last executing test programs:

1.009860708s ago: executing program 1 (id=764):
r0 = socket$inet6(0xa, 0x5, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4)
setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x28, 0x0, 0x73, 0xfffff034}, {0x6, 0x0, 0x2, 0xffffffff}]}, 0x10)
sendto$inet6(r0, &(0x7f0000000000)='\a', 0x1, 0x40008d0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x3b}}, 0x1c)

928.931846ms ago: executing program 1 (id=766):
r0 = socket$vsock_stream(0x28, 0x1, 0x0)
bind$vsock_stream(r0, &(0x7f0000000440), 0x10)
listen(r0, 0x0)
r1 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r1, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10)
shutdown(r1, 0x1)
r2 = accept4$unix(r0, 0x0, 0x0, 0x0)
recvfrom$unix(r2, &(0x7f00000002c0)=""/236, 0xec, 0x10120, 0x0, 0x0)

870.35025ms ago: executing program 1 (id=768):
r0 = socket$netlink(0x10, 0x3, 0x15)
sendmsg$nl_generic(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0xe0, 0x11, 0xf720b6c5c733ef9d, 0x70bd29, 0x25dfdbfc, {0x2}, [@nested={0xc9, 0x28, 0x0, 0x1, [@nested={0x4, 0xa0}, @generic="1e108813e26f5e64b8dde63e7e568233732f65d65ea9d6861078446939505f72e565658ac621b3c382d690b12728b56905152170f3d39b7dfe82e0392316ad499bb51601a6dd0fa575ff02b507f689ef878cd209223dc3d58fcce4197cdd86e6e0bc07f0951503dcdecfc14904276753ba952bf37d77da106bfa6789ac2f5da32871969b2393a6a1c8a3216810b92e2118d6a80ec909b9fbd2e2676152b09de57bec1c2eadd4d4848382327b85a2cb31eb2417abd935e50200f2f4c96b8f33c7aa"]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x40010}, 0x20044010)

740.866262ms ago: executing program 1 (id=770):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@bridge_newvlan={0x24, 0x70, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r2}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x40, 0x3}}}]}, 0x24}}, 0x0)

680.696142ms ago: executing program 1 (id=772):
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000400)={r0, 0x3, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={<r1=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r1, 0x1, 0x23, 0x0, 0xf000)

680.244559ms ago: executing program 1 (id=774):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x1c, 0x15, 0x301, 0x0, 0x0, {0xc}, [@typed={0x8, 0x4, 0x0, 0x0, @u32=0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x4000000)
sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={<r2=>0xffffffffffffffff})
setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000080), 0x4)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', <r3=>0x0, 0x7, 0x7800, 0x0, 0xfffffffb, {{0x5, 0x4, 0x0, 0x5, 0x14, 0x0, 0x0, 0x9, 0x4, 0x0, @remote, @multicast2}}}})
socketpair(0x1, 0x1, 0x0, 0x0)
getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x42, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000240)={'erspan0\x00', 0x0})
pipe(&(0x7f00000001c0)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r6, 0x0, 0x0, 0x22004001, 0x0, 0x0)
sendto$inet6(r6, &(0x7f0000000080)='D', 0x1, 0x4014, 0x0, 0x0)
splice(r6, 0x0, r5, 0x0, 0x1, 0x0)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)=ANY=[], 0x50)
close(r4)
r7 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c)
listen(r7, 0x0)
r8 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r8, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000e3fffffb00000001000000280001801400040000000000000000800000ffffac1414aa060001000a00800008000600035d1be34d2c0c3e7b535d9e1773a79a1d52cca871e22e7255cfb7d0c4435ffdc8e82f8e81951210dc9662c86dfc9761c3"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f3, &(0x7f0000001a80)={'syztnl0\x00', &(0x7f0000000140)={'gre0\x00', r3, 0x10, 0x20, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x27, 0x0, 0x0, 0x0, 0x0, @local, @multicast1}}}})

190.367234ms ago: executing program 2 (id=786):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000600)=@framed={{}, [@printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x83000000}, {0x85, 0x0, 0x0, 0x71}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

121.248466ms ago: executing program 2 (id=789):
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001340)=@filter={'filter\x00', 0x42, 0x4, 0x3d0, 0xffffffff, 0x248, 0x0, 0x248, 0xffffffff, 0xffffffff, 0x338, 0x338, 0x338, 0xffffffff, 0x4, 0x0, {[{{@ip={@local, @remote, 0x0, 0x0, 'syzkaller1\x00', 'veth1_to_team\x00'}, 0x0, 0xe8, 0x120, 0x0, {0x88000000}, [@common=@inet=@multiport={{0x50}, {0x0, 0x8, [0x4e24, 0x4e22, 0x4e20, 0x4e24, 0x4e23, 0x4e23, 0x4e20, 0x4e24, 0x4e22, 0x4e24, 0x4e24, 0x4e22, 0x4e23, 0x4e20, 0x4e22], [0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1], 0x1}}, @common=@icmp={{0x28}, {0x3, "0da5", 0x1}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@private, @rand_addr, 0x0, 0x0, 'bridge_slave_0\x00'}, 0x0, 0x100, 0x128, 0x0, {0x122}, [@common=@inet=@dscp={{0x28}}, @common=@unspec=@rateest={{0x68}, {'wlan1\x00', 'team_slave_1\x00', 0x25}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x90, 0xf0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x430)

120.878987ms ago: executing program 0 (id=791):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1f, 0x18, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0xb3}}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc)

120.415788ms ago: executing program 2 (id=792):
bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x48)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYBLOB="18"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='signal_generate\x00', r0}, 0x18)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x440000, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000001c0)={'veth1_to_team\x00', 0x8000})
syz_open_procfs$namespace(0x0, 0xfffffffffffffffe)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r2}, 0x18)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001100)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r4, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000540)="d2ffdd934517f3e145fa02e086dd", 0x0, 0xd5b4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50)

71.259152ms ago: executing program 0 (id=793):
r0 = socket$inet6(0xa, 0x2, 0x3a)
sendmmsg$inet6(r0, &(0x7f0000000b80)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x7ffe, @mcast2, 0x4}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)="8000102e7577d401", 0x8}], 0x1, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000002900000004000000ff0000000000deff170000000000000029"], 0x30}}], 0x1, 0x4000084)

70.855365ms ago: executing program 0 (id=794):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c00)={0x14, 0x17, 0xa, 0x101, 0x0, 0x0, {0x2}}, 0x14}}, 0x0)

70.737923ms ago: executing program 0 (id=795):
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000090000000400000003000006040000000400000007000000020000000400000004000000fcffffff002e71a061"], 0x0, 0x45, 0x0, 0x1, 0x80000001}, 0x28)

70.313189ms ago: executing program 2 (id=796):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet6_int(r0, 0x29, 0x33, 0x0, &(0x7f0000000140))

924.124µs ago: executing program 2 (id=797):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x7, 0x2a, 0x5}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r1}, 0x10)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r2}, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0xa, 0x4, 0x4, 0xc}, 0x50)

571.238µs ago: executing program 0 (id=798):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e22, 0x5, @dev={0xfe, 0x80, '\x00', 0x41}, 0x401}}, 0x4}, 0x90)

170.051µs ago: executing program 2 (id=799):
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, 0x0, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket(0xa, 0x3, 0x3a)
setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000140)={0x804, 0x0, 0x0, 0x0, 0x267a4e37}, 0xc)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={<r4=>0xffffffffffffffff})
sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000004c0)={0x44, r3, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c191f}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x44}}, 0x20000000)
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, 0x0)
close(0xffffffffffffffff)
r5 = syz_open_procfs$namespace(0xffffffffffffffff, 0x0)
r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r6, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa)
r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)
r8 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r8, 0x114, 0x8, &(0x7f0000000080), 0x4)
r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r9}, 0x10)
bind$inet(r8, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r7, 0x0, 0x15, 0x2, 0x0, 0x0, 0x2, 0x0, 0x25, 0x62, 0x0, 0x0, 0x4, 0x0, 0xfffffbf0}, 0xa)
socket$kcm(0x10, 0x2, 0x4)
r10 = socket$netlink(0x10, 0x3, 0x4)
r11 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r11, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000080)=0x10)
bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1c00f0ce5ee5bbe5cd1600000300000002000200", @ANYRES32=r5, @ANYBLOB='\x00\b\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000020000000100"/28], 0x50)
writev(r10, &(0x7f0000000080)=[{&(0x7f0000000000)="480000001400190d09004beafd0d36020a8429000b4e230f00000000a2bc5603ca00000f7f89004e002050da742dac0000000101ff05020003000200000000000100000000005839", 0x48}], 0x1)

0s ago: executing program 0 (id=800):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x94}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:57017' (ED25519) to the list of known hosts.
syzkaller login: [   56.223371][ T5821] cgroup: Unknown subsys name 'net'
[   56.310091][ T5821] cgroup: Unknown subsys name 'cpuset'
[   56.316097][ T5821] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.307810][ T5821] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   63.093190][ T5839] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   63.097336][ T5839] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   63.102286][ T5221] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   63.104655][ T5221] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   63.108039][ T5221] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   63.110849][ T5221] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   63.113281][ T5221] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   63.150723][ T5842] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   63.155552][ T5842] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   63.159138][ T5842] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   63.231293][ T5842] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   63.237793][ T5842] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   63.240986][ T5842] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   63.244713][ T5842] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   63.248346][ T5842] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   63.435916][ T5836] chnl_net:caif_netlink_parms(): no params data found
[   63.555728][ T5840] chnl_net:caif_netlink_parms(): no params data found
[   63.630733][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.634236][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.637578][ T5836] bridge_slave_0: entered allmulticast mode
[   63.641147][ T5836] bridge_slave_0: entered promiscuous mode
[   63.656307][ T5845] chnl_net:caif_netlink_parms(): no params data found
[   63.670804][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.673611][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.676839][ T5836] bridge_slave_1: entered allmulticast mode
[   63.680545][ T5836] bridge_slave_1: entered promiscuous mode
[   63.739004][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.741188][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.743841][ T5840] bridge_slave_0: entered allmulticast mode
[   63.747021][ T5840] bridge_slave_0: entered promiscuous mode
[   63.750979][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.753200][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.755734][ T5840] bridge_slave_1: entered allmulticast mode
[   63.758509][ T5840] bridge_slave_1: entered promiscuous mode
[   63.812365][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.819271][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.837362][ T5845] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.840226][ T5845] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.843703][ T5845] bridge_slave_0: entered allmulticast mode
[   63.848205][ T5845] bridge_slave_0: entered promiscuous mode
[   63.855546][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.861246][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.880114][ T5845] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.883255][ T5845] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.886589][ T5845] bridge_slave_1: entered allmulticast mode
[   63.890359][ T5845] bridge_slave_1: entered promiscuous mode
[   63.959718][ T5836] team0: Port device team_slave_0 added
[   63.964711][ T5845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.971071][ T5840] team0: Port device team_slave_0 added
[   63.975001][ T5845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.978794][ T5836] team0: Port device team_slave_1 added
[   63.982707][ T5840] team0: Port device team_slave_1 added
[   64.043479][ T5845] team0: Port device team_slave_0 added
[   64.049099][ T5845] team0: Port device team_slave_1 added
[   64.087804][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.090443][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.101175][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.120619][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.123123][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.132033][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.136744][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.139046][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.149302][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.154335][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.157842][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.167742][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.172649][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.175755][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.185533][ T5845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.203710][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.206442][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.218769][ T5845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.280807][ T5840] hsr_slave_0: entered promiscuous mode
[   64.283930][ T5840] hsr_slave_1: entered promiscuous mode
[   64.301401][ T5836] hsr_slave_0: entered promiscuous mode
[   64.303642][ T5836] hsr_slave_1: entered promiscuous mode
[   64.306065][ T5836] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   64.308513][ T5836] Cannot create hsr debugfs directory
[   64.371463][ T5845] hsr_slave_0: entered promiscuous mode
[   64.374415][ T5845] hsr_slave_1: entered promiscuous mode
[   64.378471][ T5845] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   64.381278][ T5845] Cannot create hsr debugfs directory
[   64.713207][ T5840] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   64.723963][ T5840] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   64.742863][ T5840] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   64.757064][ T5840] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   64.793874][ T5845] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   64.802969][ T5845] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   64.811529][ T5845] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   64.816437][ T5845] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   64.898150][ T5836] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   64.906633][ T5836] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   64.922227][ T5836] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   64.935982][ T5836] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   65.042872][ T5845] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.050696][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.074511][ T5845] 8021q: adding VLAN 0 to HW filter on device team0
[   65.093270][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.096229][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.119325][ T5840] 8021q: adding VLAN 0 to HW filter on device team0
[   65.130048][ T1086] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.132756][ T1086] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.153650][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.156430][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.171864][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.190260][ T5842] Bluetooth: hci1: command tx timeout
[   65.190268][ T5839] Bluetooth: hci0: command tx timeout
[   65.199478][ T1086] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.202237][ T1086] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.230603][ T5836] 8021q: adding VLAN 0 to HW filter on device team0
[   65.243730][ T5840] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   65.248317][ T5840] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   65.265176][ T5842] Bluetooth: hci2: command tx timeout
[   65.272704][ T5009] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.275468][ T5009] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.309558][ T5009] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.312400][ T5009] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.501561][ T5845] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.529981][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.538408][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.609983][ T5845] veth0_vlan: entered promiscuous mode
[   65.619920][ T5836] veth0_vlan: entered promiscuous mode
[   65.632865][ T5840] veth0_vlan: entered promiscuous mode
[   65.636888][ T5845] veth1_vlan: entered promiscuous mode
[   65.641753][ T5836] veth1_vlan: entered promiscuous mode
[   65.656619][ T5840] veth1_vlan: entered promiscuous mode
[   65.697336][ T5836] veth0_macvtap: entered promiscuous mode
[   65.703489][ T5836] veth1_macvtap: entered promiscuous mode
[   65.717413][ T5845] veth0_macvtap: entered promiscuous mode
[   65.729952][ T5845] veth1_macvtap: entered promiscuous mode
[   65.739739][ T5840] veth0_macvtap: entered promiscuous mode
[   65.758960][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.769424][ T5840] veth1_macvtap: entered promiscuous mode
[   65.777602][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.789802][ T5836] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.792489][ T5836] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.796735][ T5836] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.799712][ T5836] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.809504][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.823108][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.840020][ T5845] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.843281][ T5845] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.847064][ T5845] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.850328][ T5845] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.870624][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.898719][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.927156][ T5840] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.931205][ T5840] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.934785][ T5840] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.939795][ T5840] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.977445][   T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.982445][   T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.057063][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.060043][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.089971][   T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.094055][   T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.126926][ T1088] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.134812][ T1088] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.143614][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.147140][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.175785][ T1090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.178212][ T1090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.220753][ T5845] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   66.363259][ T5906] tipc: Started in network mode
[   66.367325][ T5906] tipc: Node identity 4a9191d4f21e, cluster identity 4711
[   66.369653][ T5906] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   66.381996][ T5906] syzkaller0: entered promiscuous mode
[   66.383796][ T5906] syzkaller0: entered allmulticast mode
[   66.407540][ T5911] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5'.
[   66.434351][ T5906] tipc: Resetting bearer <eth:syzkaller0>
[   66.449120][ T5904] tipc: Resetting bearer <eth:syzkaller0>
[   66.478826][ T5904] tipc: Disabling bearer <eth:syzkaller0>
[   66.768412][ T5931] warning: `syz.1.15' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   66.865864][ T5937] netlink: 'syz.0.18': attribute type 21 has an invalid length.
[   66.868421][ T5937] netlink: 128 bytes leftover after parsing attributes in process `syz.0.18'.
[   66.874429][ T5937] netlink: 'syz.0.18': attribute type 5 has an invalid length.
[   66.877898][ T5937] netlink: 'syz.0.18': attribute type 6 has an invalid length.
[   66.880181][ T5937] netlink: 3 bytes leftover after parsing attributes in process `syz.0.18'.
[   67.041797][ T5945] netlink: 8 bytes leftover after parsing attributes in process `syz.1.22'.
[   67.266622][ T5842] Bluetooth: hci1: command tx timeout
[   67.267010][ T5839] Bluetooth: hci0: command tx timeout
[   67.357167][ T5839] Bluetooth: hci2: command tx timeout
[   67.534376][ T5976] netlink: 20 bytes leftover after parsing attributes in process `syz.2.33'.
[   67.639126][ T5983] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   68.297426][ T6024] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.54'.
[   68.427866][ T6032] netlink: 4 bytes leftover after parsing attributes in process `syz.0.59'.
[   68.910950][ T6054] syzkaller1: entered promiscuous mode
[   68.913155][ T6054] syzkaller1: entered allmulticast mode
[   68.938648][ T6062] netlink: 16 bytes leftover after parsing attributes in process `syz.0.70'.
[   69.114200][ T6064] netlink: 248 bytes leftover after parsing attributes in process `syz.0.71'.
[   69.228546][ T6066] netlink: 36 bytes leftover after parsing attributes in process `syz.0.72'.
[   69.345704][ T5839] Bluetooth: hci0: command tx timeout
[   69.346761][ T5842] Bluetooth: hci1: command tx timeout
[   69.381805][ T6071] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   69.425225][ T5842] Bluetooth: hci2: command tx timeout
[   69.663111][ T6092] netlink: 'syz.2.81': attribute type 1 has an invalid length.
[   69.820634][ T6099] gretap1: entered promiscuous mode
[   69.852186][ T6103] macvlan2: entered promiscuous mode
[   69.853808][ T6103] macvlan2: entered allmulticast mode
[   70.044322][ T6115] team0: entered promiscuous mode
[   70.047798][ T6115] team_slave_0: entered promiscuous mode
[   70.051072][ T6115] team_slave_1: entered promiscuous mode
[   70.066141][ T6115] 8021q: adding VLAN 0 to HW filter on device macvlan2
[   70.069128][ T6115] team0: left promiscuous mode
[   70.070580][ T6115] team_slave_0: left promiscuous mode
[   70.072495][ T6115] team_slave_1: left promiscuous mode
[   70.275451][ T6130] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   70.938310][ T6180] syz.1.112 uses obsolete (PF_INET,SOCK_PACKET)
[   71.269953][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   71.272591][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   71.283657][ T6169] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[   71.431442][ T5839] Bluetooth: hci1: command tx timeout
[   71.433108][ T5842] Bluetooth: hci0: command tx timeout
[   71.516187][ T5842] Bluetooth: hci2: command tx timeout
[   71.627624][ T6216] __nla_validate_parse: 6 callbacks suppressed
[   71.627636][ T6216] netlink: 48 bytes leftover after parsing attributes in process `syz.1.124'.
[   71.860739][ T6229] netlink: 32 bytes leftover after parsing attributes in process `syz.1.131'.
[   71.948067][ T5873] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[   71.965637][ T6237] netlink: 32 bytes leftover after parsing attributes in process `syz.1.131'.
[   72.291790][ T6261] Bluetooth: MGMT ver 1.23
[   73.001737][ T6311] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   73.114486][ T6319] C: renamed from team_slave_0 (while UP)
[   73.124738][ T6319] netlink: 'syz.2.173': attribute type 3 has an invalid length.
[   73.132170][ T6319] netlink: 152 bytes leftover after parsing attributes in process `syz.2.173'.
[   73.137255][ T6319] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[   73.766180][ T6363] Zero length message leads to an empty skb
[   74.228241][ T6394] veth0: entered promiscuous mode
[   74.230803][ T6394] veth0: left promiscuous mode
[   74.380029][ T6401] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   74.642508][ T6424] netlink: 'syz.1.222': attribute type 3 has an invalid length.
[   74.646356][ T6424] netlink: 'syz.1.222': attribute type 4 has an invalid length.
[   74.648855][ T6424] netlink: 'syz.1.222': attribute type 5 has an invalid length.
[   74.651281][ T6424] netlink: 'syz.1.222': attribute type 6 has an invalid length.
[   74.653577][ T6424] netlink: 'syz.1.222': attribute type 7 has an invalid length.
[   74.657737][ T6426] smc: net device bond0 applied user defined pnetid SYZ2
[   74.658303][ T6424] netlink: 'syz.1.222': attribute type 7 has an invalid length.
[   74.662443][ T6424] netlink: 12902 bytes leftover after parsing attributes in process `syz.1.222'.
[   74.718528][ T6431] trusted_key: syz.0.226 sent an empty control message without MSG_MORE.
[   74.773590][ T6437] netlink: 'syz.0.227': attribute type 1 has an invalid length.
[   74.777773][ T6437] netlink: 24 bytes leftover after parsing attributes in process `syz.0.227'.
[   75.453967][ T6469] netlink: 64 bytes leftover after parsing attributes in process `syz.1.241'.
[   75.593343][ T6477] netlink: 'syz.2.245': attribute type 15 has an invalid length.
[   75.697030][ T6481] netlink: 4 bytes leftover after parsing attributes in process `syz.1.247'.
[   75.933667][ T6491] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   76.603139][ T6511] netlink: 32 bytes leftover after parsing attributes in process `syz.0.262'.
[   76.653193][ T6515] netlink: 'syz.2.263': attribute type 21 has an invalid length.
[   76.656591][ T6515] netlink: 128 bytes leftover after parsing attributes in process `syz.2.263'.
[   76.660631][ T6515] netlink: 3 bytes leftover after parsing attributes in process `syz.2.263'.
[   76.737741][ T6521] netlink: 240 bytes leftover after parsing attributes in process `syz.0.264'.
[   76.838061][ T6525] netlink: 8 bytes leftover after parsing attributes in process `syz.2.268'.
[   76.960338][ T6533] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   77.120122][ T6546] netlink: 8 bytes leftover after parsing attributes in process `syz.1.278'.
[   77.123726][ T6547] netlink: 4 bytes leftover after parsing attributes in process `syz.0.279'.
[   77.134018][ T6549] netlink: 'syz.2.280': attribute type 11 has an invalid length.
[   77.135581][ T6547] dummy0: entered promiscuous mode
[   77.138984][ T6547] macvtap1: entered promiscuous mode
[   77.140944][ T6547] macvtap1: entered allmulticast mode
[   77.143161][ T6547] dummy0: entered allmulticast mode
[   77.150731][ T6547] netlink: 4 bytes leftover after parsing attributes in process `syz.0.279'.
[   77.157078][ T6547] dummy0: left allmulticast mode
[   77.159819][ T6547] dummy0: left promiscuous mode
[   77.233948][ T6555] netlink: 236 bytes leftover after parsing attributes in process `syz.0.283'.
[   77.292807][ T6554] syzkaller0: entered allmulticast mode
[   77.366059][ T6562] netlink: 16410 bytes leftover after parsing attributes in process `syz.0.286'.
[   78.663507][ T6597] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   78.666590][ T6597] IPv6: NLM_F_CREATE should be set when creating new route
[   79.318732][ T6642] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[   79.321473][ T6642] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[   79.350637][ T6646] validate_nla: 3 callbacks suppressed
[   79.350667][ T6646] netlink: 'syz.1.325': attribute type 1 has an invalid length.
[   79.354616][ T6646] netlink: 4 bytes leftover after parsing attributes in process `syz.1.325'.
[   80.540480][ T6720] netlink: 'syz.1.356': attribute type 2 has an invalid length.
[   80.920839][ T6726] ip6t_srh: unknown srh match flags  4000
[   81.524535][  T108] cfg80211: failed to load regulatory.db
[   81.782096][ T6782] tipc: Started in network mode
[   81.783784][ T6782] tipc: Node identity 3a06591061a3, cluster identity 4711
[   81.787965][ T6782] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   81.791742][ T6782] syzkaller0: entered promiscuous mode
[   81.793608][ T6782] syzkaller0: entered allmulticast mode
[   81.836504][ T6782] tipc: Resetting bearer <eth:syzkaller0>
[   81.851212][ T6781] tipc: Resetting bearer <eth:syzkaller0>
[   81.879069][ T6781] tipc: Disabling bearer <eth:syzkaller0>
[   82.140235][ T6803] __nla_validate_parse: 6 callbacks suppressed
[   82.140248][ T6803] netlink: 40 bytes leftover after parsing attributes in process `syz.2.393'.
[   82.255785][ T6809] macsec1: entered allmulticast mode
[   82.337964][ T6817] sch_tbf: burst 2 is lower than device lo mtu (65550) !
[   82.349241][ T6817] sch_tbf: burst 2 is lower than device lo mtu (65550) !
[   82.351926][ T6817] sch_tbf: burst 2 is lower than device lo mtu (65550) !
[   82.467045][ T6829] netlink: 'syz.0.404': attribute type 9 has an invalid length.
[   82.471028][ T6829] netlink: 'syz.0.404': attribute type 7 has an invalid length.
[   82.473553][ T6829] netlink: 'syz.0.404': attribute type 8 has an invalid length.
[   82.484386][ T6830] ip6t_srh: unknown srh invflags 4449
[   82.671158][ T6846] netlink: 12 bytes leftover after parsing attributes in process `syz.0.412'.
[   82.954476][ T6863] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.419'.
[   83.364052][ T6872] netlink: 4 bytes leftover after parsing attributes in process `syz.1.422'.
[   84.190917][ T6913] netlink: 60 bytes leftover after parsing attributes in process `syz.2.437'.
[   84.194289][ T6913] netlink: 35 bytes leftover after parsing attributes in process `syz.2.437'.
[   84.377561][ T6929] netlink: 'syz.1.442': attribute type 12 has an invalid length.
[   85.684140][ T7028] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   85.691451][ T7028] batadv_slave_0: entered promiscuous mode
[   85.729454][ T7032] netlink: 8 bytes leftover after parsing attributes in process `syz.0.457'.
[   85.732203][ T7032] netlink: 4 bytes leftover after parsing attributes in process `syz.0.457'.
[   85.826843][ T7042] wg1 speed is unknown, defaulting to 1000
[   85.829720][ T7042] wg1 speed is unknown, defaulting to 1000
[   85.834345][ T7042] wg1 speed is unknown, defaulting to 1000
[   85.871682][ T7042] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   85.885927][ T7042] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[   85.916336][ T7042] wg1 speed is unknown, defaulting to 1000
[   85.981165][ T7047] syzkaller0: entered promiscuous mode
[   85.982916][ T7047] syzkaller0: entered allmulticast mode
[   85.988991][ T7042] wg1 speed is unknown, defaulting to 1000
[   86.832049][ T7042] wg1 speed is unknown, defaulting to 1000
[   86.883869][ T7061] syz.0.469 uses old SIOCAX25GETINFO
[   86.954571][ T7068] ip6t_srh: unknown srh invflags 4449
[   87.091684][ T7079] netlink: 'syz.2.477': attribute type 23 has an invalid length.
[   87.203087][ T7088] netlink: 8 bytes leftover after parsing attributes in process `syz.1.481'.
[   87.213475][ T7088] netlink: 8 bytes leftover after parsing attributes in process `syz.1.481'.
[   87.317634][   T13] nci: nci_rsp_packet: unknown rsp opcode 0x204
[   88.278929][ T7117] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   88.365482][ T7117] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   88.412638][ T7117] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   88.467146][ T7117] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   88.549651][ T7117] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   88.561563][ T7117] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   88.567388][ T7130] netlink: 26 bytes leftover after parsing attributes in process `syz.2.498'.
[   88.582039][ T7117] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   88.606685][ T7117] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   88.667310][ T7138] netlink: 8 bytes leftover after parsing attributes in process `syz.2.502'.
[   88.722403][    T9] hid-generic 0005:046D:8002.0002: collection stack underflow
[   88.744563][    T9] hid-generic 0005:046D:8002.0002: item 0 0 0 12 parsing failed
[   88.767449][    T9] hid-generic 0005:046D:8002.0002: probe with driver hid-generic failed with error -22
[   88.774341][ T7143] netlink: 272 bytes leftover after parsing attributes in process `syz.0.504'.
[   88.842696][ T7150] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048)
[   88.872125][ T7145] wg1 speed is unknown, defaulting to 1000
[   89.438364][ T7190] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.525'.
[   89.441389][ T7190] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[   89.728877][ T7208] Bluetooth: MGMT ver 1.23
[   89.799854][ T7208] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.868372][ T7208] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.931006][ T7208] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.976735][ T7208] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   90.068391][ T7208] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   90.077326][ T7208] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   90.087496][ T7208] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   90.098756][ T7208] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   90.121386][ T7219] netlink: 'syz.0.538': attribute type 1 has an invalid length.
[   90.149442][ T7219] bond1 (unregistering): Released all slaves
[   91.070317][ T7239] netlink: 20 bytes leftover after parsing attributes in process `syz.2.547'.
[   91.074615][ T7241] netlink: 'syz.0.548': attribute type 32 has an invalid length.
[   91.540946][ T7271] lo: entered promiscuous mode
[   91.550763][ T7271] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   91.641919][ T7276] netlink: 8 bytes leftover after parsing attributes in process `syz.1.565'.
[   92.573334][ T7341] netlink: 44 bytes leftover after parsing attributes in process `syz.1.596'.
[   92.589305][ T7341] netlink: 'syz.1.596': attribute type 1 has an invalid length.
[   92.591731][ T7341] netlink: 224 bytes leftover after parsing attributes in process `syz.1.596'.
[   94.279533][ T7406] bond0: entered promiscuous mode
[   94.281212][ T7406] bond_slave_0: entered promiscuous mode
[   94.288555][ T7406] bond_slave_1: entered promiscuous mode
[   94.298290][ T7406] batadv0: entered promiscuous mode
[   94.301875][ T7406] 8021q: adding VLAN 0 to HW filter on device hsr1
[   94.329379][ T7406] bond0: left promiscuous mode
[   94.331026][ T7406] bond_slave_0: left promiscuous mode
[   94.334632][ T7406] bond_slave_1: left promiscuous mode
[   94.347685][ T7406] batadv0: left promiscuous mode
[   94.434660][ T7416] wg1 speed is unknown, defaulting to 1000
[   94.764499][ T7443] wg1 speed is unknown, defaulting to 1000
[   95.417339][ T7505] netlink: 12 bytes leftover after parsing attributes in process `syz.2.672'.
[   95.556329][ T7515] Driver unsupported XDP return value 0 on prog  (id 102) dev N/A, expect packet loss!
[   95.678163][ T7527] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   95.680608][ T7527] syzkaller0: entered promiscuous mode
[   95.682400][ T7527] syzkaller0: entered allmulticast mode
[   95.707370][ T7527] tipc: Resetting bearer <eth:syzkaller0>
[   95.715263][ T7526] tipc: Resetting bearer <eth:syzkaller0>
[   95.722483][ T7526] tipc: Disabling bearer <eth:syzkaller0>
[   95.858906][ T7546] netlink: 24 bytes leftover after parsing attributes in process `syz.2.692'.
[   95.861630][ T7546] netlink: 24 bytes leftover after parsing attributes in process `syz.2.692'.
[   95.983508][ T7561] netlink: 44 bytes leftover after parsing attributes in process `syz.1.700'.
[   96.061628][ T7570] netlink: 4 bytes leftover after parsing attributes in process `syz.0.702'.
[   96.273055][ T7591] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms
[   96.277784][ T7591] (unnamed net_device) (uninitialized): option use_carrier: invalid value (5)
[   96.372388][ T7597] netlink: 68 bytes leftover after parsing attributes in process `syz.2.716'.
[   96.834788][ T7624] netlink: 8 bytes leftover after parsing attributes in process `syz.0.729'.
[   96.838358][ T7624] netlink: 108 bytes leftover after parsing attributes in process `syz.0.729'.
[   96.849539][ T7624] vlan2: entered allmulticast mode
[   96.851735][ T7624] veth1: entered allmulticast mode
[   97.011038][ T7630] xt_hashlimit: size too large, truncated to 1048576
[   97.621294][ T7663] netlink: 'syz.1.746': attribute type 11 has an invalid length.
[   97.823669][ T7682] netlink: 'syz.1.755': attribute type 3 has an invalid length.
[   97.893961][ T7686] x_tables: duplicate underflow at hook 1
[   97.899133][ T7689] ipt_REJECT: TCP_RESET invalid for non-tcp
[   97.948614][ T7692] netlink: 8 bytes leftover after parsing attributes in process `syz.2.760'.
[   97.954834][ T7692] netlink: 12 bytes leftover after parsing attributes in process `syz.2.760'.
[   97.959386][ T7692] netlink: 'syz.2.760': attribute type 18 has an invalid length.
[   98.015938][ T7693] wg1 speed is unknown, defaulting to 1000
[   98.930978][ T7758] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   98.933289][ T7758] IPv6: NLM_F_CREATE should be set when creating new route
[   98.969865][ T7762] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   99.186554][ T7784] 
[   99.187338][ T7784] ======================================================
[   99.189423][ T7784] WARNING: possible circular locking dependency detected
[   99.191675][ T7784] 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 Not tainted
[   99.194539][ T7784] ------------------------------------------------------
[   99.197130][ T7784] syz.2.799/7784 is trying to acquire lock:
[   99.198988][ T7784] ffff88802206d988 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0x3b/0x14c0
[   99.202172][ T7784] 
[   99.202172][ T7784] but task is already holding lock:
[   99.204529][ T7784] ffff88802206da30 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_genl_connect+0x94f/0x1930
[   99.207496][ T7784] 
[   99.207496][ T7784] which lock already depends on the new lock.
[   99.207496][ T7784] 
[   99.210607][ T7784] 
[   99.210607][ T7784] the existing dependency chain (in reverse order) is:
[   99.213389][ T7784] 
[   99.213389][ T7784] -> #2 (&nbd->config_lock){+.+.}-{4:4}:
[   99.215785][ T7784]        lock_acquire+0x120/0x360
[   99.217603][ T7784]        __mutex_lock+0x182/0xe80
[   99.219218][ T7784]        refcount_dec_and_mutex_lock+0x30/0xa0
[   99.221096][ T7784]        nbd_config_put+0x2c/0x790
[   99.222663][ T7784]        nbd_release+0xfe/0x140
[   99.224233][ T7784]        bdev_release+0x536/0x650
[   99.225859][ T7784]        blkdev_release+0x15/0x20
[   99.227464][ T7784]        __fput+0x44c/0xa70
[   99.228870][ T7784]        fput_close_sync+0x119/0x200
[   99.230519][ T7784]        __x64_sys_close+0x7f/0x110
[   99.232152][ T7784]        do_syscall_64+0xfa/0x3b0
[   99.233703][ T7784]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.235627][ T7784] 
[   99.235627][ T7784] -> #1 (&disk->open_mutex){+.+.}-{4:4}:
[   99.238435][ T7784]        lock_acquire+0x120/0x360
[   99.240166][ T7784]        __mutex_lock+0x182/0xe80
[   99.241953][ T7784]        __del_gendisk+0x129/0x9e0
[   99.243682][ T7784]        del_gendisk+0xe8/0x160
[   99.245132][ T7784]        nbd_dev_remove_work+0x47/0xe0
[   99.246799][ T7784]        process_scheduled_works+0xae1/0x17b0
[   99.248653][ T7784]        worker_thread+0x8a0/0xda0
[   99.250303][ T7784]        kthread+0x711/0x8a0
[   99.251722][ T7784]        ret_from_fork+0x3fc/0x770
[   99.253283][ T7784]        ret_from_fork_asm+0x1a/0x30
[   99.254907][ T7784] 
[   99.254907][ T7784] -> #0 (&set->update_nr_hwq_lock){++++}-{4:4}:
[   99.257766][ T7784]        validate_chain+0xb9b/0x2140
[   99.259315][ T7784]        __lock_acquire+0xab9/0xd20
[   99.261217][ T7784]        lock_acquire+0x120/0x360
[   99.262745][ T7784]        down_write+0x96/0x1f0
[   99.264219][ T7784]        blk_mq_update_nr_hw_queues+0x3b/0x14c0
[   99.266175][ T7784]        nbd_start_device+0x16c/0xac0
[   99.267792][ T7784]        nbd_genl_connect+0x1250/0x1930
[   99.269430][ T7784]        genl_family_rcv_msg_doit+0x215/0x300
[   99.271235][ T7784]        genl_rcv_msg+0x60e/0x790
[   99.272705][ T7784]        netlink_rcv_skb+0x208/0x470
[   99.274234][ T7784]        genl_rcv+0x28/0x40
[   99.275594][ T7784]        netlink_unicast+0x75c/0x8e0
[   99.277404][ T7784]        netlink_sendmsg+0x805/0xb30
[   99.278965][ T7784]        __sock_sendmsg+0x21c/0x270
[   99.280807][ T7784]        ____sys_sendmsg+0x505/0x830
[   99.282511][ T7784]        ___sys_sendmsg+0x21f/0x2a0
[   99.284223][ T7784]        __x64_sys_sendmsg+0x19b/0x260
[   99.286082][ T7784]        do_syscall_64+0xfa/0x3b0
[   99.287607][ T7784]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.289576][ T7784] 
[   99.289576][ T7784] other info that might help us debug this:
[   99.289576][ T7784] 
[   99.292665][ T7784] Chain exists of:
[   99.292665][ T7784]   &set->update_nr_hwq_lock --> &disk->open_mutex --> &nbd->config_lock
[   99.292665][ T7784] 
[   99.297061][ T7784]  Possible unsafe locking scenario:
[   99.297061][ T7784] 
[   99.299307][ T7784]        CPU0                    CPU1
[   99.300968][ T7784]        ----                    ----
[   99.302756][ T7784]   lock(&nbd->config_lock);
[   99.304379][ T7784]                                lock(&disk->open_mutex);
[   99.306706][ T7784]                                lock(&nbd->config_lock);
[   99.308869][ T7784]   lock(&set->update_nr_hwq_lock);
[   99.310461][ T7784] 
[   99.310461][ T7784]  *** DEADLOCK ***
[   99.310461][ T7784] 
[   99.312890][ T7784] 3 locks held by syz.2.799/7784:
[   99.314375][ T7784]  #0: ffffffff8f583bf0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[   99.316939][ T7784]  #1: ffffffff8f583a08 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790
[   99.319621][ T7784]  #2: ffff88802206da30 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_genl_connect+0x94f/0x1930
[   99.322862][ T7784] 
[   99.322862][ T7784] stack backtrace:
[   99.324597][ T7784] CPU: 1 UID: 0 PID: 7784 Comm: syz.2.799 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   99.324608][ T7784] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   99.324615][ T7784] Call Trace:
[   99.324620][ T7784]  <TASK>
[   99.324625][ T7784]  dump_stack_lvl+0x189/0x250
[   99.324639][ T7784]  ? __pfx_dump_stack_lvl+0x10/0x10
[   99.324649][ T7784]  ? __pfx__printk+0x10/0x10
[   99.324665][ T7784]  ? print_lock_name+0xde/0x100
[   99.324675][ T7784]  print_circular_bug+0x2ee/0x310
[   99.324687][ T7784]  check_noncircular+0x134/0x160
[   99.324698][ T7784]  validate_chain+0xb9b/0x2140
[   99.324712][ T7784]  __lock_acquire+0xab9/0xd20
[   99.324721][ T7784]  ? blk_mq_update_nr_hw_queues+0x3b/0x14c0
[   99.324729][ T7784]  lock_acquire+0x120/0x360
[   99.324736][ T7784]  ? blk_mq_update_nr_hw_queues+0x3b/0x14c0
[   99.324745][ T7784]  ? __mutex_unlock_slowpath+0x1cd/0x700
[   99.324755][ T7784]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   99.324766][ T7784]  down_write+0x96/0x1f0
[   99.324775][ T7784]  ? blk_mq_update_nr_hw_queues+0x3b/0x14c0
[   99.324783][ T7784]  ? __pfx_down_write+0x10/0x10
[   99.324792][ T7784]  blk_mq_update_nr_hw_queues+0x3b/0x14c0
[   99.324801][ T7784]  ? nbd_add_socket+0x688/0x9a0
[   99.324810][ T7784]  ? nbd_add_socket+0x688/0x9a0
[   99.324818][ T7784]  nbd_start_device+0x16c/0xac0
[   99.324826][ T7784]  ? __nla_parse+0x40/0x60
[   99.324834][ T7784]  nbd_genl_connect+0x1250/0x1930
[   99.324843][ T7784]  ? __pfx_nbd_genl_connect+0x10/0x10
[   99.324854][ T7784]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[   99.324868][ T7784]  genl_family_rcv_msg_doit+0x215/0x300
[   99.324880][ T7784]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[   99.324896][ T7784]  genl_rcv_msg+0x60e/0x790
[   99.324908][ T7784]  ? __pfx_genl_rcv_msg+0x10/0x10
[   99.324918][ T7784]  ? __pfx_nbd_genl_connect+0x10/0x10
[   99.324928][ T7784]  netlink_rcv_skb+0x208/0x470
[   99.324938][ T7784]  ? __pfx_genl_rcv_msg+0x10/0x10
[   99.324949][ T7784]  ? __pfx_netlink_rcv_skb+0x10/0x10
[   99.324960][ T7784]  ? down_read+0x1ad/0x2e0
[   99.324968][ T7784]  genl_rcv+0x28/0x40
[   99.324978][ T7784]  netlink_unicast+0x75c/0x8e0
[   99.324988][ T7784]  netlink_sendmsg+0x805/0xb30
[   99.324998][ T7784]  ? __pfx_netlink_sendmsg+0x10/0x10
[   99.325008][ T7784]  ? aa_sock_msg_perm+0x94/0x160
[   99.325019][ T7784]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   99.325030][ T7784]  ? __pfx_netlink_sendmsg+0x10/0x10
[   99.325039][ T7784]  __sock_sendmsg+0x21c/0x270
[   99.325046][ T7784]  ____sys_sendmsg+0x505/0x830
[   99.325057][ T7784]  ? __pfx_____sys_sendmsg+0x10/0x10
[   99.325067][ T7784]  ? import_iovec+0x74/0xa0
[   99.325076][ T7784]  ___sys_sendmsg+0x21f/0x2a0
[   99.325086][ T7784]  ? __pfx____sys_sendmsg+0x10/0x10
[   99.325101][ T7784]  ? __fget_files+0x2a/0x420
[   99.325111][ T7784]  ? __fget_files+0x3a0/0x420
[   99.325122][ T7784]  __x64_sys_sendmsg+0x19b/0x260
[   99.325132][ T7784]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   99.325143][ T7784]  ? __sys_socketpair+0x4a9/0x560
[   99.325151][ T7784]  ? do_syscall_64+0xbe/0x3b0
[   99.325160][ T7784]  do_syscall_64+0xfa/0x3b0
[   99.325167][ T7784]  ? lockdep_hardirqs_on+0x9c/0x150
[   99.325180][ T7784]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.325187][ T7784]  ? exc_page_fault+0x9f/0xf0
[   99.325198][ T7784]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.325206][ T7784] RIP: 0033:0x7f1e9098e929
[   99.325215][ T7784] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   99.325223][ T7784] RSP: 002b:00007f1e917b5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   99.325232][ T7784] RAX: ffffffffffffffda RBX: 00007f1e90bb5fa0 RCX: 00007f1e9098e929
[   99.325238][ T7784] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 0000000000000007
[   99.325244][ T7784] RBP: 00007f1e90a10b39 R08: 0000000000000000 R09: 0000000000000000
[   99.325249][ T7784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   99.325254][ T7784] R13: 0000000000000000 R14: 00007f1e90bb5fa0 R15: 00007ffcf9912888
[   99.325263][ T7784]  </TASK>
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   99.498720][ T7784] nbd2: detected capacity change from 0 to 127
[   99.848241][   T57] block nbd2: Receive control failed (result -104)
[  101.511051][ T5851] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  101.589214][ T5851] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  101.641045][ T5851] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  101.680579][ T5851] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  101.781391][ T5851] bridge_slave_1: left allmulticast mode
[  101.784234][ T5851] bridge_slave_1: left promiscuous mode
[  101.786876][ T5851] bridge0: port 2(bridge_slave_1) entered disabled state
[  101.791014][ T5851] bridge_slave_0: left allmulticast mode
[  101.793252][ T5851] bridge_slave_0: left promiscuous mode
[  101.797113][ T5851] bridge0: port 1(bridge_slave_0) entered disabled state
[  101.882721][ T5851] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  101.887668][ T5851] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  101.891910][ T5851] bond0 (unregistering): Released all slaves
[  101.948859][ T5851] tipc: Left network mode
[  102.081204][ T5851] hsr_slave_0: left promiscuous mode
[  102.083162][ T5851] hsr_slave_1: left promiscuous mode
[  102.085945][ T5851] batman_adv: batadv0: Removing interface: batadv_slave_0
[  102.089718][ T5851] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  102.092346][ T5851] batman_adv: batadv0: Removing interface: batadv_slave_1
[  102.097325][ T5851] veth1_macvtap: left promiscuous mode
[  102.099027][ T5851] veth0_macvtap: left promiscuous mode
[  102.100796][ T5851] veth1_vlan: left promiscuous mode
[  102.102451][ T5851] veth0_vlan: left promiscuous mode
[  102.222224][ T5851] team0 (unregistering): Port device team_slave_1 removed
[  102.236688][ T5851] team0 (unregistering): Port device team_slave_0 removed

VM DIAGNOSIS:
18:41:05  Registers:
info registers vcpu 0

CPU#0
RAX=268a29204b372300 RBX=ffffffff81976c78 RCX=268a29204b372300 RDX=0000000000000001
RSI=ffffffff8be29da0 RDI=ffffffff81976c78 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f5b R9 =1ffff110096065eb R10=dffffc0000000000 R11=ffffed10096065ec
R12=ffffffff8fa1f3f0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6f34d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c32d25f CR3=0000000114ac0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000030657267
XMM02=00080080000a0001 0006aa1414acffff XMM03=73179e5d537b3e0c 2c4de31b5d030006
XMM04=c36197fc6dc86296 dc101295818e2fe8 XMM05=c8fd5f43c4d0b7cf 55722ee271a8cc52
XMM06=1d9aa773179e5d53 7b3e0c2c4de31b5d XMM07=0300060008008000 0a00010006aa1414
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f46b9c11c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=00000000000017c0 RDI=00000000000017c1 RBP=00000000000003f8 RSP=ffffc9000430e710
R8 =ffff888106620237 R9 =1ffff11020cc4046 R10=dffffc0000000000 R11=ffffffff85478780
R12=dffffc0000000000 R13=ffffffff99af9884 R14=ffffffff99dfe6e0 R15=0000000000000000
RIP=ffffffff854787fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f1e917b56c0 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f2b42e3cfc8 CR3=00000000296b0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f2b42185478 00007f2b42185450 XMM03=00007f2b42185488 00007f2b42185480
XMM04=00007f2b42ced100 00007f2b42185440 XMM05=00007f2b42185458 00007f2b421854a0
XMM06=00007f2b42185498 00007f2b42185490 XMM07=00007f2b42185488 00007f2b42185480
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f2b42011c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
