2cffa37f39ccae64a5d9173d0bbd8d246a582fc059cc0a3beade85119e7650cdf2528e3667797212b042b0409f731c5ee2fd576c3ff6b490390def6492bb007b7016370328385c566877fbfda08fa514027f1afcf51a49971235c9136d787645c2f14ac7cbe86d198c164ad35d69f0e750df998920670c8555ed037d9822838d957a2448b921c834a68a9c5346bcf7863be5f9bd934f08f8bc23106ce1491ef7df61c0665daf6a229da2330cb442f21d280d190d2d69ddd25dd307cbf4055e15e7c8e3d7bbcb0fbbd573b630bc3703fb0d1b3877042d59c2ee6ccae39ea2cbde5d6b01697c0f179cdf68ce4a2ef9bb7129c7a3f457bdde64a58c4a66920f65eae5813c494807f2e454b64bf9711a50164f5009ee4801a22b029b508ce40d98047aef6d9d05b47836b9557ba5cebde4afc16e065ecc4322f9cf2af8599805a84802b990d17caabbe4059b7483adbe0db7f3b30005701cd9a378b04b080081c9b1cfac35a1baedf6e677fd2d2b261877dd8fb8c4c8c0c372c1d4f41b8f8b0da0f8da0307a39d7fd536a81dc0926b3d998c4b06ce35509bd14f26c29b1fd3c146e79d82577810b1fdfbddb7ef7efc8b3d08a7f8f7c24b2746d914fc46600ccfa31acf33ce0ce8783c0519cf2f5d4fc6a34160955d7daa91120d0b3cf58f6cfc2ce560de3c80025ed18fbefc33e80000d7b18fc864cb18c89e29176e1ea9c8eafa724ceee5ccc20331e70821250c686ca8d4a1d8358ad77ec675d821b2dbc9537e3746cff31114515bcd43a7bfad38b8df9b49c9850ca4427b2e10f110b1edb80f4847d338b629cc45bb624299bcac4f7fc1a0ed910faf8328ab32c483658cf8bb2ab7a72239c21e718f8c9fed46c58da62419ef6c8f6dc519d1b50d1ecb9176d66a200dff3c4242e623148544aaf2a75c93f6316f37aa42001e348782635d6bb919928209f66dacf249b722b03baf88d55956a87f4c826a49003196cb4cf772d10009e2c0c3baa830c2ff6fcfa3c9fda703ea68ccfe63e4fd81f21d3cc78fc35448bb84ee169f72d5c88797803c3c648258cb5a9bdfdf1b479da2cf6925211f08b723502eb27a82eb3bdb4a6ac2ecbb08127f65fc03269fd58fca1ffd2911c68280ad85bff145d73aabe99e627f02dd5e7b427f37073e7e244a2a0e8b5e4ff4973d065b23010bcbdf5a86ef3b3faba929391ffbc780640830eb47acb93bbc122a6542ed36d90792778d517ebdf47fed1f0a8ac1857a4b7449842add2cd1545d822103778c7233e60bd33730b2dd898616a7d8265ccb8f653ca54e0cdedcb0aaef6f4d8702dbe2563605a9b91b30215b23bccc92878a0347407af9f23ab0cd693aa4f58c5a3a3a8950c10d6eb1f1556f4050b8cebb91872d7a05b70aff4aa16af67106e21c5a6e492ba59fb2bfa7f5294f9f4f89ca3eb270c20c8b12b763fd834c1feb22c2bc81cd072545823e55b06e27a0b02b2279d9b16c002811aa67929fc5c7564d62e47b52a4ff4ef96d3cffb507e325fb036a8267e435e8ef1dcf6b2fb2bf598eff49560", 0x4bc, 0x4004, 0x0, 0x0)
getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0)
setsockopt$inet_mreqsrc(r1, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000008c0)=@newsa={0xf8, 0x10, 0x1, 0x0, 0x25dfdbfc, {{@in=@empty, @in6=@dev={0xfe, 0x80, '\x00', 0x16}, 0x0, 0x0, 0x81e, 0x4, 0xa, 0x20, 0x80, 0x21}, {@in=@multicast1, 0x0, 0x33}, @in=@loopback, {0x401, 0x0, 0x8, 0x0, 0xffffffff, 0x3, 0x0, 0x8000000}, {0xfffffffffffffffd, 0x0, 0xfffffffffffffffd, 0x80000001}, {0x0, 0x1}, 0x0, 0x0, 0xa, 0x4, 0x1, 0x40}, [@XFRMA_IF_ID={0x8, 0x1f, 0x1}]}, 0xf8}, 0x1, 0x0, 0x0, 0x24040021}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff)
r8 = socket$kcm(0x11, 0xa, 0x300)
ioctl$sock_kcm_SIOCKCMUNATTACH(r8, 0x8907, 0x0)
socket$kcm(0x2, 0xa, 0x2)
socket$kcm(0x2, 0xa, 0x73)
r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
recvmsg$kcm(r8, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0)
sendmsg$FOU_CMD_DEL(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r7, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast2}]}, 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x4000080)
r10 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r11=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0xac, 0x2c, 0xd2b, 0x70bd2b, 0x35dfdbfb, {0x0, 0x0, 0x0, r11, {0xf}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x80, 0x2, [@TCA_U32_LINK={0x8, 0x3, 0x80000000}, @TCA_U32_SEL={0x74, 0x5, {0x10, 0x9, 0x6, 0x10da, 0xa760, 0x0, 0x10, 0x100, [{0x1000, 0xe, 0xfffff000, 0x9f6}, {0xdeb2, 0x3, 0x6, 0x3}, {0x1, 0xfffffffb, 0x100, 0x3ff}, {0x200, 0x3ff, 0x3, 0x4}, {0x9, 0x7, 0x40, 0x80}, {0x3ff, 0xb, 0x3, 0xa6d}]}}]}}]}, 0xac}, 0x1, 0x0, 0x0, 0xccd4ddef28b9e90e}, 0x24040084)

410.962613ms ago: executing program 2 (id=334):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001e0001000000000002000000020000000600000e00000102"], 0x24}, 0x1, 0x0, 0x0, 0x42}, 0x2810)
sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001f80)=@updsa={0x184, 0x10, 0x1, 0x0, 0x0, {{@in6=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x89}, {@in=@loopback, 0x0, 0x33}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x8000, 0xffffffffffffffff, 0xfffffffffffffffe}, {0x0, 0xfffffffffffffffd, 0x1900000000000000}, {}, 0x70bd2b, 0x0, 0xa, 0x2, 0x80}, [@algo_auth_trunc={0x4c, 0x14, {{'sm3\x00'}}}, @algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x184}}, 0x0)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='nv', 0x2)
setsockopt$IP_VS_SO_SET_ZERO(r2, 0x0, 0x48f, &(0x7f0000000000)={0x62, @local, 0x4e23, 0x4, 'ovf\x00', 0x1, 0x10001, 0x3e}, 0x2c)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000001d7118ba000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000061182c000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendto$inet(r2, 0x0, 0x0, 0x200007e9, &(0x7f0000e68000)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10)

410.301171ms ago: executing program 2 (id=335):
r0 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'lo\x00', <r1=>0x0})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3)
ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=<r5=>0x0)
sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r5], 0x1c}}, 0x0)
write$nci(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="41040101040403"], 0x7)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xd0f, 0xffffffff, 0x0, {0x60, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FWMARK={0x8}]}}]}, 0x3c}}, 0x0)
r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a00000008"], 0x48)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
r8 = socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000040)={'wlan0\x00', <r9=>0x0})
r10 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x38, r7, 0x1, 0x0, 0x25dfdbfd, {{0x2}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0xf4, 0x2f}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]]}, 0x38}, 0x1, 0x0, 0x0, 0xd37697ff280d3c0e}, 0x0)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0x20, &(0x7f0000000440)={&(0x7f0000000280)=""/151, 0x97, <r11=>0x0, &(0x7f0000000340)=""/205, 0xcd}}, 0x10)
r12 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000004c0)=r11, 0x4)
r13 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x17, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000002000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, r12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r11, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r13}, 0x10)
r14 = syz_init_net_socket$llc(0x1a, 0x3, 0x0)
connect$llc(r14, &(0x7f0000000240)={0x1a, 0x204, 0xe, 0x0, 0xf6, 0x9, @multicast}, 0x10)
recvfrom$llc(r0, &(0x7f0000000600)=""/205, 0xcd, 0x100, 0x0, 0x0)
r15 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r15, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0xf0, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0x7}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r13, 0x8030942b, &(0x7f0000000200)={0x4, {0xe, 0x7954, 0xffffffffffffffff, 0x2, 0x3}})

299.869045ms ago: executing program 2 (id=336):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff000000f6bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x9, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10)
r1 = socket$igmp(0x2, 0x3, 0x2)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'sit0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x34, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8, 0x4, 0x800}, @TCA_HHF_QUANTUM={0x8, 0x2, 0xd}, @TCA_HHF_RESET_TIMEOUT={0x8, 0x4, 0x6}, @TCA_HHF_HH_FLOWS_LIMIT={0x8, 0x3, 0x8}, @TCA_HHF_BACKLOG_LIMIT={0x0, 0x1, 0x2}, @TCA_HHF_QUANTUM={0x3, 0x2, 0xffff8001}]}}, @TCA_RATE={0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x48801}, 0x0)
setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000003d40), 0x4)
setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10)
r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r5 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x1, 0x0, 0x0, @vifc_lcl_ifindex, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10)
setsockopt$inet_mreq(r4, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8)
syz_emit_ethernet(0x2a, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffff0000030000f38f78006400d24f4a2cda7db5f0f36ecb4bf0ab66920351e75b2ff4a69dd368c5f4f430ad95ebc7de65a4e949e0dfe4765e2eebbf724c2dd01c5984765c594fa3280d44883c9ebc25e3ae2a1021138ac232b217fb5948e442db8cdc597798802eb7cd388faea5a22996c7e3bce3ce62d3b066a5eb0a85e0a4371a8d432b3ac16a552aee26b32d53a11ed31086fc620e18a825ab060f88a7751267e5965b41a4c3503b21e7625df2f014426194"], 0x0)
r6 = socket(0x2, 0x80805, 0x0)
r7 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r7, 0x0)
close(0x3)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={<r8=>0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
sendmmsg$inet_sctp(r6, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x30, 0x4040001}], 0x1, 0x0)
getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r6, 0x84, 0x1b, &(0x7f0000000240)={r8}, &(0x7f0000000280)=0x8)
setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c)
unshare(0x62040200)
write$tun(0xffffffffffffffff, 0x0, 0x3e)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000000740)={"8c3ef01be86258108b331b07f91efab2", 0x0, 0x0, {0x6, 0x40}, {0x3, 0x1}, 0x6, [0x3, 0x5, 0x9, 0x7, 0x7, 0x5, 0x10, 0x953, 0x1, 0x4, 0x8, 0x9000000000000000, 0x2, 0x4, 0x2, 0x5]})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd70000000000004000000130317"], 0x328}}, 0x84)

419.517µs ago: executing program 0 (id=337):
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000200)={0x6c, r1, 0x1, 0x170bd2b, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0xf0ff, @dev={0xfe, 0x80, '\x00', 0x10}, 0xf8}}, {0x20, 0x2, @in6={0xa, 0x0, 0x5, @mcast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x8000)

0s ago: executing program 1 (id=338):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000006800090300ffef00000000000a0000000000000004000b0008000100010000000f6a02d5b1ed4c2b472ed789c8e16fb93900944afee4e9d1ebe61a73338763c48514ddd87ca22aef3a27b825ca64838018e95043918cb58855cfe6fa90501c98361290a7ae06f87eb9fb2900eba0dc71daa100624d31d74d7444ba5d974fdc4fabb2da2b698b63615289fa2934243816b4e079debcbac135ae8ca0afc2d561d203082bfcd2424b91e3e69a9679830f8b5743786bf6c07fbeae45a353d1308c998d22c81c098adc916e7165e99428d86e5962886bf2e8059e743fd79f5e9bf9cec09b3261f900448a24"], 0x24}}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:60628' (ED25519) to the list of known hosts.
syzkaller login: [   48.372404][ T5774] cgroup: Unknown subsys name 'net'
[   48.456313][ T5774] cgroup: Unknown subsys name 'cpuset'
[   48.461731][ T5774] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.744358][ T5774] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   55.081543][ T5845] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   55.094483][ T5845] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   55.097789][ T5845] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   55.101451][ T5845] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   55.104879][ T5845] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   55.125980][ T5845] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   55.129217][ T5845] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   55.132479][ T5845] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   55.147485][ T5851] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   55.151190][ T5851] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   55.153895][ T5851] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   55.157272][ T5237] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   55.189778][ T5852] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   55.195398][ T5852] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   55.198229][ T5852] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   55.394618][ T5842] chnl_net:caif_netlink_parms(): no params data found
[   55.440438][ T5846] chnl_net:caif_netlink_parms(): no params data found
[   55.526527][ T5849] chnl_net:caif_netlink_parms(): no params data found
[   55.531932][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.536494][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.539631][ T5842] bridge_slave_0: entered allmulticast mode
[   55.543793][ T5842] bridge_slave_0: entered promiscuous mode
[   55.549519][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.552399][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.555526][ T5842] bridge_slave_1: entered allmulticast mode
[   55.559444][ T5842] bridge_slave_1: entered promiscuous mode
[   55.644397][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.647318][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.650013][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.652287][ T5846] bridge_slave_0: entered allmulticast mode
[   55.655529][ T5846] bridge_slave_0: entered promiscuous mode
[   55.672844][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.683101][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.685616][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.688516][ T5846] bridge_slave_1: entered allmulticast mode
[   55.692145][ T5846] bridge_slave_1: entered promiscuous mode
[   55.744086][ T5842] team0: Port device team_slave_0 added
[   55.746697][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.749484][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.751734][ T5849] bridge_slave_0: entered allmulticast mode
[   55.755129][ T5849] bridge_slave_0: entered promiscuous mode
[   55.759661][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.764748][ T5842] team0: Port device team_slave_1 added
[   55.767724][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.769961][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.772203][ T5849] bridge_slave_1: entered allmulticast mode
[   55.775345][ T5849] bridge_slave_1: entered promiscuous mode
[   55.789627][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.832077][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.834642][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   55.842520][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.848006][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.850651][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   55.860262][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.867416][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.889065][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.902659][ T5846] team0: Port device team_slave_0 added
[   55.907121][ T5846] team0: Port device team_slave_1 added
[   55.946580][ T5849] team0: Port device team_slave_0 added
[   55.949552][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.952195][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   55.961089][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.975477][ T5849] team0: Port device team_slave_1 added
[   55.982901][ T5842] hsr_slave_0: entered promiscuous mode
[   55.987476][ T5842] hsr_slave_1: entered promiscuous mode
[   55.990311][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.992452][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.001364][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.055295][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.058048][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.068192][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.092512][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.095220][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.103073][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.150539][ T5846] hsr_slave_0: entered promiscuous mode
[   56.154610][ T5846] hsr_slave_1: entered promiscuous mode
[   56.157457][ T5846] debugfs: 'hsr0' already exists in 'hsr'
[   56.159749][ T5846] Cannot create hsr debugfs directory
[   56.218483][ T5849] hsr_slave_0: entered promiscuous mode
[   56.221528][ T5849] hsr_slave_1: entered promiscuous mode
[   56.224493][ T5849] debugfs: 'hsr0' already exists in 'hsr'
[   56.226725][ T5849] Cannot create hsr debugfs directory
[   56.525255][ T5842] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.537247][ T5842] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.545505][ T5842] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.550721][ T5842] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.610188][ T5846] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   56.624034][ T5846] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   56.640286][ T5846] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   56.649253][ T5846] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   56.731174][ T5849] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   56.737897][ T5849] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   56.753150][ T5849] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   56.763086][ T5849] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   56.825448][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.858356][ T5842] 8021q: adding VLAN 0 to HW filter on device team0
[   56.864743][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.882607][ T3595] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.885735][ T3595] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.902006][ T5846] 8021q: adding VLAN 0 to HW filter on device team0
[   56.907387][ T3595] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.910228][ T3595] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.924898][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.928981][ T3595] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.931779][ T3595] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.944619][ T3595] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.947444][ T3595] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.967891][ T5849] 8021q: adding VLAN 0 to HW filter on device team0
[   56.983363][   T53] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.985763][   T53] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.023076][ T3595] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.026003][ T3595] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.057447][ T5842] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   57.199221][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.203320][ T5845] Bluetooth: hci1: command tx timeout
[   57.203325][ T5852] Bluetooth: hci0: command tx timeout
[   57.247042][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.252550][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.258650][ T5846] veth0_vlan: entered promiscuous mode
[   57.270335][ T5846] veth1_vlan: entered promiscuous mode
[   57.274441][ T5845] Bluetooth: hci2: command tx timeout
[   57.328357][ T5846] veth0_macvtap: entered promiscuous mode
[   57.332969][ T5849] veth0_vlan: entered promiscuous mode
[   57.340230][ T5846] veth1_macvtap: entered promiscuous mode
[   57.350277][ T5849] veth1_vlan: entered promiscuous mode
[   57.355236][ T5842] veth0_vlan: entered promiscuous mode
[   57.362041][ T5842] veth1_vlan: entered promiscuous mode
[   57.368305][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.381063][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.398651][ T5895] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.408366][ T5895] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.411226][ T5895] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.422777][ T5895] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.431917][ T5842] veth0_macvtap: entered promiscuous mode
[   57.448449][ T5842] veth1_macvtap: entered promiscuous mode
[   57.456839][ T5849] veth0_macvtap: entered promiscuous mode
[   57.462053][ T5849] veth1_macvtap: entered promiscuous mode
[   57.486153][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.504696][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.509700][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.525182][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.532565][ T3595] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.537662][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.540674][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.546159][ T3595] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.558812][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.565570][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.568376][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.571507][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.595810][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.608341][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.613991][ T3595] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.616361][ T3595] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.679409][ T5846] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   57.687320][ T3629] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.689749][ T3629] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.701382][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.708495][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.734415][ T3595] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.737137][ T3595] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.759184][   T32] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.761862][   T32] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.764717][ T5911] batman_adv: batadv0: Adding interface: dummy0
[   57.769630][ T5911] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   57.786304][ T5911] batman_adv: batadv0: Interface activated: dummy0
[   57.799044][ T5911] batadv0: mtu less than device minimum
[   57.801731][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.805980][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.810018][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.814056][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.818006][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.821989][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.826704][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.830759][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.834716][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   58.042092][ T5922] syz.2.5 uses obsolete (PF_INET,SOCK_PACKET)
[   58.230569][ T5935] netlink: 'syz.0.9': attribute type 16 has an invalid length.
[   58.238628][ T5935] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9'.
[   58.298426][ T5939] netlink: 216 bytes leftover after parsing attributes in process `syz.2.10'.
[   58.486476][ T5955] delete_channel: no stack
[   58.551933][ T5966] netlink: 28 bytes leftover after parsing attributes in process `syz.2.21'.
[   58.556583][ T5966] netlink: 32 bytes leftover after parsing attributes in process `syz.2.21'.
[   58.559726][ T5966] netlink: 28 bytes leftover after parsing attributes in process `syz.2.21'.
[   58.616426][ T5970] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   58.693294][ T5974] warning: `syz.1.24' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   58.710619][ T5961] delete_channel: no stack
[   58.789001][ T5978] netlink: 16 bytes leftover after parsing attributes in process `syz.2.27'.
[   58.865646][ T5984] netlink: 80 bytes leftover after parsing attributes in process `syz.2.28'.
[   58.896930][ T5986] netlink: 'syz.0.29': attribute type 46 has an invalid length.
[   58.940146][ T5992] Bluetooth: MGMT ver 1.23
[   58.974111][   T13] nci: nci_add_new_protocol: the target found does not have the desired protocol
[   59.111199][ T6001] Zero length message leads to an empty skb
[   59.274652][ T5845] Bluetooth: hci0: command tx timeout
[   59.274717][ T5852] Bluetooth: hci1: command tx timeout
[   59.363823][ T5852] Bluetooth: hci2: command tx timeout
[   59.967489][ T6023] vcan0: tx drop: invalid sa for name 0x0000000000000001
[   60.015995][ T6027] netlink: 16 bytes leftover after parsing attributes in process `syz.2.41'.
[   60.817598][ T6081] netlink: 48 bytes leftover after parsing attributes in process `syz.1.64'.
[   60.880815][ T6086] netlink: 64 bytes leftover after parsing attributes in process `syz.1.64'.
[   61.354438][ T5852] Bluetooth: hci1: command tx timeout
[   61.354678][ T5845] Bluetooth: hci0: command tx timeout
[   61.433688][ T5845] Bluetooth: hci2: command tx timeout
[   62.122786][ T6184] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   62.133239][ T6184] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[   62.769273][ T6236] syzkaller1: entered promiscuous mode
[   62.771152][ T6236] syzkaller1: entered allmulticast mode
[   62.858810][ T6245] team0: No ports can be present during mode change
[   62.869420][ T6245] vlan0: entered promiscuous mode
[   62.876295][ T6245] tipc: Started in network mode
[   62.878019][ T6245] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711
[   62.881819][ T6245] tipc: Enabled bearer <eth:team0>, priority 0
[   63.114232][    C0] net_ratelimit: 15 callbacks suppressed
[   63.114267][    C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
[   63.443524][ T5845] Bluetooth: hci0: command tx timeout
[   63.443706][ T5852] Bluetooth: hci1: command tx timeout
[   63.514044][ T5852] Bluetooth: hci2: command tx timeout
[   63.626547][ T6332] __nla_validate_parse: 14 callbacks suppressed
[   63.626559][ T6332] netlink: 144 bytes leftover after parsing attributes in process `syz.1.117'.
[   63.674891][ T6334] netlink: 'syz.1.118': attribute type 29 has an invalid length.
[   63.682364][ T6334] netlink: 'syz.1.118': attribute type 29 has an invalid length.
[   63.688032][ T6334] netlink: 500 bytes leftover after parsing attributes in process `syz.1.118'.
[   63.691636][ T6334] unsupported nla_type 59
[   63.735373][ T6340] netlink: 16 bytes leftover after parsing attributes in process `syz.1.121'.
[   63.735484][ T6338] netlink: 8 bytes leftover after parsing attributes in process `syz.0.120'.
[   63.818512][ T6345] netlink: 'syz.1.122': attribute type 11 has an invalid length.
[   63.828814][ T6345] netlink: 'syz.1.122': attribute type 4 has an invalid length.
[   63.832980][ T6345] netlink: 224 bytes leftover after parsing attributes in process `syz.1.122'.
[   63.933387][ T6351] raw_sendmsg: syz.0.123 forgot to set AF_INET. Fix it!
[   63.985238][ T6354] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   63.994474][   T10] tipc: Node number set to 11578026
[   63.998195][ T6355] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   64.105922][ T6362] netlink: 8 bytes leftover after parsing attributes in process `syz.2.125'.
[   64.287610][ T6374] batman_adv: batadv0: Adding interface: dummy0
[   64.288233][ T6361] netlink: 16 bytes leftover after parsing attributes in process `syz.1.128'.
[   64.289807][ T6374] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.302789][ T6374] batman_adv: batadv0: Interface activated: dummy0
[   64.579994][ T6401] netlink: 24 bytes leftover after parsing attributes in process `syz.1.141'.
[   64.588340][ T6401] netlink: 64 bytes leftover after parsing attributes in process `syz.1.141'.
[   64.596112][ T6401] netlink: 'syz.1.141': attribute type 32 has an invalid length.
[   64.599209][ T6401] netlink: 60 bytes leftover after parsing attributes in process `syz.1.141'.
[   64.727108][ T6411] openvswitch: netlink: Missing key (keys=40, expected=2000)
[   64.979416][ T6422] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.053542][ T6422] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.112085][ T6422] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.173972][ T6422] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.287673][   T13] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.344393][   T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.347706][   T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.352628][   T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.359757][ T6426] tipc: Started in network mode
[   65.361986][ T6426] tipc: Node identity fe800000000000c5e80000000000001, cluster identity 4711
[   65.387239][ T6426] tipc: Enabling of bearer <udp:sz0> rejected, failed to enable media
[   65.408854][ T6426] tipc: Enabling of bearer <udp:sz0> rejected, failed to enable media
[   65.524413][ T6437] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   65.528953][ T6439] tipc: Resetting bearer <eth:syzkaller0>
[   65.546738][ T6436] tipc: Disabling bearer <eth:syzkaller0>
[   65.594184][ T5852] Bluetooth: hci2: command tx timeout
[   65.683165][ T6452] batman_adv: batadv0: Adding interface: dummy0
[   65.690405][ T6452] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.699649][ T6452] batman_adv: batadv0: Interface activated: dummy0
[   65.786787][ T6467] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 !
[   65.879957][ T6470] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   66.118150][ T6479] delete_channel: no stack
[   66.170731][ T6479] tipc: Enabled bearer <udp:syz2>, priority 10
[   66.981575][ T6505] netlink: 'syz.0.180': attribute type 3 has an invalid length.
[   67.097027][ T6517] netlink: 'syz.2.185': attribute type 9 has an invalid length.
[   67.422785][ T6529] tipc: Enabled bearer <udp:syz0>, priority 10
[   68.241032][ T6593] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   68.656153][ T6618] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   69.407989][ T6668] __nla_validate_parse: 19 callbacks suppressed
[   69.408002][ T6668] netlink: 288 bytes leftover after parsing attributes in process `syz.1.222'.
[   69.444971][ T6678] netlink: 12 bytes leftover after parsing attributes in process `syz.0.225'.
[   69.553280][ T6682] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[   69.756512][    C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
[   69.822060][ T6698] netlink: 'syz.0.234': attribute type 1 has an invalid length.
[   69.858098][ T6701] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) !
[   69.937065][   T33] audit: type=1107 audit(1758868715.243:2): pid=6706 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='۴/$v(Py'	uFS
[   69.937065][   T33]  +2IKոݔțuo`lznЦFVYbʑB"FLHv6'
[   70.098184][ T6672] Bluetooth: hci0: Opcode 0x0401 failed: -4
[   70.272175][ T6727] netlink: 12 bytes leftover after parsing attributes in process `syz.0.243'.
[   70.592419][ T6749] netlink: 'syz.0.250': attribute type 32 has an invalid length.
[   70.610069][ T6751] netlink: 'syz.0.250': attribute type 32 has an invalid length.
[   70.746340][ T6756] netlink: 120 bytes leftover after parsing attributes in process `syz.2.252'.
[   70.908914][ T6763] netlink: 16 bytes leftover after parsing attributes in process `syz.0.256'.
[   70.915838][ T6763] syz_tun: entered allmulticast mode
[   70.927788][ T6763] dvmrp8: entered allmulticast mode
[   70.938047][ T6763] syz_tun: left allmulticast mode
[   70.940473][ T6763] dvmrp8: left allmulticast mode
[   71.040146][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   71.045948][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   71.055033][ T6763] netlink: 'syz.0.256': attribute type 23 has an invalid length.
[   71.347270][ T6779] netlink: 'syz.0.260': attribute type 83 has an invalid length.
[   71.363790][ T5852] Bluetooth: hci0: command 0x0401 tx timeout
[   71.448760][ T6785] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition
[   71.452758][ T6785] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0)
[   71.988503][ T6817] netlink: 'syz.0.274': attribute type 23 has an invalid length.
[   72.060708][ T6826] !: renamed from dummy0 (while UP)
[   72.787300][ T6875] netlink: 'syz.2.288': attribute type 32 has an invalid length.
[   72.827284][ T6876] sctp: [Deprecated]: syz.0.289 (pid 6876) Use of int in maxseg socket option.
[   72.827284][ T6876] Use struct sctp_assoc_value instead
[   72.856631][ T6878] netlink: 64 bytes leftover after parsing attributes in process `syz.2.291'.
[   72.859862][ T6880] netlink: 64 bytes leftover after parsing attributes in process `syz.2.291'.
[   73.026843][ T6895] netlink: 4 bytes leftover after parsing attributes in process `syz.1.296'.
[   73.067586][ T6897] netlink: 8 bytes leftover after parsing attributes in process `syz.2.297'.
[   73.089402][ T6898] netlink: 256 bytes leftover after parsing attributes in process `syz.1.296'.
[   73.200552][ T6904] syz_tun: entered allmulticast mode
[   73.209834][ T6904] dvmrp8: entered allmulticast mode
[   73.219357][ T6904] syz_tun: left allmulticast mode
[   73.221396][ T6904] dvmrp8: left allmulticast mode
[   73.334606][ T6904] netlink: 'syz.2.300': attribute type 23 has an invalid length.
[   73.395846][ T6913] syz.1.303 uses old SIOCAX25GETINFO
[   73.785408][ T6946] batadv0: mtu less than device minimum
[   73.787780][ T6946] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   73.791809][ T6946] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   73.796420][ T6946] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   73.801206][ T6946] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   73.806619][ T6946] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   73.811825][ T6946] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   73.817308][ T6946] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   73.822596][ T6946] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   73.827935][ T6946] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   74.552493][ T7011] netlink: 'syz.2.333': attribute type 4 has an invalid length.
[   74.747054][ T7023] IPVS: set_ctl: invalid protocol: 98 172.20.20.170:20003
[   74.907484][ T7040] __nla_validate_parse: 10 callbacks suppressed
[   74.907500][ T7040] netlink: 16 bytes leftover after parsing attributes in process `syz.2.336'.
[   74.919464][ T7040] syz_tun: entered allmulticast mode
[   74.929052][ T7040] dvmrp8: entered allmulticast mode
[   74.933982][ T7040] syz_tun: left allmulticast mode
[   74.935752][ T7040] dvmrp8: left allmulticast mode
[   75.049673][ T6991] delete_channel: no stack
[   75.239668][ T7069] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[   75.279413][ T7075] ==================================================================
[   75.282105][ T7075] BUG: KASAN: slab-use-after-free in __xfrm_state_delete+0x666/0xca0
[   75.284540][ T7075] Write of size 8 at addr ffff888107f26d28 by task syz.2.340/7075
[   75.288228][ T7075] 
[   75.288998][ T7075] CPU: 1 UID: 0 PID: 7075 Comm: syz.2.340 Not tainted syzkaller #0 PREEMPT(full) 
[   75.289016][ T7075] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   75.289026][ T7075] Call Trace:
[   75.289041][ T7075]  <TASK>
[   75.289046][ T7075]  dump_stack_lvl+0x189/0x250
[   75.289059][ T7075]  ? __kasan_check_byte+0x12/0x40
[   75.289072][ T7075]  ? __pfx_dump_stack_lvl+0x10/0x10
[   75.289106][ T7075]  ? lock_release+0x4b/0x3e0
[   75.289130][ T7075]  ? __virt_addr_valid+0x4a5/0x5c0
[   75.289141][ T7075]  print_report+0xca/0x240
[   75.289154][ T7075]  ? __xfrm_state_delete+0x666/0xca0
[   75.289163][ T7075]  kasan_report+0x118/0x150
[   75.289173][ T7075]  ? __xfrm_state_delete+0x666/0xca0
[   75.289183][ T7075]  __xfrm_state_delete+0x666/0xca0
[   75.289195][ T7075]  xfrm_state_flush+0x45f/0x770
[   75.289206][ T7075]  pfkey_flush+0x13f/0x340
[   75.289217][ T7075]  ? __pfx_pfkey_flush+0x10/0x10
[   75.289226][ T7075]  ? kmem_cache_free+0x18f/0x400
[   75.289239][ T7075]  pfkey_sendmsg+0xbfe/0x1090
[   75.289249][ T7075]  ? trace_sched_exit_tp+0x36/0x110
[   75.289261][ T7075]  ? __pfx_pfkey_sendmsg+0x10/0x10
[   75.289274][ T7075]  ? aa_sock_msg_perm+0xf1/0x1d0
[   75.289286][ T7075]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   75.289294][ T7075]  ? __pfx_pfkey_sendmsg+0x10/0x10
[   75.289303][ T7075]  __sock_sendmsg+0x21c/0x270
[   75.289315][ T7075]  ____sys_sendmsg+0x505/0x830
[   75.289327][ T7075]  ? __pfx_____sys_sendmsg+0x10/0x10
[   75.289338][ T7075]  ? import_iovec+0x74/0xa0
[   75.289348][ T7075]  ___sys_sendmsg+0x21f/0x2a0
[   75.289357][ T7075]  ? __pfx____sys_sendmsg+0x10/0x10
[   75.289372][ T7075]  ? __fget_files+0x2a/0x420
[   75.289383][ T7075]  ? __fget_files+0x3a0/0x420
[   75.289395][ T7075]  __x64_sys_sendmsg+0x19b/0x260
[   75.289404][ T7075]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   75.289415][ T7075]  ? rcu_is_watching+0x15/0xb0
[   75.289422][ T7075]  ? do_syscall_64+0xbe/0x3b0
[   75.289431][ T7075]  do_syscall_64+0xfa/0x3b0
[   75.289437][ T7075]  ? lockdep_hardirqs_on+0x9c/0x150
[   75.289448][ T7075]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   75.289456][ T7075]  ? exc_page_fault+0x9f/0xf0
[   75.289467][ T7075]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   75.289475][ T7075] RIP: 0033:0x7f367ff8ec29
[   75.289484][ T7075] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   75.289491][ T7075] RSP: 002b:00007f3680df7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   75.289499][ T7075] RAX: ffffffffffffffda RBX: 00007f36801d5fa0 RCX: 00007f367ff8ec29
[   75.289505][ T7075] RDX: 0000000020000c04 RSI: 00002000000000c0 RDI: 0000000000000004
[   75.289511][ T7075] RBP: 00007f3680011e41 R08: 0000000000000000 R09: 0000000000000000
[   75.289517][ T7075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   75.289521][ T7075] R13: 00007f36801d6038 R14: 00007f36801d5fa0 R15: 00007ffdbd1ccf98
[   75.289530][ T7075]  </TASK>
[   75.289533][ T7075] 
[   75.390227][ T7075] Allocated by task 6446:
[   75.392106][ T7075]  kasan_save_track+0x3e/0x80
[   75.394162][ T7075]  __kasan_slab_alloc+0x6c/0x80
[   75.396288][ T7075]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[   75.398637][ T7075]  xfrm_state_alloc+0x24/0x2f0
[   75.400736][ T7075]  __find_acq_core+0x8a7/0x1c00
[   75.402876][ T7075]  xfrm_find_acq+0x78/0xa0
[   75.404801][ T7075]  xfrm_alloc_userspi+0x6b3/0xc90
[   75.407016][ T7075]  xfrm_user_rcv_msg+0x7a3/0xab0
[   75.409153][ T7075]  netlink_rcv_skb+0x208/0x470
[   75.410802][ T7075]  xfrm_netlink_rcv+0x79/0x90
[   75.412498][ T7075]  netlink_unicast+0x82f/0x9e0
[   75.414537][ T7075]  netlink_sendmsg+0x805/0xb30
[   75.416638][ T7075]  __sock_sendmsg+0x21c/0x270
[   75.418703][ T7075]  ____sys_sendmsg+0x505/0x830
[   75.420781][ T7075]  ___sys_sendmsg+0x21f/0x2a0
[   75.422854][ T7075]  __x64_sys_sendmsg+0x19b/0x260
[   75.425001][ T7075]  do_syscall_64+0xfa/0x3b0
[   75.426975][ T7075]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   75.429470][ T7075] 
[   75.430523][ T7075] Freed by task 24:
[   75.432209][ T7075]  kasan_save_track+0x3e/0x80
[   75.434102][ T7075]  kasan_save_free_info+0x46/0x50
[   75.436133][ T7075]  __kasan_slab_free+0x5b/0x80
[   75.438034][ T7075]  kmem_cache_free+0x18f/0x400
[   75.439968][ T7075]  xfrm_state_gc_task+0x52d/0x6b0
[   75.441975][ T7075]  process_scheduled_works+0xae1/0x17b0
[   75.444199][ T7075]  worker_thread+0x8a0/0xda0
[   75.446005][ T7075]  kthread+0x711/0x8a0
[   75.447626][ T7075]  ret_from_fork+0x439/0x7d0
[   75.449432][ T7075]  ret_from_fork_asm+0x1a/0x30
[   75.451358][ T7075] 
[   75.452285][ T7075] The buggy address belongs to the object at ffff888107f26d00
[   75.452285][ T7075]  which belongs to the cache xfrm_state of size 928
[   75.457538][ T7075] The buggy address is located 40 bytes inside of
[   75.457538][ T7075]  freed 928-byte region [ffff888107f26d00, ffff888107f270a0)
[   75.462796][ T7075] 
[   75.463729][ T7075] The buggy address belongs to the physical page:
[   75.466231][ T7075] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888107f25f80 pfn:0x107f24
[   75.469997][ T7075] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   75.473274][ T7075] anon flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   75.476418][ T7075] page_type: f5(slab)
[   75.478016][ T7075] raw: 057ff00000000040 ffff8881053f38c0 0000000000000000 0000000000000001
[   75.481385][ T7075] raw: ffff888107f25f80 00000000000e000b 00000000f5000000 0000000000000000
[   75.484669][ T7075] head: 057ff00000000040 ffff8881053f38c0 0000000000000000 0000000000000001
[   75.488030][ T7075] head: ffff888107f25f80 00000000000e000b 00000000f5000000 0000000000000000
[   75.491360][ T7075] head: 057ff00000000002 ffffea00041fc901 00000000ffffffff 00000000ffffffff
[   75.494747][ T7075] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   75.498048][ T7075] page dumped because: kasan: bad access detected
[   75.500543][ T7075] page_owner tracks the page as allocated
[   75.502746][ T7075] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6233, tgid 6228 (syz.2.104), ts 62766441286, free_ts 57215940146
[   75.509937][ T7075]  post_alloc_hook+0x240/0x2a0
[   75.511861][ T7075]  get_page_from_freelist+0x21e4/0x22c0
[   75.513741][ T7075]  __alloc_frozen_pages_noprof+0x181/0x370
[   75.516020][ T7075]  alloc_pages_mpol+0x232/0x4a0
[   75.517908][ T7075]  allocate_slab+0x8a/0x370
[   75.519704][ T7075]  ___slab_alloc+0xbeb/0x1420
[   75.521550][ T7075]  kmem_cache_alloc_noprof+0x283/0x3c0
[   75.523727][ T7075]  xfrm_state_alloc+0x24/0x2f0
[   75.525639][ T7075]  xfrm_state_find+0x37d4/0x5400
[   75.527620][ T7075]  xfrm_resolve_and_create_bundle+0x768/0x2f80
[   75.530094][ T7075]  xfrm_lookup_with_ifid+0x2a7/0x1a70
[   75.532236][ T7075]  xfrm_lookup_route+0x3c/0x1c0
[   75.534175][ T7075]  udp_sendmsg+0x142e/0x2170
[   75.535971][ T7075]  __sock_sendmsg+0x19c/0x270
[   75.537787][ T7075]  ____sys_sendmsg+0x52d/0x830
[   75.539669][ T7075]  ___sys_sendmsg+0x21f/0x2a0
[   75.541555][ T7075] page last free pid 5846 tgid 5846 stack trace:
[   75.544054][ T7075]  __free_frozen_pages+0xbc4/0xd30
[   75.546157][ T7075]  __slab_free+0x303/0x3c0
[   75.547927][ T7075]  qlist_free_all+0x97/0x140
[   75.549766][ T7075]  kasan_quarantine_reduce+0x148/0x160
[   75.551918][ T7075]  __kasan_slab_alloc+0x22/0x80
[   75.553860][ T7075]  kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[   75.556199][ T7075]  __alloc_skb+0x112/0x2d0
[   75.557925][ T7075]  rtmsg_ifa+0xf8/0x1f0
[   75.559589][ T7075]  __inet_insert_ifa+0x9ff/0xbf0
[   75.561543][ T7075]  inet_rtm_newaddr+0xf3a/0x18b0
[   75.563530][ T7075]  rtnetlink_rcv_msg+0x7cf/0xb70
[   75.565494][ T7075]  netlink_rcv_skb+0x208/0x470
[   75.567392][ T7075]  netlink_unicast+0x82f/0x9e0
[   75.569273][ T7075]  netlink_sendmsg+0x805/0xb30
[   75.571174][ T7075]  __sock_sendmsg+0x21c/0x270
[   75.573026][ T7075]  __sys_sendto+0x3bd/0x520
[   75.574807][ T7075] 
[   75.575748][ T7075] Memory state around the buggy address:
[   75.577943][ T7075]  ffff888107f26c00: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
[   75.581109][ T7075]  ffff888107f26c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   75.584299][ T7075] >ffff888107f26d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   75.587429][ T7075]                                   ^
[   75.589510][ T7075]  ffff888107f26d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   75.592679][ T7075]  ffff888107f26e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   75.595770][ T7075] ==================================================================
[   75.599253][ T7075] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   75.602072][ T7075] CPU: 1 UID: 0 PID: 7075 Comm: syz.2.340 Not tainted syzkaller #0 PREEMPT(full) 
[   75.605617][ T7075] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   75.609474][ T7075] Call Trace:
[   75.610843][ T7075]  <TASK>
[   75.612036][ T7075]  dump_stack_lvl+0x99/0x250
[   75.613884][ T7075]  ? __asan_memcpy+0x40/0x70
[   75.615733][ T7075]  ? __pfx_dump_stack_lvl+0x10/0x10
[   75.617758][ T7075]  ? __pfx__printk+0x10/0x10
[   75.619622][ T7075]  vpanic+0x281/0x750
[   75.621228][ T7075]  ? __pfx_vpanic+0x10/0x10
[   75.623018][ T7075]  ? irqentry_exit+0x74/0x90
[   75.624838][ T7075]  panic+0xb9/0xc0
[   75.626346][ T7075]  ? __pfx_panic+0x10/0x10
[   75.628130][ T7075]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[   75.630446][ T7075]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   75.632793][ T7075]  ? __xfrm_state_delete+0x666/0xca0
[   75.634888][ T7075]  check_panic_on_warn+0x89/0xb0
[   75.636895][ T7075]  ? __xfrm_state_delete+0x666/0xca0
[   75.638891][ T7075]  end_report+0x78/0x160
[   75.640330][ T7075]  kasan_report+0x129/0x150
[   75.641912][ T7075]  ? __xfrm_state_delete+0x666/0xca0
[   75.644042][ T7075]  __xfrm_state_delete+0x666/0xca0
[   75.646121][ T7075]  xfrm_state_flush+0x45f/0x770
[   75.648075][ T7075]  pfkey_flush+0x13f/0x340
[   75.649795][ T7075]  ? __pfx_pfkey_flush+0x10/0x10
[   75.651771][ T7075]  ? kmem_cache_free+0x18f/0x400
[   75.653758][ T7075]  pfkey_sendmsg+0xbfe/0x1090
[   75.655620][ T7075]  ? trace_sched_exit_tp+0x36/0x110
[   75.657707][ T7075]  ? __pfx_pfkey_sendmsg+0x10/0x10
[   75.659779][ T7075]  ? aa_sock_msg_perm+0xf1/0x1d0
[   75.661705][ T7075]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   75.663746][ T7075]  ? __pfx_pfkey_sendmsg+0x10/0x10
[   75.665802][ T7075]  __sock_sendmsg+0x21c/0x270
[   75.667708][ T7075]  ____sys_sendmsg+0x505/0x830
[   75.669618][ T7075]  ? __pfx_____sys_sendmsg+0x10/0x10
[   75.671589][ T7075]  ? import_iovec+0x74/0xa0
[   75.673080][ T7075]  ___sys_sendmsg+0x21f/0x2a0
[   75.674915][ T7075]  ? __pfx____sys_sendmsg+0x10/0x10
[   75.676979][ T7075]  ? __fget_files+0x2a/0x420
[   75.678836][ T7075]  ? __fget_files+0x3a0/0x420
[   75.680710][ T7075]  __x64_sys_sendmsg+0x19b/0x260
[   75.682610][ T7075]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   75.684718][ T7075]  ? rcu_is_watching+0x15/0xb0
[   75.686619][ T7075]  ? do_syscall_64+0xbe/0x3b0
[   75.688497][ T7075]  do_syscall_64+0xfa/0x3b0
[   75.690261][ T7075]  ? lockdep_hardirqs_on+0x9c/0x150
[   75.692294][ T7075]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   75.694616][ T7075]  ? exc_page_fault+0x9f/0xf0
[   75.696438][ T7075]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   75.698667][ T7075] RIP: 0033:0x7f367ff8ec29
[   75.700415][ T7075] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   75.707687][ T7075] RSP: 002b:00007f3680df7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   75.710872][ T7075] RAX: ffffffffffffffda RBX: 00007f36801d5fa0 RCX: 00007f367ff8ec29
[   75.713842][ T7075] RDX: 0000000020000c04 RSI: 00002000000000c0 RDI: 0000000000000004
[   75.716822][ T7075] RBP: 00007f3680011e41 R08: 0000000000000000 R09: 0000000000000000
[   75.719814][ T7075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   75.722767][ T7075] R13: 00007f36801d6038 R14: 00007f36801d5fa0 R15: 00007ffdbd1ccf98
[   75.725797][ T7075]  </TASK>
[   75.727735][ T7075] Kernel Offset: disabled
[   75.729451][ T7075] Rebooting in 86400 seconds..

VM DIAGNOSIS:
06:38:40  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000000 RBX=0000000000000202 RCX=14da04a3d08c5600 RDX=0000000000000000
RSI=ffffffff8be33ee0 RDI=ffffffff8be33ea0 RBP=0000000000000001 RSP=ffffc9000442f4f0
R8 =0000000000000000 R9 =ffffffff825d5b4c R10=dffffc0000000000 R11=ffffed1022daca5b
R12=dffffc0000000000 R13=ffffffff825d5b4c R14=ffffffff8e13a0e0 R15=ffff888107365640
RIP=ffffffff819d6f0f RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b863d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fdb4e5056c0 CR3=00000000255ce000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00ff000000000000 ff00000000000000 XMM05=0000000000000039 0000000000003230
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffffff0000 XMM09=6c6c696b66722f39 7968702f31313230
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=000000000000000a RBX=000000000000000a RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000002556 RDI=0000000000002557 RBP=00000000000003f8 RSP=ffffc90007a26eb0
R8 =ffff888021848237 R9 =1ffff11004309046 R10=dffffc0000000000 R11=ffffffff854fac30
R12=dffffc0000000000 R13=ffffffff99ad7917 R14=ffffffff99dcc480 R15=0000000000000000
RIP=ffffffff854facac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f3680df76c0 ffffffff 00c00000
GS =0000 ffff8881a3c3d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c29e426 CR3=0000000027692000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f36801a7498 00007f36801a7470 XMM03=00007f36801a74a8 00007f36801a74a0
XMM04=00007f3680d0d100 00007f36801a7460 XMM05=00007f36801a7478 00007f36801a74c0
XMM06=00007f36801a74b8 00007f36801a74b0 XMM07=00007f36801a74a8 00007f36801a74a0
XMM08=0000000000000000 00007f3680012f0f XMM09=0000000000000000 00007f3680012fed
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
