last executing test programs:

871.568235ms ago: executing program 2 (id=1843):
unshare(0x26020480)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10)
r3 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @default}, [@netrom, @rose, @null, @netrom, @bcast, @default, @rose, @netrom]}, &(0x7f0000000100)=0x48, 0x80800)
getsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000140), 0x10)
setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1}, {0x7}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8)
sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x12}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x3, 0xa, 0x0, 0x0, 0x2f}, {0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x6}, {0x0, 0x400000000}, 0x203, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@local, 0x1, 0x33}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0xb7, 0x0, 0x0, 0x1}}, 0xe4)

793.146328ms ago: executing program 0 (id=1844):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="2c002a79394364d2a2ac0000fbdbdf250a8093e3c805a1fd12654000"], 0x2c}}, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000180)="597ee91b26b2d3946b63a4ba2acd28067193ac6afbbb", &(0x7f00000001c0)=@tcp, 0x1}, 0x20)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{}, &(0x7f00000003c0), &(0x7f0000000580)}, 0x20)
socket$packet(0x11, 0x4, 0x300)
syz_emit_ethernet(0x69, &(0x7f0000005a40)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa0086dd6075e70000333a00fe80000000000000000000000000f700ff020000000000000000000000000001040090780000000060a3579e00002c00fe880000000000000000000000000001fe8000000000000000000000000000bb6be2c6"], 0x0)
r3 = socket(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78)
r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140040001000010000000000000000000000000a20000000000a05001d0000000092a000050000000900010073797a36000000002c000000030a0101000000000037a40900010073797a30000800000900030073797a300000000058000000060a0104000000000a0000000500000008000b4000002640e108549072746f95a80000300004802c0001800b07010074756e6e656c00001c0002800800014000000001080003400000000208000240000000090900010073797a3000000000140000001100010000000000000000000000000ab36ac9069e10fe552dbc0efa2ded485f637228190220569b01fcdf6eb6a5d95672e7e5af7a5f8f"], 0xcc}}, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, 0x0)
r7 = socket(0x400000000010, 0x3, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0)
r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f00000022c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000030000006a0af2fe000000008500000009000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989425f5d0b79f6584d0416d7c4bb9f547b328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f01000000010000006e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b98d2de10c21d3ea02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d000000200008000000000000001abc11c800000000000000000000000928ee53595a779d243a48cea769470424d20a04c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005472b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92fe8bad99ca332af00f191b66b6a6f732a91f0e2e9190e4b448da7de018c58e950767f9b320be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c52573d9308a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e495f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e4a48dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f00000021f8547d393dabe616fbbde21c90be00b5a22671395c7a69c6dd4d022ffc97ddb6aa025131652d409da1d8cfc3d219d4b1c1b7b8170d7c33d91db2b73f7ae02485a209a2474b5d0790d05c01bec623056e4d3f4d3149373a28b26a15a1fcce73d57e6eaf7e6f315fe275ebc9ef7aeca277dde01dde724f419803a2172a7833ceab38d21ca4f1dea5e1f4d8824167b21dd289dd4e6ecfba9e163bdbc48e1e758ecde05c10809c9edfa6d77c652fd742e6dad13d2a397bebe3ea8bc087d3720e2202f36c7719ae34f042e19dc08a3323a3d94098a7ec171469352bab1662c3e4d4803c565cfcce32dad628fade43a4844abb230ce608726fd87e93c405a96cf638c41510f26e9da5f316"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48)
socket$packet(0x11, 0x2, 0x300)
unshare(0x60600)
r9 = socket(0x400000000010, 0x3, 0x0)
r10 = socket$unix(0x1, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r11=>0x0})
sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_bpf={{0x8}, {0x14, 0x2, [@TCA_BPF_FD={0x8, 0x6, r8}, @TCA_BPF_CLASSID={0x8, 0x3, {0xffe0, 0xa}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0)
write$cgroup_subtree(r5, &(0x7f00000003c0)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x1000)
write$tcp_mem(r4, &(0x7f00000003c0)={0x2, 0x20, 0xfffffffffffffffe, 0x20, 0x8}, 0x48)
sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=@newqdisc={0x154, 0x24, 0x3fe3aa0262d8c783, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x124, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x10, 0x0, 0x0, 0x1c, 0x0, 0x3}}, @TCA_CHOKE_STAB={0x104, 0x2, "1c1f15f3c5e23d27d29a00dd397b5c11d4cf201c1a0619fc314514ab71788e4079fdbe4f2a0d60b83a7d04c1d709981110401e5e10685abbad9b6f18e303e902c77244658a099a36fa486760c4941ea7df64250af29a4935de5d244f0549d93679b3d4fb358c2076bc6b1c9735ff8243f088e67455ba14975d12e5903ceeb7a23d62ecb5253ad444ef726b58a00f13f22ccc84cc06c9912b621c3ddc5f3229dc84c0880b5c6faefe33413b34a146e592fc15ae234dac030f05bb99eab08dfd2cb5659c6fc21fb7da6c380165ddde4659e75538dc864a53f691e1d785d6e6f73a03abf2120bce67e2d50075fd811b3e03a1cc2d66335bdee19738a0c1fb79b77d"}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x8}]}}]}, 0x154}}, 0x0)

602.238653ms ago: executing program 0 (id=1846):
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket(0x10, 0x3, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000540)={r0, 0x0, 0x0, 0x4}, 0x20)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x5, 0x6, 0xfff, 0x0, r0, 0xfffffffd, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x0, 0xd}, 0xffffffffffffffd7)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x6e20, @broadcast}, 0x10)
syz_emit_ethernet(0x32, &(0x7f0000000300)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty=0xe0000001}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x1, 0x5d, 0x100}}}}}}}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="0c002000040000000400000009000000e4000000", @ANYRES32=r1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
r4 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4)
sendmsg$nl_route(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', @ANYRES32=r4], 0x28}}, 0x802)

523.016681ms ago: executing program 0 (id=1849):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="48010000100013070000000000000000fe880000000000000000000000000001ac1e000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac14142800000000000000000000000000000000330000002001000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000023500000200000000000000000000000c001c00", @ANYRES32=0x0, @ANYBLOB="060000004c00144073686131000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000048ddc7031cfe5b59d4a85900000000000000000000ca68a450b1443e4bcd45e3b82285c385a5ee39d511f3b456f15f"], 0x148}}, 0x0)

521.521806ms ago: executing program 0 (id=1850):
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket(0x10, 0x3, 0x0)
socket(0x10, 0x3, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4)
sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000040800", @ANYRES32=r0], 0x28}}, 0x802)

451.188739ms ago: executing program 0 (id=1851):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
socket(0x8000000010, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.sectors\x00', 0x26e1, 0x0)
close(r1)
ioctl$SIOCSIFHWADDR(r1, 0x8b26, &(0x7f0000000200)={'wlan1\x00', @random="ffffff8dffff"})
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={<r2=>0x0, 0x40, 0x10, 0x6}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000180)={r2, 0xc, 0x10, 0x4, 0x6}, &(0x7f00000001c0)=0x18)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendto$inet6(r3, &(0x7f0000000000)="c5", 0x1, 0x50, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @local, 0x13}, 0x1c)
setsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000180)={0x0, 0x9}, 0x8)
r4 = socket$inet6(0xa, 0x3, 0x2f)
setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@loopback, 0x0, 0x0, 0xffff, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x6c}, 0x0, @in6=@empty, 0x0, 0x0, 0x0, 0x3}}, 0xe8)
connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c)

448.631232ms ago: executing program 1 (id=1852):
socketpair(0x15, 0x800, 0x6, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$FS_IOC_GETFSSYSFSPATH(r0, 0x80811501, &(0x7f00000000c0)={0x80})
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket(0x10, 0x3, 0x0)
socket(0xa, 0x7, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4)
sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', @ANYRES32=r1], 0x28}}, 0x802)

448.031771ms ago: executing program 0 (id=1853):
socket(0x15, 0x5, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'macvlan1\x00'})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000001000000000000000009500000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000001000000000000000009500000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94)
r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES8=r0, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB], 0x48) (async)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES8=r0, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB], 0x48)
bpf$PROG_BIND_MAP(0x23, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x48}}, 0x48000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xe, &(0x7f0000000100)=ANY=[], &(0x7f0000000340)='syzkaller\x00'}, 0x94)
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[], 0x50)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
bind$bt_l2cap(r1, &(0x7f0000000000), 0xe)
listen(r1, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x2, @any, 0x0, 0x2}, 0xe) (async)
connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x2, @any, 0x0, 0x2}, 0xe)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="180500000000c800000000004b64ffec850000007d000000850000002a00000095"], &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='sched_switch\x00', r2}, 0x18)
socket$key(0xf, 0x3, 0x2)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x40)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0) (async)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
socket$kcm(0x11, 0x3, 0x300) (async)
r3 = socket$kcm(0x11, 0x3, 0x300)
setsockopt$sock_attach_bpf(r3, 0x1, 0x28, &(0x7f0000000040), 0x4)
recvmsg(r3, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x2)
bpf$PROG_LOAD(0x5, 0x0, 0x0) (async)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r4, &(0x7f0000000140)=[{&(0x7f0000000440)="5800000014001d2340834b80040d8d560a067ee500ff000000000000000058000b4824ca945f64009400140425010ebc000000000000008000f0fffeffe809005300fff5dd80000010000100080c10000000000000000100", 0x58}], 0x1)
syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async)
r5 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
bind$802154_raw(r5, &(0x7f0000000640)={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0002}}}, 0x14)
socket$kcm(0x10, 0x2, 0x0) (async)
socket$kcm(0x10, 0x2, 0x0)
syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)

313.259034ms ago: executing program 2 (id=1854):
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket(0x10, 0x3, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r0}, 0x50)
r1 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4)
sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', @ANYRES32=r1], 0x28}}, 0x802)

312.816883ms ago: executing program 1 (id=1855):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2)
syz_emit_ethernet(0x56, &(0x7f0000000000)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x20, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @private0, [{}, {}, {0xe, 0x1, "24fcaa8fc05a"}]}}}}}}, 0x0)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYRES16=r3, @ANYBLOB], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x812, r4, 0xffffd000)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@ptr={0xd, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x61, 0x2e]}}, &(0x7f0000000340)=""/118, 0x28, 0x76, 0x0, 0x0, 0x10000, @value=r4}, 0x28)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xc4, 0x19, 0xfd3649826d894c67, 0x70bd2c, 0x0, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffffffffffc}, {0x0, 0xacb0}, 0x400, 0x0, 0x0, 0x0, 0x0, 0x2}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x4c050)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd29, 0x0, {{@in6=@rand_addr=' \x01\x00', @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x1000, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x40000000000000}, 0x2, 0x0, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@empty, 0x0, 0x33}, 0x0, @in=@broadcast, 0xfffffffe, 0x2, 0x3}]}]}, 0xfc}}, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r8 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef)
r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x100, 0x0)
close(r9)
r10 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0xff, 0x7, 0x6361, 0x5, 0xfffffffd, 0x40000005}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x6fd5, 0x1a05db2f, 0x1, 0x8, 0x1, 0x1}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2000c040}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56f41, 0x1070b923, 0x80000, {0x0, 0x0, 0x0, 0x0, {0x0, 0xe}, {0x8, 0xb}, {0xf, 0xd}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x4008000)
ioctl$SIOCSIFHWADDR(r9, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})

312.421088ms ago: executing program 2 (id=1856):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d100d6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe00000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b35a20af1752f3f2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e170000000000000e83e1300000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450fc21d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e80339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd52364600000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f7b5bf21ecd12357309e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a4de84ff1907140070000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba9b49254d8192124c20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f3390343c12aa51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35e9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff17320adda5867947257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a927de6f4c09f4b742e037381c85d2ec7bb2a8152f0d6a99a0370e0cbd65744eb2efd7b65f04aa7e72588757b9612bb4253a63bb303c0c68a07f115d104f2007237a4f771416741bfd63fdfe3ae6f8bea755d8b7202c2bbae137dc1c3cf40db74a4c1c219d8ddec8f91dae2cdea1353fe062830fa1d233296ec9d8317872257e154665485e7f31cdbfbf435517faf93015b57417d84b8bc8662e097d5ba55d02d48e150695ffae3a676555b10da11751865126d19336116a1e58ab727dda6b343cc97f94791369df1cffe6740f90735f66ca54fd87800b4bda4db5e68aaccf44d24e09f8a769e3ae7bf246673f15e3d1adae4384bdb7cd30a33e30466b421feb96006c810fd3830a1c75af2580727ffc604d2b04f476acc21419fad9b1baec88974da2db29b80859bde08b85c8086e4b7f1fd568042ad5396d3179c717ed53db529a811662841b1dc43291e450ce9b8d7d80fcb44966d7ad4691a3787000000000000000000000000000000000000000000001cadd5e4558166315878c65b6b9f21"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x18)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0x60000000, &(0x7f0000000100)="b9ff03316844268cb89e14f0080065e0ffff00123c00630277fbac141416e000030a44079f03b180006000000003845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0x6f, 0x60000000, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0, 0x1}, 0x2c)

262.989478ms ago: executing program 2 (id=1857):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c)
listen(r0, 0x0)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x5a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r2 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0)
write$cgroup_pid(r2, &(0x7f00000000c0), 0x12)
pread64(r2, &(0x7f0000001840)=""/4096, 0x1000, 0x1)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0)
r4 = socket(0x10, 0x803, 0x2)
syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(r4, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="200029bd7000ffdbdf251000000008003a0001800000050035003d0000000a000900aaaaaaaaaaaa000008003c0075000000050030000100000008003400010400000500330002000000"], 0x50}, 0x1, 0x0, 0x0, 0x400c0}, 0x4000000)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfe, {{@in6=@private0={0xfc, 0x0, '\x00', 0x40}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x400, 0x0, 0x0, 0xa, 0x60, 0x0, 0x0, 0x0, 0xee01}, {}, {}, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
sendmsg(r0, &(0x7f00000004c0)={&(0x7f0000000340)=@isdn={0x22, 0x3, 0xa, 0x10, 0xaa}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000400)="37308f46a2e17f1e54f0f4a01534ad330384dc88bdb74a44e86baa1cd4bb82922e14ae20069462edccca70e12c11ba42612e1deae98345ef7d4e779a1cbb21b67fed8c9bd44d6728c64c1169a573ef882b542ecbb41d5af5efc539c613154958d799", 0x62}], 0x1, &(0x7f0000000680)=[{0xc8, 0x118, 0x1, "6acadb28a347f3013454dd274e396a5ff337f9c73a88a9d12ff8f9c1b6f2d2d5017b8b104556ff13fe2e95618ec9882fb06edaaed34c9dcb9fb68f302f89b9cd9377098ae2a70eff7dd444fbde44ea5084321f49fd76e0d0d834ff4869aab86f5d2726e0840ad2cef2201b4865684fea266c87529388170c6ef3bfebac1debd3e59f4107acdfa8607ebc264bf2f35a598540f571b6898a96cfbc644e7ab7c39189b6294405ea690721d8a0a41c179e74dd8a653c46a16a"}], 0xc8}, 0x1)
r8 = socket(0x11, 0x80a, 0x0)
bind$inet6(r8, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, &(0x7f00000000c0)={0x2, [0x0, 0x0]}, &(0x7f0000000100)=0xc)
sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002445df00000000050000000000000000000000000000000700"/112], 0xb8}}, 0x4000)

192.903252ms ago: executing program 1 (id=1858):
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000001800090400000001fedbdf250a000000000000000000008008001e0001000000080008"], 0x2c}}, 0x0)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)={0xc8, r2, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_REG_RULES={0xa0, 0x22, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x2}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x1}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x100}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xa7}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x9}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x81}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x3}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xffffffff}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xfffffffe}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x8c8}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x3}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xe}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xe}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xe}]}]}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'aa\x00'}]}, 0xc8}, 0x1, 0x0, 0x0, 0x20000054}, 0x0)
sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100010}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xcc, r2, 0x100, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff7, 0x1b}}}}, [@NL80211_ATTR_TID_CONFIG={0xac, 0x11d, 0x0, 0x1, [{0xa8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x200}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xf8}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x80, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x4c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0xfca1}, @NL80211_TXRATE_HT={0x20, 0x2, [{0x6, 0x5}, {0x7, 0x1}, {0x4, 0x6}, {0x1, 0x9}, {0x0, 0x8}, {0x7, 0x9}, {0x4, 0x1}, {0x4, 0x4}, {0x4, 0x9}, {0x7, 0x1}, {0x3, 0x7}, {0x0, 0x6}, {0x1, 0x1}, {0x3, 0x6}, {0x5, 0x9}, {0x1, 0x2}, {0x0, 0x2}, {0x3, 0x9}, {0x1, 0xa}, {0x7, 0x3}, {0x4, 0x8}, {0x5, 0x4}, {0x7, 0x8}, {0x5, 0xa}, {0x1}, {0x5}, {0x7, 0x5}, {0x5, 0x7}]}, @NL80211_TXRATE_LEGACY={0xc, 0x1, [0x33, 0x9, 0x16, 0x30, 0x0, 0x36, 0x6c, 0x1]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x1c, 0x10d2, 0x9, 0xf6, 0x1000, 0x8, 0x9cfe]}}]}, @NL80211_BAND_2GHZ={0x30, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x1b, 0x2, [{0x0, 0x6}, {0x5, 0x6}, {0x7, 0x6}, {0x7, 0x3}, {0x1, 0x3}, {0x1, 0x4}, {0x6, 0x8}, {0x1, 0x8}, {0x1, 0x3}, {0x3, 0x2}, {0x2, 0x4}, {0x0, 0x8}, {0x4, 0x6}, {0x3, 0x1}, {0x7, 0x9}, {0x3, 0x8}, {0x2, 0x9}, {0x7, 0x1}, {0x2, 0x5}, {0x4, 0x1}, {0x7, 0x8}, {0x1, 0xa}, {0x0, 0x4}]}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x0]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}]}]}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4000000}, 0x40)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x90, 0x2c, 0xd27, 0x70bd28, 0x6000000, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x5c, 0x2, [@TCA_FW_ACT={0x58, 0x4, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xfffffc00, 0x8, 0x10000000, 0x200000b, 0xff}, @broadcast, @local, 0xff, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x7ffffffe}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xff, 0x4}}]}, 0x90}, 0x1, 0x0, 0x0, 0x4}, 0x4000800)
syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', 0x0, 0x0, 0x2)

111.436658ms ago: executing program 1 (id=1859):
r0 = socket$kcm(0x10, 0x5, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r3 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10)
sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0)
write$tun(r2, &(0x7f0000000ac0)=ANY=[@ANYBLOB="00000000bbbbbbbbbbbbaaaaaaaaaa3088a84d008100660086dd6eb3d5f001952fff"], 0x1d7)
sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c0300001a"], 0x34c}}, 0x0)

3.338532ms ago: executing program 1 (id=1860):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@bridge_delneigh={0x28, 0x1c, 0x1, 0x0, 0x0, {0x7, 0x0, 0xffff, r1, 0x80, 0xb2}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x40800)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=@newlink={0x50, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc, 0x1e, 0x5}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6}]}}}, @IFLA_CARRIER_CHANGES={0x8, 0x23, 0x2}]}, 0x50}}, 0x0)

2.095891ms ago: executing program 2 (id=1861):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newtaction={0x48, 0x30, 0x2, 0x70bd25, 0x0, {}, [{0x34, 0x1, [@m_vlan={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) (async)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) (async)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0)
r1 = socket$inet6(0xa, 0x1, 0x0)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000b95000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000040)=0x40) (async)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000b95000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000040)=0x40)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@newsa={0x104, 0x10, 0x281, 0x0, 0x0, {{@in=@remote, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}, {@in=@private, 0x4d2, 0x3c}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in=@multicast1}]}, 0x104}}, 0x0)
ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f00000000c0)={'\x00', 0x0, 0x3, 0x1})

400.622µs ago: executing program 1 (id=1862):
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={0x1, 0x58, &(0x7f0000000340)}, 0x10)
bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57)
sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[], 0x30}}, 0x40)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0xc6, 0xffffffffffffff7e, &(0x7f0000001100)="0cffffdf71c8afefeba000de036040220f2842c80c281835c8f284ff389638d59060532ffbf290caef997337765892b82639ffe5b6cf59cddacb37cee1ff708dc6b53ff38e47dd175e95d6680b1126339d53b69f3d85d1a41c19d9b34ad4ff2c1d62953a27678eb65c384497a2bdf179bef466f7cc6a5020d0f1678cc9e34507bde5379bcc0e2af81aa87e0b1b6388590e5f6746455b420b11424ed06aa8ceb6fb42f447ee780ed08ab2d8d68018576a1a601c1997ec43899750ed6a30da7328ee4a0f000000", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x50)
r1 = socket$kcm(0x29, 0x6, 0x0)
sendmsg$kcm(r1, &(0x7f0000000580)={&(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x3, 0x1, 0x3}}, 0x80, &(0x7f0000000240)}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
sendfile(r2, r4, &(0x7f00000000c0)=0x1eba, 0x9)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000180)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010027bd7000fcdbdf254400000008000300", @ANYRES32=r6, @ANYBLOB="0a001800030303030303000004005a8020005a8018000080140005"], 0x4c}, 0x1, 0x0, 0x0, 0xc891}, 0x4040810)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000140)=0x3, 0x4)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan0\x00', <r7=>0x0})
sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88000000", @ANYRES16=r3, @ANYBLOB="01002abd7000fedbdf253b00000008000300", @ANYRES32=r7, @ANYBLOB="6a0033008000e1000802110000000802110000005050505050500000030000000000000064000140010003010e0406f8970000020005030037022a01032d1a02000c0200000000000000300001000f0000000700060000000472060303b9260303710701ff010002f6000000"], 0x88}, 0x1, 0x0, 0x0, 0x880}, 0x0)

0s ago: executing program 2 (id=1863):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000e00000000000000000000008500000050000000850000002a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000003f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x15)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="c80300001600010000000100fcffffff0a01010000000000000000000000000000000000000000000000ffff000000000000000000000000000080201d000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="ff0200000000000000000000000000010000000033000000ac1414450000000000000000000000000000000000000000010000000000000000000000000000000000000000000000fffffffffffffffff1ffffffffffffff03000000000000000000000000000000000000000000000000000000000000000200000000000000feffffffffffffff00000000000000009607000000000000043d000000000000ef0000000000000000000000060000002c00130020010000000000000000000000000002ac141430000000000000000000000000000000000a000000e40006007f000001000000000000000000000000ff0100000000000000000000000000014e2303ff4e24000e0200200088000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000001000004d332000000ff020000000000000000000000000001040000000000000001000000000000000800000000000000070000000000000002000000000000000100000000000000070000000000000035000000000000000100000000000000ffffffffffffff7f0100010000000000264a000000000000dd52000078070000bcbc00002abd7000063500000a0000ff61000000000000001f0102007863686163686131322d67656e657269630000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8060000de36d16a4d3d3133db0c2db4721a0b1bf4670216ed84807f707f71ce0286f3cbc3604abbaea1ec0fdb659c3e827a9de929a80b6fec8db684a855ea16fe88fcf3f18869e1da3ffe7cb218a17a640d4080a351551a8093c68b475b42e373c240f8165988c339587cc95b34cf32eacc2b008c96a4a85a1105f0e2ff97163bfaf69fe23e5632608f14a90b1d742c44d4014528a79cc7c983bcfe7c301daf6873d65ac80dcee02ec890005ca87ca7c725fa238e5ded18f34eb38bd6dc4e20fc4a571dd25bf1a16f3573cc1412e46263fe4ca927fed06cdc2659006f0008"], 0x3c8}}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000002000010300000000000000000200000000000000000000000800060000000200"], 0x24}}, 0x0)
socket$inet6(0x10, 0x800, 0x0)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10)
sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x60)
ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000080)={'veth1_to_bridge\x00', {0x2, 0x4e21, @local}})
setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x100000011, @multicast2, 0x0, 0x0, 'sh\x00', 0x37, 0x9d, 0x62}, 0x2c)
r5 = socket$inet6(0x10, 0x3, 0x0)
write(r5, &(0x7f0000000040)="2400000021002551241c0165ff00fc020200000000100f000ee1000c08000b0000000000", 0x24)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:49137' (ED25519) to the list of known hosts.
syzkaller login: [   49.156257][ T5771] cgroup: Unknown subsys name 'net'
[   49.241654][ T5771] cgroup: Unknown subsys name 'cpuset'
[   49.248636][ T5771] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.954297][ T5771] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   55.229602][ T5840] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   55.233199][ T5840] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   55.236386][ T5840] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   55.239224][ T5840] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   55.242303][ T5840] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   55.316450][   T54] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   55.319185][   T54] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   55.322420][   T54] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   55.325219][   T54] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   55.327811][   T54] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   55.382187][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   55.391448][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   55.394295][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   55.397539][   T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   55.400415][   T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   55.547786][ T5839] chnl_net:caif_netlink_parms(): no params data found
[   55.622182][ T5844] chnl_net:caif_netlink_parms(): no params data found
[   55.642097][ T5839] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.644540][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.646926][ T5839] bridge_slave_0: entered allmulticast mode
[   55.649650][ T5839] bridge_slave_0: entered promiscuous mode
[   55.658314][ T5839] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.660512][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.663169][ T5839] bridge_slave_1: entered allmulticast mode
[   55.665793][ T5839] bridge_slave_1: entered promiscuous mode
[   55.736770][ T5839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.765180][ T5839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.812610][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.815552][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.818655][ T5844] bridge_slave_0: entered allmulticast mode
[   55.822887][ T5844] bridge_slave_0: entered promiscuous mode
[   55.828700][ T5839] team0: Port device team_slave_0 added
[   55.832705][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.835535][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.838366][ T5844] bridge_slave_1: entered allmulticast mode
[   55.842970][ T5844] bridge_slave_1: entered promiscuous mode
[   55.857892][ T5839] team0: Port device team_slave_1 added
[   55.892123][ T5846] chnl_net:caif_netlink_parms(): no params data found
[   55.900303][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.904677][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.907432][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   55.917305][ T5839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.923674][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.925892][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   55.934935][ T5839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.945637][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.015319][ T5844] team0: Port device team_slave_0 added
[   56.032157][ T5839] hsr_slave_0: entered promiscuous mode
[   56.035482][ T5839] hsr_slave_1: entered promiscuous mode
[   56.042533][ T5844] team0: Port device team_slave_1 added
[   56.134345][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.137128][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.147382][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.167879][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.170020][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.179854][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.184357][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.187288][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.190186][ T5846] bridge_slave_0: entered allmulticast mode
[   56.194963][ T5846] bridge_slave_0: entered promiscuous mode
[   56.210955][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.213726][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.216411][ T5846] bridge_slave_1: entered allmulticast mode
[   56.219111][ T5846] bridge_slave_1: entered promiscuous mode
[   56.287357][ T5844] hsr_slave_0: entered promiscuous mode
[   56.289894][ T5844] hsr_slave_1: entered promiscuous mode
[   56.293231][ T5844] debugfs: 'hsr0' already exists in 'hsr'
[   56.295062][ T5844] Cannot create hsr debugfs directory
[   56.298273][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.313373][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.370583][ T5846] team0: Port device team_slave_0 added
[   56.390431][ T5846] team0: Port device team_slave_1 added
[   56.414272][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.417024][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.427203][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.444273][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.446951][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   56.456801][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.536322][ T5839] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.557193][ T5839] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.567374][ T5846] hsr_slave_0: entered promiscuous mode
[   56.569955][ T5846] hsr_slave_1: entered promiscuous mode
[   56.573406][ T5846] debugfs: 'hsr0' already exists in 'hsr'
[   56.575482][ T5846] Cannot create hsr debugfs directory
[   56.583397][ T5839] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.595519][ T5839] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.702338][ T5844] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   56.723009][ T5844] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   56.735187][ T5844] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   56.746143][ T5844] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   56.834883][ T5846] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   56.840005][ T5846] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   56.845960][ T5846] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   56.855170][ T5846] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   56.884857][ T5839] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.905635][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.926288][ T5839] 8021q: adding VLAN 0 to HW filter on device team0
[   56.930220][ T5844] 8021q: adding VLAN 0 to HW filter on device team0
[   56.964673][   T64] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.967390][   T64] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.975491][   T64] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.977768][   T64] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.981965][   T64] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.984194][   T64] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.003430][   T64] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.006532][   T64] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.070579][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0
[   57.099997][ T5846] 8021q: adding VLAN 0 to HW filter on device team0
[   57.107250][ T1224] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.109661][ T1224] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.119574][ T1224] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.121919][ T1224] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.205403][ T5839] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.229130][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.258868][ T5839] veth0_vlan: entered promiscuous mode
[   57.273502][ T5839] veth1_vlan: entered promiscuous mode
[   57.282137][   T54] Bluetooth: hci0: command tx timeout
[   57.289504][ T5844] veth0_vlan: entered promiscuous mode
[   57.304722][ T5844] veth1_vlan: entered promiscuous mode
[   57.314024][ T5839] veth0_macvtap: entered promiscuous mode
[   57.326900][ T5839] veth1_macvtap: entered promiscuous mode
[   57.336820][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.349752][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.359044][ T5844] veth0_macvtap: entered promiscuous mode
[   57.361717][   T54] Bluetooth: hci1: command tx timeout
[   57.363816][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.380398][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.386309][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.389280][ T5844] veth1_macvtap: entered promiscuous mode
[   57.396611][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.408573][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.424196][ T5846] veth0_vlan: entered promiscuous mode
[   57.432307][   T54] Bluetooth: hci2: command tx timeout
[   57.445180][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.459329][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.476437][ T5846] veth1_vlan: entered promiscuous mode
[   57.490794][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.495419][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.499288][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.528476][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.546399][   T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.555149][   T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.574975][ T5846] veth0_macvtap: entered promiscuous mode
[   57.584911][ T5846] veth1_macvtap: entered promiscuous mode
[   57.600720][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.604744][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.623525][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.635599][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.658233][   T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.663054][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.666759][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.670810][   T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.678376][   T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.687228][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.693961][ T5839] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   57.748915][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.755277][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.777775][ T5905] netlink: 277 bytes leftover after parsing attributes in process `syz.0.1'.
[   57.790861][ T2269] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.797931][ T2269] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.824730][ T5907] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3'.
[   57.844395][ T2269] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.847776][ T2269] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.864422][ T5907] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3'.
[   57.921142][ T5911] batman_adv: batadv0: Adding interface: dummy0
[   57.925693][ T5911] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   57.934989][ T5911] batman_adv: batadv0: Interface activated: dummy0
[   57.952363][ T5911] batadv0: mtu less than device minimum
[   57.958198][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.962946][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.967534][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.972384][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.976674][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.980463][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.984589][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.989228][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   57.993889][ T5911] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[   58.198812][ T5935] Zero length message leads to an empty skb
[   58.266436][ T5941] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   58.269642][ T5941] IPv6: NLM_F_CREATE should be set when creating new route
[   58.359126][ T5952] batman_adv: batadv0: Adding interface: dummy0
[   58.361115][ T5952] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   58.369700][ T5952] batman_adv: batadv0: Interface activated: dummy0
[   58.470615][ T5957] ieee802154 phy0 wpan0: encryption failed: -22
[   58.528312][ T5966] netlink: 28 bytes leftover after parsing attributes in process `syz.2.20'.
[   58.533284][ T5966] netlink: 32 bytes leftover after parsing attributes in process `syz.2.20'.
[   58.536045][ T5966] netlink: 28 bytes leftover after parsing attributes in process `syz.2.20'.
[   58.826031][ T5994] netlink: 64 bytes leftover after parsing attributes in process `syz.2.28'.
[   58.845241][ T5994] (unnamed net_device) (uninitialized): (slave bond_slave_1): Device is not our slave
[   58.848258][ T5994] (unnamed net_device) (uninitialized): option active_slave: invalid value (bond_slave_1)
[   58.852595][ T5998] netlink: 188 bytes leftover after parsing attributes in process `syz.2.28'.
[   59.042615][ T6013] netlink: 15 bytes leftover after parsing attributes in process `syz.0.32'.
[   59.047931][ T6009] batman_adv: batadv0: Adding interface: dummy0
[   59.050328][ T6009] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   59.061460][ T6009] batman_adv: batadv0: Interface activated: dummy0
[   59.136314][ T6016] delete_channel: no stack
[   59.195696][ T6021] netlink: 128 bytes leftover after parsing attributes in process `syz.0.38'.
[   59.250280][ T6025] bridge0: port 3(netdevsim2) entered blocking state
[   59.258070][ T6025] bridge0: port 3(netdevsim2) entered disabled state
[   59.260288][ T6025] netdevsim netdevsim1 netdevsim2: entered allmulticast mode
[   59.264036][ T6025] netdevsim netdevsim1 netdevsim2: entered promiscuous mode
[   59.267235][ T6025] bridge0: port 3(netdevsim2) entered blocking state
[   59.269732][ T6025] bridge0: port 3(netdevsim2) entered forwarding state
[   59.361708][   T54] Bluetooth: hci0: command tx timeout
[   59.399070][ T6033] warning: `syz.2.41' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   59.441636][   T54] Bluetooth: hci1: command tx timeout
[   59.521606][   T54] Bluetooth: hci2: command tx timeout
[   60.026142][   T24] cfg80211: failed to load regulatory.db
[   60.298481][ T5312] IPVS: starting estimator thread 0...
[   60.334011][ T6051] syz.1.48 uses obsolete (PF_INET,SOCK_PACKET)
[   60.384945][ T6052] IPVS: using max 36 ests per chain, 86400 per kthread
[   60.524080][ T6067] netlink: 'syz.2.50': attribute type 32 has an invalid length.
[   60.900616][ T6089] syzkaller1: entered promiscuous mode
[   60.903941][ T6089] syzkaller1: entered allmulticast mode
[   61.269181][ T6106] geneve0: entered promiscuous mode
[   61.434397][ T6112] Bluetooth: MGMT ver 1.23
[   61.442427][   T54] Bluetooth: hci0: command tx timeout
[   61.477069][ T6114] tipc: Started in network mode
[   61.478846][ T6114] tipc: Node identity fe80000000000000000000000000001, cluster identity 4711
[   61.483800][ T6114] tipc: Enabled bearer <udp:syz0>, priority 10
[   61.511952][   T54] Bluetooth: hci1: command tx timeout
[   61.516688][ T6116] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   61.593500][   T54] Bluetooth: hci2: command tx timeout
[   62.106439][ T6135] block nbd0: not configured, cannot reconfigure
[   62.208874][ T6133] tipc: Started in network mode
[   62.210680][ T6133] tipc: Node identity eae4876374a6, cluster identity 4711
[   62.214530][ T6133] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   62.226753][ T6132] tipc: Disabling bearer <eth:syzkaller0>
[   62.491982][ T5903] tipc: Node number set to 4269801488
[   62.710347][ T6179] syzkaller1: tun_chr_ioctl cmd 2148553947
[   62.717401][ T6179] syzkaller1: tun_chr_ioctl cmd 21731
[   62.725488][ T6170] raw_sendmsg: syz.1.87 forgot to set AF_INET. Fix it!
[   62.829415][ T6187] __nla_validate_parse: 22 callbacks suppressed
[   62.829427][ T6187] netlink: 28 bytes leftover after parsing attributes in process `syz.2.95'.
[   62.840929][ T6187] netlink: 32 bytes leftover after parsing attributes in process `syz.2.95'.
[   62.843925][ T6187] netlink: 28 bytes leftover after parsing attributes in process `syz.2.95'.
[   62.986423][ T6200] netlink: 8 bytes leftover after parsing attributes in process `syz.0.99'.
[   62.993255][ T6200] netlink: 8 bytes leftover after parsing attributes in process `syz.0.99'.
[   63.026080][ T6204] netlink: 12 bytes leftover after parsing attributes in process `syz.2.101'.
[   63.030727][ T6206] netlink: 12 bytes leftover after parsing attributes in process `syz.2.101'.
[   63.056713][ T6204] 8021q: adding VLAN 0 to HW filter on device bond1
[   63.073364][ T6206] 8021q: adding VLAN 0 to HW filter on device bond2
[   63.075848][ T6204] netlink: 8 bytes leftover after parsing attributes in process `syz.2.101'.
[   63.180358][ T6217] netlink: 24 bytes leftover after parsing attributes in process `syz.0.103'.
[   63.511935][   T54] Bluetooth: hci0: command tx timeout
[   63.601595][   T54] Bluetooth: hci1: command tx timeout
[   63.675398][   T54] Bluetooth: hci2: command tx timeout
[   64.159298][ T6313] netlink: 48 bytes leftover after parsing attributes in process `syz.1.107'.
[   64.169288][ T6313] netlink: 'syz.1.107': attribute type 2 has an invalid length.
[   64.234876][ T6320] net_ratelimit: 51 callbacks suppressed
[   64.234897][ T6320] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   64.617556][ T6353] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   64.844989][ T5312] IPVS: starting estimator thread 0...
[   64.905440][ T6375] ieee802154 phy0 wpan0: encryption failed: -22
[   64.943023][ T6373] IPVS: using max 45 ests per chain, 108000 per kthread
[   64.972542][ T6382] netlink: 'syz.1.128': attribute type 32 has an invalid length.
[   65.515844][ T6400] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0)
[   65.520353][ T6400] dvmrp1: tun_chr_ioctl cmd 1074025677
[   65.523258][ T6400] dvmrp1: linktype set to 518
[   65.848748][ T6414] netlink: 'syz.1.142': attribute type 13 has an invalid length.
[   65.852079][ T6414] netlink: 'syz.1.142': attribute type 17 has an invalid length.
[   65.910186][ T6414] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   65.975881][ T6422] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[   66.015079][ T6424] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   66.081964][   T33] audit: type=1800 audit(1758868693.473:2): pid=6427 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.147" name="memory.events" dev="tmpfs" ino=214 res=0 errno=0
[   66.086886][ T6425] netlink: 'syz.0.144': attribute type 2 has an invalid length.
[   66.679240][ T6461] syzkaller1: entered promiscuous mode
[   66.681678][ T6461] syzkaller1: entered allmulticast mode
[   66.909135][ T6490] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   66.977033][ T6499] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   67.156598][ T6517] tipc: Enabled bearer <udp:syz0>, priority 10
[   67.200304][ T6520] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   67.687434][ T6540] syzkaller1: entered promiscuous mode
[   67.691502][ T6540] syzkaller1: entered allmulticast mode
[   67.854600][ T6554] __nla_validate_parse: 31 callbacks suppressed
[   67.854615][ T6554] netlink: 44 bytes leftover after parsing attributes in process `syz.1.193'.
[   68.151418][ T5873] tipc: Node number set to 2655160163
[   68.243451][ T6586] netlink: 20 bytes leftover after parsing attributes in process `syz.0.204'.
[   68.344083][ T6592] ipvlan2: entered promiscuous mode
[   68.444732][ T6599] netlink: 8 bytes leftover after parsing attributes in process `syz.2.209'.
[   68.823260][ T6633] netlink: 24 bytes leftover after parsing attributes in process `syz.0.217'.
[   68.832720][ T6629] ipvlan2: entered promiscuous mode
[   68.959697][ T6648] netlink: 596 bytes leftover after parsing attributes in process `syz.2.224'.
[   69.040130][ T6646] netlink: 104 bytes leftover after parsing attributes in process `syz.1.222'.
[   69.141595][ T6668] IPv6: addrconf: prefix option has invalid lifetime
[   69.162211][ T6668] netlink: 'syz.2.230': attribute type 29 has an invalid length.
[   69.170164][ T6668] netlink: 'syz.2.230': attribute type 29 has an invalid length.
[   69.176290][ T6672] netlink: 16 bytes leftover after parsing attributes in process `syz.0.231'.
[   69.176312][ T6668] netlink: 64 bytes leftover after parsing attributes in process `syz.2.230'.
[   69.302856][ T6687] netlink: 300 bytes leftover after parsing attributes in process `syz.2.238'.
[   69.481394][ T6702] openvswitch: netlink: Message has 8 unknown bytes.
[   70.295944][ T6725] netlink: 4 bytes leftover after parsing attributes in process `syz.0.251'.
[   70.432948][ T6736] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   70.476256][    C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
[   70.529124][ T6742] syz_tun: entered allmulticast mode
[   70.535232][ T6742] dvmrp8: entered allmulticast mode
[   70.539025][ T6742] syz_tun: left allmulticast mode
[   70.541928][ T6742] dvmrp8: left allmulticast mode
[   70.764815][ T6755] netlink: 'syz.0.264': attribute type 46 has an invalid length.
[   70.821850][ T6761] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   70.911857][ T6772] netlink: 'syz.1.271': attribute type 1 has an invalid length.
[   71.116732][    C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
[   71.118975][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[   71.396507][ T6787] dvmrp0: entered allmulticast mode
[   72.118398][ T6853] netlink: 'syz.0.295': attribute type 2 has an invalid length.
[   72.121934][ T6852] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[   72.155938][ T6855] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   72.158813][ T6855] syzkaller0: entered promiscuous mode
[   72.160874][ T6855] syzkaller0: entered allmulticast mode
[   72.224725][ T6855] tipc: Resetting bearer <eth:syzkaller0>
[   72.230911][ T6855] netlink: 'syz.1.300': attribute type 5 has an invalid length.
[   72.238329][ T6850] syzkaller1: entered promiscuous mode
[   72.240117][ T6850] syzkaller1: entered allmulticast mode
[   72.248010][ T6854] tipc: Resetting bearer <eth:syzkaller0>
[   72.264123][ T6854] tipc: Disabling bearer <eth:syzkaller0>
[   72.404553][ T6864] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   72.444994][ T6867] netlink: 'syz.2.304': attribute type 1 has an invalid length.
[   72.712825][ T5840] Bluetooth: hci2: command 0x0405 tx timeout
[   72.953645][ T6909] __nla_validate_parse: 15 callbacks suppressed
[   72.953656][ T6909] netlink: 8 bytes leftover after parsing attributes in process `syz.0.320'.
[   73.590455][ T6926] netlink: 4 bytes leftover after parsing attributes in process `syz.1.325'.
[   73.823905][ T6930] netlink: 8 bytes leftover after parsing attributes in process `syz.2.327'.
[   73.826875][ T6930] tipc: Enabling of bearer <eth:vlan0> rejected, failed to enable media
[   74.222052][ T6949] netlink: 'syz.2.331': attribute type 29 has an invalid length.
[   74.225282][ T6949] netlink: 'syz.2.331': attribute type 29 has an invalid length.
[   74.228371][ T6949] netlink: 348 bytes leftover after parsing attributes in process `syz.2.331'.
[   74.436790][ T6957] netlink: 316 bytes leftover after parsing attributes in process `syz.2.335'.
[   74.440539][ T6957] netlink: 8 bytes leftover after parsing attributes in process `syz.2.335'.
[   74.465092][ T6957] netlink: 16 bytes leftover after parsing attributes in process `syz.2.335'.
[   74.608329][ T6970] netlink: 12 bytes leftover after parsing attributes in process `syz.2.340'.
[   74.633574][ T6972] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   74.913241][ T6992] netlink: 16 bytes leftover after parsing attributes in process `syz.1.347'.
[   75.046008][ T7003] netlink: 8 bytes leftover after parsing attributes in process `syz.1.352'.
[   75.102669][ T6996] block nbd1: server does not support multiple connections per device.
[   75.109603][ T6996] block nbd1: shutting down sockets
[   76.210342][ T7068] netlink: 'syz.2.372': attribute type 11 has an invalid length.
[   77.146957][ T7130] openvswitch: netlink: IP tunnel dst address not specified
[   77.648182][ T7176] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   77.731021][ T7183] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   77.915618][ T7192] dvmrp8: entered allmulticast mode
[   78.084523][ T7206] __nla_validate_parse: 5 callbacks suppressed
[   78.084534][ T7206] netlink: 12 bytes leftover after parsing attributes in process `syz.2.416'.
[   78.251766][ T7217] openvswitch: netlink: EtherType 50a is less than min 600
[   78.381496][ T7192] dvmrp8: left allmulticast mode
[   78.435331][ T7228] netlink: 12 bytes leftover after parsing attributes in process `syz.2.425'.
[   78.466968][ T7230] tipc: Enabling of bearer <dp:s> rejected, media not registered
[   78.579255][ T7243] netlink: 8 bytes leftover after parsing attributes in process `syz.0.431'.
[   78.584630][ T7243] syzkaller1: entered promiscuous mode
[   78.586715][ T7243] syzkaller1: entered allmulticast mode
[   78.620347][ T7248] IPVS: wlc: SCTP 172.20.20.187:0 - no destination available
[   78.777569][ T7270] netlink: 4 bytes leftover after parsing attributes in process `syz.2.439'.
[   78.972347][ T7284] netlink: 'syz.0.444': attribute type 4 has an invalid length.
[   78.975234][ T7284] netlink: 'syz.0.444': attribute type 4 has an invalid length.
[   78.978151][ T7284] netlink: 'syz.0.444': attribute type 4 has an invalid length.
[   78.980792][ T7284] netlink: 'syz.0.444': attribute type 4 has an invalid length.
[   78.986224][ T7284] netlink: 'syz.0.444': attribute type 4 has an invalid length.
[   78.989427][ T7284] netlink: 'syz.0.444': attribute type 4 has an invalid length.
[   78.992710][ T7284] netlink: 'syz.0.444': attribute type 4 has an invalid length.
[   78.995953][ T7284] netlink: 'syz.0.444': attribute type 4 has an invalid length.
[   78.999116][ T7284] netlink: 'syz.0.444': attribute type 4 has an invalid length.
[   79.095986][ T7295] netlink: 16 bytes leftover after parsing attributes in process `syz.0.448'.
[   79.178066][ T7306] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   79.188858][ T7303] netlink: 148 bytes leftover after parsing attributes in process `syz.0.450'.
[   79.252790][ T7307] netlink: 8 bytes leftover after parsing attributes in process `syz.1.451'.
[   79.273975][ T7314] netlink: 28 bytes leftover after parsing attributes in process `syz.0.454'.
[   79.489366][ T7331] netlink: 28 bytes leftover after parsing attributes in process `syz.0.460'.
[   79.493427][ T7331] netlink: 32 bytes leftover after parsing attributes in process `syz.0.460'.
[   79.829501][ T7352] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[   79.856542][ T7354] Driver unsupported XDP return value 0 on prog  (id 94) dev N/A, expect packet loss!
[   80.050393][ T7373] team_slave_0: entered promiscuous mode
[   80.052770][ T7373] team_slave_1: entered promiscuous mode
[   80.056841][ T7373] 8021q: adding VLAN 0 to HW filter on device macvlan2
[   80.069203][ T7373] 8021q: adding VLAN 0 to HW filter on device macvlan3
[   80.504346][ T7398] delete_channel: no stack
[   81.428706][ T7452] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[   81.557091][ T7465] trusted_key: syz.1.513 sent an empty control message without MSG_MORE.
[   82.481129][ T7527] Bluetooth: MGMT ver 1.23
[   82.621496][ T7537] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   82.914399][ T7548] validate_nla: 1 callbacks suppressed
[   82.914428][ T7548] netlink: 'syz.2.538': attribute type 10 has an invalid length.
[   82.934574][ T7548] 8021q: adding VLAN 0 to HW filter on device team0
[   82.939545][ T7548] bond0: (slave team0): Enslaving as an active interface with an up link
[   83.124582][ T7563] netlink: 'syz.0.544': attribute type 1 has an invalid length.
[   83.127789][ T7563] netlink: 'syz.0.544': attribute type 1 has an invalid length.
[   83.230005][ T7573] netlink: 'syz.2.548': attribute type 29 has an invalid length.
[   83.235659][ T7573] netlink: 'syz.2.548': attribute type 29 has an invalid length.
[   83.279443][ T7576] __nla_validate_parse: 19 callbacks suppressed
[   83.279459][ T7576] netlink: 8 bytes leftover after parsing attributes in process `syz.0.549'.
[   83.299612][ T7578] netlink: 524 bytes leftover after parsing attributes in process `syz.2.548'.
[   83.300509][ T7576] netlink: 'syz.0.549': attribute type 4 has an invalid length.
[   83.414261][ T7587] netlink: 16 bytes leftover after parsing attributes in process `syz.2.552'.
[   83.453954][ T7591] netlink: 36 bytes leftover after parsing attributes in process `syz.1.555'.
[   83.593639][ T7605] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[   83.705471][ T7613] netlink: 8 bytes leftover after parsing attributes in process `syz.2.564'.
[   83.709200][ T7613] netlink: 8 bytes leftover after parsing attributes in process `syz.2.564'.
[   83.726456][ T7615] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0
[   83.793099][ T7618] netlink: 'syz.0.568': attribute type 11 has an invalid length.
[   83.834238][ T7623] netlink: 104 bytes leftover after parsing attributes in process `syz.1.569'.
[   84.008717][ T7639] netlink: 'syz.1.575': attribute type 21 has an invalid length.
[   84.107576][ T7647] netlink: 24 bytes leftover after parsing attributes in process `syz.0.579'.
[   84.264673][ T7650] netlink: 288 bytes leftover after parsing attributes in process `syz.1.580'.
[   84.938560][ T7646] Bluetooth: hci0: Opcode 0x0401 failed: -4
[   85.027966][ T7670] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   85.127764][ T7674] netlink: 20 bytes leftover after parsing attributes in process `syz.1.589'.
[   86.030500][ T7716] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-272); Ignoring new local tt entry: 80:00:00:00:00:85
[   86.241402][ T5840] Bluetooth: hci0: command 0x0401 tx timeout
[   86.461064][ T7740] netlink: 'syz.1.610': attribute type 16 has an invalid length.
[   86.472957][    C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
[   86.477131][    C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
[   86.504989][ T7746] netlink: 'syz.0.609': attribute type 29 has an invalid length.
[   86.508156][ T7746] netlink: 'syz.0.609': attribute type 29 has an invalid length.
[   86.513297][ T7746] unsupported nla_type 58
[   86.628269][ T7757] tipc: Started in network mode
[   86.630294][ T7757] tipc: Node identity fe80000000000000000000000000001, cluster identity 4711
[   86.635151][ T7757] tipc: Enabled bearer <udp:syz0>, priority 10
[   86.854269][ T7770] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[   87.085596][ T7801] batman_adv: batadv0: Interface deactivated: dummy0
[   87.088711][ T7801] batman_adv: batadv0: Removing interface: dummy0
[   87.092311][ T7803] xt_HMARK: proto mask must be zero with L3 mode
[   87.095581][ T7801] bridge_slave_0: left allmulticast mode
[   87.097885][ T7801] bridge_slave_0: left promiscuous mode
[   87.101500][ T7801] bridge0: port 1(bridge_slave_0) entered disabled state
[   87.110589][ T7801] bridge_slave_1: left allmulticast mode
[   87.116515][ T7801] bridge_slave_1: left promiscuous mode
[   87.118914][ T7801] bridge0: port 2(bridge_slave_1) entered disabled state
[   87.133441][ T7801] bond0: (slave bond_slave_0): Releasing backup interface
[   87.155504][ T7801] bond0: (slave bond_slave_1): Releasing backup interface
[   87.177979][ T7801] team0: Port device team_slave_0 removed
[   87.189501][ T7801] team0: Port device team_slave_1 removed
[   87.193616][ T7801] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   87.196634][ T7801] batman_adv: batadv0: Removing interface: batadv_slave_0
[   87.202757][ T7801] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   87.205839][ T7801] batman_adv: batadv0: Removing interface: batadv_slave_1
[   87.210774][ T7801] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[   87.322901][ T5903] IPVS: starting estimator thread 0...
[   87.323987][ T7809] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[   87.421497][ T7811] IPVS: using max 49 ests per chain, 117600 per kthread
[   87.753022][ T5873] tipc: Node number set to 4269801488
[   87.787140][ T7801] syz.1.627 (7801) used greatest stack depth: 19832 bytes left
[   87.966757][ T7838] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check.
[   88.263379][ T7849] syz_tun: entered allmulticast mode
[   88.272161][ T7849] dvmrp8: entered allmulticast mode
[   88.286679][ T7849] syz_tun: left allmulticast mode
[   88.291777][ T7849] dvmrp8: left allmulticast mode
[   88.400786][ T7849] netlink: 'syz.2.650': attribute type 23 has an invalid length.
[   88.553210][ T7862] __nla_validate_parse: 12 callbacks suppressed
[   88.553228][ T7862] netlink: 28 bytes leftover after parsing attributes in process `syz.0.656'.
[   88.559448][ T7862] netlink: 32 bytes leftover after parsing attributes in process `syz.0.656'.
[   88.563716][ T7862] netlink: 28 bytes leftover after parsing attributes in process `syz.0.656'.
[   88.647629][ T7873] netlink: 8 bytes leftover after parsing attributes in process `syz.0.659'.
[   89.395997][ T7882] netlink: 'syz.2.660': attribute type 1 has an invalid length.
[   89.448332][ T7884] syzkaller1: entered promiscuous mode
[   89.450829][ T7884] syzkaller1: entered allmulticast mode
[   89.514891][ T7891] netlink: 60 bytes leftover after parsing attributes in process `syz.1.663'.
[   89.518687][ T7891] unsupported nlmsg_type 40
[   89.667343][ T7913] netlink: 4 bytes leftover after parsing attributes in process `syz.1.672'.
[   89.670914][ T7913] netlink: 12 bytes leftover after parsing attributes in process `syz.1.672'.
[   89.810740][ T7923] netlink: 8 bytes leftover after parsing attributes in process `syz.0.673'.
[   89.817230][ T7924] netlink: 8 bytes leftover after parsing attributes in process `syz.0.673'.
[   89.935727][ T7923] netlink: 8 bytes leftover after parsing attributes in process `syz.0.673'.
[   90.454211][ T7971] netlink: 'syz.1.692': attribute type 1 has an invalid length.
[   90.917265][ T7992] dvmrp1: entered allmulticast mode
[   90.920947][ T7992] dvmrp1: left allmulticast mode
[   90.973445][ T7993] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[   91.330342][ T8024] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[   92.898016][ T8151] bridge0: port 3(netdevsim2) entered disabled state
[   93.171145][   T12] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   93.174361][   T12] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   93.177662][   T12] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   93.180350][   T12] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   93.616450][ T8198] __nla_validate_parse: 21 callbacks suppressed
[   93.616462][ T8198] netlink: 24 bytes leftover after parsing attributes in process `syz.2.765'.
[   93.688554][ T8202] netlink: 16 bytes leftover after parsing attributes in process `syz.0.767'.
[   93.799544][ T8210] netlink: 8 bytes leftover after parsing attributes in process `syz.0.770'.
[   93.810000][ T8215] dvmrp8: entered allmulticast mode
[   93.822166][ T8210] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[   93.824028][ T8216] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[   93.825902][ T8210] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[   93.974777][ T8215] dvmrp8: left allmulticast mode
[   93.974911][ T8224] netlink: 28 bytes leftover after parsing attributes in process `syz.2.774'.
[   93.980374][ T8224] netlink: 8 bytes leftover after parsing attributes in process `syz.2.774'.
[   94.529533][ T8226] netlink: 8 bytes leftover after parsing attributes in process `syz.1.775'.
[   94.670188][ T8234] bridge: RTM_NEWNEIGH with invalid state 0x10
[   95.088391][ T8280] netlink: 28 bytes leftover after parsing attributes in process `syz.2.796'.
[   95.091814][ T8280] netlink: 8 bytes leftover after parsing attributes in process `syz.2.796'.
[   95.589453][ T8310] tipc: Enabling of bearer <udp:syz2> rejected, failed to enable media
[   96.048173][ T8346] netlink: 4 bytes leftover after parsing attributes in process `syz.1.822'.
[   96.153433][ T8346] netlink: 256 bytes leftover after parsing attributes in process `syz.1.822'.
[   97.384628][ T8404] openvswitch: netlink: Missing key (keys=40, expected=10000000)
[   97.780025][ T8437] netlink: 'syz.0.856': attribute type 29 has an invalid length.
[   97.784976][ T8437] netlink: 'syz.0.856': attribute type 29 has an invalid length.
[   97.793601][ T8441] netlink: 'syz.0.856': attribute type 29 has an invalid length.
[   98.925021][ T8528] __nla_validate_parse: 11 callbacks suppressed
[   98.925037][ T8528] netlink: 16 bytes leftover after parsing attributes in process `syz.2.865'.
[   98.946678][ T8530] netlink: 100 bytes leftover after parsing attributes in process `syz.0.864'.
[   99.016904][ T8535] netlink: 16 bytes leftover after parsing attributes in process `syz.0.868'.
[   99.045011][ T8537] netlink: 4 bytes leftover after parsing attributes in process `syz.2.869'.
[   99.119872][ T8543] netlink: 256 bytes leftover after parsing attributes in process `syz.2.869'.
[   99.261657][ T8550] netlink: 12 bytes leftover after parsing attributes in process `syz.0.873'.
[   99.294695][ T8550] netlink: 80 bytes leftover after parsing attributes in process `syz.0.873'.
[   99.535946][ T8559] netlink: 36 bytes leftover after parsing attributes in process `syz.2.878'.
[  100.133646][ T8578] netlink: 4 bytes leftover after parsing attributes in process `syz.1.883'.
[  100.192682][ T8579] netlink: 256 bytes leftover after parsing attributes in process `syz.1.883'.
[  100.306325][ T8586] vxcan0: tx drop: invalid sa for name 0x0000000000000002
[  100.351675][ T8588] netlink: 'syz.1.887': attribute type 32 has an invalid length.
[  102.090804][ T8689] tipc: New replicast peer: 255.255.255.255
[  102.094110][ T8689] tipc: Enabled bearer <udp:syz2>, priority 10
[  103.795285][ T8794] netlink: 'syz.1.942': attribute type 10 has an invalid length.
[  103.800443][ T8794] net veth1_virt_wifi virt_wifi0: entered promiscuous mode
[  103.805373][ T8794] net veth1_virt_wifi virt_wifi0: entered allmulticast mode
[  103.809641][ T8794] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check.
[  104.063729][ T8815] __nla_validate_parse: 17 callbacks suppressed
[  104.063741][ T8815] netlink: 12 bytes leftover after parsing attributes in process `syz.0.949'.
[  104.548129][ T8837] netlink: 16 bytes leftover after parsing attributes in process `syz.2.956'.
[  104.553356][ T8837] lo: entered allmulticast mode
[  104.559773][ T8837] dvmrp8: entered allmulticast mode
[  104.566765][ T8837] lo: left allmulticast mode
[  104.568664][ T8837] dvmrp8: left allmulticast mode
[  105.099208][ T8865] netlink: 12 bytes leftover after parsing attributes in process `syz.1.967'.
[  105.180540][ T8872] geneve2: entered promiscuous mode
[  105.255252][ T8875] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  105.265099][ T8875] netlink: 28 bytes leftover after parsing attributes in process `syz.1.971'.
[  105.280546][ T8875] netlink: 124 bytes leftover after parsing attributes in process `syz.1.971'.
[  105.381710][ T8884] netlink: 'syz.2.974': attribute type 1 has an invalid length.
[  105.734200][ T8895] netlink: 8 bytes leftover after parsing attributes in process `syz.2.978'.
[  105.737374][ T8895] netlink: 8 bytes leftover after parsing attributes in process `syz.2.978'.
[  105.740116][ T8895] netlink: 8 bytes leftover after parsing attributes in process `syz.2.978'.
[  105.893527][ T8906] netlink: 16 bytes leftover after parsing attributes in process `syz.2.983'.
[  105.903363][ T8906] lo: entered allmulticast mode
[  105.914551][ T8906] dvmrp8: entered allmulticast mode
[  105.919922][ T8906] lo: left allmulticast mode
[  105.921774][ T8906] dvmrp8: left allmulticast mode
[  105.945140][ T8901] netlink: 'syz.1.981': attribute type 1 has an invalid length.
[  105.947906][ T8901] netlink: 224 bytes leftover after parsing attributes in process `syz.1.981'.
[  106.027336][ T8915] netlink: 'syz.2.983': attribute type 23 has an invalid length.
[  106.267357][ T8933] sctp: [Deprecated]: syz.1.993 (pid 8933) Use of int in maxseg socket option.
[  106.267357][ T8933] Use struct sctp_assoc_value instead
[  107.765120][ T9003] syz_tun: entered allmulticast mode
[  107.771037][ T9003] dvmrp8: entered allmulticast mode
[  107.775201][ T9003] syz_tun: left allmulticast mode
[  107.777462][ T9003] dvmrp8: left allmulticast mode
[  107.877347][ T9003] netlink: 'syz.0.1020': attribute type 23 has an invalid length.
[  108.148613][ T9027] dvmrp8: entered allmulticast mode
[  108.156147][ T9027] dvmrp8: left allmulticast mode
[  108.261982][ T9027] netlink: 'syz.1.1030': attribute type 23 has an invalid length.
[  109.240068][ T9099] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0)
[  109.257818][ T9099] __nla_validate_parse: 19 callbacks suppressed
[  109.257834][ T9099] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1050'.
[  109.270569][ T9098] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1051'.
[  109.548526][ T9121] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1056'.
[  109.724854][ T9135] tun0: tun_chr_ioctl cmd 1074025681
[  109.842372][ T9140] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1062'.
[  109.847202][ T9140] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1062'.
[  109.871184][ T9142] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1064'.
[  110.078182][ T9154] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1067'.
[  110.388602][ T9161] delete_channel: no stack
[  110.438306][ T9164] syzkaller1: entered promiscuous mode
[  110.441427][ T9164] syzkaller1: entered allmulticast mode
[  110.868657][ T9187] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1079'.
[  110.962532][ T9187] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1079'.
[  111.037151][ T9201] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1083'.
[  111.150224][ T9216] netlink: 'syz.0.1089': attribute type 5 has an invalid length.
[  111.156265][ T9218] netlink: 'syz.1.1090': attribute type 29 has an invalid length.
[  111.159491][ T9214] 8021q: VLANs not supported on ip_vti0
[  111.187740][ T9219] netlink: 'syz.1.1090': attribute type 29 has an invalid length.
[  111.384896][ T9239] delete_channel: no stack
[  111.504059][ T9243] bridge0: port 2(bridge_slave_1) entered disabled state
[  111.506779][ T9243] bridge0: port 1(bridge_slave_0) entered disabled state
[  111.521719][ T9243] batman_adv: batadv0: Interface deactivated: dummy0
[  111.565724][ T9243] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  111.572074][ T9243] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  111.648140][   T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  111.656644][   T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  111.659530][   T12] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  111.663371][   T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  111.760821][ T9256] syz_tun: entered allmulticast mode
[  111.769943][ T9256] dvmrp8: entered allmulticast mode
[  111.773991][ T9256] syz_tun: left allmulticast mode
[  111.776043][ T9256] dvmrp8: left allmulticast mode
[  111.890002][ T9256] netlink: 'syz.0.1102': attribute type 23 has an invalid length.
[  112.314991][ T9313] netlink: 'syz.2.1123': attribute type 29 has an invalid length.
[  112.318023][ T9313] netlink: 'syz.2.1123': attribute type 29 has an invalid length.
[  112.555552][ T9324] ieee802154 phy0 wpan0: encryption failed: -22
[  113.095768][ T9365] tun0: tun_chr_ioctl cmd 1074025675
[  113.098052][ T9365] tun0: persist enabled
[  113.100225][ T9365] tun0: tun_chr_ioctl cmd 1074025675
[  113.105882][ T9365] tun0: persist disabled
[  113.754293][ T9412] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  113.757529][ T9412] syzkaller0: entered promiscuous mode
[  113.759526][ T9412] syzkaller0: entered allmulticast mode
[  113.773355][ T9412] tipc: Resetting bearer <eth:syzkaller0>
[  113.782461][ T9409] tipc: Resetting bearer <eth:syzkaller0>
[  113.790595][ T9409] tipc: Disabling bearer <eth:syzkaller0>
[  114.102179][ T9439] netlink: 'syz.0.1171': attribute type 1 has an invalid length.
[  114.104865][ T9439] netlink: 'syz.0.1171': attribute type 1 has an invalid length.
[  114.107453][ T9439] netlink: 'syz.0.1171': attribute type 1 has an invalid length.
[  114.110125][ T9439] netlink: 'syz.0.1171': attribute type 1 has an invalid length.
[  114.294235][ T9461] __nla_validate_parse: 66 callbacks suppressed
[  114.294250][ T9461] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1180'.
[  114.343255][ T9463] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1181'.
[  114.349403][ T9463] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1181'.
[  114.355306][ T9463] netlink: 188 bytes leftover after parsing attributes in process `syz.0.1181'.
[  114.404546][ T9459] netlink: 184 bytes leftover after parsing attributes in process `syz.1.1179'.
[  114.447319][ T9471] netdevsim netdevsim0: Direct firmware load for .
[  114.447319][ T9471]  failed with error -2
[  114.451342][ T9471] netdevsim netdevsim0: Falling back to sysfs fallback for: .
[  114.451342][ T9471] 
[  114.672435][ T9493] IPVS: set_ctl: invalid protocol: 22 100.1.1.2:20001
[  115.041901][ T9526] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[  115.553031][ T9555] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1208'.
[  115.634280][ T9562] netlink: 500 bytes leftover after parsing attributes in process `syz.1.1209'.
[  116.446110][ T9623] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1224'.
[  116.684255][ T9648] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1233'.
[  116.695602][ T9648] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1233'.
[  117.585840][ T9706] tipc: Enabling of bearer <udp:syz1> rejected, failed to enable media
[  117.626775][ T9706] 8021q: adding VLAN 0 to HW filter on device bond0
[  117.632566][ T9706] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  118.035864][ T9726] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  118.039747][ T9726] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  118.874593][ T9760] validate_nla: 31 callbacks suppressed
[  118.874604][ T9760] netlink: 'syz.2.1265': attribute type 1 has an invalid length.
[  118.905815][ T9760] 8021q: adding VLAN 0 to HW filter on device bond3
[  118.923466][ T9760] bond3: (slave ip6gretap1): making interface the new active one
[  118.926901][ T9760] bond3: (slave ip6gretap1): Enslaving as an active interface with an up link
[  118.951103][ T9760] veth7: entered promiscuous mode
[  118.956129][ T9760] bond3: (slave veth7): Enslaving as an active interface with a down link
[  118.960914][ T9760] erspan0: entered allmulticast mode
[  119.087502][ T9775] openvswitch: netlink: IP tunnel dst address not specified
[  119.225971][ T9787] sit2: entered promiscuous mode
[  119.283140][ T9791] netlink: 'syz.2.1277': attribute type 29 has an invalid length.
[  119.286202][ T9791] netlink: 'syz.2.1277': attribute type 29 has an invalid length.
[  119.289473][ T9792] netlink: 'syz.2.1277': attribute type 29 has an invalid length.
[  120.637953][ T9837] __nla_validate_parse: 13 callbacks suppressed
[  120.637970][ T9837] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.645194][ T9837] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.649930][ T9836] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.654117][ T9836] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.658129][ T9838] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.662280][ T9837] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.666131][ T9837] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.669900][ T9836] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.673854][ T9837] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.677694][ T9836] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1293'.
[  120.762976][ T9840] syz.2.1294 uses old SIOCAX25GETINFO
[  121.136475][ T9859] lo: entered allmulticast mode
[  121.143692][ T9859] dvmrp8: entered allmulticast mode
[  121.146957][ T9859] lo: left allmulticast mode
[  121.148664][ T9859] dvmrp8: left allmulticast mode
[  121.199574][ T9860] netlink: 'syz.2.1302': attribute type 23 has an invalid length.
[  121.360761][ T9869] sctp: [Deprecated]: syz.2.1306 (pid 9869) Use of struct sctp_assoc_value in delayed_ack socket option.
[  121.360761][ T9869] Use struct sctp_sack_info instead
[  121.996739][ T9915] netlink: 'syz.1.1317': attribute type 23 has an invalid length.
[  122.197665][ T9939] openvswitch: netlink: Flow key attr not present in new flow.
[  122.543029][ T9979] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[  123.096671][T10036] 8021q: adding VLAN 0 to HW filter on device bond1
[  123.737215][T10068] dvmrp0: entered allmulticast mode
[  123.814373][T10070] lo speed is unknown, defaulting to 1000
[  123.817452][T10070] lo speed is unknown, defaulting to 1000
[  123.820293][T10070] lo speed is unknown, defaulting to 1000
[  123.870519][T10071] erspan0: left allmulticast mode
[  123.889766][T10071] 8021q: adding VLAN 0 to HW filter on device bond0
[  123.894323][T10071] 8021q: adding VLAN 0 to HW filter on device team0
[  123.897707][T10071] batman_adv: batadv0: Interface activated: dummy0
[  123.900304][T10071] batadv0: mtu less than device minimum
[  123.903433][T10071] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[  123.908314][T10071] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[  123.913234][T10071] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[  123.918118][T10071] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[  123.922706][T10071] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[  123.926667][T10071] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[  123.930525][T10071] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-272)
[  123.937505][T10070] infiniband syz0: set active
[  123.939145][T10070] infiniband syz0: added lo
[  123.948354][ T8152] lo speed is unknown, defaulting to 1000
[  123.950184][ T8152] syz0: Port: 1 Link ACTIVE
[  123.979343][T10070] RDS/IB: syz0: added
[  123.989282][T10070] lo speed is unknown, defaulting to 1000
[  124.107584][T10070] lo speed is unknown, defaulting to 1000
[  124.165169][T10083] ip6tnl0: entered promiscuous mode
[  124.220527][T10070] lo speed is unknown, defaulting to 1000
[  124.386114][T10097] lo speed is unknown, defaulting to 1000
[  124.765499][T10121] dvmrp8: entered allmulticast mode
[  124.768604][T10121] dvmrp8: left allmulticast mode
[  124.837380][T10122] lo speed is unknown, defaulting to 1000
[  124.875476][T10121] netlink: 'syz.1.1381': attribute type 23 has an invalid length.
[  125.427232][T10139] dvmrp8: entered allmulticast mode
[  125.431066][T10139] dvmrp8: left allmulticast mode
[  125.501699][T10140] lo speed is unknown, defaulting to 1000
[  125.537972][T10139] netlink: 'syz.2.1388': attribute type 23 has an invalid length.
[  125.758202][T10146] __nla_validate_parse: 92 callbacks suppressed
[  125.758218][T10146] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1390'.
[  126.080910][T10156] netlink: 165 bytes leftover after parsing attributes in process `syz.2.1393'.
[  126.375782][T10181] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1398'.
[  126.386031][T10181] dvmrp8: entered allmulticast mode
[  126.388907][T10181] dvmrp8: left allmulticast mode
[  126.435637][T10181] lo speed is unknown, defaulting to 1000
[  126.475727][T10188] netlink: 'syz.1.1398': attribute type 23 has an invalid length.
[  126.615022][T10198] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1402'.
[  126.650664][T10195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1401'.
[  126.664291][T10195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1401'.
[  126.667865][T10195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1401'.
[  126.836897][T10209] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1406'.
[  126.837416][T10208] netlink: 176 bytes leftover after parsing attributes in process `syz.1.1407'.
[  127.040825][T10217] lo speed is unknown, defaulting to 1000
[  127.330922][T10225] net_ratelimit: 16 callbacks suppressed
[  127.330933][T10225] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[  127.461035][T10236] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1412'.
[  127.571542][T10243] tipc: New replicast peer: 255.255.255.255
[  127.574629][T10243] tipc: Enabled bearer <udp:syz2>, priority 10
[  127.977454][T10275] netlink: 'syz.2.1421': attribute type 1 has an invalid length.
[  128.002874][T10275] 8021q: adding VLAN 0 to HW filter on device bond4
[  128.016808][T10275] veth11: entered promiscuous mode
[  128.022520][T10275] bond4: (slave veth11): Enslaving as an active interface with an up link
[  128.114112][T10284] lo speed is unknown, defaulting to 1000
[  128.599185][T10314] veth0: entered promiscuous mode
[  128.688942][T10318] dvmrp8: entered allmulticast mode
[  128.696238][T10318] dvmrp8: left allmulticast mode
[  128.774441][T10326] lo speed is unknown, defaulting to 1000
[  128.800529][T10329] netlink: 'syz.1.1428': attribute type 23 has an invalid length.
[  128.870697][T10333] netlink: 'syz.2.1433': attribute type 29 has an invalid length.
[  128.889642][T10335] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms)
[  129.480385][T10371] delete_channel: no stack
[  129.936386][T10419] netlink: 'syz.0.1457': attribute type 1 has an invalid length.
[  130.796778][T10468] tipc: Enabling of bearer <udp:syz2> rejected, already enabled
[  130.905777][T10476] __nla_validate_parse: 20 callbacks suppressed
[  130.905788][T10476] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1477'.
[  130.910929][T10476] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1477'.
[  130.943893][T10478] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1478'.
[  130.947535][T10478] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1478'.
[  130.951007][T10478] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1478'.
[  131.245779][T10490] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1483'.
[  131.249977][T10491] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1483'.
[  131.444902][T10499] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1485'.
[  131.458224][T10499] dvmrp8: entered allmulticast mode
[  131.460272][T10497] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1484'.
[  131.548284][T10499] lo speed is unknown, defaulting to 1000
[  131.602000][T10501] netlink: 'syz.1.1485': attribute type 23 has an invalid length.
[  131.752006][T10507] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  131.754534][T10507] syzkaller0: entered promiscuous mode
[  131.756212][T10507] syzkaller0: entered allmulticast mode
[  131.787805][T10507] tipc: Resetting bearer <eth:syzkaller0>
[  131.792109][T10506] tipc: Resetting bearer <eth:syzkaller0>
[  131.802793][T10506] tipc: Disabling bearer <eth:syzkaller0>
[  131.968535][T10498] dvmrp8: left allmulticast mode
[  132.031759][T10510] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1488'.
[  132.374731][T10524] netlink: 'syz.0.1492': attribute type 13 has an invalid length.
[  132.450448][ T5714] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  132.454116][ T5714] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  132.457462][ T5714] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  132.460825][ T5714] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  132.555334][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  132.669948][T10536] netlink: 'syz.1.1494': attribute type 29 has an invalid length.
[  132.674334][T10536] netlink: 'syz.1.1494': attribute type 29 has an invalid length.
[  133.335103][T10550] dvmrp8: entered allmulticast mode
[  133.376737][T10550] lo speed is unknown, defaulting to 1000
[  133.399950][T10553] netlink: 'syz.2.1500': attribute type 23 has an invalid length.
[  133.573430][T10570] tipc: New replicast peer: 255.255.255.255
[  133.579454][T10570] tipc: Enabled bearer <udp:syz2>, priority 10
[  133.616072][T10549] dvmrp8: left allmulticast mode
[  133.843294][T10597] vxcan1: entered allmulticast mode
[  133.845747][T10597] vxcan1: left allmulticast mode
[  133.978437][T10606] syz_tun: entered allmulticast mode
[  133.988904][T10606] dvmrp8: entered allmulticast mode
[  134.012408][T10606] syz_tun: left allmulticast mode
[  134.014240][T10606] dvmrp8: left allmulticast mode
[  134.067025][T10620] netlink: 'syz.2.1523': attribute type 32 has an invalid length.
[  134.069984][T10620] (unnamed net_device) (uninitialized): option coupled_control: invalid value (12)
[  134.078335][T10622] netlink: 'syz.1.1524': attribute type 1 has an invalid length.
[  134.146398][T10606] lo speed is unknown, defaulting to 1000
[  134.176419][T10629] netlink: 'syz.0.1518': attribute type 23 has an invalid length.
[  134.997522][T10688] syz_tun: entered allmulticast mode
[  135.020456][T10688] dvmrp8: entered allmulticast mode
[  135.030864][T10688] syz_tun: left allmulticast mode
[  135.033678][T10688] dvmrp8: left allmulticast mode
[  135.150157][T10688] lo speed is unknown, defaulting to 1000
[  135.186272][T10699] netlink: 'syz.0.1541': attribute type 23 has an invalid length.
[  135.302664][T10695] lo speed is unknown, defaulting to 1000
[  135.509565][T10705] vxcan1 speed is unknown, defaulting to 1000
[  135.524575][T10705] vxcan1 speed is unknown, defaulting to 1000
[  135.527616][T10705] vxcan1 speed is unknown, defaulting to 1000
[  135.832839][T10705] infiniband syz2: set down
[  135.834809][ T8152] vxcan1 speed is unknown, defaulting to 1000
[  135.841355][T10705] infiniband syz2: added vxcan1
[  135.887820][T10705] RDS/IB: syz2: added
[  135.898683][T10705] vxcan1 speed is unknown, defaulting to 1000
[  135.932270][T10710] __nla_validate_parse: 22 callbacks suppressed
[  135.932285][T10710] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1546'.
[  136.107550][T10723] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1551'.
[  136.150832][T10725] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1552'.
[  136.182028][T10725] dvmrp8: entered allmulticast mode
[  136.186838][T10705] vxcan1 speed is unknown, defaulting to 1000
[  136.191094][T10725] dvmrp8: left allmulticast mode
[  136.346853][T10730] netlink: 'syz.1.1552': attribute type 23 has an invalid length.
[  136.372977][T10705] vxcan1 speed is unknown, defaulting to 1000
[  136.491055][T10705] vxcan1 speed is unknown, defaulting to 1000
[  136.604171][T10705] vxcan1 speed is unknown, defaulting to 1000
[  136.729644][T10725] lo speed is unknown, defaulting to 1000
[  137.162225][T10745] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1557'.
[  137.277605][T10748] netlink: 248 bytes leftover after parsing attributes in process `syz.1.1559'.
[  137.613180][T10768] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1563'.
[  137.632828][T10768] dvmrp8: entered allmulticast mode
[  137.648843][T10768] dvmrp8: left allmulticast mode
[  137.717373][T10769] lo speed is unknown, defaulting to 1000
[  137.759919][T10768] netlink: 'syz.1.1563': attribute type 23 has an invalid length.
[  137.824676][T10769] vxcan1 speed is unknown, defaulting to 1000
[  137.877037][T10773] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1565'.
[  138.018757][T10777] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1567'.
[  138.305631][T10792] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1573'.
[  138.320262][T10794] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1574'.
[  138.352075][T10794] syz_tun: entered allmulticast mode
[  138.368442][T10794] dvmrp8: entered allmulticast mode
[  138.391759][T10794] syz_tun: left allmulticast mode
[  138.395746][T10794] dvmrp8: left allmulticast mode
[  138.422221][T10796] lo speed is unknown, defaulting to 1000
[  138.497316][T10794] netlink: 'syz.0.1574': attribute type 23 has an invalid length.
[  138.612210][T10800] lo speed is unknown, defaulting to 1000
[  138.617237][T10796] vxcan1 speed is unknown, defaulting to 1000
[  138.786232][T10800] vxcan1 speed is unknown, defaulting to 1000
[  139.581674][T10824] netlink: 'syz.0.1584': attribute type 1 has an invalid length.
[  139.695092][   T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  139.698171][   T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  139.701066][T10832] lo speed is unknown, defaulting to 1000
[  139.830458][T10832] vxcan1 speed is unknown, defaulting to 1000
[  140.295395][T10866] dvmrp8: entered allmulticast mode
[  140.303929][T10866] dvmrp8: left allmulticast mode
[  140.434952][T10866] netlink: 'syz.1.1594': attribute type 23 has an invalid length.
[  140.435192][T10870] lo speed is unknown, defaulting to 1000
[  140.617796][T10870] vxcan1 speed is unknown, defaulting to 1000
[  141.037867][T10916] __nla_validate_parse: 9 callbacks suppressed
[  141.037877][T10916] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1610'.
[  141.043743][T10914] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1609'.
[  141.052626][T10916] dvmrp8: entered allmulticast mode
[  141.059058][T10916] dvmrp8: left allmulticast mode
[  141.100554][T10914] lo speed is unknown, defaulting to 1000
[  141.142006][T10920] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1609'.
[  141.186140][T10919] netlink: 'syz.1.1610': attribute type 23 has an invalid length.
[  141.351738][T10914] vxcan1 speed is unknown, defaulting to 1000
[  141.351940][T10916] lo speed is unknown, defaulting to 1000
[  141.541689][T10916] vxcan1 speed is unknown, defaulting to 1000
[  141.915021][T10949] netlink: 'syz.1.1619': attribute type 12 has an invalid length.
[  141.918275][T10949] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1619'.
[  141.976941][T10947] lo speed is unknown, defaulting to 1000
[  142.066444][T10957] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1623'.
[  142.234483][T10960] lo speed is unknown, defaulting to 1000
[  142.234646][T10947] vxcan1 speed is unknown, defaulting to 1000
[  142.529651][T10960] vxcan1 speed is unknown, defaulting to 1000
[  142.640276][T10986] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1626'.
[  142.689721][T10986] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1626'.
[  142.706931][T10986] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1626'.
[  142.831679][T10992] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1627'.
[  142.851885][T10992] dvmrp8: entered allmulticast mode
[  142.856028][T10992] dvmrp8: left allmulticast mode
[  142.963829][T10992] lo speed is unknown, defaulting to 1000
[  142.997640][T10996] netlink: 'syz.1.1627': attribute type 23 has an invalid length.
[  143.147000][T10994] lo speed is unknown, defaulting to 1000
[  143.254832][T10992] vxcan1 speed is unknown, defaulting to 1000
[  143.458323][T10994] vxcan1 speed is unknown, defaulting to 1000
[  144.392157][T11011] syzkaller1: entered promiscuous mode
[  144.393912][T11011] syzkaller1: entered allmulticast mode
[  144.593602][T11013] lo speed is unknown, defaulting to 1000
[  144.871711][T11013] vxcan1 speed is unknown, defaulting to 1000
[  145.078867][T11032] netlink: 'syz.1.1642': attribute type 32 has an invalid length.
[  145.427194][T11049] netlink: 'syz.1.1648': attribute type 1 has an invalid length.
[  145.432639][T11049] netlink: 228 bytes leftover after parsing attributes in process `syz.1.1648'.
[  145.786814][T11065] lo speed is unknown, defaulting to 1000
[  146.019792][T11065] vxcan1 speed is unknown, defaulting to 1000
[  146.213513][T11091] netlink: 'syz.0.1666': attribute type 16 has an invalid length.
[  146.216392][T11091] netlink: 'syz.0.1666': attribute type 17 has an invalid length.
[  146.256216][T11091] bridge0: port 2(bridge_slave_1) entered disabled state
[  146.259039][T11091] bridge0: port 1(bridge_slave_0) entered disabled state
[  146.275462][T11091] team_slave_0: left promiscuous mode
[  146.277400][T11091] team_slave_1: left promiscuous mode
[  146.281888][T11091] batman_adv: batadv0: Interface deactivated: dummy0
[  146.316812][T11097] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[  146.325233][T11095] IPv6: NLM_F_REPLACE set, but no existing node found!
[  146.343546][T11091] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  146.350281][T11091] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  146.491353][ T5714] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0
[  146.494389][ T5714] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  146.497771][ T5714] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0
[  146.500774][ T5714] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  146.525627][ T5714] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0
[  146.528553][ T5714] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  146.532192][ T5714] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0
[  146.538443][ T5714] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  146.884574][T11120] __nla_validate_parse: 8 callbacks suppressed
[  146.884589][T11120] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1670'.
[  146.890530][T11120] netlink: 'syz.2.1670': attribute type 1 has an invalid length.
[  146.911610][T11120] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1670'.
[  147.021433][T11123] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1671'.
[  147.027247][T11123] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1671'.
[  147.044890][T11123] gtp0: entered promiscuous mode
[  147.046572][T11123] gtp0: entered allmulticast mode
[  147.436554][T11147] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1677'.
[  147.585308][T11163] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1684'.
[  147.589005][T11159] lo speed is unknown, defaulting to 1000
[  147.668482][T11171] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1686'.
[  147.761693][T11173] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1687'.
[  147.770226][T11159] vxcan1 speed is unknown, defaulting to 1000
[  148.005873][T11180] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1689'.
[  148.314492][T11184] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1691'.
[  148.927804][T11217] lo speed is unknown, defaulting to 1000
[  148.974175][T11220] netlink: 'syz.2.1699': attribute type 23 has an invalid length.
[  149.064833][T11217] vxcan1 speed is unknown, defaulting to 1000
[  149.265938][T11239] lo speed is unknown, defaulting to 1000
[  149.530811][T11239] vxcan1 speed is unknown, defaulting to 1000
[  150.402255][T11280] lo speed is unknown, defaulting to 1000
[  150.444550][T11284] netlink: 'syz.1.1720': attribute type 23 has an invalid length.
[  150.626530][T11280] vxcan1 speed is unknown, defaulting to 1000
[  151.153063][T11308] syzkaller1: entered promiscuous mode
[  151.154934][T11308] syzkaller1: entered allmulticast mode
[  151.198408][T11308] lo speed is unknown, defaulting to 1000
[  151.380135][T11308] vxcan1 speed is unknown, defaulting to 1000
[  151.561943][T11314] lo speed is unknown, defaulting to 1000
[  151.762469][T11314] vxcan1 speed is unknown, defaulting to 1000
[  152.003372][T11330] __nla_validate_parse: 41 callbacks suppressed
[  152.003383][T11330] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1736'.
[  152.008030][T11330] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1736'.
[  152.111913][T11335] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1737'.
[  152.214902][T11340] syzkaller1: entered promiscuous mode
[  152.221115][T11340] syzkaller1: entered allmulticast mode
[  152.457532][T11356] lo speed is unknown, defaulting to 1000
[  152.559062][T11365] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1746'.
[  152.593428][T11356] vxcan1 speed is unknown, defaulting to 1000
[  152.673087][T11372] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1748'.
[  152.743366][T11376] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1750'.
[  152.800675][T11379] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1750'.
[  153.143263][T11398] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1756'.
[  153.391611][T11419] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  153.425969][T11419] syzkaller0: entered promiscuous mode
[  153.427792][T11419] syzkaller0: entered allmulticast mode
[  153.430341][T11419] tipc: Resetting bearer <eth:syzkaller0>
[  153.524853][T11426] tipc: Resetting bearer <eth:syzkaller0>
[  153.631551][T11423] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1766'.
[  154.690917][T11426] tipc: Disabling bearer <eth:syzkaller0>
[  154.787253][T11443] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1772'.
[  154.798325][T11441] nbd: socks must be embedded in a SOCK_ITEM attr
[  154.933438][T11462] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  154.957449][T11457] lo speed is unknown, defaulting to 1000
[  155.107524][T11457] vxcan1 speed is unknown, defaulting to 1000
[  155.826129][T11493] lo speed is unknown, defaulting to 1000
[  155.949736][T11493] vxcan1 speed is unknown, defaulting to 1000
[  156.233878][T11500] vlan3: entered promiscuous mode
[  156.235630][T11500] bond0: entered promiscuous mode
[  156.237323][T11500] vlan3: entered allmulticast mode
[  156.239053][T11500] bond0: entered allmulticast mode
[  156.752728][T11522] lo speed is unknown, defaulting to 1000
[  156.874071][T11522] vxcan1 speed is unknown, defaulting to 1000
[  157.051558][T11500] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  157.055147][T11519] __nla_validate_parse: 11 callbacks suppressed
[  157.055157][T11519] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1798'.
[  157.412031][T11547] lo speed is unknown, defaulting to 1000
[  157.486706][T11555] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1810'.
[  157.510981][T11557] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1811'.
[  157.648694][T11547] vxcan1 speed is unknown, defaulting to 1000
[  158.007928][T11585] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1821'.
[  158.011726][T11585] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1821'.
[  158.198688][T11599] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1825'.
[  158.202265][T11599] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1825'.
[  158.205710][T11599] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1825'.
[  158.242418][T11601] netlink: 176 bytes leftover after parsing attributes in process `syz.0.1826'.
[  158.662233][T11604] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1827'.
[  160.568767][T11642] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0)
[  160.701580][T11659] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[  160.923617][T11677] netlink: 'syz.1.1847': attribute type 1 has an invalid length.
[  161.111343][   T54] Bluetooth: hci0: command 0x0401 tx timeout
[  161.111560][ T5840] Bluetooth: hci0: Opcode 0x0c1a failed: -110
[  161.518820][T11726] ==================================================================
[  161.521288][T11726] BUG: KASAN: use-after-free in xfrm_alloc_spi+0x570/0xf30
[  161.523472][T11726] Read of size 4 at addr ffff888111ae1744 by task syz.2.1863/11726
[  161.527308][T11726] 
[  161.528172][T11726] CPU: 1 UID: 0 PID: 11726 Comm: syz.2.1863 Not tainted syzkaller #0 PREEMPT(full) 
[  161.528184][T11726] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  161.528190][T11726] Call Trace:
[  161.528204][T11726]  <TASK>
[  161.528210][T11726]  dump_stack_lvl+0x189/0x250
[  161.528223][T11726]  ? __kasan_check_byte+0x12/0x40
[  161.528236][T11726]  ? __pfx_dump_stack_lvl+0x10/0x10
[  161.528245][T11726]  ? lock_release+0x4b/0x3e0
[  161.528257][T11726]  ? __virt_addr_valid+0x4a5/0x5c0
[  161.528268][T11726]  print_report+0xca/0x240
[  161.528280][T11726]  ? xfrm_alloc_spi+0x570/0xf30
[  161.528291][T11726]  kasan_report+0x118/0x150
[  161.528301][T11726]  ? xfrm_alloc_spi+0x570/0xf30
[  161.528313][T11726]  xfrm_alloc_spi+0x570/0xf30
[  161.528325][T11726]  ? xfrm_alloc_spi+0x2a0/0xf30
[  161.528367][T11726]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  161.528378][T11726]  ? xfrm_find_acq+0x87/0xa0
[  161.528391][T11726]  xfrm_alloc_userspi+0x70b/0xc90
[  161.528402][T11726]  ? apparmor_capable+0x137/0x1b0
[  161.528411][T11726]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  161.528418][T11726]  ? __nla_parse+0x40/0x60
[  161.528426][T11726]  xfrm_user_rcv_msg+0x7a3/0xab0
[  161.528440][T11726]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  161.528458][T11726]  ? __pfx___mutex_trylock_common+0x10/0x10
[  161.528467][T11726]  ? rcu_is_watching+0x15/0xb0
[  161.528474][T11726]  ? trace_contention_end+0x39/0x120
[  161.528482][T11726]  ? __mutex_lock+0x335/0x1350
[  161.528490][T11726]  netlink_rcv_skb+0x208/0x470
[  161.528499][T11726]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  161.528511][T11726]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  161.528522][T11726]  ? netlink_deliver_tap+0x2e/0x1b0
[  161.528530][T11726]  ? netlink_deliver_tap+0x2e/0x1b0
[  161.528538][T11726]  xfrm_netlink_rcv+0x79/0x90
[  161.528551][T11726]  netlink_unicast+0x82f/0x9e0
[  161.528559][T11726]  ? __pfx_netlink_unicast+0x10/0x10
[  161.528567][T11726]  ? netlink_sendmsg+0x642/0xb30
[  161.528575][T11726]  ? skb_put+0x11b/0x210
[  161.528585][T11726]  netlink_sendmsg+0x805/0xb30
[  161.528594][T11726]  ? __pfx_netlink_sendmsg+0x10/0x10
[  161.528603][T11726]  ? aa_sock_msg_perm+0xf1/0x1d0
[  161.528614][T11726]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  161.528621][T11726]  ? __pfx_netlink_sendmsg+0x10/0x10
[  161.528629][T11726]  __sock_sendmsg+0x21c/0x270
[  161.528641][T11726]  ____sys_sendmsg+0x505/0x830
[  161.528651][T11726]  ? __pfx_____sys_sendmsg+0x10/0x10
[  161.528662][T11726]  ? import_iovec+0x74/0xa0
[  161.528671][T11726]  ___sys_sendmsg+0x21f/0x2a0
[  161.528680][T11726]  ? __pfx____sys_sendmsg+0x10/0x10
[  161.528696][T11726]  ? __fget_files+0x2a/0x420
[  161.528707][T11726]  ? __fget_files+0x3a0/0x420
[  161.528719][T11726]  __x64_sys_sendmsg+0x19b/0x260
[  161.528728][T11726]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  161.528739][T11726]  ? rcu_is_watching+0x15/0xb0
[  161.528747][T11726]  ? do_syscall_64+0xbe/0x3b0
[  161.528754][T11726]  do_syscall_64+0xfa/0x3b0
[  161.528761][T11726]  ? lockdep_hardirqs_on+0x9c/0x150
[  161.528772][T11726]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  161.528779][T11726]  ? exc_page_fault+0x9f/0xf0
[  161.528790][T11726]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  161.528798][T11726] RIP: 0033:0x7fb90678ec29
[  161.528807][T11726] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  161.528814][T11726] RSP: 002b:00007fb907569038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  161.528823][T11726] RAX: ffffffffffffffda RBX: 00007fb9069d5fa0 RCX: 00007fb90678ec29
[  161.528829][T11726] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004
[  161.528834][T11726] RBP: 00007fb906811e41 R08: 0000000000000000 R09: 0000000000000000
[  161.528839][T11726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  161.528844][T11726] R13: 00007fb9069d6038 R14: 00007fb9069d5fa0 R15: 00007ffd0beef308
[  161.528853][T11726]  </TASK>
[  161.528856][T11726] 
[  161.659074][T11726] The buggy address belongs to the physical page:
[  161.661105][T11726] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x111ae1
[  161.664223][T11726] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
[  161.666473][T11726] raw: 057ff00000000000 0000000000000000 00000000ffffffff 0000000000000000
[  161.669142][T11726] raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
[  161.671768][T11726] page dumped because: kasan: bad access detected
[  161.673958][T11726] page_owner tracks the page as freed
[  161.676025][T11726] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 7711, tgid 7710 (syz.0.600), ts 85739465087, free_ts 150173889904
[  161.683071][T11726]  post_alloc_hook+0x240/0x2a0
[  161.684950][T11726]  get_page_from_freelist+0x21e4/0x22c0
[  161.687061][T11726]  __alloc_frozen_pages_noprof+0x181/0x370
[  161.689340][T11726]  alloc_pages_mpol+0x232/0x4a0
[  161.691236][T11726]  allocate_slab+0x8a/0x370
[  161.692994][T11726]  ___slab_alloc+0xbeb/0x1420
[  161.694804][T11726]  kmem_cache_alloc_noprof+0x283/0x3c0
[  161.696888][T11726]  xfrm_state_alloc+0x24/0x2f0
[  161.698749][T11726]  xfrm_state_find+0x37d4/0x5400
[  161.700711][T11726]  xfrm_resolve_and_create_bundle+0x768/0x2f80
[  161.703103][T11726]  xfrm_lookup_with_ifid+0x2a7/0x1a70
[  161.705193][T11726]  xfrm_lookup_route+0x3c/0x1c0
[  161.707083][T11726]  rawv6_sendmsg+0xdbf/0x1830
[  161.708927][T11726]  __sock_sendmsg+0x19c/0x270
[  161.710760][T11726]  ____sys_sendmsg+0x52d/0x830
[  161.712641][T11726]  ___sys_sendmsg+0x21f/0x2a0
[  161.714478][T11726] page last free pid 5846 tgid 5846 stack trace:
[  161.716889][T11726]  __free_frozen_pages+0xbc4/0xd30
[  161.718914][T11726]  __slab_free+0x303/0x3c0
[  161.720649][T11726]  qlist_free_all+0x97/0x140
[  161.722468][T11726]  kasan_quarantine_reduce+0x148/0x160
[  161.724592][T11726]  __kasan_slab_alloc+0x22/0x80
[  161.726487][T11726]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  161.728589][T11726]  getname_flags+0xb8/0x540
[  161.730372][T11726]  do_sys_openat2+0xbc/0x1c0
[  161.732154][T11726]  __x64_sys_openat+0x138/0x170
[  161.734070][T11726]  do_syscall_64+0xfa/0x3b0
[  161.735860][T11726]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  161.738174][T11726] 
[  161.739125][T11726] Memory state around the buggy address:
[  161.741267][T11726]  ffff888111ae1600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  161.744307][T11726]  ffff888111ae1680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  161.747377][T11726] >ffff888111ae1700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  161.750438][T11726]                                            ^
[  161.752768][T11726]  ffff888111ae1780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  161.755854][T11726]  ffff888111ae1800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  161.758916][T11726] ==================================================================
[  161.762374][T11726] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  161.765269][T11726] CPU: 1 UID: 0 PID: 11726 Comm: syz.2.1863 Not tainted syzkaller #0 PREEMPT(full) 
[  161.768883][T11726] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  161.772728][T11726] Call Trace:
[  161.774058][T11726]  <TASK>
[  161.775222][T11726]  dump_stack_lvl+0x99/0x250
[  161.776972][T11726]  ? __asan_memcpy+0x40/0x70
[  161.778754][T11726]  ? __pfx_dump_stack_lvl+0x10/0x10
[  161.780753][T11726]  ? __pfx__printk+0x10/0x10
[  161.782583][T11726]  vpanic+0x281/0x750
[  161.784136][T11726]  ? __pfx_vpanic+0x10/0x10
[  161.785887][T11726]  ? irqentry_exit+0x74/0x90
[  161.787681][T11726]  panic+0xb9/0xc0
[  161.789176][T11726]  ? __pfx_panic+0x10/0x10
[  161.790934][T11726]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  161.793228][T11726]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  161.795555][T11726]  ? xfrm_alloc_spi+0x570/0xf30
[  161.797469][T11726]  check_panic_on_warn+0x89/0xb0
[  161.799407][T11726]  ? xfrm_alloc_spi+0x570/0xf30
[  161.801295][T11726]  end_report+0x78/0x160
[  161.803002][T11726]  kasan_report+0x129/0x150
[  161.804767][T11726]  ? xfrm_alloc_spi+0x570/0xf30
[  161.806679][T11726]  xfrm_alloc_spi+0x570/0xf30
[  161.808550][T11726]  ? xfrm_alloc_spi+0x2a0/0xf30
[  161.810476][T11726]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  161.812471][T11726]  ? xfrm_find_acq+0x87/0xa0
[  161.814299][T11726]  xfrm_alloc_userspi+0x70b/0xc90
[  161.816277][T11726]  ? apparmor_capable+0x137/0x1b0
[  161.818239][T11726]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  161.820404][T11726]  ? __nla_parse+0x40/0x60
[  161.822173][T11726]  xfrm_user_rcv_msg+0x7a3/0xab0
[  161.824152][T11726]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  161.826266][T11726]  ? __pfx___mutex_trylock_common+0x10/0x10
[  161.828573][T11726]  ? rcu_is_watching+0x15/0xb0
[  161.830466][T11726]  ? trace_contention_end+0x39/0x120
[  161.832466][T11726]  ? __mutex_lock+0x335/0x1350
[  161.834283][T11726]  netlink_rcv_skb+0x208/0x470
[  161.836192][T11726]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  161.838292][T11726]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  161.840341][T11726]  ? netlink_deliver_tap+0x2e/0x1b0
[  161.842410][T11726]  ? netlink_deliver_tap+0x2e/0x1b0
[  161.844463][T11726]  xfrm_netlink_rcv+0x79/0x90
[  161.846252][T11726]  netlink_unicast+0x82f/0x9e0
[  161.848146][T11726]  ? __pfx_netlink_unicast+0x10/0x10
[  161.850179][T11726]  ? netlink_sendmsg+0x642/0xb30
[  161.852114][T11726]  ? skb_put+0x11b/0x210
[  161.853739][T11726]  netlink_sendmsg+0x805/0xb30
[  161.855584][T11726]  ? __pfx_netlink_sendmsg+0x10/0x10
[  161.857617][T11726]  ? aa_sock_msg_perm+0xf1/0x1d0
[  161.859550][T11726]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  161.861608][T11726]  ? __pfx_netlink_sendmsg+0x10/0x10
[  161.863651][T11726]  __sock_sendmsg+0x21c/0x270
[  161.865481][T11726]  ____sys_sendmsg+0x505/0x830
[  161.867329][T11726]  ? __pfx_____sys_sendmsg+0x10/0x10
[  161.869403][T11726]  ? import_iovec+0x74/0xa0
[  161.871229][T11726]  ___sys_sendmsg+0x21f/0x2a0
[  161.873126][T11726]  ? __pfx____sys_sendmsg+0x10/0x10
[  161.875184][T11726]  ? __fget_files+0x2a/0x420
[  161.876989][T11726]  ? __fget_files+0x3a0/0x420
[  161.878840][T11726]  __x64_sys_sendmsg+0x19b/0x260
[  161.880786][T11726]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  161.882900][T11726]  ? rcu_is_watching+0x15/0xb0
[  161.884808][T11726]  ? do_syscall_64+0xbe/0x3b0
[  161.886656][T11726]  do_syscall_64+0xfa/0x3b0
[  161.888401][T11726]  ? lockdep_hardirqs_on+0x9c/0x150
[  161.890488][T11726]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  161.892789][T11726]  ? exc_page_fault+0x9f/0xf0
[  161.894609][T11726]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  161.896949][T11726] RIP: 0033:0x7fb90678ec29
[  161.898739][T11726] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  161.906034][T11726] RSP: 002b:00007fb907569038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  161.909241][T11726] RAX: ffffffffffffffda RBX: 00007fb9069d5fa0 RCX: 00007fb90678ec29
[  161.912253][T11726] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004
[  161.915352][T11726] RBP: 00007fb906811e41 R08: 0000000000000000 R09: 0000000000000000
[  161.918440][T11726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  161.921526][T11726] R13: 00007fb9069d6038 R14: 00007fb9069d5fa0 R15: 00007ffd0beef308
[  161.924609][T11726]  </TASK>
[  161.926470][T11726] Kernel Offset: disabled
[  161.928183][T11726] Rebooting in 86400 seconds..

VM DIAGNOSIS:
06:39:49  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000000 RBX=1ffff11026cc7f69 RCX=ffff88801e9cb980 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc9000a0b78c0 RSP=ffffc9000a0b7740
R8 =ffffffff8fa2ee37 R9 =1ffffffff1f45dc6 R10=dffffc0000000000 R11=fffffbfff1f45dc7
R12=ffff88813663fb48 R13=dffffc0000000000 R14=ffff88804b03b1c0 R15=0000000000000001
RIP=ffffffff81b44e68 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b863d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b31924000 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0058000000000000 0000ff00e57e060a
XMM02=bc0e012504140094 00645f94ca24480b XMM03=0009e8fffefff000 8000000000000000
XMM04=0001000000000000 00100c0800010010 XMM05=000080ddf5ff0053 0009e8fffefff000
XMM06=8000000000000000 bc0e012504140094 XMM07=00645f94ca24480b 0058000000000000
XMM08=0000000000000000 00007fb93ca12f0f XMM09=0000000000000000 00007fb93ca12fed
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000037 RBX=0000000000000037 RCX=0000000000000000 RDX=00000000000003f8
RSI=00000000000013c8 RDI=00000000000013c9 RBP=00000000000003f8 RSP=ffffc90002bee9f0
R8 =ffff88801f110237 R9 =1ffff11003e22046 R10=dffffc0000000000 R11=ffffffff854fac30
R12=dffffc0000000000 R13=ffffffff99ad7915 R14=ffffffff99dcc480 R15=0000000000000000
RIP=ffffffff854facac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fb9075696c0 ffffffff 00c00000
GS =0000 ffff8881a3c3d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b31e23ffc CR3=0000000110290000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fb9069a7498 00007fb9069a7470 XMM03=00007fb9069a74a8 00007fb9069a74a0
XMM04=00007fb90750d100 00007fb9069a7460 XMM05=00007fb9069a7478 00007fb9069a74c0
XMM06=00007fb9069a74b8 00007fb9069a74b0 XMM07=00007fb9069a74a8 00007fb9069a74a0
XMM08=0000000000000000 00007fb906812f0f XMM09=0000000000000000 00007fb906812fed
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
