last executing test programs:

1.14027417s ago: executing program 1 (id=1782):
r0 = socket$rxrpc(0x21, 0x2, 0x2)
connect$rxrpc(r0, &(0x7f0000002800)=@in4={0x21, 0x0, 0xa, 0x10}, 0x24)

1.139707828s ago: executing program 1 (id=1784):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt(r0, 0x0, 0x6, &(0x7f0000000080)=""/3, &(0x7f0000000040)=0x3)

1.052315825s ago: executing program 1 (id=1786):
r0 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10)
recvmmsg(r0, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000080)=""/9, 0x9}], 0x1, 0x0, 0x18}, 0xb7}], 0x1, 0x40002021, 0x0)
r1 = socket$tipc(0x1e, 0x5, 0x0)
sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f00000003c0)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f0000000340)=[{&(0x7f00000002c0)='/', 0x1}], 0x1, 0x0, 0x0, 0x1000a8d0}, 0x0)

1.051945888s ago: executing program 2 (id=1788):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000013c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000ffffffff7a0af0fff8ffff5979a4f0ff00000000b7060000ffffffff2d6405000000000065040400014741001404000001007d60b7030000000000006a0a00fe40000900850000001f000000b70000000004000095000000000000006623848adf1dc9a764ab51a064e0ff0c9b27a26293fddf0180000071ff31f1622271d5518193e09483c5a020c334f8c76334d8ce8303b01ddaa52e8756ad60a07d6f27c125e16d024098f755d8583da60f27c162dbba0700002ac9170f50f2568836077b7f711a18ebf608d87b885297b6a79819782748b376358c33c9f53bfd989b1ca58949a54d5827df14feecea46408a05d572077f1252fbb72c3d099c501bc4ded6fca17a3447222c95edb47b77aafa63b9dd5fa5c53e9c37251709f1ff7f0000f07bf7f53ce129a9ecd3b4dd15100f2b450f98526a0d8cac7c97fc2f64015306a1bd7e43fe1ca8345710fb6379b4c53cf55eefb4c0974486a8d25a363adbd83b49e13fbd1777b27020bd9b8cff3f48c9411670c34f23ab8caf7851b290feb3045a1b622f20c4383a0280f040de7667f8b1d0842835e81c358ebe73af41e5b5b924275cb1749289b44e9728e7a73f148ac8206afe120c1437490d99000000110000fdffffffffffffffaf580278e1342aabd1b623f6c4f128858e4eb6b42f2173184c2b99b645f6ec0e14e5d7c95a0008000000f30f6c0000000000ff0000b8f5001a1d2a34dc0973ec302bc23211d3e3b6e6dad65a51e5497a3419cecec38126247b27113ad4c7915c8f82c333a7b350802f0311807010d1ed50c18411aa6900daccc02f4ba4b078f07e41f781eee222c7d071d5a94d82ca9a0846c1af59cee16639b4970f8f0a82c6a712fd5722d637d406160ffaffffffb4e0bde6749aa52c408b74251914c5d3255fd88a42e7ebb69ebcd8eee623e51dbb1f1b548c91a6825c0686fdc16be1cbb72c217fda18bd746253ca66093daf35923300b600000000ac376e0a4649a8a84e1d293a6b109c5e59b366bca5cc3d936c53d4a48c05099e6fc36d5aa23bff8cce0600fcff00000300a568a8532623d12b40b50ac26f2e8255470a04bfbe7acb581b90991d965a01d1f84cb6b973558e1e3f8118c77ccf0b3c6eb6443870004da10c75723b65f83769ad1f0e4ef6b9ef1cec23264fd8fdac6264af1cb467020bdc12b797b6c156c439105829d2ae1c45f7cfa40df68fd36a03353a55a8a89b60317cd78ea1dc8e0f77f2c1e68ec7c01bd5a2028a8fc107007f3deb1f200abe1f753754678dae8b4e3ba3d086d4b95dfc5817e3dafae2d38b522f942cc750399d90296171fdb1e05882f8a4b8fbd219ccac3a895828b4f22b6527ce31ceb02b7b2b4492510134552f0b076b168394f8417f25cc82ae04007193cbe69de8bf35e4bebd15412426b2e20ab1f05fc44ae9ae094c1b81d3ef947692b44d2afb09c7498dedf0f87c38bbcab7357836f03e8a7c392e535694a3ead2de11e6b1781e2a018c0ada7bc7f0eb2d678f23c07ac341fda2e563ee95085742f5fee9f95f4741b226e428d20b00bc140000e4b2f5efd0a0b1ceba000830ba8634b5aa26bdbe91614e92fae3c7349531df9bf4c01ebf5d8eb7d53e5f30647661623fbdb3f60033fc32f68ea86a2df1e76fe27dfdff1cf9194849c4cc0da9533e5983693e526a7dc0d8728f3b573ca4427bdb44df9341e9b8050e896598a156c935c800436a312e7ae3c011e46851ac599f0427729ab9c55ae0ab4c0000000000000000000000000000c87bcc2ac5aed9247b51d92e0993af4beaf1f3f47dcdfab9165f98155d93e383d6b85158b54675c1585037508c1e9461a1c3d1a6e2402045cae150a7016f1a90716eebbdf6afc4414d900be0bdf19f4a273f44f4357380b4387f1c8b104f0e406b2f04e5ed88631be6411f9927fe9f83412b7c5a676ceec8b454ebf6481c98e86b6933a02daea0b4ec0be5b3d916bd70208b4588626c277648475002e2c62681bd07331422a6e47bbd40857d52c4894944fae5c500000000000000ff00000000de784314b8fd419216b48d0f353c11ae185749fa9ac7dfa16bc5c23a23f74b17a7f1b2d799480f33faa3537a910d6ca02f48b0e69beb1119f106ea59195dbc72e17a5dc8c3d131d82f067e29dc39665dff39fb6347b374aaaf6e65efde3f8f26283bcd93e80cacc6202bf29ccfcb08caf18d668a462493aa82e76affba9c9af31d1c23237aa6eccfadfaf794bb1004c07b21ac6ed77718098b2f722bd05fea3561b86b2838a8de5b4f91d6aba95dc9f4464a024be4d0d8d04f5023e7e19e503624d39a43c7b310de519b40738ff9a623065c06d69d16d4a46ff300022fee47803989b7e916254e0fb9e1c8b07d8a4b8b692a75a32e6ed2caeaa7c258c47fe6143cd9e90b801eff78cd4e402374e0e4ca07b7f17254e3d2f0a2a1bac6fde8a15e3ef3588065524d41966fb3915e804c53201efee751ec294584d23d9008bdf046f55c030ab941a0b8723412127efb3eac0ccf68133c76770d5e7dabcc48d47685404cc540535ed70df75c24660d85f9c9a245185c7da217d1c3743db85db67b9b8a8f00af02367429f6f0b53c169c4356751bf68745dbde055e1522ae256ae53ae637a1431855d16dfa91d82a021a4b2dbb50bf6d59fdd0c9bc84cd7b544de2523b6ce8aaeb94bfba75079f7455204ccca02bd389d8409b2effe9b88e301ac4fe28752386a0678a3f54b2bdf56f927ddd6b0ac98b2b505f668597455ada51ba95ab852b49373a11ff310601bcdd23acb4c01bcd2f3e1ad378d14c07d923087d3518369710b70ffb0b523dc4f00f275c381fe1c091e478b04d5e4a9f75b4072acb005a83c25625ab7affffffff7177e27a1bf112114eb10250c2b9dca234f8967f0439696a2345e747b5f1d8c4bec86d8e8f2eb121ea0159615e7d475d45837921c2c0c3f9e683ac8000214a657c9f0a00000000000000159596ac570c4b889106f937d56b2346c818917b727bf5e2741068ec000000000000000000ec84"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000880), 0xfffffffffffffddd}, 0x48)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r0, 0xffffff2a, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x8, 0x0, 0x0}}, 0x10)

1.002564441s ago: executing program 2 (id=1790):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000002340)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4509c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a900d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a3c0db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848022e8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0000000000000000000000000001545f0ec539c3b58facd2f62dc3307a6c91d6b"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48)
bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000001780)={@cgroup=r0, r0, 0x37, 0x2008, 0x4}, 0x20)

983.932473ms ago: executing program 2 (id=1792):
socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000002b00))

923.38543ms ago: executing program 2 (id=1794):
r0 = socket(0xa, 0x3, 0x87)
sendmmsg$unix(r0, &(0x7f0000000d40)=[{{&(0x7f0000000580)=@abs={0x0, 0x0, 0x84e24}, 0x6e, &(0x7f00000008c0)=[{0x0, 0xa00}, {&(0x7f0000000800)="42b63929779bc316fe8baf21f6af690ff67321456cdf71ac9ebab5a30378dde97cfcc29598b3bfff011674c6643d06260be6ef362cbd40759093deed134bf815d4e8072ba3f1a4e06856789e5716e769a09d83c8", 0x54}], 0x2, 0x0, 0x0, 0x80}}], 0x1, 0x20000000)

922.822359ms ago: executing program 2 (id=1796):
r0 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req3={0x54c, 0x4, 0x3, 0x3, 0xc, 0x6, 0x7}, 0x1c)
recvfrom(r0, &(0x7f0000000040)=""/18, 0x12, 0x6667b9fa4a4fda0, 0x0, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0x1, 0x2003, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xf}, {0xfff3, 0xfffe}, {0x10}}}, 0x24}}, 0x4000010)
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0)
r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000480)='kfree\x00', r2, 0x0, 0x7fffffffffffffff}, 0x18)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000003e000701feffffff00000000027c0000000039a0040008000c0001800600060008"], 0x30}, 0x1, 0x0, 0x0, 0x4000c000}, 0xc000)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94)
r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000400)='netfs_rreq_ref\x00', r5, 0x0, 0x9}, 0x18)
r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8)
close(r7)
bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="11000000ff7f0000ff0f00000900000000900000", @ANYRES32=r3, @ANYBLOB="008000"/20, @ANYRES32, @ANYBLOB="00000000020000000500"/20, @ANYRES32=r7, @ANYBLOB="173c07b2450dbfc532"], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, 0x0, 0x0}, 0x94)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000840)={&(0x7f00000009c0)={{0xeb9f, 0x1, 0x0, 0x18, 0xfffff, 0xc, 0xc, 0x2, [@fwd={0x8}]}}, 0x0, 0x26}, 0x28)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
r8 = socket(0x2a, 0x2, 0x0)
r9 = socket$vsock_stream(0x28, 0x1, 0x0)
setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r9, 0x28, 0x1, &(0x7f0000000480)=0xffffffff00000041, 0x8)
bind$vsock_stream(r9, &(0x7f0000000940), 0x10)
listen(r9, 0x0)
r10 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r10, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10)
writev(r10, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x20000081}], 0x1)
getsockname$packet(r8, 0x0, &(0x7f00000001c0))

795.561335ms ago: executing program 0 (id=1797):
r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
ioctl$sock_netrom_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={0x0, @default, @netrom={'nr', 0x0}, 0x3, 'syz0\x00', @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2, 0x8, [@null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]})

713.294957ms ago: executing program 0 (id=1798):
getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0))
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d3, &(0x7f00000000c0))

713.206122ms ago: executing program 0 (id=1799):
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'ip6gretap0\x00', @ifru_mtu=0x6})
ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000))

662.195368ms ago: executing program 0 (id=1800):
socket$nl_route(0x10, 0x3, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0)
ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000001c0)=0x3)
ioctl$PPPIOCGIDLE(r2, 0x8010743f, &(0x7f0000000100))
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000001e00), 0xffffffffffffffff)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000006c0f00000a"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000aac020000060a0b040000000000000000020000003c020480380201800a0001006d6174636800000028020280080002400000000114020300d67a8527f76ec1d39e537c4c3060c6a405106c72848aa8bcb429b3a20d532452032d5f166334739d1719a5778bd4f724ee4ca57f2527aeeb0c75755d68fc6fa55f4825682ee95e581039823e5963beedcf65b8b005623d90772b8b6ebd2498b0aff725a3eabb6c99cb2edfe10b9c33be8a971e08401bc0807e75a2ff376b7934473bc1f02bb512b77414daf260c9c7d4e1f0758b56ec5823892af310e6252fcfb1d9dbad362baa26f43f12f831fd221926d6536eeff641db46920ae0e48f3ff5de599714ba6510ce479d4116a519792281736f39c9fc0e10ef557392c43389271cebcf36543fcf6f83bf74b93ee4eb5e8c82e35bb4784cc1ed0ad291b16e8368487589f7590bf5896f340a36555a1cf69736da230a809176dbdfba3d47efb9a6932e5503d277532b7d4e6f7c7373a298e5843a9f74d5fd07fbc6ad22bc644ba9b3c94ec3c8f0b9321b16e5826b1f058f781760a5d4b6a8880202b41689139c37cd51f65a92d883f8901add03b650c9ec182fb565a4d657ebba9d6a5eb426b22d5933b72362e6ec327fb679aa8034b8b3b6680ad138be47652a3e77981187d2921cebfc1639aa280e3d38dba9b1af49ceded79c78a2d656b3a3e946e17e6257def6679f70f11aa01a2d906aecf4dbc7d1a332a8932ed719ce7eecb5450f494f944b3f6b637502ddba609c6e45dcfad1db7c7dda3e2c8d5ddcf27132985442e9b8df16f96c82e72e3e2491856d07756b9f08000100627066000900010073797a30000000000900020073797a3200000000440005800800024000000002080001"], 0x2d4}}, 0x4048010)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r5}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0xe, &(0x7f0000001b80)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000044000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d6200100000000000000ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a0932f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c43ff010000000000000128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee99367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57d31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e4a9f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001e40)={<r7=>0xffffffffffffffff})
sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f00)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002abd7000fedbdf2501000000100007800c00018008000100", @ANYRES32=r7, @ANYBLOB="0c0005004fc31bfd000000000c0002"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
r8 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f00000000c0)={'vcan0\x00', <r9=>0x0})
bind$can_j1939(r8, &(0x7f0000000340)={0x1d, r9, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18)
setsockopt$sock_int(r8, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="b4000000000000007910000000000000c300e4ff50000000950074000000000007cd68541c8ecf9531b5304b5cc21956f2bc86279e6ad8df17d9770ecf3cf86fc3e24813c30a62be8343fd64d83b7a67d4fe75024d408c8c6efad5de675dd7c2fd4bc5150ac10908d8ed5d462d8b3d226984e301c5303515a91caae004c5b15d99b0603e513689df039b1b3be2397b3e4ceded9089bc2e15d40b2051974e6b2478ae72cf47bee3a056433e3c9ec50f965cb28a3e9ed5f403cb7753bb80134316c458ef5fc56add28eb81da659d42e1efe216f3f7fe157783ba79e1b2d5f2212e804de42b27f23214bebff612b6287d969b02d2f8c9fa6eb8da5fb47c68478a3972a3760cab8ed724a951c4e98eb2fcf27e92142b602215c964"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195}, 0x48)
sendmsg$inet(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000080)="81b641f1f384100400b63c76b6", 0xd}], 0x1}, 0x4048081)
connect$can_j1939(r8, &(0x7f0000000000)={0x1d, r9, 0x3, {0x2, 0xff, 0x4}, 0xff}, 0x18)

414.269372ms ago: executing program 0 (id=1801):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000080)=0x100000001, 0x4)
connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x4000000, @ipv4={'\x00', '\xff\xff', @remote}, 0x401}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000300)=0x2, 0x54)
sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001600)="db02fec25f5a8a76dbe2bb39b45e486c8cc477fad2345fbed359e4577ce1fcf93def36fa0db7a254a771615ca10f33612b2ecf49c17c8d83fc0e1386fbcf8478ab33dae171a85dfc7734834b8f065ddfa4830025f61d3c509772d282485da1fea2ff8f32600a9c3b9d973da02df0408e371f91fc2ecc14bb0ae106547526a2011dd9169d691d9f960c8e2b79e339928a8c5614aa5ceee3e198931ddeebae9bc0fef21d6f75841dbe498166bdb39711b4b3ad9227bbb026e1a7d137cf455cec48d64d6042dd412ac67a2a5681e587cfc60c9a217830c80ade6ec24900934fd56787769caeb1634ba4d8a6227ff19255a046db5944fa66804821c5e883bc42527c0cd45decdd2de49d736f0d1a0789615f7c2f01b47fbff7cf9fde5f3dcf585c4aba8ead30b0718496354a644ebd28852ac37507c15c4393814e9d3772d18d2c0c10e1e0db916cfa18f83a59169a9f2be8043761e2b8d677d835f712906d68d2ec317e5d02a05e7b1139c74b46f28d05f84eb5ce2ddc23c7552fa085b6b269bb93c5369b496b2bc789284a11dc4a3a077852548bd2a993321288d7b06652dbcd36847bc3c7d4242bd409c3234649af8721836f5df78b21660362be669b39d97a670edb44a0b663ef02b21d564c22f8ccbd4948455ec009b52f74918002db3863385fc86d74b08462250659e28501cc4887eecc06cd0912e1cab4b80c58ed730d4d31433ad1bba79d14133b85bb6860f4d1d6bd21f8257d471720cda92f3cbc6297792178e86d2b8e08f7f3a56ba7cedf56346fca091ac390ece4fd36ba0426e6db2c2a2265dac1fb8ba3c1179c9c5cb1255bf6335e226a9f476890983bb6355206ea03f9c03c424c53bbf131c7eeb6d45fb0a8783037001c4f6a1d1ec828ef8742e885afdce47f776ec691fd27c5e5cae7c2957f5dc5f9aec4983bd10daccfb3b3ab2d35fd7a0690aa470c223f6dafbb71ba85a0bae41174c346db456ba3eaae2a2012a2be02285c049b9f5f948c7968b187a0d7726cca1ef9e4b971cb72c5fae99760e5ae7c609fc2be9f0a643b6dc3ef8f7472c9629465fab92437ce339d8d477a0b3b7c5127d02a4b1b75bfefff27c0fbc36bf682e28844e64b0bca1855a9ca1f37fffe394f43c242774e8fb60b826e319b9aa9b0770afcca41f339bb7d3667cdd01e7c6d66686993067c274d5ac72cb7856f1dcc5b0a1c508c44d3deeed9bdf9b9e2108b070813b776aa9fc41794cf36ecb779803412eb311a2e001f4a008eee5dd928a1bb97529ace6cdcf0ae194bb8ef460c1f7700c50cfe03ceb4f1f1dbc9a27010c9c011a7fef2526bacd7b7b8ea0c0fedd3f2dfc5a2599c90a8409bedef178741195f22ad8a922238f9a8e3fcdfef407ee1ca7d8ca5205511fe480d2ee822e9439e33544744f695bc067a3d4c3d23328f41af7228996e065d4008a4476a533b46ee8e686fbddc6a817ebbbe11b6d703c69db82b33e9b2b6af996a66359c3f63215971e53b623c", 0x42a}], 0x1}}], 0x1, 0x24000015)
recvmsg(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)=""/87, 0x57}, {&(0x7f00000003c0)=""/109, 0x6d}, {&(0x7f0000000440)=""/150, 0x96}, {&(0x7f0000000500)=""/191, 0xbf}, {&(0x7f00000005c0)=""/175, 0xaf}], 0x5}, 0x10002)

345.409689ms ago: executing program 0 (id=1802):
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x8, 0x0, 0x0)
r0 = socket(0x200000000000011, 0x2, 0xd)
bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
close(r2)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x0, 0x1, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20004040)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @random="e5db029ea53c"})
write$cgroup_devices(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="1e000300008c71ef28ff4b"], 0xffdd)

159.601113ms ago: executing program 1 (id=1803):
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x63, 0x11, 0x2f}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xb4}, @exit]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x70)

82.221576ms ago: executing program 1 (id=1804):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
shutdown(r0, 0x1)
shutdown(r0, 0x1)

15.595276ms ago: executing program 1 (id=1805):
r0 = socket(0x2, 0x2, 0x1)
bind$unix(r0, &(0x7f0000000000)=@abs, 0x6e)
connect$unix(r0, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e24}, 0x6e)

0s ago: executing program 2 (id=1806):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000d80)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in6=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d2, 0x33}, @in=@broadcast, {0x0, 0x0, 0x0, 0x40000, 0x2}, {}, {}, 0x0, 0x0, 0xa}}}, 0xf8}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x33}, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x29}}, {}, {}, {}, 0x0, 0x0, 0xa}}}, 0xf8}}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:7597' (ED25519) to the list of known hosts.
syzkaller login: [   47.389802][ T5747] cgroup: Unknown subsys name 'net'
[   47.519925][ T5747] cgroup: Unknown subsys name 'cpuset'
[   47.527163][ T5747] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   48.894946][ T5747] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   55.948260][ T5831] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   56.051512][ T5841] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   56.054505][ T5841] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   56.057556][ T5841] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   56.060919][ T5841] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   56.075370][ T5841] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   56.258359][ T5840] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   58.017304][ T5841] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   58.020512][ T5211] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   58.023250][ T5211] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   58.030152][ T5211] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   58.033109][ T5211] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   58.072073][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   58.076109][   T55] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   58.079774][   T55] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   58.082445][   T55] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   58.085732][   T55] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   58.092850][ T5879] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   58.097391][ T5879] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   58.110223][ T5878] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   58.115974][ T5878] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   58.119016][ T5878] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   58.395893][ T5871] chnl_net:caif_netlink_parms(): no params data found
[   58.401061][ T5875] chnl_net:caif_netlink_parms(): no params data found
[   58.443366][ T5873] chnl_net:caif_netlink_parms(): no params data found
[   58.535260][ T5875] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.538555][ T5875] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.541016][ T5875] bridge_slave_0: entered allmulticast mode
[   58.543774][ T5875] bridge_slave_0: entered promiscuous mode
[   58.555425][ T5871] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.557732][ T5871] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.560202][ T5871] bridge_slave_0: entered allmulticast mode
[   58.562909][ T5871] bridge_slave_0: entered promiscuous mode
[   58.590234][ T5875] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.593273][ T5875] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.596901][ T5875] bridge_slave_1: entered allmulticast mode
[   58.600859][ T5875] bridge_slave_1: entered promiscuous mode
[   58.613786][ T5871] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.617000][ T5871] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.619935][ T5871] bridge_slave_1: entered allmulticast mode
[   58.623615][ T5871] bridge_slave_1: entered promiscuous mode
[   58.640264][ T5873] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.643269][ T5873] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.647839][ T5873] bridge_slave_0: entered allmulticast mode
[   58.650721][ T5873] bridge_slave_0: entered promiscuous mode
[   58.676323][ T5873] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.679041][ T5873] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.681538][ T5873] bridge_slave_1: entered allmulticast mode
[   58.684555][ T5873] bridge_slave_1: entered promiscuous mode
[   58.695912][ T5875] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   58.700850][ T5871] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   58.705939][ T5875] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   58.718250][ T5871] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   58.723681][ T5873] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   58.743502][ T5873] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   58.769817][ T5871] team0: Port device team_slave_0 added
[   58.772904][ T5871] team0: Port device team_slave_1 added
[   58.782575][ T5875] team0: Port device team_slave_0 added
[   58.794028][ T5875] team0: Port device team_slave_1 added
[   58.803954][ T5873] team0: Port device team_slave_0 added
[   58.814103][ T5871] batman_adv: batadv0: Adding interface: batadv_slave_0
[   58.816630][ T5871] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   58.825036][ T5871] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   58.838283][ T5875] batman_adv: batadv0: Adding interface: batadv_slave_0
[   58.840598][ T5875] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   58.848914][ T5875] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   58.853314][ T5873] team0: Port device team_slave_1 added
[   58.862967][ T5871] batman_adv: batadv0: Adding interface: batadv_slave_1
[   58.865696][ T5871] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   58.873758][ T5871] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   58.882268][ T5875] batman_adv: batadv0: Adding interface: batadv_slave_1
[   58.884532][ T5875] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   58.892958][ T5875] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   58.906541][ T5873] batman_adv: batadv0: Adding interface: batadv_slave_0
[   58.908781][ T5873] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   58.917191][ T5873] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   58.921613][ T5873] batman_adv: batadv0: Adding interface: batadv_slave_1
[   58.923848][ T5873] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   58.932111][ T5873] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   58.987066][ T5873] hsr_slave_0: entered promiscuous mode
[   58.989691][ T5873] hsr_slave_1: entered promiscuous mode
[   59.003766][ T5871] hsr_slave_0: entered promiscuous mode
[   59.006921][ T5871] hsr_slave_1: entered promiscuous mode
[   59.009025][ T5871] debugfs: 'hsr0' already exists in 'hsr'
[   59.011005][ T5871] Cannot create hsr debugfs directory
[   59.041189][ T5875] hsr_slave_0: entered promiscuous mode
[   59.044063][ T5875] hsr_slave_1: entered promiscuous mode
[   59.047909][ T5875] debugfs: 'hsr0' already exists in 'hsr'
[   59.050212][ T5875] Cannot create hsr debugfs directory
[   59.286557][ T5873] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   59.297216][ T5873] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   59.302448][ T5873] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   59.312951][ T5873] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   59.363202][ T5871] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   59.368888][ T5871] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   59.375342][ T5871] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   59.396387][ T5871] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   59.436443][ T5875] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   59.445951][ T5875] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   59.456334][ T5875] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   59.467187][ T5875] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   59.557086][ T5873] 8021q: adding VLAN 0 to HW filter on device bond0
[   59.583797][ T5875] 8021q: adding VLAN 0 to HW filter on device bond0
[   59.596108][ T5873] 8021q: adding VLAN 0 to HW filter on device team0
[   59.602365][ T5871] 8021q: adding VLAN 0 to HW filter on device bond0
[   59.612986][ T5875] 8021q: adding VLAN 0 to HW filter on device team0
[   59.618739][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   59.621141][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   59.630465][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   59.632864][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   59.649264][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   59.651624][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   59.656632][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   59.659060][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   59.669787][ T5871] 8021q: adding VLAN 0 to HW filter on device team0
[   59.681489][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   59.683848][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   59.694059][ T5875] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   59.699624][ T5875] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   59.712933][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   59.715289][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   59.739912][ T5873] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   59.887359][ T5875] 8021q: adding VLAN 0 to HW filter on device batadv0
[   59.901811][ T5873] 8021q: adding VLAN 0 to HW filter on device batadv0
[   59.912252][ T5871] 8021q: adding VLAN 0 to HW filter on device batadv0
[   59.927818][ T5875] veth0_vlan: entered promiscuous mode
[   59.938773][ T5875] veth1_vlan: entered promiscuous mode
[   59.967145][ T5871] veth0_vlan: entered promiscuous mode
[   59.972869][ T5875] veth0_macvtap: entered promiscuous mode
[   59.987625][ T5871] veth1_vlan: entered promiscuous mode
[   59.990622][ T5875] veth1_macvtap: entered promiscuous mode
[   59.994350][ T5873] veth0_vlan: entered promiscuous mode
[   60.007336][ T5873] veth1_vlan: entered promiscuous mode
[   60.023986][ T5875] batman_adv: batadv0: Interface activated: batadv_slave_0
[   60.037100][ T5871] veth0_macvtap: entered promiscuous mode
[   60.041592][ T5875] batman_adv: batadv0: Interface activated: batadv_slave_1
[   60.050779][ T5871] veth1_macvtap: entered promiscuous mode
[   60.056421][ T5878] Bluetooth: hci0: command tx timeout
[   60.060723][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   60.068352][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   60.071594][ T5873] veth0_macvtap: entered promiscuous mode
[   60.074287][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   60.082346][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   60.089344][ T5871] batman_adv: batadv0: Interface activated: batadv_slave_0
[   60.101216][ T5873] veth1_macvtap: entered promiscuous mode
[   60.106827][ T5871] batman_adv: batadv0: Interface activated: batadv_slave_1
[   60.124565][ T5901] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   60.128013][ T5901] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   60.130737][ T5901] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   60.133455][ T5901] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   60.137094][ T5878] Bluetooth: hci1: command tx timeout
[   60.142972][ T5873] batman_adv: batadv0: Interface activated: batadv_slave_0
[   60.145506][ T5878] Bluetooth: hci2: command tx timeout
[   60.171947][ T5873] batman_adv: batadv0: Interface activated: batadv_slave_1
[   60.194233][ T5698] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   60.211736][ T5698] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   60.230761][ T5698] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   60.240252][ T5698] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   60.240513][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.246511][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.278721][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.281481][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.301422][  T526] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.306867][  T526] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.330885][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.334545][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.367203][ T1089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.379118][ T1089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.426812][ T3626] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   60.433645][ T3626] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.501777][ T5944] netlink: 'syz.2.25': attribute type 15 has an invalid length.
[   60.504392][ T5944] netlink: 666 bytes leftover after parsing attributes in process `syz.2.25'.
[   60.739846][ T5971] netlink: 20 bytes leftover after parsing attributes in process `syz.2.38'.
[   60.942850][ T5989] syz.2.47 uses obsolete (PF_INET,SOCK_PACKET)
[   61.235326][ T6011] bridge0: port 2(bridge_slave_1) entered disabled state
[   61.486983][ T6030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'.
[   61.489939][ T6030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'.
[   61.493041][ T6030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'.
[   61.501917][ T6030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'.
[   61.507551][ T6030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'.
[   61.511276][ T6030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'.
[   61.515182][ T6030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'.
[   61.519081][ T6030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'.
[   62.135095][ T5878] Bluetooth: hci0: command tx timeout
[   62.213445][ T6077] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   62.226309][ T5878] Bluetooth: hci2: command tx timeout
[   62.226362][ T5841] Bluetooth: hci1: command tx timeout
[   62.374157][ T6090] netlink: 'syz.2.93': attribute type 21 has an invalid length.
[   62.954128][ T6132] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[   62.957939][ T6132] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[   63.008049][ T6138] netlink: 'syz.0.113': attribute type 5 has an invalid length.
[   63.812204][ T6195] netlink: 'syz.1.139': attribute type 3 has an invalid length.
[   63.912085][ T6202] Driver unsupported XDP return value 0 on prog  (id 21) dev N/A, expect packet loss!
[   64.014174][ T6208] pim6reg1: entered promiscuous mode
[   64.017818][ T6208] pim6reg1: entered allmulticast mode
[   64.215295][ T5841] Bluetooth: hci0: command tx timeout
[   64.302962][ T5841] Bluetooth: hci1: command tx timeout
[   64.306396][ T5841] Bluetooth: hci2: command tx timeout
[   64.451870][ T6234] Zero length message leads to an empty skb
[   64.756843][ T6256] warning: `syz.0.167' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   64.768089][ T6256] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   65.419195][ T6270] netlink: 'syz.1.172': attribute type 5 has an invalid length.
[   65.594287][ T6280] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5
[   65.781592][ T6293] __nla_validate_parse: 55 callbacks suppressed
[   65.781612][ T6293] netlink: 8 bytes leftover after parsing attributes in process `syz.2.181'.
[   65.883744][ T6297] netlink: 240 bytes leftover after parsing attributes in process `syz.0.184'.
[   65.890788][ T6297] netlink: 48 bytes leftover after parsing attributes in process `syz.0.184'.
[   65.948816][ T6303] netlink: 16 bytes leftover after parsing attributes in process `syz.0.187'.
[   65.953734][ T6302] netlink: 48 bytes leftover after parsing attributes in process `syz.1.185'.
[   66.295119][ T5841] Bluetooth: hci0: command tx timeout
[   66.374997][ T5841] Bluetooth: hci2: command tx timeout
[   66.375294][ T5878] Bluetooth: hci1: command tx timeout
[   67.376105][ T6397] vlan2: entered allmulticast mode
[   67.378324][ T6397] syz_tun: entered allmulticast mode
[   67.506525][ T6402] netlink: 24 bytes leftover after parsing attributes in process `syz.2.233'.
[   67.745948][ T6402] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.233'.
[   67.812789][ T6413] netlink: 8 bytes leftover after parsing attributes in process `syz.2.238'.
[   67.889613][ T6413] openvswitch: netlink: nsh attribute has 65520 unknown bytes.
[   67.916369][ T6413] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   68.186558][ T6424] netlink: 56 bytes leftover after parsing attributes in process `syz.2.244'.
[   68.300115][ T6424] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input6
[   69.114368][ T6459] netlink: 248 bytes leftover after parsing attributes in process `syz.0.257'.
[   69.840273][ T6489] ICMPv6: NA: aa:aa:aa:aa:aa:00 advertised our address fe80::aa on syz_tun!
[   69.863213][ T6492] netlink: 'syz.1.270': attribute type 11 has an invalid length.
[   70.273809][ T6511] 8021q: adding VLAN 0 to HW filter on device bond1
[   71.209513][ T6561] __nla_validate_parse: 3 callbacks suppressed
[   71.209533][ T6561] netlink: 28 bytes leftover after parsing attributes in process `syz.0.296'.
[   71.215825][ T6561] netlink: 28 bytes leftover after parsing attributes in process `syz.0.296'.
[   71.230928][ T6561] gretap0: entered promiscuous mode
[   71.246817][ T6561] gretap0: left promiscuous mode
[   71.262102][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[   71.276455][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[   71.691076][ T6592] netlink: 'syz.1.307': attribute type 1 has an invalid length.
[   71.748365][ T6592] bond1: entered promiscuous mode
[   71.752118][ T6592] 8021q: adding VLAN 0 to HW filter on device bond1
[   71.788220][ T6597] bond1: (slave bridge1): making interface the new active one
[   71.791822][ T6597] bridge1: entered promiscuous mode
[   71.799446][ T6597] bond1: (slave bridge1): Enslaving as an active interface with an up link
[   71.973011][ T6612] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) !
[   72.081565][ T6613] syzkaller1: entered allmulticast mode
[   73.001678][ T6670] sock: sock_timestamping_bind_phc: sock not bind to device
[   73.129564][ T6679] netlink: 'syz.2.343': attribute type 3 has an invalid length.
[   73.132873][ T6679] netlink: 8 bytes leftover after parsing attributes in process `syz.2.343'.
[   73.416993][  T790] IPVS: starting estimator thread 0...
[   73.505151][ T6691] IPVS: using max 51 ests per chain, 122400 per kthread
[   74.118748][ T6717] netlink: 16 bytes leftover after parsing attributes in process `syz.2.361'.
[   74.170298][ T6721] tipc: Started in network mode
[   74.172343][ T6721] tipc: Node identity 168f703d5f9a, cluster identity 4711
[   74.179241][ T6721] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   74.183069][ T6721] syzkaller0: entered promiscuous mode
[   74.187549][ T6721] syzkaller0: entered allmulticast mode
[   74.230682][ T6721] tipc: Resetting bearer <eth:syzkaller0>
[   74.259315][ T6720] tipc: Resetting bearer <eth:syzkaller0>
[   74.288215][ T6720] tipc: Disabling bearer <eth:syzkaller0>
[   74.537880][ T6745] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (2878)
[   74.554494][ T6745] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255
[   74.743039][ T6751] mac80211_hwsim hwsim3 wlan0: entered promiscuous mode
[   74.751943][ T6751] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[   74.771179][ T6763] syzkaller1: entered promiscuous mode
[   74.773662][ T6763] syzkaller1: entered allmulticast mode
[   74.822679][ T6765] batadv_slave_0: entered promiscuous mode
[   74.875956][ T6758] netlink: 32 bytes leftover after parsing attributes in process `syz.1.381'.
[   75.258760][ T6757] batadv_slave_0: left promiscuous mode
[   75.412171][ T6795] netlink: 'syz.0.394': attribute type 1 has an invalid length.
[   75.428273][ T6795] netlink: 'syz.0.394': attribute type 10 has an invalid length.
[   75.431171][ T6795] netlink: 236 bytes leftover after parsing attributes in process `syz.0.394'.
[   76.481244][ T6840] netlink: 140 bytes leftover after parsing attributes in process `syz.2.412'.
[   77.299587][ T6889] netlink: 8 bytes leftover after parsing attributes in process `syz.2.434'.
[   77.399276][   T13] nci: nci_add_new_protocol: the target found does not have the desired protocol
[   77.457747][ T6899] netlink: 12 bytes leftover after parsing attributes in process `syz.0.437'.
[   78.498026][ T6961] netlink: 4 bytes leftover after parsing attributes in process `syz.0.467'.
[   78.501376][ T6961] netlink: 12 bytes leftover after parsing attributes in process `syz.0.467'.
[   79.549110][ T7051] netlink: 100 bytes leftover after parsing attributes in process `syz.1.510'.
[   79.552898][ T7051] netlink: 100 bytes leftover after parsing attributes in process `syz.1.510'.
[   79.898415][ T7073] netlink: 'syz.1.522': attribute type 3 has an invalid length.
[   79.913059][ T7073] syz_tun: entered allmulticast mode
[   79.939218][ T7073] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   79.964207][ T7073] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[   80.031269][ T7079] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   80.076741][ T7072] syz_tun: left allmulticast mode
[   81.302012][ T7143] netlink: 'syz.0.549': attribute type 7 has an invalid length.
[   81.307462][ T7143] netlink: 244 bytes leftover after parsing attributes in process `syz.0.549'.
[   81.506959][   T24] cfg80211: failed to load regulatory.db
[   81.778139][ T7172] tc_dump_action: action bad kind
[   82.171498][   T33] audit: type=1800 audit(1754678349.088:2): pid=7170 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.560" name="cgroup.controllers" dev="tmpfs" ino=1044 res=0 errno=0
[   82.239206][ T7196] IPv6: NLM_F_REPLACE set, but no existing node found!
[   82.350209][ T7204] lo: entered promiscuous mode
[   82.355935][ T7204] tunl0: entered promiscuous mode
[   82.364905][ T7204] gre0: entered promiscuous mode
[   82.420372][ T7204] gretap0: entered promiscuous mode
[   82.439370][ T7204] erspan0: entered promiscuous mode
[   82.463708][ T7204] ip_vti0: entered promiscuous mode
[   82.478091][ T7204] ip6_vti0: entered promiscuous mode
[   82.483455][ T7204] sit0: entered promiscuous mode
[   82.528916][ T7204] ip6tnl0: entered promiscuous mode
[   82.533989][ T7204] ip6gre0: entered promiscuous mode
[   82.540872][ T7204] syz_tun: entered promiscuous mode
[   82.547853][ T7204] ip6gretap0: entered promiscuous mode
[   82.553956][ T7204] bridge0: port 1(bridge_slave_0) entered disabled state
[   82.563995][ T7204] bridge0: entered promiscuous mode
[   82.569952][ T7204] vcan0: entered promiscuous mode
[   82.573161][ T7204] bond0: entered promiscuous mode
[   82.575205][ T7204] bond_slave_0: entered promiscuous mode
[   82.578305][ T7204] bond_slave_1: entered promiscuous mode
[   82.585688][ T7204] team0: entered promiscuous mode
[   82.587764][ T7204] team_slave_0: entered promiscuous mode
[   82.590259][ T7204] team_slave_1: entered promiscuous mode
[   82.594504][ T7204] dummy0: entered promiscuous mode
[   82.602598][ T7204] nlmon0: entered promiscuous mode
[   82.606928][ T7204] caif0: entered promiscuous mode
[   82.609692][ T7204] batadv0: entered promiscuous mode
[   82.615399][ T7204] vxcan0: entered promiscuous mode
[   82.617966][ T7204] vxcan1: entered promiscuous mode
[   82.620494][ T7204] veth0: entered promiscuous mode
[   82.636807][ T7204] veth1: entered promiscuous mode
[   82.647208][ T7204] wg0: entered promiscuous mode
[   82.651726][ T7204] wg1: entered promiscuous mode
[   82.656393][ T7204] wg2: entered promiscuous mode
[   82.659918][ T7204] veth0_to_bridge: entered promiscuous mode
[   82.665955][ T7204] veth1_to_bridge: entered promiscuous mode
[   82.669742][ T7204] veth0_to_bond: entered promiscuous mode
[   82.674039][ T7204] veth1_to_bond: entered promiscuous mode
[   82.681153][ T7204] veth0_to_team: entered promiscuous mode
[   82.686900][ T7204] veth1_to_team: entered promiscuous mode
[   82.692824][ T7204] veth0_to_batadv: entered promiscuous mode
[   82.697771][ T7204] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   82.700931][ T7204] batadv_slave_0: entered promiscuous mode
[   82.704995][ T7204] veth1_to_batadv: entered promiscuous mode
[   82.709195][ T7204] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   82.711857][ T7204] batadv_slave_1: entered promiscuous mode
[   82.715928][ T7204] xfrm0: entered promiscuous mode
[   82.719234][ T7204] veth0_to_hsr: entered promiscuous mode
[   82.723837][ T7204] veth1_to_hsr: entered promiscuous mode
[   82.728917][ T7204] hsr0: entered promiscuous mode
[   82.732993][ T7204] veth1_virt_wifi: entered promiscuous mode
[   82.738032][ T7204] veth0_virt_wifi: entered promiscuous mode
[   82.742070][ T7204] net veth1_virt_wifi virt_wifi0: entered promiscuous mode
[   82.753456][ T7204] vlan0: entered promiscuous mode
[   82.760807][ T7204] vlan1: entered promiscuous mode
[   82.763304][ T7204] macvlan0: entered promiscuous mode
[   82.768527][ T7204] macvlan1: entered promiscuous mode
[   82.773041][ T7204] ipvlan0: entered promiscuous mode
[   82.775512][ T7204] ipvlan1: entered promiscuous mode
[   82.783011][ T7204] macvtap0: entered promiscuous mode
[   82.788153][ T7204] macsec0: entered promiscuous mode
[   82.793265][ T7204] geneve0: entered promiscuous mode
[   82.798848][ T7204] geneve1: entered promiscuous mode
[   82.803073][ T7204] netdevsim netdevsim1 netdevsim0: entered promiscuous mode
[   82.808771][ T7204] netdevsim netdevsim1 netdevsim1: entered promiscuous mode
[   82.814102][ T7204] netdevsim netdevsim1 netdevsim2: entered promiscuous mode
[   82.825313][ T7204] netdevsim netdevsim1 netdevsim3: entered promiscuous mode
[   82.839544][ T7204] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[   82.850252][ T7204] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode
[   82.857688][ T7204] syztnl0: entered promiscuous mode
[   82.880274][ T7229] syz0: Port: 1 Link DOWN
[   82.880362][   T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.893431][   T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.907300][ T5698] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.914776][ T5698] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   83.209077][ T7246] tipc: Started in network mode
[   83.211279][ T7246] tipc: Node identity daf1327ceef7, cluster identity 4711
[   83.215305][ T7246] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   83.248132][ T7246] syzkaller0: entered promiscuous mode
[   83.250370][ T7246] syzkaller0: entered allmulticast mode
[   83.253057][ T7246] tipc: Resetting bearer <eth:syzkaller0>
[   83.267174][ T7245] tipc: Resetting bearer <eth:syzkaller0>
[   83.818591][ T7248] netlink: 100 bytes leftover after parsing attributes in process `syz.2.589'.
[   84.104081][ T7245] tipc: Disabling bearer <eth:syzkaller0>
[   84.146573][ T7253] netlink: 'syz.2.591': attribute type 1 has an invalid length.
[   84.188970][ T7253] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address
[   84.195347][ T7253] bond1: (slave vxcan3): Error -95 calling set_mac_address
[   84.244180][ T7257] gretap1: entered promiscuous mode
[   84.250983][ T7257] bond1: (slave gretap1): making interface the new active one
[   84.256979][ T7257] bond1: (slave gretap1): Enslaving as an active interface with an up link
[   84.394075][ T7265] netlink: 4 bytes leftover after parsing attributes in process `syz.0.596'.
[   84.447663][ T7265] netlink: 'syz.0.596': attribute type 1 has an invalid length.
[   84.451396][ T7265] netlink: 5624 bytes leftover after parsing attributes in process `syz.0.596'.
[   84.513498][ T7274] netlink: 56 bytes leftover after parsing attributes in process `syz.2.597'.
[   84.591542][ T7281] netlink: 'syz.1.599': attribute type 1 has an invalid length.
[   84.614408][ T7274] netlink: 152 bytes leftover after parsing attributes in process `syz.2.597'.
[   84.947404][ T7297] bridge0: port 2(bridge_slave_1) entered disabled state
[   84.951358][ T7297] bridge0: port 1(bridge_slave_0) entered disabled state
[   85.052255][ T7297] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   85.065973][ T7297] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   85.183692][   T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   85.194111][   T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   85.206823][   T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   85.210663][   T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   85.350985][ T7322] netlink: 56 bytes leftover after parsing attributes in process `syz.0.612'.
[   85.367723][ T7322] netlink: 56 bytes leftover after parsing attributes in process `syz.0.612'.
[   85.623046][ T7348] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[   85.627653][ T7347] IPVS: stopping backup sync thread 7348 ...
[   86.149610][ T7376] !: renamed from dummy0
[   86.473769][ T7402] netlink: 24 bytes leftover after parsing attributes in process `syz.2.644'.
[   86.877079][ T5698] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   86.881305][ T5698] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   86.891236][ T5698] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   86.903899][ T5698] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   87.436188][ T7496] trusted_key: syz.0.663 sent an empty control message without MSG_MORE.
[   87.494520][ T7501] Bluetooth: MGMT ver 1.23
[   87.509564][ T7502] tun0: tun_chr_ioctl cmd 1074025675
[   87.511466][ T7502] tun0: persist enabled
[   87.514092][ T7502] tun0: tun_chr_ioctl cmd 1074025675
[   87.516433][ T7502] tun0: persist enabled
[   87.600237][ T7501] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   87.702867][ T7501] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   87.776232][ T7501] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   87.861380][ T7501] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   88.012226][   T12] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   88.025813][ T7526] openvswitch: netlink: IP tunnel dst address not specified
[   88.029777][   T12] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   88.044120][   T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   88.067649][   T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   88.960300][ T7564] netlink: 356 bytes leftover after parsing attributes in process `syz.0.693'.
[   89.001017][ T7566] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   89.294580][ T7576] tun0: tun_chr_ioctl cmd 1074812117
[   89.337376][ T7580] netlink: 'syz.0.701': attribute type 1 has an invalid length.
[   89.340646][ T7580] netlink: 228 bytes leftover after parsing attributes in process `syz.0.701'.
[   89.396273][ T7584] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[   89.452421][ T7589] netlink: 36 bytes leftover after parsing attributes in process `syz.0.702'.
[   89.456295][ T7589] netlink: 16 bytes leftover after parsing attributes in process `syz.0.702'.
[   89.459279][ T7589] netlink: 36 bytes leftover after parsing attributes in process `syz.0.702'.
[   89.462281][ T7589] netlink: 36 bytes leftover after parsing attributes in process `syz.0.702'.
[   89.659256][ T7508] Set syz1 is full, maxelem 65536 reached
[   89.729307][ T7600] netlink: 'syz.2.708': attribute type 2 has an invalid length.
[   89.736489][ T7600] netlink: 240 bytes leftover after parsing attributes in process `syz.2.708'.
[   89.804610][ T7602] netlink: 'syz.1.710': attribute type 1 has an invalid length.
[   90.249744][ T7611] netlink: 28 bytes leftover after parsing attributes in process `syz.1.714'.
[   90.707508][ T7640] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms
[   90.712477][ T7640] (unnamed net_device) (uninitialized): option use_carrier: invalid value (5)
[   90.834143][ T7648] netlink: 96 bytes leftover after parsing attributes in process `syz.1.731'.
[   90.913679][ T7652] syzkaller1: entered promiscuous mode
[   90.918587][ T7652] syzkaller1: entered allmulticast mode
[   91.219862][ T7670] netlink: 277 bytes leftover after parsing attributes in process `syz.2.742'.
[   91.352219][ T7677] only policy match revision 0 supported
[   91.352238][ T7677] unable to load match
[   91.514226][ T7687] A link change request failed with some changes committed already. Interface ip6gre0 may have been left with an inconsistent configuration, please check.
[   91.819157][ T7709] tipc: Started in network mode
[   91.821232][ T7709] tipc: Node identity 9a48b0ac0e2f, cluster identity 4711
[   91.825340][ T7709] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   91.855776][ T7709] syzkaller0: entered promiscuous mode
[   91.858143][ T7709] syzkaller0: entered allmulticast mode
[   91.862069][ T7709] tipc: Resetting bearer <eth:syzkaller0>
[   91.888771][ T7708] tipc: Resetting bearer <eth:syzkaller0>
[   92.887168][ T7708] tipc: Disabling bearer <eth:syzkaller0>
[   92.887533][   T10] tipc: Node number set to 2489823404
[   92.951004][ T7733] netlink: 'syz.0.768': attribute type 1 has an invalid length.
[   92.985000][ T7733] 8021q: adding VLAN 0 to HW filter on device bond2
[   93.006316][ T7733] bond2: (slave gretap1): making interface the new active one
[   93.010955][ T7733] bond2: (slave gretap1): Enslaving as an active interface with an up link
[   93.044194][ T7738] netlink: 'syz.2.770': attribute type 1 has an invalid length.
[   93.447279][  T790] IPVS: starting estimator thread 0...
[   93.535505][ T7777] IPVS: using max 80 ests per chain, 192000 per kthread
[   94.446223][ T7847] __nla_validate_parse: 1 callbacks suppressed
[   94.446234][ T7847] netlink: 40 bytes leftover after parsing attributes in process `syz.1.821'.
[   94.599143][ T7820] syz.2.810 (7820) used greatest stack depth: 19736 bytes left
[   94.791789][ T7864] netlink: 8 bytes leftover after parsing attributes in process `syz.2.829'.
[   94.917239][ T7872] veth1_to_bond: entered allmulticast mode
[   94.999428][ T7876] Bluetooth: MGMT ver 1.23
[   95.063837][ T7884] netlink: 'syz.0.839': attribute type 5 has an invalid length.
[   95.067352][ T7884] netlink: 24 bytes leftover after parsing attributes in process `syz.0.839'.
[   95.107466][ T7886] netlink: 'syz.0.840': attribute type 2 has an invalid length.
[   95.373119][ T7891] netlink: 4 bytes leftover after parsing attributes in process `syz.1.842'.
[   97.090404][ T7909] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[   98.125851][ T7976] netlink: 32 bytes leftover after parsing attributes in process `syz.1.872'.
[   98.143704][ T7976] netlink: 36 bytes leftover after parsing attributes in process `syz.1.872'.
[   98.229308][ T7982] netlink: 168 bytes leftover after parsing attributes in process `syz.0.876'.
[   98.346371][ T7984] netlink: 'syz.0.877': attribute type 1 has an invalid length.
[   98.621259][ T8007] netlink: 68 bytes leftover after parsing attributes in process `syz.0.888'.
[  100.100138][ T8059] netlink: 'syz.0.907': attribute type 9 has an invalid length.
[  100.588476][ T8085] geneve3: entered promiscuous mode
[  100.592683][ T5698] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 20000 - 0
[  100.602367][ T5698] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 20000 - 0
[  100.608217][ T5698] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 20000 - 0
[  100.614953][   T12] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 20000 - 0
[  101.221719][ T8142] netlink: 'syz.2.946': attribute type 1 has an invalid length.
[  101.221747][ T8141] netlink: 'syz.0.944': attribute type 39 has an invalid length.
[  101.241187][ T8142] netlink: 3 bytes leftover after parsing attributes in process `syz.2.946'.
[  101.452462][ T8161] netlink: 'syz.1.956': attribute type 3 has an invalid length.
[  101.457235][ T8161] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.956'.
[  101.500205][ T8164] netlink: 32 bytes leftover after parsing attributes in process `syz.0.957'.
[  101.507511][ T8164] netlink: 32 bytes leftover after parsing attributes in process `syz.0.957'.
[  101.594556][ T8171] netlink: 'syz.1.960': attribute type 8 has an invalid length.
[  101.720696][ T8180] netlink: 4 bytes leftover after parsing attributes in process `syz.1.963'.
[  101.740993][ T8180] bond0: (slave bond_slave_1): Releasing backup interface
[  102.057788][ T8189] netlink: 'syz.2.967': attribute type 303 has an invalid length.
[  102.070849][ T8189] netlink: 8 bytes leftover after parsing attributes in process `syz.2.967'.
[  102.079389][ T8189] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  102.082588][ T8189] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  102.093381][ T8195] netlink: 12 bytes leftover after parsing attributes in process `syz.1.970'.
[  102.387079][ T8203] netlink: 'syz.1.973': attribute type 7 has an invalid length.
[  102.390343][ T8203] netlink: 'syz.1.973': attribute type 8 has an invalid length.
[  102.393624][ T8203] netlink: 'syz.1.973': attribute type 4 has an invalid length.
[  102.397643][ T8203] netlink: 204 bytes leftover after parsing attributes in process `syz.1.973'.
[  102.496913][ T8207] netlink: 'syz.1.975': attribute type 23 has an invalid length.
[  102.778576][ T8228] netlink: 36 bytes leftover after parsing attributes in process `syz.1.985'.
[  102.791944][ T8228] netlink: 36 bytes leftover after parsing attributes in process `syz.1.985'.
[  102.923336][ T8242] (unnamed net_device) (uninitialized): option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0)
[  103.208408][ T8271] sock: sock_set_timeout: `syz.2.1004' (pid 8271) tries to set negative timeout
[  103.816059][ T8308] bridge_slave_1: left allmulticast mode
[  103.818382][ T8308] bridge_slave_1: left promiscuous mode
[  103.821019][ T8308] bridge0: port 2(bridge_slave_1) entered disabled state
[  103.830452][ T8308] bridge_slave_0: left allmulticast mode
[  103.832915][ T8308] bridge_slave_0: left promiscuous mode
[  103.836695][ T8308] bridge0: port 1(bridge_slave_0) entered disabled state
[  104.238668][ T8344] pim6reg: entered allmulticast mode
[  104.448503][ T8363] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  104.452772][ T8363] syzkaller0: entered promiscuous mode
[  104.455696][ T8363] syzkaller0: entered allmulticast mode
[  104.496135][ T8363] tipc: Resetting bearer <eth:syzkaller0>
[  104.499747][ T8362] tipc: Resetting bearer <eth:syzkaller0>
[  104.512867][ T8362] tipc: Disabling bearer <eth:syzkaller0>
[  105.149960][ T8408] sit0: left promiscuous mode
[  105.164237][ T8399] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20003
[  105.219898][ T8412] validate_nla: 2 callbacks suppressed
[  105.219909][ T8412] netlink: 'syz.0.1070': attribute type 1 has an invalid length.
[  105.376756][ T8420] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  105.403141][ T8420] batman_adv: batadv0: Removing interface: batadv_slave_0
[  106.280718][ T8467] __nla_validate_parse: 10 callbacks suppressed
[  106.280734][ T8467] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1094'.
[  106.306623][ T8467] sch_tbf: burst 1476 is lower than device bridge3 mtu (1514) !
[  106.404385][ T8477] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1100'.
[  106.982121][ T8512] netlink: 'syz.1.1108': attribute type 3 has an invalid length.
[  108.021576][ T8578] batman_adv: batadv0: Removing interface: batadv_slave_0
[  108.032245][ T8578] batman_adv: batadv0: Removing interface: batadv_slave_1
[  108.091981][ T8582] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1149'.
[  108.232552][ T8595] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  108.247157][ T8593] lo: entered promiscuous mode
[  108.249256][ T8593] tunl0: entered promiscuous mode
[  108.251403][ T8593] gre0: entered promiscuous mode
[  108.253354][ T8593] gretap0: entered promiscuous mode
[  108.255322][ T8593] erspan0: entered promiscuous mode
[  108.257292][ T8593] ip_vti0: entered promiscuous mode
[  108.259331][ T8593] ip6_vti0: entered promiscuous mode
[  108.261300][ T8593] sit0: entered promiscuous mode
[  108.263330][ T8593] ip6tnl0: entered promiscuous mode
[  108.265562][ T8593] ip6gre0: entered promiscuous mode
[  108.268498][ T8593] syz_tun: entered promiscuous mode
[  108.270803][ T8593] ip6gretap0: entered promiscuous mode
[  108.272803][ T8593] vcan0: entered promiscuous mode
[  108.274764][ T8593] bond0: entered promiscuous mode
[  108.276554][ T8593] bond_slave_0: entered promiscuous mode
[  108.278668][ T8593] bond_slave_1: entered promiscuous mode
[  108.280854][ T8593] team0: entered promiscuous mode
[  108.282696][ T8593] team_slave_0: entered promiscuous mode
[  108.286535][ T8593] team_slave_1: entered promiscuous mode
[  108.290719][ T8593] !: entered promiscuous mode
[  108.296724][ T8593] nlmon0: entered promiscuous mode
[  108.300075][ T8593] caif0: entered promiscuous mode
[  108.302210][ T8593] batadv0: entered promiscuous mode
[  108.304386][ T8593] veth0: entered promiscuous mode
[  108.307977][ T8593] veth1: entered promiscuous mode
[  108.310018][ T8593] wg1: entered promiscuous mode
[  108.311848][ T8593] wg2: entered promiscuous mode
[  108.313589][ T8593] veth0_to_bridge: entered promiscuous mode
[  108.316116][ T8593] bridge_slave_0: entered promiscuous mode
[  108.318562][ T8593] veth1_to_bridge: entered promiscuous mode
[  108.321304][ T8593] bridge_slave_1: entered promiscuous mode
[  108.324205][ T8593] veth0_to_bond: entered promiscuous mode
[  108.327169][ T8593] veth1_to_bond: entered promiscuous mode
[  108.329453][ T8593] veth0_to_team: entered promiscuous mode
[  108.331700][ T8593] veth1_to_team: entered promiscuous mode
[  108.333912][ T8593] veth0_to_batadv: entered promiscuous mode
[  108.336166][ T8593] batadv_slave_0: entered promiscuous mode
[  108.338917][ T8593] veth1_to_batadv: entered promiscuous mode
[  108.341894][ T8593] batadv_slave_1: entered promiscuous mode
[  108.344501][ T8593] xfrm0: entered promiscuous mode
[  108.346900][ T8593] veth0_to_hsr: entered promiscuous mode
[  108.349433][ T8593] veth1_to_hsr: entered promiscuous mode
[  108.352104][ T8593] hsr0: entered promiscuous mode
[  108.354530][ T8593] veth1_virt_wifi: entered promiscuous mode
[  108.357489][ T8593] veth0_virt_wifi: entered promiscuous mode
[  108.360449][ T8593] net veth1_virt_wifi virt_wifi0: entered promiscuous mode
[  108.364395][ T8593] vlan0: entered promiscuous mode
[  108.367409][ T8593] vlan1: entered promiscuous mode
[  108.370212][ T8593] macvlan0: entered promiscuous mode
[  108.373009][ T8593] macvlan1: entered promiscuous mode
[  108.376371][ T8593] ipvlan0: entered promiscuous mode
[  108.378972][ T8593] ipvlan1: entered promiscuous mode
[  108.381378][ T8593] macvtap0: entered promiscuous mode
[  108.383945][ T8593] macsec0: entered promiscuous mode
[  108.386436][ T8593] geneve0: entered promiscuous mode
[  108.388896][ T8593] geneve1: entered promiscuous mode
[  108.391195][ T8593] netdevsim netdevsim0 netdevsim0: entered promiscuous mode
[  108.393905][ T8593] netdevsim netdevsim0 netdevsim1: entered promiscuous mode
[  108.396992][ T8593] netdevsim netdevsim0 netdevsim2: entered promiscuous mode
[  108.399808][ T8593] netdevsim netdevsim0 netdevsim3: entered promiscuous mode
[  108.402479][ T8593] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode
[  108.405034][ T8593] syztnl2: entered promiscuous mode
[  108.407315][ T8593] bond1: entered promiscuous mode
[  108.409301][ T8593] tun0: entered promiscuous mode
[  108.411660][ T8593] ip6erspan0: entered promiscuous mode
[  108.415227][ T8593] bond2: entered promiscuous mode
[  108.417134][ T8593] gretap1: entered promiscuous mode
[  108.425461][ T8593] veth2: entered promiscuous mode
[  108.427321][ T8593] veth3: entered promiscuous mode
[  108.429547][ T8593] bridge0: entered promiscuous mode
[  108.452553][ T8595] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  108.546519][ T8595] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  108.594633][ T8595] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  108.675453][   T13] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  108.689397][ T5698] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  108.699837][ T5698] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  108.709470][   T13] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  108.941798][ T8613] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1162'.
[  108.967672][ T8617] sock: sock_set_timeout: `syz.1.1163' (pid 8617) tries to set negative timeout
[  109.043568][ T8623] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1166'.
[  109.660203][ T8632] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.1170'.
[  109.747700][ T8638] GUP no longer grows the stack in syz.0.1173 (8638): 200000003000-20000000a000 (200000001000)
[  109.751552][ T8638] CPU: 0 UID: 0 PID: 8638 Comm: syz.0.1173 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f-dirty #0 PREEMPT(full) 
[  109.751566][ T8638] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  109.751571][ T8638] Call Trace:
[  109.751575][ T8638]  <TASK>
[  109.751581][ T8638]  dump_stack_lvl+0x189/0x250
[  109.751620][ T8638]  ? __pfx_dump_stack_lvl+0x10/0x10
[  109.751630][ T8638]  ? __pfx__printk+0x10/0x10
[  109.751639][ T8638]  ? find_vma+0xe7/0x160
[  109.751658][ T8638]  __get_user_pages+0x2a60/0x30b0
[  109.751685][ T8638]  ? __pfx___get_user_pages+0x10/0x10
[  109.751700][ T8638]  __gup_longterm_locked+0xd66/0x15b0
[  109.751715][ T8638]  ? try_grab_folio_fast+0x35b/0x4f0
[  109.751729][ T8638]  ? sanity_check_pinned_pages+0x11c8/0x12c0
[  109.751743][ T8638]  gup_fast_fallback+0x1cd4/0x2260
[  109.751774][ T8638]  ? __pfx_gup_fast_fallback+0x10/0x10
[  109.751785][ T8638]  ? stack_depot_save_flags+0x429/0x900
[  109.751797][ T8638]  ? pin_user_pages_fast+0x4d/0xb0
[  109.751809][ T8638]  iov_iter_extract_pages+0x35a/0x5e0
[  109.751825][ T8638]  extract_iter_to_sg+0xe46/0x24e0
[  109.751842][ T8638]  ? __pfx_extract_iter_to_sg+0x10/0x10
[  109.751858][ T8638]  ? __asan_memset+0x22/0x50
[  109.751869][ T8638]  af_alg_get_rsgl+0x436/0x810
[  109.751889][ T8638]  aead_recvmsg+0x4cc/0x13f0
[  109.751901][ T8638]  ? trace_sched_exit_tp+0x38/0x120
[  109.751914][ T8638]  ? __pfx_aead_recvmsg+0x10/0x10
[  109.751923][ T8638]  ? bpf_lsm_socket_recvmsg+0x9/0x20
[  109.751933][ T8638]  ? __pfx_aead_recvmsg+0x10/0x10
[  109.751941][ T8638]  sock_recvmsg_nosec+0x186/0x1c0
[  109.751953][ T8638]  ____sys_recvmsg+0x3aa/0x460
[  109.751965][ T8638]  ? __pfx_____sys_recvmsg+0x10/0x10
[  109.751979][ T8638]  ? import_iovec+0x74/0xa0
[  109.751990][ T8638]  ___sys_recvmsg+0x1b5/0x510
[  109.752001][ T8638]  ? __pfx____sys_recvmsg+0x10/0x10
[  109.752021][ T8638]  ? __might_fault+0xb0/0x130
[  109.752033][ T8638]  do_recvmmsg+0x307/0x770
[  109.752044][ T8638]  ? __pfx_do_recvmmsg+0x10/0x10
[  109.752051][ T8638]  ? __ia32_sys_rt_sigreturn+0x6a2/0x7b0
[  109.752071][ T8638]  ? __pfx_do_futex+0x10/0x10
[  109.752088][ T8638]  __x64_sys_recvmmsg+0x190/0x240
[  109.752098][ T8638]  ? __pfx___x64_sys_recvmmsg+0x10/0x10
[  109.752107][ T8638]  ? __task_pid_nr_ns+0x28/0x470
[  109.752120][ T8638]  ? do_syscall_64+0xbe/0x3b0
[  109.752133][ T8638]  do_syscall_64+0xfa/0x3b0
[  109.752143][ T8638]  ? lockdep_hardirqs_on+0x9c/0x150
[  109.752153][ T8638]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  109.752160][ T8638]  ? exc_page_fault+0x9f/0xf0
[  109.752171][ T8638]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  109.752178][ T8638] RIP: 0033:0x7f545c98ebe9
[  109.752186][ T8638] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  109.752193][ T8638] RSP: 002b:00007f545d877038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
[  109.752202][ T8638] RAX: ffffffffffffffda RBX: 00007f545cbb5fa0 RCX: 00007f545c98ebe9
[  109.752208][ T8638] RDX: 0000000000000002 RSI: 0000200000000180 RDI: 0000000000000008
[  109.752212][ T8638] RBP: 00007f545ca11e19 R08: 0000000000000000 R09: 0000000000000000
[  109.752217][ T8638] R10: 0000000000000101 R11: 0000000000000246 R12: 0000000000000000
[  109.752221][ T8638] R13: 00007f545cbb6038 R14: 00007f545cbb5fa0 R15: 00007ffe3bb248b8
[  109.752233][ T8638]  </TASK>
[  110.666763][ T8691] syzkaller0: entered promiscuous mode
[  110.668734][ T8691] syzkaller0: entered allmulticast mode
[  111.608880][ T8717] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1212'.
[  111.869429][ T8750] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1225'.
[  111.989540][ T8753] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  112.001703][ T8753] syzkaller0: entered promiscuous mode
[  112.003677][ T8753] syzkaller0: entered allmulticast mode
[  112.067546][ T8753] tipc: Resetting bearer <eth:syzkaller0>
[  112.082227][ T8751] tipc: Resetting bearer <eth:syzkaller0>
[  112.112787][ T8751] tipc: Disabling bearer <eth:syzkaller0>
[  112.351472][ T8807] gtp0: entered promiscuous mode
[  112.356750][ T8807] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1240'.
[  113.126422][ T5878] Bluetooth: hci2: link tx timeout
[  113.128735][ T5878] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  113.148949][ T8839] netlink: zone id is out of range
[  113.195504][ T8839] netlink: zone id is out of range
[  113.205005][ T8839] netlink: zone id is out of range
[  113.232563][ T8839] netlink: zone id is out of range
[  113.245769][ T8839] netlink: zone id is out of range
[  113.265529][ T8839] netlink: zone id is out of range
[  113.267313][ T8839] netlink: zone id is out of range
[  113.269161][ T8839] netlink: zone id is out of range
[  113.271042][ T8839] netlink: zone id is out of range
[  113.416451][ T8848] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1251'.
[  113.471285][ T8853] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1251'.
[  113.688029][ T8879] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  113.699064][ T8879] syzkaller0: entered promiscuous mode
[  113.701252][ T8879] syzkaller0: entered allmulticast mode
[  113.723122][ T8879] tipc: Resetting bearer <eth:syzkaller0>
[  113.734315][ T8878] tipc: Resetting bearer <eth:syzkaller0>
[  113.756327][ T8878] tipc: Disabling bearer <eth:syzkaller0>
[  113.877528][ T8900] netlink: 'syz.0.1277': attribute type 7 has an invalid length.
[  113.985706][ T5841] Bluetooth: hci2: link tx timeout
[  113.987451][ T5841] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  114.046792][   T33] audit: type=1800 audit(1754678380.968:3): pid=8917 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1285" name=449D06 dev="tmpfs" ino=2004 res=0 errno=0
[  114.226003][ T8948] syz_tun: entered allmulticast mode
[  114.231339][ T8948] net_ratelimit: 9 callbacks suppressed
[  114.231350][ T8948] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check.
[  114.310540][ T8957] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  114.344291][ T8947] 8021q: adding VLAN 0 to HW filter on device bond3
[  114.347210][ T8947] bond3: entered promiscuous mode
[  114.349265][ T8947] bond0: (slave bond3): Enslaving as an active interface with an up link
[  114.415319][ T8968] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1307'.
[  114.512704][ T8978] netlink: 16386 bytes leftover after parsing attributes in process `syz.0.1313'.
[  114.861859][ T9020] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1331'.
[  115.174995][ T5841] Bluetooth: hci2: command 0x0406 tx timeout
[  115.664162][ T9051] netlink: 'syz.1.1344': attribute type 13 has an invalid length.
[  115.667303][ T9051] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1344'.
[  115.670487][ T9051] (unnamed net_device) (uninitialized): option fail_over_mac: invalid value (6)
[  116.108052][ T9066] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1351'.
[  116.251627][ T9085] netlink: 'syz.2.1359': attribute type 1 has an invalid length.
[  116.426541][ T9106] openvswitch: netlink: ufid size 18 bytes exceeds the range (1, 16)
[  116.429417][ T9106] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  116.463339][ T9113] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  116.571393][ T9128] 8021q: adding VLAN 0 to HW filter on device macvlan2
[  116.640000][ T9131] __nla_validate_parse: 3 callbacks suppressed
[  116.640010][ T9131] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1381'.
[  116.645422][ T9131] netlink: 19 bytes leftover after parsing attributes in process `syz.2.1381'.
[  116.648529][ T9131] netlink: 19 bytes leftover after parsing attributes in process `syz.2.1381'.
[  117.029262][ T9152] syzkaller1: entered promiscuous mode
[  117.031324][ T9152] syzkaller1: entered allmulticast mode
[  117.107703][ T9155] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  117.107865][ T9154] IPVS: stopping backup sync thread 9155 ...
[  117.142055][ T9157] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  117.146682][ T9157] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode
[  117.149334][ T9157] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode
[  117.157402][ T9157] tipc: Resetting bearer <eth:syzkaller0>
[  117.270814][ T9163] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1395'.
[  117.529378][ T9183] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (3)
[  117.607506][ T9195] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1408'.
[  118.038273][ T9245] netlink: 'syz.2.1419': attribute type 1 has an invalid length.
[  118.040974][ T9245] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1419'.
[  118.135515][  T790] tipc: Node number set to 1226141757
[  118.173729][ T9265] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1426'.
[  118.232759][ T9273] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1428'.
[  118.288661][ T9279] (unnamed net_device) (uninitialized): option ad_select: invalid value (34)
[  118.337450][ T9273] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1428'.
[  118.556575][ T9312] netlink: 'syz.1.1436': attribute type 2 has an invalid length.
[  118.731954][ T9320] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1439'.
[  119.001532][ T9353] netlink: 'syz.2.1452': attribute type 29 has an invalid length.
[  119.050860][ T9358] openvswitch: netlink: Invalid MD length 0 for MD type 0
[  119.053642][ T9358] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  119.552918][ T9378] netlink: 'syz.0.1462': attribute type 1 has an invalid length.
[  119.556558][ T9378] netlink: 'syz.0.1462': attribute type 3 has an invalid length.
[  119.559311][ T9378] NCSI netlink: No device for ifindex 246
[  120.013973][ T9402] netlink: 'syz.2.1474': attribute type 7 has an invalid length.
[  120.259036][ T9422] syzkaller0: entered promiscuous mode
[  120.261725][ T9422] syzkaller0: entered allmulticast mode
[  120.582866][ T9458] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  120.586634][ T9458] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0
[  120.652128][ T9458] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  120.663935][ T9458] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0
[  120.728786][ T9458] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  120.732073][ T9458] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0
[  120.801226][ T9458] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  120.804532][ T9458] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0
[  120.947096][   T13] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20000 - 0
[  120.949916][   T13] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0
[  120.952925][   T13] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20000 - 0
[  120.956045][   T13] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0
[  120.959328][   T13] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20000 - 0
[  120.962105][   T13] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0
[  120.985686][   T13] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20000 - 0
[  120.989278][   T13] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0
[  123.497535][ T9590] netlink: 'syz.2.1554': attribute type 6 has an invalid length.
[  123.501868][ T9590] netlink: 'syz.2.1554': attribute type 6 has an invalid length.
[  123.735160][ T5878] Bluetooth: hci0: Opcode 0x0c1a failed: -110
[  123.745070][ T5878] Bluetooth: hci0: command 0x0c1a tx timeout
[  124.043337][ T9640] __nla_validate_parse: 3 callbacks suppressed
[  124.043348][ T9640] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1578'.
[  124.117150][ T9651] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1584'.
[  124.140057][ T9654] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  124.276177][ T9673] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1594'.
[  124.315062][ T9677] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1596'.
[  124.413164][ T9687] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1601'.
[  124.478302][ T9689] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  125.332444][ T9716] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1613'.
[  125.359202][ T9718] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1614'.
[  125.367495][ T9718] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1614'.
[  125.554310][ T9730] syzkaller0: entered promiscuous mode
[  125.559659][ T9730] syzkaller0: entered allmulticast mode
[  126.042107][ T9738] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1624'.
[  126.511511][ T9736] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1623'.
[  126.695992][ T3626] wlan0: Trigger new scan to find an IBSS to join
[  126.699426][ T9760] tipc: New replicast peer: 255.255.255.255
[  126.701927][ T9760] tipc: Enabled bearer <udp:syz2>, priority 10
[  127.912033][ T9800] Bluetooth: hci0: Opcode 0x080f failed: -22
[  128.216291][ T9815] netlink: 'syz.0.1656': attribute type 4 has an invalid length.
[  128.800977][ T9824] netlink: 'syz.2.1661': attribute type 1 has an invalid length.
[  128.803496][ T9825] netlink: 'syz.1.1662': attribute type 42 has an invalid length.
[  128.806891][ T9824] netlink: 'syz.2.1661': attribute type 1 has an invalid length.
[  128.809963][ T9824] netlink: 'syz.2.1661': attribute type 1 has an invalid length.
[  128.813632][ T9824] netlink: 'syz.2.1661': attribute type 1 has an invalid length.
[  128.818849][ T9824] netlink: 'syz.2.1661': attribute type 1 has an invalid length.
[  128.823101][ T9824] netlink: 'syz.2.1661': attribute type 1 has an invalid length.
[  128.826257][ T9824] netlink: 'syz.2.1661': attribute type 1 has an invalid length.
[  128.832280][ T9824] netlink: 'syz.2.1661': attribute type 1 has an invalid length.
[  128.990799][ T9842] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  129.166217][ T9851] __nla_validate_parse: 80 callbacks suppressed
[  129.166228][ T9851] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.1674'.
[  129.338922][ T9862] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.1678'.
[  129.477490][ T9870] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1682'.
[  129.741778][ T3626] wlan0: Trigger new scan to find an IBSS to join
[  129.975123][ T5878] Bluetooth: hci0: command tx timeout
[  130.153193][ T9923] infiniband syz1: set down
[  130.155073][ T9923] infiniband syz1: added veth1_to_bond
[  130.183393][ T9923] RDS/IB: syz1: added
[  130.185471][ T9923] smc: adding ib device syz1 with port count 1
[  130.187744][ T9923] smc:    ib device syz1 port 1 has pnetid 
[  130.511298][ T9944] vxcan1: entered allmulticast mode
[  130.891700][ T9955] syzkaller0: entered promiscuous mode
[  130.896911][ T9955] syzkaller0: entered allmulticast mode
[  131.833792][ T9961] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR
[  131.883343][ T9988] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1736'.
[  132.097196][T10016] bond0: left promiscuous mode
[  132.099034][T10016] bond3: left promiscuous mode
[  132.102542][T10016] 8021q: adding VLAN 0 to HW filter on device bond0
[  132.108968][T10016] bond0: entered promiscuous mode
[  132.110969][T10016] bond3: entered promiscuous mode
[  132.114391][T10016] team0: Port device bond0 added
[  132.156933][T10025] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1753'.
[  132.168134][T10024] netlink: 830 bytes leftover after parsing attributes in process `syz.2.1752'.
[  132.174009][T10025] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1753'.
[  132.298963][T10039] sctp: [Deprecated]: syz.1.1761 (pid 10039) Use of int in maxseg socket option.
[  132.298963][T10039] Use struct sctp_assoc_value instead
[  132.396276][T10051] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1767'.
[  132.707278][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  132.709428][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[  132.775703][ T7473] wlan0: Trigger new scan to find an IBSS to join
[  132.921217][T10115] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1796'.
[  133.151498][T10125] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1800'.
[  133.246322][T10125] nbd0: detected capacity change from 0 to 875674160
[  133.251852][   T57] block nbd0: Receive control failed (result -32)
[  133.260227][ T9939] block nbd0: Dead connection, failed to find a fallback
[  133.266973][ T9939] block nbd0: shutting down sockets
[  133.272498][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.278587][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.281885][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.287399][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.290309][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.293416][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.297102][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.302776][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.306403][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.309466][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.312283][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.315767][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.318886][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.321921][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.326527][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.329606][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.333071][ T9939] ldm_validate_partition_table(): Disk read failed.
[  133.360684][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.382153][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.388201][ T9939] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[  133.396861][ T9939] Buffer I/O error on dev nbd0, logical block 0, async page read
[  133.402793][ T9939] Dev nbd0: unable to read RDB block 0
[  133.410021][ T9939]  nbd0: unable to read partition table
[  133.424426][ T9939] ldm_validate_partition_table(): Disk read failed.
[  133.438250][ T9939] Dev nbd0: unable to read RDB block 0
[  133.440586][ T9939]  nbd0: unable to read partition table
[  133.465850][T10139] syzkaller0: entered promiscuous mode
[  133.467752][T10139] syzkaller0: entered allmulticast mode
[  133.695396][ T3626] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  133.830280][T10156] ==================================================================
[  133.833794][T10156] BUG: KASAN: use-after-free in xfrm_alloc_spi+0x570/0xf30
[  133.837908][T10156] Read of size 4 at addr ffff88802b95edc4 by task syz.2.1806/10156
[  133.843103][T10156] 
[  133.844193][T10156] CPU: 0 UID: 0 PID: 10156 Comm: syz.2.1806 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f-dirty #0 PREEMPT(full) 
[  133.844214][T10156] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  133.844223][T10156] Call Trace:
[  133.844232][T10156]  <TASK>
[  133.844239][T10156]  dump_stack_lvl+0x189/0x250
[  133.844261][T10156]  ? __kasan_check_byte+0x12/0x40
[  133.844282][T10156]  ? __pfx_dump_stack_lvl+0x10/0x10
[  133.844296][T10156]  ? lock_release+0x4b/0x3e0
[  133.844316][T10156]  ? __virt_addr_valid+0x4a5/0x5c0
[  133.844330][T10156]  print_report+0xca/0x240
[  133.844347][T10156]  ? xfrm_alloc_spi+0x570/0xf30
[  133.844361][T10156]  kasan_report+0x118/0x150
[  133.844380][T10156]  ? xfrm_alloc_spi+0x570/0xf30
[  133.844393][T10156]  xfrm_alloc_spi+0x570/0xf30
[  133.844405][T10156]  ? xfrm_alloc_spi+0x2a0/0xf30
[  133.844420][T10156]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  133.844432][T10156]  ? xfrm_find_acq+0x87/0xa0
[  133.844444][T10156]  xfrm_alloc_userspi+0x70b/0xc90
[  133.844458][T10156]  ? __pfx_aa_get_newest_label+0x10/0x10
[  133.844479][T10156]  ? apparmor_capable+0x137/0x1b0
[  133.844491][T10156]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  133.844508][T10156]  ? __nla_parse+0x40/0x60
[  133.844523][T10156]  xfrm_user_rcv_msg+0x7a3/0xab0
[  133.844537][T10156]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  133.844595][T10156]  ? __pfx___mutex_trylock_common+0x10/0x10
[  133.844622][T10156]  ? rcu_is_watching+0x15/0xb0
[  133.844644][T10156]  ? trace_contention_end+0x39/0x120
[  133.844657][T10156]  ? __mutex_lock+0x335/0x1340
[  133.844679][T10156]  netlink_rcv_skb+0x208/0x470
[  133.844700][T10156]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  133.844715][T10156]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  133.844736][T10156]  ? netlink_deliver_tap+0x2e/0x1b0
[  133.844756][T10156]  ? netlink_deliver_tap+0x2e/0x1b0
[  133.844776][T10156]  xfrm_netlink_rcv+0x79/0x90
[  133.844793][T10156]  netlink_unicast+0x82f/0x9e0
[  133.844812][T10156]  ? __pfx_netlink_unicast+0x10/0x10
[  133.844828][T10156]  ? netlink_sendmsg+0x642/0xb30
[  133.844846][T10156]  ? skb_put+0x11b/0x210
[  133.844859][T10156]  netlink_sendmsg+0x805/0xb30
[  133.844880][T10156]  ? __pfx_netlink_sendmsg+0x10/0x10
[  133.844902][T10156]  ? aa_sock_msg_perm+0x94/0x160
[  133.844919][T10156]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  133.844933][T10156]  ? __pfx_netlink_sendmsg+0x10/0x10
[  133.844952][T10156]  __sock_sendmsg+0x21c/0x270
[  133.844970][T10156]  ____sys_sendmsg+0x505/0x830
[  133.844982][T10156]  ? __pfx_____sys_sendmsg+0x10/0x10
[  133.844997][T10156]  ? import_iovec+0x74/0xa0
[  133.845015][T10156]  ___sys_sendmsg+0x21f/0x2a0
[  133.845027][T10156]  ? __pfx____sys_sendmsg+0x10/0x10
[  133.845049][T10156]  ? __fget_files+0x2a/0x420
[  133.845061][T10156]  ? __fget_files+0x3a0/0x420
[  133.845076][T10156]  __x64_sys_sendmsg+0x19b/0x260
[  133.845090][T10156]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  133.845105][T10156]  ? rcu_is_watching+0x15/0xb0
[  133.845125][T10156]  ? do_syscall_64+0xbe/0x3b0
[  133.845144][T10156]  do_syscall_64+0xfa/0x3b0
[  133.845162][T10156]  ? lockdep_hardirqs_on+0x9c/0x150
[  133.845179][T10156]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  133.845192][T10156]  ? exc_page_fault+0x9f/0xf0
[  133.845208][T10156]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  133.845221][T10156] RIP: 0033:0x7f098078ebe9
[  133.845236][T10156] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  133.845247][T10156] RSP: 002b:00007f0981510038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  133.845263][T10156] RAX: ffffffffffffffda RBX: 00007f09809b5fa0 RCX: 00007f098078ebe9
[  133.845272][T10156] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003
[  133.845281][T10156] RBP: 00007f0980811e19 R08: 0000000000000000 R09: 0000000000000000
[  133.845288][T10156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  133.845296][T10156] R13: 00007f09809b6038 R14: 00007f09809b5fa0 R15: 00007ffce870c158
[  133.845311][T10156]  </TASK>
[  133.845316][T10156] 
[  134.013626][T10156] The buggy address belongs to the physical page:
[  134.016375][T10156] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b95e
[  134.020017][T10156] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  134.022996][T10156] raw: 00fff00000000000 0000000000000000 ffffea0000ae5790 0000000000000000
[  134.026600][T10156] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[  134.030237][T10156] page dumped because: kasan: bad access detected
[  134.033232][T10156] page_owner tracks the page as freed
[  134.035586][T10156] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9796, tgid 9795 (syz.0.1651), ts 127865099201, free_ts 131804898084
[  134.042147][T10156]  post_alloc_hook+0x240/0x2a0
[  134.043697][T10156]  get_page_from_freelist+0x21e4/0x22c0
[  134.045434][T10156]  __alloc_frozen_pages_noprof+0x181/0x370
[  134.047322][T10156]  alloc_pages_mpol+0x232/0x4a0
[  134.048903][T10156]  allocate_slab+0x8a/0x3b0
[  134.050354][T10156]  ___slab_alloc+0xbfc/0x1480
[  134.051892][T10156]  __kmalloc_cache_noprof+0x296/0x3d0
[  134.053703][T10156]  __genradix_ptr_alloc+0x352/0x4a0
[  134.055421][T10156]  __genradix_prealloc+0x44/0x90
[  134.057004][T10156]  sctp_stream_init+0x14b/0x440
[  134.058551][T10156]  sctp_association_new+0x10dd/0x25f0
[  134.060308][T10156]  sctp_connect_new_asoc+0x2c5/0x690
[  134.062094][T10156]  sctp_sendmsg+0x155c/0x2810
[  134.063696][T10156]  __sock_sendmsg+0x19c/0x270
[  134.065195][T10156]  __sys_sendto+0x3bd/0x520
[  134.066690][T10156]  __x64_sys_sendto+0xde/0x100
[  134.068195][T10156] page last free pid 5747 tgid 5747 stack trace:
[  134.070203][T10156]  __free_frozen_pages+0xc71/0xe70
[  134.071842][T10156]  __put_partials+0x161/0x1c0
[  134.073392][T10156]  put_cpu_partial+0x17c/0x250
[  134.074929][T10156]  __slab_free+0x2f7/0x400
[  134.076339][T10156]  qlist_free_all+0x97/0x140
[  134.077850][T10156]  kasan_quarantine_reduce+0x148/0x160
[  134.079607][T10156]  __kasan_slab_alloc+0x22/0x80
[  134.081184][T10156]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  134.083046][T10156]  start_this_handle+0x37c/0x21c0
[  134.084669][T10156]  jbd2__journal_start+0x2c1/0x5b0
[  134.086298][T10156]  __ext4_journal_start_sb+0x227/0x5c0
[  134.088013][T10156]  ext4_dirty_inode+0x93/0x110
[  134.089539][T10156]  __mark_inode_dirty+0x2d1/0xdf0
[  134.091122][T10156]  file_update_time+0x40c/0x490
[  134.092669][T10156]  ext4_page_mkwrite+0x1fa/0x1110
[  134.094246][T10156]  do_page_mkwrite+0x14d/0x310
[  134.095764][T10156] 
[  134.096536][T10156] Memory state around the buggy address:
[  134.098272][T10156]  ffff88802b95ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  134.100873][T10156]  ffff88802b95ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  134.103456][T10156] >ffff88802b95ed80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  134.105976][T10156]                                            ^
[  134.107909][T10156]  ffff88802b95ee00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  134.110454][T10156]  ffff88802b95ee80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  134.113011][T10156] ==================================================================
[  134.115743][T10156] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  134.118070][T10156] CPU: 0 UID: 0 PID: 10156 Comm: syz.2.1806 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f-dirty #0 PREEMPT(full) 
[  134.121963][T10156] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  134.125164][T10156] Call Trace:
[  134.126247][T10156]  <TASK>
[  134.127257][T10156]  dump_stack_lvl+0x99/0x250
[  134.128767][T10156]  ? __asan_memcpy+0x40/0x70
[  134.130256][T10156]  ? __pfx_dump_stack_lvl+0x10/0x10
[  134.131917][T10156]  ? __pfx__printk+0x10/0x10
[  134.133420][T10156]  panic+0x2db/0x790
[  134.134673][T10156]  ? __pfx_panic+0x10/0x10
[  134.136096][T10156]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  134.137994][T10156]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  134.139880][T10156]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  134.141902][T10156]  ? print_memory_metadata+0x314/0x400
[  134.143699][T10156]  ? xfrm_alloc_spi+0x570/0xf30
[  134.145292][T10156]  check_panic_on_warn+0x89/0xb0
[  134.146911][T10156]  ? xfrm_alloc_spi+0x570/0xf30
[  134.148500][T10156]  end_report+0x78/0x160
[  134.149969][T10156]  kasan_report+0x129/0x150
[  134.151473][T10156]  ? xfrm_alloc_spi+0x570/0xf30
[  134.153061][T10156]  xfrm_alloc_spi+0x570/0xf30
[  134.154585][T10156]  ? xfrm_alloc_spi+0x2a0/0xf30
[  134.156178][T10156]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  134.157850][T10156]  ? xfrm_find_acq+0x87/0xa0
[  134.159314][T10156]  xfrm_alloc_userspi+0x70b/0xc90
[  134.160992][T10156]  ? __pfx_aa_get_newest_label+0x10/0x10
[  134.162866][T10156]  ? apparmor_capable+0x137/0x1b0
[  134.164669][T10156]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  134.166535][T10156]  ? __nla_parse+0x40/0x60
[  134.168056][T10156]  xfrm_user_rcv_msg+0x7a3/0xab0
[  134.169724][T10156]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  134.171496][T10156]  ? __pfx___mutex_trylock_common+0x10/0x10
[  134.173590][T10156]  ? rcu_is_watching+0x15/0xb0
[  134.175323][T10156]  ? trace_contention_end+0x39/0x120
[  134.177119][T10156]  ? __mutex_lock+0x335/0x1340
[  134.178732][T10156]  netlink_rcv_skb+0x208/0x470
[  134.180367][T10156]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  134.182170][T10156]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  134.184063][T10156]  ? netlink_deliver_tap+0x2e/0x1b0
[  134.185854][T10156]  ? netlink_deliver_tap+0x2e/0x1b0
[  134.187723][T10156]  xfrm_netlink_rcv+0x79/0x90
[  134.189305][T10156]  netlink_unicast+0x82f/0x9e0
[  134.190959][T10156]  ? __pfx_netlink_unicast+0x10/0x10
[  134.192700][T10156]  ? netlink_sendmsg+0x642/0xb30
[  134.194326][T10156]  ? skb_put+0x11b/0x210
[  134.195719][T10156]  netlink_sendmsg+0x805/0xb30
[  134.197290][T10156]  ? __pfx_netlink_sendmsg+0x10/0x10
[  134.199020][T10156]  ? aa_sock_msg_perm+0x94/0x160
[  134.200649][T10156]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  134.202359][T10156]  ? __pfx_netlink_sendmsg+0x10/0x10
[  134.204076][T10156]  __sock_sendmsg+0x21c/0x270
[  134.205669][T10156]  ____sys_sendmsg+0x505/0x830
[  134.207194][T10156]  ? __pfx_____sys_sendmsg+0x10/0x10
[  134.208892][T10156]  ? import_iovec+0x74/0xa0
[  134.210367][T10156]  ___sys_sendmsg+0x21f/0x2a0
[  134.211899][T10156]  ? __pfx____sys_sendmsg+0x10/0x10
[  134.213649][T10156]  ? __fget_files+0x2a/0x420
[  134.215207][T10156]  ? __fget_files+0x3a0/0x420
[  134.216720][T10156]  __x64_sys_sendmsg+0x19b/0x260
[  134.218278][T10156]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  134.220020][T10156]  ? rcu_is_watching+0x15/0xb0
[  134.221553][T10156]  ? do_syscall_64+0xbe/0x3b0
[  134.223124][T10156]  do_syscall_64+0xfa/0x3b0
[  134.224672][T10156]  ? lockdep_hardirqs_on+0x9c/0x150
[  134.226375][T10156]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  134.228306][T10156]  ? exc_page_fault+0x9f/0xf0
[  134.229846][T10156]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  134.231767][T10156] RIP: 0033:0x7f098078ebe9
[  134.233186][T10156] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  134.239250][T10156] RSP: 002b:00007f0981510038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  134.241945][T10156] RAX: ffffffffffffffda RBX: 00007f09809b5fa0 RCX: 00007f098078ebe9
[  134.244489][T10156] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003
[  134.246993][T10156] RBP: 00007f0980811e19 R08: 0000000000000000 R09: 0000000000000000
[  134.249489][T10156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  134.252013][T10156] R13: 00007f09809b6038 R14: 00007f09809b5fa0 R15: 00007ffce870c158
[  134.254643][T10156]  </TASK>
[  134.256255][T10156] Kernel Offset: disabled
[  134.257699][T10156] Rebooting in 86400 seconds..

VM DIAGNOSIS:
18:40:01  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000039 RBX=0000000000000039 RCX=0000000000000000 RDX=00000000000003f8
RSI=00000000000010d0 RDI=00000000000010d1 RBP=00000000000003f8 RSP=ffffc90002c8e9f0
R8 =ffff8880204d8237 R9 =1ffff1100409b046 R10=dffffc0000000000 R11=ffffffff854c1d90
R12=dffffc0000000000 R13=ffffffff99a95919 R14=ffffffff99d9a4e0 R15=0000000000000000
RIP=ffffffff854c1e0c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f09815106c0 ffffffff 00c00000
GS =0000 ffff8880b8680000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000540 CR3=0000000120506000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f0980987498 00007f0980987470 XMM03=00007f09809874a8 00007f09809874a0
XMM04=00007f09814ed100 00007f0980987460 XMM05=00007f0980987478 00007f09809874c0
XMM06=00007f09809874b8 00007f09809874b0 XMM07=00007f09809874a8 00007f09809874a0
XMM08=0000000000000000 00007f0980812ee7 XMM09=0000000000000000 00007f0980812fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff8fbd181c RBX=ffffffff8fbd1830 RCX=ffffffff8fbd1824 RDX=ffffffff8fbd1810
RSI=ffffffff903ce136 RDI=ffffffff8be309a0 RBP=ffffffff8fbd1824 RSP=ffffc9000305ef38
R8 =0000000000000013 R9 =ffffffff8172cd05 R10=ffffc9000305f058 R11=ffffffff81ac3450
R12=ffffffff8222a1bb R13=ffffffff8fbd1820 R14=ffffc9000305f008 R15=ffffffff8fbd1820
RIP=ffffffff8172df8f RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c80000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f272f0541d0 CR3=000000012a19a000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffff0000 0000000000000000
XMM02=ffff000000000000 ffffffffffffffff XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
