last executing test programs:

1.551255715s ago: executing program 1 (id=1768):
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2, 0x3032, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0)
syz_open_procfs$namespace(0x0, &(0x7f0000000000))

1.20403986s ago: executing program 1 (id=1775):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$ETHTOOL_MSG_FEATURES_GET(r0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000040}, 0x800)
socketpair(0x1e, 0x1, 0x0, &(0x7f0000000080)={<r1=>0x0, 0x0})
close(r1)
ppoll(0x0, 0x0, 0x0, &(0x7f000000c240), 0x8)
r2 = socket$l2tp6(0xa, 0x2, 0x73)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket(0x400000000010, 0x3, 0x0)
r6 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x2, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x40}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002e40)=@delchain={0x24, 0x64, 0x1, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff3}, {}, {0xb, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804)
ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f00000000c0))
socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000080)={'veth0_virt_wifi\x00', &(0x7f0000000000)=@ethtool_rxfh={0x46, 0x9, 0xb, 0x8, 0x5, "218108", 0x1, [0x4, 0x4, 0x1, 0x10]}})
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r8)
sendmsg$IEEE802154_LLSEC_LIST_KEY(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, r9, 0x325}, 0x14}}, 0x0)
r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r11 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r10)
sendmsg$NLBL_MGMT_C_ADDDEF(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x14, r11, 0x511, 0x0, 0xfffffffe, {0x5}}, 0x21}}, 0xa000000)

738.561768ms ago: executing program 2 (id=1777):
r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xca)
setsockopt$ax25_int(r0, 0x101, 0x2, &(0x7f0000000000)=0x6, 0x4)

682.353214ms ago: executing program 2 (id=1778):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a300000000048000000090a010400000000000000000700000008000a40000000000900020073797a3100000000090001007379"], 0xf0}}, 0x0)
socket(0x11, 0x4, 0x9)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r2}, 0x10)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0)
r3 = socket$xdp(0x2c, 0x3, 0x0)
r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r4, 0x0, 0x1a, 0x0, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)
setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/96, 0x2329000, 0x800}, 0x20)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000002000000000000000000000203000000000000000000000d00"/54], &(0x7f0000000140)=""/240, 0x56, 0xf0, 0x1}, 0x28)
r5 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r5, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(aegis128-aesni)\x00'}, 0x58)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r6, &(0x7f0000000240)={0x1f, 0xffff, 0x2}, 0x6)
recvmmsg(r6, &(0x7f0000000600), 0x204083acb88ff8b, 0x2, 0x0)
mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0)
r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x0, 0x0)
accept4$ax25(r7, &(0x7f00000000c0)={{0x3, @rose}, [@rose, @default, @bcast, @rose, @remote, @null, @bcast, @netrom]}, &(0x7f0000000140)=0x48, 0x0)
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x16, &(0x7f0000000040), 0xfffffceb)
syz_init_net_socket$802154_raw(0x24, 0x3, 0x0)
unshare(0x62040200)
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)=@newlink={0x58, 0x10, 0xffffff23, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x15610}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x14, 0x2, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2a}}}, @IFLA_IPTUN_PROTO={0x5, 0x9, 0x29}]}}}, @IFLA_MTU={0x8, 0x4, 0x500}]}, 0x58}, 0x1, 0x0, 0x0, 0x20040001}, 0x8000)

393.577325ms ago: executing program 0 (id=1782):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000108500000075000000a50000002300000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='virtio_transport_alloc_pkt\x00', r0}, 0x10)
r1 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r1, &(0x7f0000000500)={0x28, 0x0, 0x0, @local}, 0x10)

324.579205ms ago: executing program 1 (id=1783):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x3f, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWRULE={0x88, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x58, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_INNER_NUM={0x8}, @NFTA_INNER_EXPR={0x24, 0x5, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x2, 0x1, 0x1, 0x0, 0xe}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb0}}, 0x0)

252.343659ms ago: executing program 0 (id=1784):
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
shutdown(r0, 0x3)

252.016963ms ago: executing program 1 (id=1785):
r0 = socket(0x2b, 0x80801, 0x1)
ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180))

251.611259ms ago: executing program 0 (id=1786):
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
connect$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x6, @mcast2, 0x2}, 0x1c)
connect$inet6(r0, &(0x7f00000004c0)={0xa, 0x4e21, 0x5, @mcast1, 0x101}, 0x1c)

164.063577ms ago: executing program 2 (id=1787):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000580)={0x14, 0x3, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x4000080)

163.755976ms ago: executing program 1 (id=1788):
r0 = socket$kcm(0x10, 0x400000002, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33)
recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000004700)=""/4097, 0x1001}, {&(0x7f0000003700)=""/4074, 0xfea}, {&(0x7f0000002240)=""/115, 0x73}, {&(0x7f00000022c0)=""/203, 0xcb}], 0x4}, 0x0)

163.495494ms ago: executing program 2 (id=1789):
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendto$inet6(r0, &(0x7f00000001c0)="c2", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x8, @private0={0xfc, 0x0, '\x00', 0x1}, 0xff}, 0x1c, &(0x7f0000000400)=[{&(0x7f0000000080)="0f386bb8", 0x4}], 0x1}}], 0x1, 0x4000)
shutdown(r0, 0x1)
setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0xfffffffe}, 0x14)

100.750085ms ago: executing program 0 (id=1790):
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x4, &(0x7f0000000200)=@framed={{}, [@ldst={0x3, 0x0, 0x6, 0x1, 0x0, 0x21}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94)

100.292078ms ago: executing program 1 (id=1791):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r1}, 0x10)
unshare(0x22020600)
r2 = socket(0x10, 0x3, 0x0)
recvmmsg(r2, &(0x7f0000005180), 0x400000000000166, 0x1a000, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r6 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}}, 0x20040084)
sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001380)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)
r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r8, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6)
write(r8, &(0x7f0000000040)="09000000010000", 0x7)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r9 = socket$kcm(0x2, 0xa, 0x2)
ioctl$TUNSETLINK(r0, 0x400454cd, 0x30d)
ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
r10 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000006c000000160a01020000000000000000010000000900010073797a30000000000900020073797a3000000000400003802c00038004000100766c616e31000000000000000000000014000100776c616e3100000000000000000000000800014000000000080002"], 0xfc}}, 0x0)
write$tun(r0, &(0x7f0000000440)={@val, @void, @eth={@multicast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x6, 0x0, 0x6}}, {@ipv4={0x800, @tipc={{0x6, 0x4, 0x1, 0x5, 0x38, 0x66, 0x0, 0xff, 0x6, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, @dev={0xac, 0x14, 0x14, 0x43}, {[@noop]}}, @payload_direct={{{{0x20, 0x0, 0x1, 0x1, 0x1, 0x8, 0x2, 0x2, 0x2, 0x0, 0x1, 0x5, 0x3, 0x3, 0x0, 0x347b, 0x2, 0x4e20, 0x4e22}, 0x0, 0x2}}}}}}}}, 0x52)

98.967946ms ago: executing program 2 (id=1792):
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x31}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x14}, 0x94)

96.366103ms ago: executing program 0 (id=1793):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$igmp6(0xa, 0x3, 0x2)
splice(r0, 0xfffffffffffffffe, r1, 0x0, 0x8, 0x0)

513.855µs ago: executing program 2 (id=1794):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0)
writev(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)="89c9157afde08ea4387fbe5739d1766791827bb588e5a143fea3b55347c980460b48a9d8a6579c910b46ee7b5e2ecf067a673b4bd1061bfd94c39247445926593da3717f1907fc9742eb0448d0236a020e606a457553f39c650c01d7702c0e5db4ea9bdc377cfa2b8f58c2b7f7d25c09f8cfa89b483afe93790ddfe1ea26f7c344bb334e6a", 0x85}], 0x1)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f0000000080), 0x8)

0s ago: executing program 0 (id=1795):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
sendto$inet(r0, 0x0, 0x0, 0x20048880, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x18)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x28, r4, 0x1, 0xff1f, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x26004808)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:8976' (ED25519) to the list of known hosts.
syzkaller login: [   58.478400][ T5838] cgroup: Unknown subsys name 'net'
[   58.587230][ T5838] cgroup: Unknown subsys name 'cpuset'
[   58.593371][ T5838] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   60.935275][ T5838] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   66.232278][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   66.247074][ T5854] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   66.250423][ T5854] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   66.254852][ T5859] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   66.292644][ T5859] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   66.293165][ T5854] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   66.300112][ T5859] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   66.300191][ T5854] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   66.309117][ T5854] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   66.312796][ T5854] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   66.342783][ T5236] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   66.346517][ T5236] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   66.350057][ T5236] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   66.354434][ T5236] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   66.358273][ T5236] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   66.713115][ T5856] chnl_net:caif_netlink_parms(): no params data found
[   66.768457][ T5860] chnl_net:caif_netlink_parms(): no params data found
[   66.827352][ T5852] chnl_net:caif_netlink_parms(): no params data found
[   66.892279][ T5856] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.896132][ T5856] bridge0: port 1(bridge_slave_0) entered disabled state
[   66.898653][ T5856] bridge_slave_0: entered allmulticast mode
[   66.901906][ T5856] bridge_slave_0: entered promiscuous mode
[   66.916796][ T5860] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.919526][ T5860] bridge0: port 1(bridge_slave_0) entered disabled state
[   66.922446][ T5860] bridge_slave_0: entered allmulticast mode
[   66.926309][ T5860] bridge_slave_0: entered promiscuous mode
[   66.930019][ T5856] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.933675][ T5856] bridge0: port 2(bridge_slave_1) entered disabled state
[   66.935942][ T5856] bridge_slave_1: entered allmulticast mode
[   66.938680][ T5856] bridge_slave_1: entered promiscuous mode
[   66.966948][ T5860] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.969299][ T5860] bridge0: port 2(bridge_slave_1) entered disabled state
[   66.971614][ T5860] bridge_slave_1: entered allmulticast mode
[   66.974721][ T5860] bridge_slave_1: entered promiscuous mode
[   67.024741][ T5860] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   67.029374][ T5856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   67.050627][ T5860] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   67.069348][ T5856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   67.115462][ T5852] bridge0: port 1(bridge_slave_0) entered blocking state
[   67.118346][ T5852] bridge0: port 1(bridge_slave_0) entered disabled state
[   67.121327][ T5852] bridge_slave_0: entered allmulticast mode
[   67.125422][ T5852] bridge_slave_0: entered promiscuous mode
[   67.128707][ T5852] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.131123][ T5852] bridge0: port 2(bridge_slave_1) entered disabled state
[   67.134127][ T5852] bridge_slave_1: entered allmulticast mode
[   67.137418][ T5852] bridge_slave_1: entered promiscuous mode
[   67.141517][ T5860] team0: Port device team_slave_0 added
[   67.162998][ T5860] team0: Port device team_slave_1 added
[   67.166611][ T5856] team0: Port device team_slave_0 added
[   67.192181][ T5856] team0: Port device team_slave_1 added
[   67.210948][ T5852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   67.225674][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_0
[   67.227848][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   67.237896][ T5860] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   67.254205][ T5852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   67.258170][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_1
[   67.260319][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   67.268618][ T5860] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   67.289186][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_0
[   67.291937][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   67.300118][ T5856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   67.327918][ T5860] hsr_slave_0: entered promiscuous mode
[   67.330549][ T5860] hsr_slave_1: entered promiscuous mode
[   67.334581][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_1
[   67.337108][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   67.345600][ T5856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   67.361148][ T5852] team0: Port device team_slave_0 added
[   67.381165][ T5852] team0: Port device team_slave_1 added
[   67.448615][ T5856] hsr_slave_0: entered promiscuous mode
[   67.450966][ T5856] hsr_slave_1: entered promiscuous mode
[   67.454192][ T5856] debugfs: 'hsr0' already exists in 'hsr'
[   67.456062][ T5856] Cannot create hsr debugfs directory
[   67.458439][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_0
[   67.461061][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   67.469860][ T5852] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   67.476455][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_1
[   67.478510][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   67.487310][ T5852] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   67.584734][ T5852] hsr_slave_0: entered promiscuous mode
[   67.587852][ T5852] hsr_slave_1: entered promiscuous mode
[   67.590722][ T5852] debugfs: 'hsr0' already exists in 'hsr'
[   67.594071][ T5852] Cannot create hsr debugfs directory
[   67.867771][ T5860] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   67.883241][ T5860] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   67.902950][ T5860] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   67.916196][ T5860] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   67.950049][ T5856] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   67.963787][ T5856] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   67.970861][ T5856] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   67.984295][ T5856] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   68.074526][ T5852] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   68.082261][ T5852] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   68.095713][ T5852] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   68.108916][ T5852] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   68.172039][ T5860] 8021q: adding VLAN 0 to HW filter on device bond0
[   68.219457][ T5860] 8021q: adding VLAN 0 to HW filter on device team0
[   68.235187][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   68.238305][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   68.266846][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   68.269710][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   68.288152][ T5856] 8021q: adding VLAN 0 to HW filter on device bond0
[   68.347131][ T5856] 8021q: adding VLAN 0 to HW filter on device team0
[   68.359391][ T5852] 8021q: adding VLAN 0 to HW filter on device bond0
[   68.369093][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   68.371378][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   68.384801][ T5236] Bluetooth: hci1: command tx timeout
[   68.384807][ T5854] Bluetooth: hci2: command tx timeout
[   68.385048][ T5854] Bluetooth: hci0: command tx timeout
[   68.399482][ T1089] bridge0: port 2(bridge_slave_1) entered blocking state
[   68.402531][ T1089] bridge0: port 2(bridge_slave_1) entered forwarding state
[   68.425837][ T5852] 8021q: adding VLAN 0 to HW filter on device team0
[   68.450487][ T1089] bridge0: port 1(bridge_slave_0) entered blocking state
[   68.453918][ T1089] bridge0: port 1(bridge_slave_0) entered forwarding state
[   68.479929][ T1089] bridge0: port 2(bridge_slave_1) entered blocking state
[   68.482938][ T1089] bridge0: port 2(bridge_slave_1) entered forwarding state
[   68.568045][ T5860] 8021q: adding VLAN 0 to HW filter on device batadv0
[   68.658229][ T5860] veth0_vlan: entered promiscuous mode
[   68.678492][ T5860] veth1_vlan: entered promiscuous mode
[   68.748368][ T5856] 8021q: adding VLAN 0 to HW filter on device batadv0
[   68.764182][ T5860] veth0_macvtap: entered promiscuous mode
[   68.776858][ T5860] veth1_macvtap: entered promiscuous mode
[   68.805031][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_0
[   68.822833][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_1
[   68.858994][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   68.864500][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   68.892901][ T5852] 8021q: adding VLAN 0 to HW filter on device batadv0
[   68.895542][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   68.909145][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   68.951216][ T5856] veth0_vlan: entered promiscuous mode
[   68.978410][ T5856] veth1_vlan: entered promiscuous mode
[   69.027482][ T5852] veth0_vlan: entered promiscuous mode
[   69.057605][ T5856] veth0_macvtap: entered promiscuous mode
[   69.063199][ T5852] veth1_vlan: entered promiscuous mode
[   69.066145][ T3611] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   69.070592][ T3611] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   69.085817][ T5856] veth1_macvtap: entered promiscuous mode
[   69.123454][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   69.129338][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   69.144974][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_0
[   69.167784][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_1
[   69.179984][ T5852] veth0_macvtap: entered promiscuous mode
[   69.198074][ T5852] veth1_macvtap: entered promiscuous mode
[   69.211124][ T5883] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   69.220209][ T5883] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   69.221608][ T5860] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   69.237115][ T5883] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   69.255722][ T5883] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   69.269707][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_0
[   69.316946][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_1
[   69.356315][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   69.370857][ T5883] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   69.382718][ T5883] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   69.398654][ T3611] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   69.401792][ T3611] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   69.408112][ T5883] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   69.491421][ T5199] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   69.506508][ T5199] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   69.540985][ T1089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   69.543852][ T1089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   69.630939][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   69.655360][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   69.734676][ T5934] netlink: 'syz.1.9': attribute type 1 has an invalid length.
[   69.738645][ T5934] netlink: 'syz.1.9': attribute type 4 has an invalid length.
[   69.741096][ T5934] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.9'.
[   69.774260][ T5937] netlink: 'syz.2.8': attribute type 1 has an invalid length.
[   69.776859][ T5937] netlink: 144 bytes leftover after parsing attributes in process `syz.2.8'.
[   69.782157][ T5937] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8'.
[   69.994730][ T5948] warning: `syz.1.14' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   70.105652][ T5952] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.16'.
[   70.288667][ T5962] syz.1.21 uses obsolete (PF_INET,SOCK_PACKET)
[   70.462672][ T5854] Bluetooth: hci1: command tx timeout
[   70.462761][   T54] Bluetooth: hci2: command tx timeout
[   70.473188][   T54] Bluetooth: hci0: command tx timeout
[   70.654435][ T5966] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   71.190167][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[   71.193014][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[   71.414212][ T5981] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   71.817478][ T6000] netlink: 16 bytes leftover after parsing attributes in process `syz.0.37'.
[   71.943595][ T6010] netlink: 16 bytes leftover after parsing attributes in process `syz.2.42'.
[   72.106723][ T6024] netlink: 12 bytes leftover after parsing attributes in process `syz.0.49'.
[   72.149387][ T6026] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (3)
[   72.249685][ T6035] netlink: 4 bytes leftover after parsing attributes in process `syz.2.55'.
[   72.545481][   T54] Bluetooth: hci1: command tx timeout
[   72.545687][ T5854] Bluetooth: hci0: command tx timeout
[   72.547314][ T5236] Bluetooth: hci2: command tx timeout
[   72.771627][ T6071] tipc: Failed to obtain node identity
[   72.776721][ T6071] tipc: Enabling of bearer <ib:caif0> rejected, failed to enable media
[   73.463849][ T6108] netlink: 168 bytes leftover after parsing attributes in process `syz.2.87'.
[   73.478720][ T6110] bond0: option use_carrier: invalid value (6)
[   73.648764][ T6126] netlink: 8 bytes leftover after parsing attributes in process `syz.0.94'.
[   73.752140][ T6131] ip6gretap0: entered promiscuous mode
[   73.756467][ T6131] syz_tun: entered promiscuous mode
[   73.783414][ T6129] netlink: 'syz.2.92': attribute type 1 has an invalid length.
[   74.409546][ T6150] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[   74.415299][ T6150] openvswitch: netlink: Message has 1 unknown bytes.
[   74.623339][ T5236] Bluetooth: hci2: command tx timeout
[   74.623695][   T54] Bluetooth: hci0: command tx timeout
[   74.633959][   T54] Bluetooth: hci1: command tx timeout
[   74.671931][ T6160] bridge0: port 2(bridge_slave_1) entered disabled state
[   74.674946][ T6160] bridge0: port 1(bridge_slave_0) entered disabled state
[   74.743735][ T6160] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   74.750625][ T6160] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   74.841552][ T5883] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   74.848595][ T5883] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   74.872627][ T5883] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   74.875523][ T5883] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   74.985875][ T6176] __nla_validate_parse: 3 callbacks suppressed
[   74.985889][ T6176] netlink: 12 bytes leftover after parsing attributes in process `syz.0.115'.
[   75.054503][ T6168] infiniband syz2: set active
[   75.056304][ T6168] infiniband syz2: added batadv_slave_1
[   75.086194][ T6168] RDS/IB: syz2: added
[   75.087996][ T6168] smc: adding ib device syz2 with port count 1
[   75.090217][ T6168] smc:    ib device syz2 port 1 has pnetid 
[   75.904443][ T6235] netlink: 'syz.1.143': attribute type 1 has an invalid length.
[   76.161982][ T6253] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   76.174878][ T6257] tap0: tun_chr_ioctl cmd 1074025676
[   76.176857][ T6257] tap0: owner set to 0
[   76.240278][ T6253] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   76.308485][ T6253] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   76.320038][ T6266] netlink: 16 bytes leftover after parsing attributes in process `syz.0.158'.
[   76.386939][ T6253] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   76.387222][ T6264] IPVS: wrr: UDP 224.0.0.2:0 - no destination available
[   76.395765][ T1272] IPVS: starting estimator thread 0...
[   76.475398][ T5721] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   76.485322][ T6268] IPVS: using max 61 ests per chain, 146400 per kthread
[   76.497476][ T5721] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   76.528488][ T5721] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   76.531259][ T5721] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   76.537488][ T6278] tipc: Started in network mode
[   76.539093][ T6278] tipc: Node identity 36fc6935505f, cluster identity 4711
[   76.541616][ T6278] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   76.555659][ T6278] syzkaller0: entered promiscuous mode
[   76.557428][ T6278] syzkaller0: entered allmulticast mode
[   76.606585][ T6278] tipc: Resetting bearer <eth:syzkaller0>
[   76.612846][ T6277] tipc: Resetting bearer <eth:syzkaller0>
[   76.632892][ T6277] tipc: Disabling bearer <eth:syzkaller0>
[   76.707969][   T54] Bluetooth: hci2: command tx timeout
[   76.727646][ T6300] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   76.765592][ T6304] netlink: 48 bytes leftover after parsing attributes in process `syz.1.170'.
[   76.895965][ T6314] netlink: 8 bytes leftover after parsing attributes in process `syz.1.173'.
[   77.259244][ T6333] unknown channel width for channel at 909000KHz?
[   77.459364][ T6338] Illegal XDP return value 4294967262 on prog  (id 17) dev N/A, expect packet loss!
[   77.546818][ T6344] netlink: 'syz.2.183': attribute type 1 has an invalid length.
[   77.549526][ T6344] netlink: 1 bytes leftover after parsing attributes in process `syz.2.183'.
[   77.649342][ T6352] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.186'.
[   77.661306][ T6350] syzkaller1: entered promiscuous mode
[   77.664402][ T6350] syzkaller1: entered allmulticast mode
[   77.739649][ T6356] IPv6: Can't replace route, no match found
[   77.994531][ T6382] netlink: 248 bytes leftover after parsing attributes in process `syz.1.202'.
[   78.030165][ T6384] netlink: 8 bytes leftover after parsing attributes in process `syz.0.203'.
[   78.070109][ T6384] : entered promiscuous mode
[   78.082860][ T6388] netlink: 'syz.1.204': attribute type 4 has an invalid length.
[   78.315693][ T6408] netlink: 'syz.1.211': attribute type 1 has an invalid length.
[   78.451043][ T6420] openvswitch: netlink: Missing valid actions attribute.
[   78.457972][ T6420] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   78.910043][ T6454] netlink: 'syz.0.224': attribute type 30 has an invalid length.
[   79.013691][ T6454] Zero length message leads to an empty skb
[   79.100639][ T6464] netlink: 28 bytes leftover after parsing attributes in process `syz.1.228'.
[   79.170642][ T6469] bridge_slave_0: left allmulticast mode
[   79.178832][ T6469] bridge_slave_0: left promiscuous mode
[   79.181309][ T6469] bridge0: port 1(bridge_slave_0) entered disabled state
[   79.209814][ T6469] bridge_slave_1: left allmulticast mode
[   79.212072][ T6469] bridge_slave_1: left promiscuous mode
[   79.232950][ T6469] bridge0: port 2(bridge_slave_1) entered disabled state
[   79.241464][ T6469] bond0: (slave bond_slave_0): Releasing backup interface
[   79.254398][ T6469] bond0: (slave bond_slave_1): Releasing backup interface
[   79.271288][ T6469] team0: Port device team_slave_0 removed
[   79.283078][ T6469] team0: Port device team_slave_1 removed
[   79.285308][ T6469] batman_adv: batadv0: Removing interface: batadv_slave_0
[   79.289550][ T6469] batman_adv: batadv0: Removing interface: batadv_slave_1
[   79.293188][ T6476] team0: Mode changed to "broadcast"
[   79.303310][ T6480] vlan0: entered promiscuous mode
[   79.323491][ T6469] tipc: Started in network mode
[   79.329221][ T6469] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711
[   79.331766][ T6469] tipc: Enabled bearer <eth:team0>, priority 0
[   79.469429][ T6498] xt_time: unknown flags 0xf4
[   79.585084][ T6506] Bluetooth: MGMT ver 1.23
[   79.996879][ T6544] netlink: 'syz.0.265': attribute type 58 has an invalid length.
[   80.000038][ T6544] netlink: 20 bytes leftover after parsing attributes in process `syz.0.265'.
[   80.208131][ T6558] netlink: 'syz.0.270': attribute type 4 has an invalid length.
[   80.350311][ T6572] syz_tun: entered allmulticast mode
[   80.445412][ T5917] tipc: Node number set to 11578026
[   80.530869][ T6570] syz_tun: left allmulticast mode
[   80.669654][ T6592] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   80.762111][ T6592] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   80.828084][ T6592] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   80.840451][ T6600] netlink: 24 bytes leftover after parsing attributes in process `syz.0.291'.
[   80.891027][ T6592] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   80.987958][ T5883] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   80.999662][ T5883] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   81.034704][   T12] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   81.043005][   T12] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   81.340862][ T6622] netlink: 'syz.0.300': attribute type 1 has an invalid length.
[   81.661417][ T6643] netlink: 288 bytes leftover after parsing attributes in process `syz.1.308'.
[   81.670184][ T6645] netlink: 'syz.0.309': attribute type 8 has an invalid length.
[   81.964944][ T6664] vlan2: entered promiscuous mode
[   82.216548][ T6686] netlink: 8 bytes leftover after parsing attributes in process `syz.1.329'.
[   82.219413][ T6686] netlink: 4 bytes leftover after parsing attributes in process `syz.1.329'.
[   82.246925][ T6688] netlink: 8 bytes leftover after parsing attributes in process `syz.2.330'.
[   82.266705][ T6690] netlink: 36 bytes leftover after parsing attributes in process `syz.1.331'.
[   82.628308][ T6728] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   83.908109][ T6793] openvswitch: netlink: Key type 29 is not supported
[   85.470669][ T6874] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   85.854560][ T6895] netlink: 16 bytes leftover after parsing attributes in process `syz.0.413'.
[   85.857771][ T6895] netlink: 64 bytes leftover after parsing attributes in process `syz.0.413'.
[   85.889362][ T6899] netlink: 24 bytes leftover after parsing attributes in process `syz.0.415'.
[   85.895918][ T6899] netlink: 12 bytes leftover after parsing attributes in process `syz.0.415'.
[   86.016426][ T6904] netlink: 36 bytes leftover after parsing attributes in process `syz.2.417'.
[   86.071447][ T6908] tipc: Started in network mode
[   86.073233][ T6908] tipc: Node identity 4, cluster identity 4711
[   86.075091][ T6908] tipc: Node number set to 4
[   86.080892][ T6910] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[   86.116300][ T6912] openvswitch: netlink: nsh attribute has 127 unknown bytes.
[   86.293737][ T6924] pimreg: entered allmulticast mode
[   86.548665][    T9] cfg80211: failed to load regulatory.db
[   86.642147][ T6941] netlink: 8 bytes leftover after parsing attributes in process `syz.0.434'.
[   86.722518][ T6945] netlink: 'syz.0.436': attribute type 1 has an invalid length.
[   86.726673][ T6945] netlink: 36 bytes leftover after parsing attributes in process `syz.0.436'.
[   86.957759][ T6959] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check.
[   87.163989][ T6981] netlink: 12 bytes leftover after parsing attributes in process `syz.0.454'.
[   87.283792][ T6994] lo speed is unknown, defaulting to 1000
[   87.285887][ T6994] lo speed is unknown, defaulting to 1000
[   87.288514][ T6994] lo speed is unknown, defaulting to 1000
[   87.294168][ T6994] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   87.302090][ T6994] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[   87.325375][ T6994] lo speed is unknown, defaulting to 1000
[   87.329634][ T6994] lo speed is unknown, defaulting to 1000
[   87.334007][ T6994] lo speed is unknown, defaulting to 1000
[   87.610224][ T7014] netlink: 'syz.0.469': attribute type 8 has an invalid length.
[   88.352891][ T7031] netlink: 60 bytes leftover after parsing attributes in process `syz.2.477'.
[   88.527028][ T7046] netlink: 8 bytes leftover after parsing attributes in process `syz.1.483'.
[   88.626174][   T27] wlan1: Trigger new scan to find an IBSS to join
[   88.875144][ T7047] lo speed is unknown, defaulting to 1000
[   89.054046][ T7069] netlink: 'syz.2.492': attribute type 4 has an invalid length.
[   89.065573][    T9] lo speed is unknown, defaulting to 1000
[   89.071847][    T9] syz1: Port: 1 Link DOWN
[   89.078154][ T7069] netlink: 'syz.2.492': attribute type 4 has an invalid length.
[   89.099541][    T9] lo speed is unknown, defaulting to 1000
[   89.107757][    T9] syz1: Port: 1 Link ACTIVE
[   89.291748][ T7082] bond1: (slave ip6gretap1): making interface the new active one
[   89.295537][ T7082] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link
[   90.150761][ T7119] ieee802154 phy0 wpan0: encryption failed: -22
[   90.376275][ T7121] lo speed is unknown, defaulting to 1000
[   90.598394][ T7145] netlink: zone id is out of range
[   90.650074][ T7151] netlink: 'syz.2.526': attribute type 1 has an invalid length.
[   91.311754][ T7189] __nla_validate_parse: 7 callbacks suppressed
[   91.311769][ T7189] netlink: 4 bytes leftover after parsing attributes in process `syz.1.543'.
[   91.674069][   T27] wlan1: Trigger new scan to find an IBSS to join
[   92.326680][ T7215] lo speed is unknown, defaulting to 1000
[   93.364832][ T7282] sctp: [Deprecated]: syz.2.582 (pid 7282) Use of int in max_burst socket option.
[   93.364832][ T7282] Use struct sctp_assoc_value instead
[   94.022753][ T7306] netlink: 8 bytes leftover after parsing attributes in process `syz.1.587'.
[   94.027432][ T7306] openvswitch: netlink: nsh attr 0 has unexpected len 7 expected 0
[   94.034969][ T7306] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   94.489568][ T7318] syzkaller0: entered promiscuous mode
[   94.491341][ T7318] syzkaller0: entered allmulticast mode
[   94.626129][   T64] wlan1: Trigger new scan to find an IBSS to join
[   95.506293][   T36] wlan1: Creating new IBSS network, BSSID 4e:77:9c:ad:11:76
[   95.591792][ T7341] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   95.599249][ T7341] syzkaller0: entered promiscuous mode
[   95.601803][ T7341] syzkaller0: entered allmulticast mode
[   95.618118][ T7341] tipc: Resetting bearer <eth:syzkaller0>
[   95.622109][ T7340] tipc: Resetting bearer <eth:syzkaller0>
[   95.645376][ T7340] tipc: Disabling bearer <eth:syzkaller0>
[   95.748905][ T7349] netlink: 4 bytes leftover after parsing attributes in process `syz.0.603'.
[   95.770169][ T7353] netlink: 104 bytes leftover after parsing attributes in process `syz.1.604'.
[   96.076058][ T7378] openvswitch: netlink: ERSPAN option length err (len 256, max 255).
[   96.340444][ T7401] netlink: 'syz.0.625': attribute type 9 has an invalid length.
[   96.346220][ T7401] netlink: 224 bytes leftover after parsing attributes in process `syz.0.625'.
[   96.397790][ T7375] lo speed is unknown, defaulting to 1000
[   97.039475][ T7439] netlink: 24 bytes leftover after parsing attributes in process `syz.1.636'.
[   97.084399][ T7442] netlink: 20 bytes leftover after parsing attributes in process `syz.2.637'.
[   97.478172][ T7472] netlink: 'syz.1.649': attribute type 10 has an invalid length.
[   97.491200][ T7472] team0: Port device dummy0 added
[   97.778952][ T7491] netlink: 4 bytes leftover after parsing attributes in process `syz.2.656'.
[   97.929615][ T7505] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: invalid value (71)
[   97.936117][ T7505] Bluetooth: MGMT ver 1.23
[   97.943168][ T7505] netlink: 16 bytes leftover after parsing attributes in process `syz.2.659'.
[   97.947540][ T7505] netlink: 16 bytes leftover after parsing attributes in process `syz.2.659'.
[   98.503231][ T7527] IPVS: length: 163 != 8
[   98.619276][ T7534] netlink: 28 bytes leftover after parsing attributes in process `syz.1.672'.
[   98.622198][ T7534] netlink: 28 bytes leftover after parsing attributes in process `syz.1.672'.
[   98.625640][ T7534] netlink: 44 bytes leftover after parsing attributes in process `syz.1.672'.
[   98.748035][ T7542] netlink: 8 bytes leftover after parsing attributes in process `syz.0.676'.
[   98.976337][ T7548] syzkaller0: entered promiscuous mode
[   98.978597][ T7548] syzkaller0: entered allmulticast mode
[   99.986655][   T54] Bluetooth: hci2: Opcode 0x0401 failed: -110
[   99.991107][   T54] Bluetooth: hci2: command 0x0401 tx timeout
[  100.586751][ T7590] openvswitch: netlink: Tunnel attr 227 out of range max 16
[  100.670484][ T7589] syzkaller0: entered promiscuous mode
[  100.676764][ T7589] syzkaller0: entered allmulticast mode
[  100.955619][ T7616] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048)
[  101.468025][ T7655] tipc: Enabled bearer <ib:ip6gre0>, priority 10
[  101.845640][ T7673] erspan0: entered promiscuous mode
[  101.849364][ T7673] erspan0: left promiscuous mode
[  101.960387][ T7673] __nla_validate_parse: 4 callbacks suppressed
[  101.960403][ T7673] netlink: 12 bytes leftover after parsing attributes in process `syz.2.733'.
[  102.079031][ T7682] netlink: 28 bytes leftover after parsing attributes in process `syz.1.737'.
[  102.181328][ T7690] gretap1: entered promiscuous mode
[  102.185669][ T7690] gretap1: entered allmulticast mode
[  102.272514][ T7699] tipc: Enabled bearer <udp:syz2>, priority 10
[  102.333742][ T7699] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  102.585242][ T5314] tipc: Node number set to 1721985333
[  102.639733][ T7724] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-alb(6)
[  103.104524][ T7746] bridge0: port 1(erspan0) entered blocking state
[  103.107293][ T7746] bridge0: port 1(erspan0) entered disabled state
[  103.110157][ T7746] erspan0: entered allmulticast mode
[  103.117230][ T7746] erspan0: entered promiscuous mode
[  103.269311][ T7751] erspan0: left allmulticast mode
[  103.271396][ T7751] erspan0: left promiscuous mode
[  103.274947][ T7751] bridge0: port 1(erspan0) entered disabled state
[  103.372573][ T7761] netlink: 28 bytes leftover after parsing attributes in process `syz.2.766'.
[  103.599213][ T7776] netlink: 12 bytes leftover after parsing attributes in process `syz.0.771'.
[  103.699520][ T7784] bridge0: port 1(bridge_slave_0) entered disabled state
[  103.709023][ T7784] bridge0: port 2(bridge_slave_1) entered disabled state
[  104.002059][ T7803] netlink: 44 bytes leftover after parsing attributes in process `syz.2.782'.
[  104.187875][ T7816] xt_limit: Overflow, try lower: 604147548/4200216962
[  105.085690][ T7898] netlink: 8 bytes leftover after parsing attributes in process `syz.0.815'.
[  105.088879][ T7898] veth1: entered promiscuous mode
[  105.090994][ T7898] netlink: 'syz.0.815': attribute type 1 has an invalid length.
[  105.106339][ T7898] netlink: 36 bytes leftover after parsing attributes in process `syz.0.815'.
[  105.110646][ T7898] A link change request failed with some changes committed already. Interface veth1 may have been left with an inconsistent configuration, please check.
[  105.185229][ T7906] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3
[  105.347595][ T7925] netlink: 8 bytes leftover after parsing attributes in process `syz.1.828'.
[  105.483874][ T7942] netlink: 277 bytes leftover after parsing attributes in process `syz.1.836'.
[  105.817257][ T7968] netlink: zone id is out of range
[  105.819112][ T7968] netlink: zone id is out of range
[  105.821178][ T7968] netlink: zone id is out of range
[  105.827475][ T7968] netlink: zone id is out of range
[  105.829142][ T7968] netlink: zone id is out of range
[  105.830841][ T7968] netlink: zone id is out of range
[  105.835550][ T7968] netlink: zone id is out of range
[  105.841088][ T7968] netlink: zone id is out of range
[  106.624150][ T8027] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  106.736057][ T8027] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  106.784593][ T8044] sctp: [Deprecated]: syz.0.879 (pid 8044) Use of int in max_burst socket option.
[  106.784593][ T8044] Use struct sctp_assoc_value instead
[  106.826388][ T8027] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  106.895583][ T8027] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  107.006721][   T13] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  107.036981][ T5883] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  107.052501][ T5883] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  107.066868][ T5883] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  107.199873][ T8068] netlink: 'syz.1.888': attribute type 12 has an invalid length.
[  107.202279][ T8068] netlink: 9472 bytes leftover after parsing attributes in process `syz.1.888'.
[  107.384983][ T8084] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition
[  107.388913][ T8084] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0)
[  108.466570][ T8126] netlink: 'syz.2.908': attribute type 13 has an invalid length.
[  108.469905][ T8126] netlink: 'syz.2.908': attribute type 17 has an invalid length.
[  108.606682][ T8127] netlink: 8 bytes leftover after parsing attributes in process `syz.2.908'.
[  109.420479][ T8150] netlink: 88 bytes leftover after parsing attributes in process `syz.0.916'.
[  109.424661][ T8150] netlink: 16 bytes leftover after parsing attributes in process `syz.0.916'.
[  110.784567][ T8190] netlink: 216 bytes leftover after parsing attributes in process `syz.0.934'.
[  110.787646][ T8190] netlink: 24 bytes leftover after parsing attributes in process `syz.0.934'.
[  110.790613][ T8190] netlink: 16 bytes leftover after parsing attributes in process `syz.0.934'.
[  111.675002][ T8238] netlink: 'syz.0.956': attribute type 23 has an invalid length.
[  111.694086][ T8236] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  111.697779][ T8236] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  112.287673][ T8278] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.975'.
[  112.292305][ T8278] net_ratelimit: 14 callbacks suppressed
[  112.297140][ T8278] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[  112.300640][ T8278] openvswitch: netlink: Duplicate key (type 0).
[  112.439929][ T8289] syz_tun: entered allmulticast mode
[  112.467513][ T8289] dvmrp8: entered allmulticast mode
[  112.552043][ T8294] netlink: 'syz.1.980': attribute type 23 has an invalid length.
[  112.670863][ T8299] openvswitch: netlink: Missing key (keys=40, expected=2000)
[  112.794853][ T8287] syz_tun: left allmulticast mode
[  112.797628][ T8287] dvmrp8: left allmulticast mode
[  112.914625][ T8307] netlink: 84 bytes leftover after parsing attributes in process `syz.0.985'.
[  113.664420][ T8338] netlink: 'syz.2.1001': attribute type 6 has an invalid length.
[  113.667254][ T8338] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1001'.
[  113.686452][ T8341] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.1003'.
[  113.834327][ T8354] openvswitch: netlink: Multiple metadata blocks provided
[  114.680798][ T8409] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1035'.
[  114.693493][ T8409] unsupported nlmsg_type 40
[  114.881918][ T8423] batman_adv: batadv0: Adding interface: vxlan0
[  114.890031][ T8423] batman_adv: batadv0: The MTU of interface vxlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  114.900855][ T8423] batman_adv: batadv0: Interface activated: vxlan0
[  114.905358][   T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  114.908806][   T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  114.915229][   T12] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  114.918081][   T12] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  115.183849][ T8456] delete_channel: no stack
[  115.219316][ T5314] IPVS: starting estimator thread 0...
[  115.234904][ T8461] syzkaller1: entered promiscuous mode
[  115.237051][ T8461] syzkaller1: entered allmulticast mode
[  115.314963][ T8462] IPVS: using max 59 ests per chain, 141600 per kthread
[  115.325247][ T8468] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1062'.
[  115.336987][ T8469] IPVS: sync thread started: state = BACKUP, mcast_ifn = batadv0, syncid = 0, id = 0
[  115.497882][ T8483] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1069'.
[  115.501301][ T8483] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1069'.
[  115.523421][ T8483] netlink: 'syz.0.1069': attribute type 1 has an invalid length.
[  115.930035][ T8446] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  115.969857][ T8498] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1075'.
[  116.203626][ T8508] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1079'.
[  116.455217][ T8520] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check.
[  116.506332][ T8523] Unsupported ieee802154 address type: 0
[  116.598917][ T8528] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  116.604143][ T8528] syzkaller0: entered promiscuous mode
[  116.606143][ T8528] syzkaller0: entered allmulticast mode
[  116.633245][ T8528] tipc: Resetting bearer <eth:syzkaller0>
[  116.639775][ T8527] tipc: Resetting bearer <eth:syzkaller0>
[  116.659231][ T8527] tipc: Disabling bearer <eth:syzkaller0>
[  116.817610][ T8535] netlink: 'syz.2.1092': attribute type 3 has an invalid length.
[  117.207644][ T8580] netlink: 'syz.2.1112': attribute type 1 has an invalid length.
[  117.252475][ T8580] 8021q: adding VLAN 0 to HW filter on device bond1
[  117.296499][ T8580] 8021q: adding VLAN 0 to HW filter on device bond1
[  117.299584][ T8580] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address
[  117.306510][ T8580] bond1: (slave vxcan3): Error -95 calling set_mac_address
[  117.352196][ T8590] bond1: (slave bridge1): Enslaving as an active interface with a down link
[  117.388138][ T8596] __nla_validate_parse: 4 callbacks suppressed
[  117.388152][ T8596] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1120'.
[  117.395125][ T8596] netlink: 'syz.0.1120': attribute type 1 has an invalid length.
[  117.461364][ T8600] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1122'.
[  117.465991][ T8600] netem: invalid attributes len -16
[  117.525356][ T8607] netlink: 164 bytes leftover after parsing attributes in process `syz.1.1125'.
[  117.783731][ T8627] netlink: 'syz.1.1135': attribute type 1 has an invalid length.
[  117.821419][ T8627] gretap1: entered promiscuous mode
[  117.828120][ T8627] bond2: (slave gretap1): making interface the new active one
[  117.832697][ T8627] bond2: (slave gretap1): Enslaving as an active interface with an up link
[  117.838474][ T8627] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1135'.
[  117.845114][ T8627] 8021q: adding VLAN 0 to HW filter on device bond2
[  118.348023][ T8668] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[  118.741626][ T8690] syzkaller0: entered promiscuous mode
[  118.746382][ T8690] syzkaller0: entered allmulticast mode
[  119.297875][ T8706] netem: change failed
[  119.328484][ T8708] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1169'.
[  119.408133][ T8716] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1173'.
[  119.526939][ T8728] trusted_key: syz.0.1179 sent an empty control message without MSG_MORE.
[  119.618493][ T8733] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1181'.
[  119.737998][ T8741] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1186'.
[  119.744313][   T33] audit: type=1800 audit(1755942986.076:2): pid=8739 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1184" name="blkio.bfq.time_recursive" dev="tmpfs" ino=2038 res=0 errno=0
[  119.772483][   T33] audit: type=1800 audit(1755942986.096:3): pid=8739 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1184" name="blkio.bfq.time_recursive" dev="tmpfs" ino=2038 res=0 errno=0
[  119.944646][ T8756] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable
[  119.974323][ T8758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1193'.
[  120.300045][ T8776] netlink: 'syz.2.1197': attribute type 1 has an invalid length.
[  120.349376][ T8776] 8021q: adding VLAN 0 to HW filter on device bond2
[  120.375769][ T8776] bond2: (slave geneve2): making interface the new active one
[  120.385386][ T8776] bond2: (slave geneve2): Enslaving as an active interface with an up link
[  120.397660][ T8776] syz.2.1197 (8776) used greatest stack depth: 18664 bytes left
[  120.446535][ T8779] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1198'.
[  120.568269][ T8786] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2950
[  120.636644][ T8792] netlink: 'syz.2.1204': attribute type 9 has an invalid length.
[  120.854053][ T8805] wg1 speed is unknown, defaulting to 1000
[  120.856575][ T8805] wg1 speed is unknown, defaulting to 1000
[  120.859441][ T8805] wg1 speed is unknown, defaulting to 1000
[  120.876788][ T8805] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[  120.925251][ T8805] wg1 speed is unknown, defaulting to 1000
[  120.930445][ T8805] wg1 speed is unknown, defaulting to 1000
[  120.934613][ T8805] wg1 speed is unknown, defaulting to 1000
[  120.985818][ T8809] netlink: 'syz.1.1212': attribute type 10 has an invalid length.
[  121.013984][ T8809] team0: Port device dummy0 removed
[  121.019017][ T8809] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check.
[  121.155400][ T8817] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  121.158679][ T8817] syzkaller0: entered promiscuous mode
[  121.160908][ T8817] syzkaller0: entered allmulticast mode
[  121.184537][ T8817] tipc: Resetting bearer <eth:syzkaller0>
[  121.189332][ T8816] tipc: Resetting bearer <eth:syzkaller0>
[  121.202259][ T8816] tipc: Disabling bearer <eth:syzkaller0>
[  121.282130][ T8820] netlink: 'syz.1.1217': attribute type 2 has an invalid length.
[  121.289687][ T8820] netlink: 'syz.1.1217': attribute type 1 has an invalid length.
[  121.357570][ T8823] netlink: 'syz.1.1219': attribute type 1 has an invalid length.
[  121.386256][ T8823] 8021q: adding VLAN 0 to HW filter on device bond3
[  121.447104][ T8827] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[  121.449969][ T8827] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  121.680960][ T8840] ieee802154 phy0 wpan0: encryption failed: -22
[  121.840037][ T8838] wg1 speed is unknown, defaulting to 1000
[  122.072705][ T8865] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check.
[  122.690001][ T8921] __nla_validate_parse: 8 callbacks suppressed
[  122.690013][ T8921] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1260'.
[  122.697806][ T8921] netlink: 'syz.0.1260': attribute type 2 has an invalid length.
[  122.700333][ T8921] netlink: 'syz.0.1260': attribute type 1 has an invalid length.
[  122.703143][ T8921] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1260'.
[  122.900909][ T8945] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1274'.
[  122.950099][ T8951] bridge0: port 1(netdevsim2) entered blocking state
[  122.953027][ T8951] bridge0: port 1(netdevsim2) entered disabled state
[  122.955460][ T8951] netdevsim netdevsim0 netdevsim2: entered allmulticast mode
[  122.958871][ T8951] netdevsim netdevsim0 netdevsim2: entered promiscuous mode
[  122.970664][ T8953] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1278'.
[  123.141241][ T8971] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048)
[  123.255523][ T8976] bridge_slave_0: left allmulticast mode
[  123.257798][ T8976] bridge_slave_0: left promiscuous mode
[  123.260227][ T8976] bridge0: port 1(bridge_slave_0) entered disabled state
[  123.268052][ T8976] bridge_slave_1: left allmulticast mode
[  123.270292][ T8976] bridge_slave_1: left promiscuous mode
[  123.273889][ T8976] bridge0: port 2(bridge_slave_1) entered disabled state
[  123.286672][ T8976] bond0: (slave bond_slave_0): Releasing backup interface
[  123.305846][ T8976] bond0: (slave bond_slave_1): Releasing backup interface
[  123.309744][ T8984] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1285'.
[  123.322165][ T8976] team0: Port device team_slave_0 removed
[  123.338316][ T8976] team0: Port device team_slave_1 removed
[  123.340884][ T8976] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  123.346327][ T8976] batman_adv: batadv0: Removing interface: batadv_slave_0
[  123.350160][ T8976] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  123.353491][ T8976] batman_adv: batadv0: Removing interface: batadv_slave_1
[  123.367909][ T8976] bond1: (slave bridge1): Releasing active interface
[  123.379617][ T8976] bond2: (slave geneve2): Releasing active interface
[  124.020138][ T8995] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1295'.
[  124.025359][ T8995] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1295'.
[  124.209498][ T9003] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1299'.
[  124.895530][ T9040] netlink: 'syz.0.1310': attribute type 16 has an invalid length.
[  124.898655][ T9040] netlink: 'syz.0.1310': attribute type 17 has an invalid length.
[  124.935741][ T9040] 8021q: adding VLAN 0 to HW filter on device bond0
[  124.938871][ T9040] 8021q: adding VLAN 0 to HW filter on device team0
[  124.941333][ T9040] tipc: Resetting bearer <eth:team0>
[  124.948220][ T9040] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  125.528646][   T26] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)
[  125.832265][ T9060] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  125.834706][ T9060] IPv6: NLM_F_CREATE should be set when creating new route
[  125.837098][ T9060] IPv6: NLM_F_CREATE should be set when creating new route
[  125.840427][ T9060] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  126.007532][ T9069] tipc: Resetting bearer <eth:team0>
[  126.020714][ T9069] netdevsim netdevsim0 netdevsim2: left allmulticast mode
[  126.024661][ T9069] netdevsim netdevsim0 netdevsim2: left promiscuous mode
[  126.028446][ T9069] bridge0: port 1(netdevsim2) entered disabled state
[  126.036726][ T9069] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check.
[  126.246930][ T9085] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1332'.
[  126.313039][ T9083] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1331'.
[  126.412252][ T9103] 8021q: adding VLAN 0 to HW filter on device bond3
[  126.466907][   T33] audit: type=1800 audit(1755942992.806:4): pid=9109 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1342" name="memory.events" dev="tmpfs" ino=2620 res=0 errno=0
[  126.482539][   T33] audit: type=1804 audit(1755942992.816:5): pid=9109 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1342" name="/newroot/515/memory.events" dev="tmpfs" ino=2620 res=1 errno=0
[  126.855861][ T9141] x_tables: ip_tables: udp match: only valid for protocol 17
[  127.057964][ T9162] sctp: [Deprecated]: syz.2.1367 (pid 9162) Use of struct sctp_assoc_value in delayed_ack socket option.
[  127.057964][ T9162] Use struct sctp_sack_info instead
[  127.176190][ T9171] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  127.179487][ T9171] syzkaller0: entered promiscuous mode
[  127.181953][ T9171] syzkaller0: entered allmulticast mode
[  127.188558][ T9173] netlink: 'syz.2.1372': attribute type 21 has an invalid length.
[  127.194724][ T9171] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) !
[  127.204030][ T9173] netlink: 'syz.2.1372': attribute type 4 has an invalid length.
[  127.206981][ T9173] netlink: 'syz.2.1372': attribute type 5 has an invalid length.
[  127.213173][ T9171] tipc: Resetting bearer <eth:syzkaller0>
[  127.218123][ T9170] tipc: Resetting bearer <eth:syzkaller0>
[  127.232191][ T9170] tipc: Disabling bearer <eth:syzkaller0>
[  127.339313][ T9179] hsr_slave_1 (unregistering): left promiscuous mode
[  127.404448][ T9180] nbd: socks must be embedded in a SOCK_ITEM attr
[  127.408871][ T9180] block nbd0: shutting down sockets
[  127.700219][ T9186] wg1 speed is unknown, defaulting to 1000
[  129.980009][ T9224] __nla_validate_parse: 5 callbacks suppressed
[  129.980021][ T9224] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1389'.
[  130.233280][ T9234] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode
[  130.244397][ T9237] veth0: entered promiscuous mode
[  130.249243][ T9237] veth0: left promiscuous mode
[  130.269190][ T9234] bridge_slave_0: left allmulticast mode
[  130.271457][ T9234] bridge_slave_0: left promiscuous mode
[  130.275024][ T9234] bridge0: port 1(bridge_slave_0) entered disabled state
[  130.329338][ T9234] bridge_slave_1: left allmulticast mode
[  130.331648][ T9234] bridge_slave_1: left promiscuous mode
[  130.334649][ T9234] bridge0: port 2(bridge_slave_1) entered disabled state
[  130.345605][ T9234] bond0: (slave bond_slave_0): Releasing backup interface
[  130.351930][ T9234] bond0: (slave bond_slave_1): Releasing backup interface
[  130.367500][ T9234] team0: Port device team_slave_0 removed
[  130.375162][ T9234] team0: Port device team_slave_1 removed
[  130.377096][ T9246] netlink: 'syz.1.1394': attribute type 10 has an invalid length.
[  130.377800][ T9234] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  130.381926][ T9234] batman_adv: batadv0: Removing interface: batadv_slave_0
[  130.390394][ T9234] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  130.393906][ T9234] batman_adv: batadv0: Removing interface: batadv_slave_1
[  130.403432][ T9234] bond2: (slave gretap1): Releasing active interface
[  130.415350][ T9245] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1400'.
[  130.419132][ T9246] mac80211_hwsim hwsim5 wlan1: left allmulticast mode
[  130.457107][ T9246] 8021q: adding VLAN 0 to HW filter on device bond0
[  130.468112][ T9246] bond0: (slave wlan1): Enslaving as an active interface with an up link
[  130.477249][ T9234] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  130.480820][ T9234] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  130.536057][ T9256] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1405'.
[  130.539738][ T9256] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1405'.
[  130.623768][   T54] Bluetooth: hci2: link tx timeout
[  130.626907][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  130.638884][ T9266] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1410'.
[  130.644356][ T9266] netlink: 'syz.2.1410': attribute type 1 has an invalid length.
[  130.647016][ T9266] netlink: 'syz.2.1410': attribute type 2 has an invalid length.
[  130.650238][ T9266] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1410'.
[  130.795589][ T9278] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1416'.
[  130.841575][ T9282] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check.
[  131.734446][ T9360] bond0: (slave gretap0): Opening slave failed
[  132.167779][ T9411] netlink: 'syz.0.1475': attribute type 1 has an invalid length.
[  132.193345][ T9416] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1476'.
[  132.216378][ T9411] bond4: (slave geneve2): making interface the new active one
[  132.219839][ T9411] bond4: (slave geneve2): Enslaving as an active interface with an up link
[  132.231905][ T9411] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1475'.
[  132.238975][ T5883] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0
[  132.252816][ T9411] 8021q: adding VLAN 0 to HW filter on device bond4
[  132.267387][ T5883] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0
[  132.291183][ T5883] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0
[  132.296402][ T5883] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0
[  132.429616][ T9428] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1478'.
[  132.468657][ T9428] team1: entered promiscuous mode
[  132.470340][ T9428] team1: entered allmulticast mode
[  132.633021][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  132.635609][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  132.669048][ T9451] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[  132.704144][ T5236] Bluetooth: hci2: command 0x0401 tx timeout
[  133.855839][ T9568] bridge2: entered promiscuous mode
[  133.858523][ T9568] bridge2: entered allmulticast mode
[  133.861741][ T9568] team0: Port device bridge2 added
[  134.818066][ T9604] batadv_slave_1: entered promiscuous mode
[  134.840855][ T9603] batadv_slave_1: left promiscuous mode
[  135.036226][ T9618] syzkaller0: entered promiscuous mode
[  135.039290][ T9618] syzkaller0: entered allmulticast mode
[  135.526576][ T9664] netlink: 'syz.2.1577': attribute type 4 has an invalid length.
[  135.537931][ T9664] netlink: 'syz.2.1577': attribute type 4 has an invalid length.
[  136.873801][ T9695] batman_adv: batadv0: Adding interface: ip6gretap1
[  136.876642][ T9695] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  136.888462][ T9695] batman_adv: batadv0: Interface activated: ip6gretap1
[  136.901763][ T9704] netlink: 'syz.2.1596': attribute type 22 has an invalid length.
[  136.916248][ T9704] __nla_validate_parse: 7 callbacks suppressed
[  136.916259][ T9704] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1596'.
[  136.929449][   T13] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  136.932171][ T9704] netlink: 'syz.2.1596': attribute type 22 has an invalid length.
[  136.934904][   T13] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  136.938104][ T9704] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1596'.
[  136.941977][   T13] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  136.948246][   T13] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  136.979165][ T9709] netlink: 34 bytes leftover after parsing attributes in process `syz.0.1597'.
[  137.388205][ T9746] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1615'.
[  137.523953][ T9764] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1624'.
[  137.601731][ T9772] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1628'.
[  137.689747][ T9784] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1634'.
[  138.725148][ T9830] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1652'.
[  138.749055][ T9834] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1655'.
[  138.752281][ T9834] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1655'.
[  138.759970][ T9834] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check.
[  139.114859][ T9861] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  139.294126][ T9878] netlink: 'syz.2.1676': attribute type 1 has an invalid length.
[  139.591375][ T9902] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  139.596330][ T9902] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  139.679707][ T9902] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  139.686369][ T9902] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  139.716898][ T9904] wg1 speed is unknown, defaulting to 1000
[  139.743686][ T9902] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  139.746637][ T9902] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  139.837404][ T9902] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  139.863256][ T9902] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  139.887277][ T9918] netlink: 'syz.0.1689': attribute type 1 has an invalid length.
[  140.041295][   T13] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  140.050706][   T13] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  140.095070][ T5883] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  140.098595][ T5883] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  140.101976][ T5883] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  140.108631][ T5883] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  140.134029][   T12] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  140.139333][   T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  140.419893][ T9949] netlink: 'syz.1.1700': attribute type 29 has an invalid length.
[  140.582146][ T9964] netlink: 'syz.0.1706': attribute type 1 has an invalid length.
[  141.497003][T10030] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  141.676990][   T55] block nbd0: Receive control failed (result -32)
[  142.064593][T10006] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  143.091768][T10103] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  143.188088][T10144] __nla_validate_parse: 4 callbacks suppressed
[  143.188103][T10144] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1778'.
[  143.577310][T10144] wg1 speed is unknown, defaulting to 1000
[  143.595470][T10160] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1783'.
[  143.949503][T10188] ==================================================================
[  143.953142][T10188] BUG: KASAN: slab-out-of-bounds in xfrm_alloc_spi+0x570/0xf30
[  143.956223][T10188] Read of size 4 at addr ffff88810a7dbb44 by task syz.2.1796/10188
[  143.960369][T10188] 
[  143.961402][T10188] CPU: 1 UID: 0 PID: 10188 Comm: syz.2.1796 Not tainted syzkaller #0 PREEMPT(full) 
[  143.961422][T10188] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  143.961434][T10188] Call Trace:
[  143.961442][T10188]  <TASK>
[  143.961473][T10188]  dump_stack_lvl+0x189/0x250
[  143.961495][T10188]  ? __kasan_check_byte+0x12/0x40
[  143.961521][T10188]  ? __pfx_dump_stack_lvl+0x10/0x10
[  143.961537][T10188]  ? lock_release+0x4b/0x3e0
[  143.961563][T10188]  ? __virt_addr_valid+0x4a5/0x5c0
[  143.961584][T10188]  print_report+0xca/0x240
[  143.961597][T10188]  ? xfrm_alloc_spi+0x570/0xf30
[  143.961612][T10188]  kasan_report+0x118/0x150
[  143.961634][T10188]  ? xfrm_alloc_spi+0x570/0xf30
[  143.961653][T10188]  xfrm_alloc_spi+0x570/0xf30
[  143.961669][T10188]  ? xfrm_alloc_spi+0x2a0/0xf30
[  143.961686][T10188]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  143.961700][T10188]  ? xfrm_find_acq+0x87/0xa0
[  143.961717][T10188]  xfrm_alloc_userspi+0x70b/0xc90
[  143.961734][T10188]  ? bpf_trace_printk+0xc1/0x190
[  143.961752][T10188]  ? apparmor_capable+0x137/0x1b0
[  143.961764][T10188]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  143.961774][T10188]  ? __nla_parse+0x40/0x60
[  143.961789][T10188]  xfrm_user_rcv_msg+0x7a3/0xab0
[  143.961800][T10188]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  143.961809][T10188]  ? bpf_trace_run2+0x322/0x4b0
[  143.961837][T10188]  ? rcu_is_watching+0x15/0xb0
[  143.961848][T10188]  ? trace_contention_end+0x39/0x120
[  143.961857][T10188]  ? __mutex_lock+0x335/0x1360
[  143.961896][T10188]  netlink_rcv_skb+0x208/0x470
[  143.961911][T10188]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  143.961920][T10188]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  143.961935][T10188]  ? netlink_deliver_tap+0x2e/0x1b0
[  143.961946][T10188]  ? netlink_deliver_tap+0x2e/0x1b0
[  143.961957][T10188]  xfrm_netlink_rcv+0x79/0x90
[  143.961966][T10188]  netlink_unicast+0x82f/0x9e0
[  143.961979][T10188]  ? __pfx_netlink_unicast+0x10/0x10
[  143.961989][T10188]  ? netlink_sendmsg+0x642/0xb30
[  143.962000][T10188]  ? skb_put+0x11b/0x210
[  143.962019][T10188]  netlink_sendmsg+0x805/0xb30
[  143.962039][T10188]  ? __pfx_netlink_sendmsg+0x10/0x10
[  143.962058][T10188]  ? aa_sock_msg_perm+0xf1/0x1d0
[  143.962081][T10188]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  143.962096][T10188]  ? __pfx_netlink_sendmsg+0x10/0x10
[  143.962113][T10188]  __sock_sendmsg+0x21c/0x270
[  143.962132][T10188]  ____sys_sendmsg+0x505/0x830
[  143.962149][T10188]  ? __pfx_____sys_sendmsg+0x10/0x10
[  143.962162][T10188]  ? import_iovec+0x74/0xa0
[  143.962173][T10188]  ___sys_sendmsg+0x21f/0x2a0
[  143.962182][T10188]  ? __pfx____sys_sendmsg+0x10/0x10
[  143.962199][T10188]  ? __fget_files+0x2a/0x420
[  143.962212][T10188]  ? __fget_files+0x3a0/0x420
[  143.962232][T10188]  __x64_sys_sendmsg+0x19b/0x260
[  143.962246][T10188]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  143.962261][T10188]  ? rcu_is_watching+0x15/0xb0
[  143.962275][T10188]  ? do_syscall_64+0xbe/0x3b0
[  143.962298][T10188]  do_syscall_64+0xfa/0x3b0
[  143.962316][T10188]  ? lockdep_hardirqs_on+0x9c/0x150
[  143.962334][T10188]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  143.962346][T10188]  ? exc_page_fault+0x9f/0xf0
[  143.962362][T10188]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  143.962373][T10188] RIP: 0033:0x7f58e778ebe9
[  143.962388][T10188] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  143.962398][T10188] RSP: 002b:00007f58e86cc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  143.962413][T10188] RAX: ffffffffffffffda RBX: 00007f58e79b5fa0 RCX: 00007f58e778ebe9
[  143.962424][T10188] RDX: 0000000024000014 RSI: 0000200000000200 RDI: 0000000000000003
[  143.962431][T10188] RBP: 00007f58e7811e19 R08: 0000000000000000 R09: 0000000000000000
[  143.962440][T10188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  143.962448][T10188] R13: 00007f58e79b6038 R14: 00007f58e79b5fa0 R15: 00007ffe20487f08
[  143.962463][T10188]  </TASK>
[  143.962467][T10188] 
[  144.105944][T10188] Allocated by task 5836:
[  144.107334][T10188]  kasan_save_track+0x3e/0x80
[  144.108769][T10188]  __kasan_slab_alloc+0x6c/0x80
[  144.110360][T10188]  kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[  144.112292][T10188]  kmalloc_reserve+0xbd/0x290
[  144.113771][T10188]  __alloc_skb+0x142/0x2d0
[  144.115256][T10188]  napi_alloc_skb+0x84/0x7d0
[  144.116790][T10188]  e1000_clean_rx_irq+0x448/0x1170
[  144.118455][T10188]  e1000_clean+0xca4/0x2b00
[  144.120004][T10188]  __napi_poll+0xc7/0x360
[  144.121640][T10188]  net_rx_action+0x707/0xe30
[  144.123386][T10188]  handle_softirqs+0x286/0x870
[  144.125100][T10188]  do_softirq+0xec/0x180
[  144.126484][T10188]  __local_bh_enable_ip+0x17d/0x1c0
[  144.128227][T10188]  __dev_queue_xmit+0x1d79/0x3b50
[  144.129818][T10188]  ip_finish_output2+0xd03/0x1160
[  144.131502][T10188]  ip_output+0x2a1/0x3c0
[  144.132876][T10188]  __ip_queue_xmit+0x1106/0x1b00
[  144.134527][T10188]  __tcp_transmit_skb+0x2215/0x3680
[  144.136244][T10188]  tcp_write_xmit+0x1862/0x67f0
[  144.137877][T10188]  __tcp_push_pending_frames+0x97/0x360
[  144.139793][T10188]  tcp_sendmsg_locked+0x4afd/0x5620
[  144.141531][T10188]  tcp_sendmsg+0x2f/0x50
[  144.142958][T10188]  __sock_sendmsg+0x19c/0x270
[  144.144477][T10188]  sock_write_iter+0x258/0x330
[  144.146050][T10188]  vfs_write+0x5c9/0xb30
[  144.147542][T10188]  ksys_write+0x145/0x250
[  144.148958][T10188]  do_syscall_64+0xfa/0x3b0
[  144.150451][T10188]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  144.152428][T10188] 
[  144.153211][T10188] Freed by task 5836:
[  144.154563][T10188]  kasan_save_track+0x3e/0x80
[  144.156149][T10188]  kasan_save_free_info+0x46/0x50
[  144.157816][T10188]  __kasan_slab_free+0x5b/0x80
[  144.159411][T10188]  kmem_cache_free+0x18f/0x400
[  144.161095][T10188]  skb_release_data+0x62d/0x7c0
[  144.163039][T10188]  kfree_skb_partial+0x97/0xb0
[  144.164545][T10188]  tcp_add_backlog+0x143a/0x1bb0
[  144.166147][T10188]  tcp_v4_rcv+0x2642/0x2f40
[  144.167662][T10188]  ip_protocol_deliver_rcu+0x221/0x440
[  144.169422][T10188]  ip_local_deliver_finish+0x3bb/0x6f0
[  144.171340][T10188]  NF_HOOK+0x30c/0x3a0
[  144.172678][T10188]  ip_sublist_rcv_finish+0x221/0x2a0
[  144.174399][T10188]  ip_sublist_rcv+0x6e7/0x9b0
[  144.176034][T10188]  ip_list_rcv+0x3e2/0x430
[  144.177516][T10188]  __netif_receive_skb_list_core+0x7d2/0x800
[  144.179541][T10188]  netif_receive_skb_list_internal+0x975/0xcc0
[  144.181834][T10188]  gro_receive_skb+0x642/0xce0
[  144.183416][T10188]  e1000_clean_rx_irq+0x980/0x1170
[  144.185097][T10188]  e1000_clean+0xca4/0x2b00
[  144.186579][T10188]  __napi_poll+0xc7/0x360
[  144.188068][T10188]  net_rx_action+0x707/0xe30
[  144.189518][T10188]  handle_softirqs+0x286/0x870
[  144.191130][T10188]  do_softirq+0xec/0x180
[  144.192487][T10188]  __local_bh_enable_ip+0x17d/0x1c0
[  144.194173][T10188]  __dev_queue_xmit+0x1d79/0x3b50
[  144.195871][T10188]  ip_finish_output2+0xd03/0x1160
[  144.197516][T10188]  ip_output+0x2a1/0x3c0
[  144.198915][T10188]  __ip_queue_xmit+0x1106/0x1b00
[  144.200535][T10188]  __tcp_transmit_skb+0x2215/0x3680
[  144.202487][T10188]  tcp_write_xmit+0x1862/0x67f0
[  144.204033][T10188]  __tcp_push_pending_frames+0x97/0x360
[  144.205839][T10188]  tcp_sendmsg_locked+0x4afd/0x5620
[  144.207565][T10188]  tcp_sendmsg+0x2f/0x50
[  144.208979][T10188]  __sock_sendmsg+0x19c/0x270
[  144.210586][T10188]  sock_write_iter+0x258/0x330
[  144.212180][T10188]  vfs_write+0x5c9/0xb30
[  144.213703][T10188]  ksys_write+0x145/0x250
[  144.215435][T10188]  do_syscall_64+0xfa/0x3b0
[  144.217248][T10188]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  144.219532][T10188] 
[  144.220484][T10188] The buggy address belongs to the object at ffff88810a7db800
[  144.220484][T10188]  which belongs to the cache skbuff_small_head of size 704
[  144.226080][T10188] The buggy address is located 132 bytes to the right of
[  144.226080][T10188]  allocated 704-byte region [ffff88810a7db800, ffff88810a7dbac0)
[  144.230825][T10188] 
[  144.231610][T10188] The buggy address belongs to the physical page:
[  144.234049][T10188] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a7d8
[  144.237463][T10188] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  144.240656][T10188] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  144.243548][T10188] page_type: f5(slab)
[  144.245145][T10188] raw: 057ff00000000040 ffff888100a9ec80 dead000000000122 0000000000000000
[  144.248470][T10188] raw: 0000000000000000 0000000000120012 00000000f5000000 0000000000000000
[  144.251873][T10188] head: 057ff00000000040 ffff888100a9ec80 dead000000000122 0000000000000000
[  144.254782][T10188] head: 0000000000000000 0000000000120012 00000000f5000000 0000000000000000
[  144.257786][T10188] head: 057ff00000000002 ffffea000429f601 00000000ffffffff 00000000ffffffff
[  144.260620][T10188] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  144.263684][T10188] page dumped because: kasan: bad access detected
[  144.265687][T10188] page_owner tracks the page as allocated
[  144.267592][T10188] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5836, tgid 5836 (sshd), ts 142637739646, free_ts 141580812444
[  144.274056][T10188]  post_alloc_hook+0x240/0x2a0
[  144.275620][T10188]  get_page_from_freelist+0x21e4/0x22c0
[  144.277452][T10188]  __alloc_frozen_pages_noprof+0x181/0x370
[  144.279327][T10188]  alloc_pages_mpol+0x232/0x4a0
[  144.281045][T10188]  allocate_slab+0x8a/0x370
[  144.282818][T10188]  ___slab_alloc+0xbeb/0x1410
[  144.284321][T10188]  kmem_cache_alloc_node_noprof+0x280/0x3c0
[  144.286125][T10188]  kmalloc_reserve+0xbd/0x290
[  144.287678][T10188]  __alloc_skb+0x142/0x2d0
[  144.289145][T10188]  tcp_stream_alloc_skb+0x3d/0x340
[  144.290787][T10188]  tcp_sendmsg_locked+0xf38/0x5620
[  144.292461][T10188]  tcp_sendmsg+0x2f/0x50
[  144.293872][T10188]  __sock_sendmsg+0x19c/0x270
[  144.295538][T10188]  sock_write_iter+0x258/0x330
[  144.297085][T10188]  vfs_write+0x5c9/0xb30
[  144.298509][T10188]  ksys_write+0x145/0x250
[  144.299922][T10188] page last free pid 10042 tgid 10040 stack trace:
[  144.302400][T10188]  __free_frozen_pages+0xbc4/0xd30
[  144.304195][T10188]  stack_depot_save_flags+0x436/0x860
[  144.305865][T10188]  kasan_save_track+0x4f/0x80
[  144.307482][T10188]  __kasan_kmalloc+0x93/0xb0
[  144.308969][T10188]  __kmalloc_node_noprof+0x276/0x4e0
[  144.310680][T10188]  __vmalloc_node_range_noprof+0x5a9/0x12f0
[  144.312624][T10188]  __vmalloc_noprof+0xb1/0xf0
[  144.314159][T10188]  bpf_prog_alloc_no_stats+0x4a/0x4b0
[  144.315905][T10188]  bpf_prog_alloc+0x3c/0x1a0
[  144.317463][T10188]  bpf_prog_create_from_user+0xa7/0x440
[  144.319342][T10188]  fanout_set_data+0x283/0x3c0
[  144.321053][T10188]  packet_setsockopt+0x7ee/0x12c0
[  144.322992][T10188]  do_sock_setsockopt+0x17c/0x1b0
[  144.324890][T10188]  __x64_sys_setsockopt+0x13f/0x1b0
[  144.326537][T10188]  do_syscall_64+0xfa/0x3b0
[  144.328094][T10188]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  144.329980][T10188] 
[  144.330823][T10188] Memory state around the buggy address:
[  144.332633][T10188]  ffff88810a7dba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  144.335174][T10188]  ffff88810a7dba80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  144.337701][T10188] >ffff88810a7dbb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  144.340351][T10188]                                            ^
[  144.342648][T10188]  ffff88810a7dbb80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  144.345412][T10188]  ffff88810a7dbc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  144.347859][T10188] ==================================================================
[  144.350883][T10188] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  144.353105][T10188] CPU: 1 UID: 0 PID: 10188 Comm: syz.2.1796 Not tainted syzkaller #0 PREEMPT(full) 
[  144.355969][T10188] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  144.359107][T10188] Call Trace:
[  144.360223][T10188]  <TASK>
[  144.361313][T10188]  dump_stack_lvl+0x99/0x250
[  144.363165][T10188]  ? __asan_memcpy+0x40/0x70
[  144.364587][T10188]  ? __pfx_dump_stack_lvl+0x10/0x10
[  144.366174][T10188]  ? __pfx__printk+0x10/0x10
[  144.367640][T10188]  vpanic+0x281/0x750
[  144.368955][T10188]  ? __pfx_vpanic+0x10/0x10
[  144.370449][T10188]  ? irqentry_exit+0x74/0x90
[  144.371889][T10188]  panic+0xb9/0xc0
[  144.373088][T10188]  ? __pfx_panic+0x10/0x10
[  144.374451][T10188]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  144.376273][T10188]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  144.378125][T10188]  ? xfrm_alloc_spi+0x570/0xf30
[  144.379689][T10188]  check_panic_on_warn+0x89/0xb0
[  144.381625][T10188]  ? xfrm_alloc_spi+0x570/0xf30
[  144.383277][T10188]  end_report+0x78/0x160
[  144.384591][T10188]  kasan_report+0x129/0x150
[  144.386029][T10188]  ? xfrm_alloc_spi+0x570/0xf30
[  144.387589][T10188]  xfrm_alloc_spi+0x570/0xf30
[  144.389102][T10188]  ? xfrm_alloc_spi+0x2a0/0xf30
[  144.390878][T10188]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  144.392721][T10188]  ? xfrm_find_acq+0x87/0xa0
[  144.394152][T10188]  xfrm_alloc_userspi+0x70b/0xc90
[  144.395682][T10188]  ? bpf_trace_printk+0xc1/0x190
[  144.397218][T10188]  ? apparmor_capable+0x137/0x1b0
[  144.398707][T10188]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  144.400604][T10188]  ? __nla_parse+0x40/0x60
[  144.402334][T10188]  xfrm_user_rcv_msg+0x7a3/0xab0
[  144.404172][T10188]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  144.405865][T10188]  ? bpf_trace_run2+0x322/0x4b0
[  144.407396][T10188]  ? rcu_is_watching+0x15/0xb0
[  144.408921][T10188]  ? trace_contention_end+0x39/0x120
[  144.410682][T10188]  ? __mutex_lock+0x335/0x1360
[  144.412179][T10188]  netlink_rcv_skb+0x208/0x470
[  144.413673][T10188]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  144.415419][T10188]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  144.417039][T10188]  ? netlink_deliver_tap+0x2e/0x1b0
[  144.418615][T10188]  ? netlink_deliver_tap+0x2e/0x1b0
[  144.420378][T10188]  xfrm_netlink_rcv+0x79/0x90
[  144.422191][T10188]  netlink_unicast+0x82f/0x9e0
[  144.423706][T10188]  ? __pfx_netlink_unicast+0x10/0x10
[  144.425366][T10188]  ? netlink_sendmsg+0x642/0xb30
[  144.426939][T10188]  ? skb_put+0x11b/0x210
[  144.428286][T10188]  netlink_sendmsg+0x805/0xb30
[  144.429740][T10188]  ? __pfx_netlink_sendmsg+0x10/0x10
[  144.431569][T10188]  ? aa_sock_msg_perm+0xf1/0x1d0
[  144.433164][T10188]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  144.434915][T10188]  ? __pfx_netlink_sendmsg+0x10/0x10
[  144.436962][T10188]  __sock_sendmsg+0x21c/0x270
[  144.438816][T10188]  ____sys_sendmsg+0x505/0x830
[  144.440726][T10188]  ? __pfx_____sys_sendmsg+0x10/0x10
[  144.442818][T10188]  ? import_iovec+0x74/0xa0
[  144.444617][T10188]  ___sys_sendmsg+0x21f/0x2a0
[  144.446486][T10188]  ? __pfx____sys_sendmsg+0x10/0x10
[  144.448587][T10188]  ? __fget_files+0x2a/0x420
[  144.450431][T10188]  ? __fget_files+0x3a0/0x420
[  144.452317][T10188]  __x64_sys_sendmsg+0x19b/0x260
[  144.454282][T10188]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  144.456463][T10188]  ? rcu_is_watching+0x15/0xb0
[  144.458375][T10188]  ? do_syscall_64+0xbe/0x3b0
[  144.460300][T10188]  do_syscall_64+0xfa/0x3b0
[  144.462143][T10188]  ? lockdep_hardirqs_on+0x9c/0x150
[  144.464163][T10188]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  144.466485][T10188]  ? exc_page_fault+0x9f/0xf0
[  144.468362][T10188]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  144.470571][T10188] RIP: 0033:0x7f58e778ebe9
[  144.472056][T10188] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  144.478143][T10188] RSP: 002b:00007f58e86cc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  144.480730][T10188] RAX: ffffffffffffffda RBX: 00007f58e79b5fa0 RCX: 00007f58e778ebe9
[  144.483343][T10188] RDX: 0000000024000014 RSI: 0000200000000200 RDI: 0000000000000003
[  144.486241][T10188] RBP: 00007f58e7811e19 R08: 0000000000000000 R09: 0000000000000000
[  144.488726][T10188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  144.491307][T10188] R13: 00007f58e79b6038 R14: 00007f58e79b5fa0 R15: 00007ffe20487f08
[  144.494304][T10188]  </TASK>
[  144.496205][T10188] Kernel Offset: disabled
[  144.497899][T10188] Rebooting in 86400 seconds..

VM DIAGNOSIS:
09:56:50  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000000 RBX=ffffc90003bef888 RCX=ffff888021c08000 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc90003bef930 RSP=ffffc90003bef840
R8 =ffffc90003bef6e7 R9 =1ffff9200077dedc R10=dffffc0000000000 R11=fffff5200077dedd
R12=1ffff9200077df11 R13=dffffc0000000000 R14=1ffff9200077df0c R15=1ffff9200077df0c
RIP=ffffffff81b4370e RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000200 CR3=00000001073d4000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f58e7812e53
XMM06=0000000000000000 00007f58e7812e4d XMM07=0000000000000000 00007f58e7812e61
XMM08=0000000000000000 00007f58e7812ee7 XMM09=0000000000000000 00007f58e7812fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=000000000000002e RBX=000000000000002e RCX=0000000000000000 RDX=00000000000003f8
RSI=000000000000113a RDI=000000000000113b RBP=00000000000003f8 RSP=ffffc90020bc69f0
R8 =ffff88801f4a0237 R9 =1ffff11003e94046 R10=dffffc0000000000 R11=ffffffff854eff70
R12=dffffc0000000000 R13=ffffffff99afa90d R14=ffffffff99def3a0 R15=0000000000000000
RIP=ffffffff854effec RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f58e86cc6c0 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f58e86cbfc8 CR3=000000002658e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f58e7987498 00007f58e7987470 XMM03=00007f58e79874a8 00007f58e79874a0
XMM04=00007f58e84ed100 00007f58e7987460 XMM05=00007f58e7987478 00007f58e79874c0
XMM06=00007f58e79874b8 00007f58e79874b0 XMM07=00007f58e79874a8 00007f58e79874a0
XMM08=0000000000000000 00007f58e7812ee7 XMM09=0000000000000000 00007f58e7812fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
