last executing test programs:

3.262246052s ago: executing program 0 (id=669):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="0402000010000100feffffff00010000fe88000000000000000000000000000100000000000000000000000000000000000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fe80000000000000000000000000002500000000000000009201000000000000060000000000000000000040200000001c250800000000000200000000000000f8ffffffffffffff0080000000000000000000000000000000000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd70000435000002000100200000000000000008001e006400000008001600000001000c000f0002000000000000000800160008000000e5000300646566"], 0x204}, 0x1, 0x0, 0x0, 0x8801}, 0x0)

3.162133411s ago: executing program 0 (id=670):
socket$alg(0x26, 0x5, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x34, 0x3c, 0x107, 0x0, 0x0, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x72}]}, @typed={0x8, 0x7, 0x0, 0x0, @fd=r0}]}, 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010)

3.092961256s ago: executing program 0 (id=671):
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
setsockopt$inet_opts(r0, 0x0, 0x6, &(0x7f0000000380)='\a', 0x1)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4)
setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4)
sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffff9}, 0x1c, 0x0}}], 0x1, 0x20004808)
recvmmsg(r0, &(0x7f0000001400)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=""/5, 0x5}, 0x9d39}], 0x1, 0x12141, 0x0)

2.99330037s ago: executing program 0 (id=673):
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = openat$cgroup_int(r0, &(0x7f0000000080)='pids.max\x00', 0x2, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB='-0'], 0x9)

2.921959437s ago: executing program 0 (id=675):
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x1, 0x803, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=r2, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES64=r1], 0x48}}, 0x0)

2.723430139s ago: executing program 0 (id=676):
r0 = socket(0x10, 0x803, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=@gettaction={0x4c, 0x32, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x4}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x8}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xbe}}]}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x4c}}, 0x80)
getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x38, 0x10, 0x401, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, 0x98, 0x1114}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x38}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010000104fcfffffffedbdf2500000000", @ANYRES32=r2, @ANYBLOB="8750a754ac000000300012800b000100697036746e6c0000200002800600100008000000080014003f0700000400130006000a00020000"], 0x50}, 0x1, 0x0, 0x0, 0x20040805}, 0x20004094)

1.271051333s ago: executing program 2 (id=692):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000003000000400001802c00040014000100020000007f000001000000000000feff1300020002000000e000000200000000000000000d0001007564703a73797a3200000000"], 0x54}}, 0x0)
sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x5c, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x48, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x4000004)

1.012844295s ago: executing program 1 (id=699):
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1837000000000000000000000800000085550c00000000009500000000000000e95a7f0fda1bc47138b7c53358451a9fa55742722f2d891fcf50e9d9ba8c18740091e294f5e3f6919d2e8a39d6119fbbbca9d0a4fe148f638347e08636ba40af31364908adfd64cafc4f7275fce536a74435dced0929185cb17ff57535ea870a2c0b60fcbf5c929988527d6c39b38e250e3af4a548f228bb66cd2ef0b591cf5da93825149d1a981f2bab3882c5b390aa251aa5c81ea7e1ab578306ec55ed304fb348d866586e62ad91d210f5c3df337b0ad85f7505ece06e1317d2d70bd3f24cf881d1a7f08249f3575d8e2729e72fc73c3c6a9107557d4d73c6a16098fad638dd05006ac2496ff16198b05b4eb885824518b5ebe1c5279595486b387fca4d682a8ae38bed86da508891ffb168899ace398b787f37b3a0390059d733be5fd0"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x24, 0xfffffffffffffffc, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x80)

922.709842ms ago: executing program 1 (id=700):
r0 = socket$inet(0x2, 0x5, 0x0)
unshare(0x2c020400)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0)
connect$inet(r0, &(0x7f0000000140)={0x2, 0xc000, @remote}, 0x10)

859.80691ms ago: executing program 1 (id=701):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000540)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x39}}, 0x10)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f00000007c0)=0x40000401, 0x4)
setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c)
setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x2, 0x4)
bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x10000000}, 0x1c)
listen(r0, 0xb5d6)

793.024939ms ago: executing program 1 (id=702):
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xa, 0x7, 0x8000, 0x1}, 0x50)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r1, 0x0, 0x0)
socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @local, 'bridge_slave_1\x00'}}, 0x1e)
bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x16, 0x5, 0x8, 0x8, 0xd056}, 0x50)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x6}, 0x1c)
listen(r2, 0x3)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000200)={<r4=>0x0, @in={{0x2, 0x4e22, @local}}, 0x7, 0x2, 0xf9, 0x7, 0x41, 0x1}, &(0x7f0000000300)=0x9c)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000400)={r4, 0x5}, 0x8)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10)
syz_emit_ethernet(0x36, &(0x7f00000002c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x65, 0x0, 0xf, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}}}}}}, 0x0)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f00000005c0)={0xfff9, 0x8006, 0x7, 0x0, <r5=>r4}, &(0x7f0000000600)=0x10)
sendmsg$inet_sctp(r3, &(0x7f0000000740)={&(0x7f0000000440)=@in={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000000580)=[{&(0x7f0000000480)}, {&(0x7f00000004c0)="555cee0ca7047befc28441c5f1450ef7d298df78d9cfe90f2fcacd0af0d68f9f5ee10f4ec436e0a31da2f2bf54d8b9c9c2fac80ab70460521a5ddb278eba23f04b2ad69e0f9ca281a9c0cd27882abf58b2a2db9c61cd12f5832c1da73782ec024e3128b132b632aa706822cb11278e2c7ddb29926d2c3a872f86fcfc437bfc14570e79d65086135210c9f9631f9a127e", 0x90}], 0x2, &(0x7f0000000640)=[@dstaddrv6={0x20, 0x84, 0x8, @remote}, @init={0x18, 0x84, 0x0, {0xd6b2, 0x4, 0x6, 0x7}}, @init={0x18, 0x84, 0x0, {0x3, 0x73b, 0x800, 0x8}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x608e}}, @sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0x1, 0x0, 0x6, 0x1, 0x80000001, 0x2, r4}}, @sndinfo={0x20, 0x84, 0x2, {0x2, 0xb, 0xffffffcf, 0x0, r4}}, @init={0x18, 0x84, 0x0, {0x9, 0x3de2, 0x8, 0x7fff}}, @sndinfo={0x20, 0x84, 0x2, {0x6, 0x8006, 0xff, 0xff, r5}}], 0xf0, 0x8040}, 0x4000040)
r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0)
write$rfkill(r6, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8)
write$rfkill(r6, &(0x7f0000000000)={0x0, 0x2, 0xff, 0x0, 0x1}, 0x8)
syz_emit_ethernet(0x68, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x2, 0x0, 0x0, 0x1000, {[@timestamp={0x8, 0xa, 0x4}]}}, {"83c28bcb1ad8b8d36292345e51d7592f06063c3723788e3752d56c88a684d46b5445f44c1e54"}}}}}}, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
write$rfkill(r6, &(0x7f0000000340)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8)
r7 = socket$igmp6(0xa, 0x3, 0x2)
setsockopt$MRT6_DEL_MFC(r7, 0x29, 0xcd, &(0x7f0000000380)={{0xa, 0x4e20, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, {0xa, 0x4e21, 0xb11c, @private0={0xfc, 0x0, '\x00', 0x1}, 0x2}, 0x0, {[0x2, 0x8, 0x0, 0x0, 0x100, 0x4, 0x80, 0xffffffff]}}, 0x5c)

283.19627ms ago: executing program 2 (id=703):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a"], 0xc8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001000010700020100000000000a00000006000100"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)

221.713019ms ago: executing program 2 (id=704):
socket$nl_generic(0x10, 0x3, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0xa8}, [@ldst={0x5, 0x3, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000006c59850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$sock_attach_bpf(r1, 0x29, 0x17, &(0x7f0000000100)=r0, 0x4)
sendmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x0, @mcast2}, 0x80, 0x0}, 0xb80b)

109.612505ms ago: executing program 2 (id=705):
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180200000000000000000000000000008500000056000000850000000800000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

109.324713ms ago: executing program 1 (id=706):
r0 = socket$inet(0x2, 0x3, 0x30)
getsockopt$inet_mreqsrc(r0, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000080)=0x2c)

107.834089ms ago: executing program 2 (id=707):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x3}, @func={0x1, 0x0, 0x0, 0x12}, @ptr={0x0, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x2e, 0x0, 0x0, 0x61]}}, 0x0, 0x46}, 0x28)

476.065µs ago: executing program 2 (id=708):
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000740)=ANY=[@ANYBLOB="61128c000000000061138c0000000000bf2000000000000015000000081400002d0301000000000095000000000000006916600000000000bf67000000000000260600000fff07906706000007000000170300000ee600a8bf050000000000001d360000000000006507f9ff01000000a70700004c000000cc75000000000000bf54000000000000070400000400f9ffad4301000000000095000023000000000500000000000000950000000000000032ff7f5be95e09b67754bb12feffffff8ecf264e0f84f9f17d3c51e3c7bdd2d17f2f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd399703d6c4f6f3be5b369289aa6812b8e007e733a9a4f16d0abbd5ad9381806ef08513e3d3778a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad5b803306b17cf4ef3f1d45f65727546e7c955ccefa1f6ab689fde4de4e63edf10271a5144ddc8da3aa5b0ab733a1b901627b562ed04ae76002d4519af619e3a2a4d69e0dee5eb106774a8f3e6916dfec88b5634ef79b02d2ca8ff54c158f0200000000eafb735fd552bdc206004aeb0743eb2dc819cf5c8ac86d8a297dff0445a13d00dce431e56723888fb126a163f16fb2ad9bc1172ba7cbebe174cecac4d03723f1c932b3faffffffffffffff5fc998e13b670e373e3e5897f7ad2e99e0e67a993716dbf580469f0f53acbb40b401e3738270b315d362ed834f2a0700000096649a462e7ee4bcf8b07a101c879730beb4000000000000000000000000000000bc00f6"], 0x0}, 0x94)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000800)=ANY=[@ANYBLOB="ac0100001000330600000f0000000000fc000000000000000000000000000000ffffffff00ffffffff00000000ffff0000004000000080010000200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff0200000000000000000000000000010000000032000000e000000200000000000000000000000023030000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000000000000a000200000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00200000004e2200000000ac1414bb0000000000000000000000001c00040002004e2100000000fc00000000000000000000000000000108000c000400000008000b00070000002c0017"], 0x1ac}}, 0x0)

0s ago: executing program 1 (id=709):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
r3 = socket(0x10, 0x3, 0x0)
write(r3, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000002000a00000800040001000000", 0x24)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_buf(r4, 0x0, 0x10, &(0x7f0000000280)="17000000020001000003be8c5ee1568812006c000203000aff3f000098fc5ad90a00bb6a880000d6c8db0000dba67e06020000e28900000200df018002000000fc0607bdff59100ac45761547a6c1f004a5a2d8f89814b4f00c88fbb01005033bf79ac2dfc060115003901000000000000ea0000000027658fc4b59bd2b8e56858977f6701e974d805859b590ce5af649a701102ffff02dfccebf6ba00087b47949a1dd1e0400600000000000000dcd87f4e312a70ed4d46", 0xb8)
sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NLBL_CALIPSO_C_ADD(r5, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x24, 0x0, 0x0, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000000)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$SIOCX25SFACILITIES(r2, 0x89e3, &(0x7f0000000640)={0x70, 0x3, 0x8, 0x7, 0x0, 0x81})
r7 = socket(0x1, 0x803, 0x0)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000)
sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r7, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x82010000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x30, 0x140b, 0x4, 0x70bd27, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x3}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x5}]}, 0x30}}, 0x4)
r9 = socket(0x1, 0x803, 0x0)
getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={<r11=>0xffffffffffffffff, <r12=>0xffffffffffffffff})
setsockopt$SO_ATTACH_FILTER(r12, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0xff, 0x0, 0xfffff038}, {0x28, 0x0, 0x10, 0xffeff024}, {0x6, 0x0, 0x83, 0xfffffffd}]}, 0x10)
sendmmsg(r11, &(0x7f0000001c00), 0x400000000000159, 0x40840)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'erspan0\x00'}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x3c}, 0x1, 0x0, 0x0, 0x600}, 0x24044800)
r13 = socket$nl_generic(0x10, 0x3, 0x10)
r14 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="0100000000000000000010000000280001"], 0x3c}}, 0x0)
sendmsg$IPVS_CMD_SET_SERVICE(r7, &(0x7f0000000600)={&(0x7f0000000240), 0xc, &(0x7f00000005c0)={&(0x7f0000000780)={0xa8, r14, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010100}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x61}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vxcan1\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xff}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}]}, 0xa8}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
close(r0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:46769' (ED25519) to the list of known hosts.
syzkaller login: [   56.480786][ T5810] cgroup: Unknown subsys name 'net'
[   56.593036][ T5810] cgroup: Unknown subsys name 'cpuset'
[   56.599061][ T5810] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.950341][ T5810] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   64.694616][ T5237] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   64.698603][ T5237] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   64.701952][ T5237] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   64.705499][ T5237] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   64.708883][ T5237] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   64.756237][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   64.762303][   T55] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   64.765507][   T55] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   64.769173][   T55] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   64.773025][   T55] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   64.869071][ T5237] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   64.872186][ T5237] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   64.875137][ T5237] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   64.878557][ T5237] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   64.882419][ T5237] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   65.026802][ T5848] chnl_net:caif_netlink_parms(): no params data found
[   65.171184][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.175431][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.178951][ T5848] bridge_slave_0: entered allmulticast mode
[   65.183078][ T5848] bridge_slave_0: entered promiscuous mode
[   65.188212][ T5852] chnl_net:caif_netlink_parms(): no params data found
[   65.197071][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.201150][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.204149][ T5848] bridge_slave_1: entered allmulticast mode
[   65.208048][ T5848] bridge_slave_1: entered promiscuous mode
[   65.277669][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.285003][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.373780][ T5848] team0: Port device team_slave_0 added
[   65.376192][ T5852] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.380345][ T5852] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.382996][ T5852] bridge_slave_0: entered allmulticast mode
[   65.386124][ T5852] bridge_slave_0: entered promiscuous mode
[   65.391264][ T5848] team0: Port device team_slave_1 added
[   65.401337][ T5852] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.403537][ T5852] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.405821][ T5852] bridge_slave_1: entered allmulticast mode
[   65.408514][ T5852] bridge_slave_1: entered promiscuous mode
[   65.448284][ T5855] chnl_net:caif_netlink_parms(): no params data found
[   65.459736][ T5852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.463944][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.466731][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.477224][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.492237][ T5852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.504865][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.507790][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.517962][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.572423][ T5852] team0: Port device team_slave_0 added
[   65.581506][ T5852] team0: Port device team_slave_1 added
[   65.642955][ T5848] hsr_slave_0: entered promiscuous mode
[   65.646104][ T5848] hsr_slave_1: entered promiscuous mode
[   65.688242][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.691200][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.701332][ T5852] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.705831][ T5855] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.708651][ T5855] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.711568][ T5855] bridge_slave_0: entered allmulticast mode
[   65.714997][ T5855] bridge_slave_0: entered promiscuous mode
[   65.718861][ T5855] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.721263][ T5855] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.724051][ T5855] bridge_slave_1: entered allmulticast mode
[   65.727140][ T5855] bridge_slave_1: entered promiscuous mode
[   65.731307][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.733773][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.742946][ T5852] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.821100][ T5855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.841806][ T5852] hsr_slave_0: entered promiscuous mode
[   65.844250][ T5852] hsr_slave_1: entered promiscuous mode
[   65.846380][ T5852] debugfs: 'hsr0' already exists in 'hsr'
[   65.848499][ T5852] Cannot create hsr debugfs directory
[   65.853092][ T5855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.917337][ T5855] team0: Port device team_slave_0 added
[   65.938740][ T5855] team0: Port device team_slave_1 added
[   65.984518][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.987270][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.996795][ T5855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   66.012030][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_1
[   66.014655][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   66.023513][ T5855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   66.090706][ T5855] hsr_slave_0: entered promiscuous mode
[   66.093172][ T5855] hsr_slave_1: entered promiscuous mode
[   66.095474][ T5855] debugfs: 'hsr0' already exists in 'hsr'
[   66.097289][ T5855] Cannot create hsr debugfs directory
[   66.191800][ T5848] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   66.199778][ T5848] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   66.220757][ T5848] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   66.236412][ T5848] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   66.305524][ T5852] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   66.312724][ T5852] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   66.330500][ T5852] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   66.342556][ T5852] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   66.432636][ T5855] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   66.441869][ T5855] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   66.460175][ T5855] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   66.466595][ T5855] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   66.548477][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.567562][ T5852] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.581095][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[   66.600415][ T3636] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.603380][ T3636] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.614587][ T5852] 8021q: adding VLAN 0 to HW filter on device team0
[   66.626088][ T3636] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.628968][ T3636] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.637492][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.640291][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.663994][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.666584][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.691461][ T5855] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.731943][ T5848] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   66.750928][ T5855] 8021q: adding VLAN 0 to HW filter on device team0
[   66.760033][   T55] Bluetooth: hci0: command tx timeout
[   66.774742][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.777427][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.804557][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.807292][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.839662][   T55] Bluetooth: hci1: command tx timeout
[   66.922079][   T55] Bluetooth: hci2: command tx timeout
[   66.934541][ T5852] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.973824][ T5852] veth0_vlan: entered promiscuous mode
[   66.980418][ T5852] veth1_vlan: entered promiscuous mode
[   67.024646][ T5852] veth0_macvtap: entered promiscuous mode
[   67.039208][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.045864][ T5852] veth1_macvtap: entered promiscuous mode
[   67.091184][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.106019][ T5855] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.121157][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.131976][ T5848] veth0_vlan: entered promiscuous mode
[   67.145772][ T5718] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.150378][ T5718] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.154204][ T5718] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.183120][ T5718] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.201761][ T5848] veth1_vlan: entered promiscuous mode
[   67.247941][ T5855] veth0_vlan: entered promiscuous mode
[   67.280886][ T3636] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.284133][ T3636] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.286649][ T5855] veth1_vlan: entered promiscuous mode
[   67.318182][ T5848] veth0_macvtap: entered promiscuous mode
[   67.341217][ T5848] veth1_macvtap: entered promiscuous mode
[   67.355016][ T2939] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.358117][ T2939] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.372916][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.391410][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.397355][ T5855] veth0_macvtap: entered promiscuous mode
[   67.411921][ T5855] veth1_macvtap: entered promiscuous mode
[   67.415685][ T5876] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.420139][ T5876] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.425904][ T5876] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.439110][ T5876] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.457356][ T5852] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   67.472827][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.496419][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.513286][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.527593][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.542845][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.566939][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.622886][ T1091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.633723][ T1091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.684056][ T5917] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4'.
[   67.697831][ T1091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.702912][ T1091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.737465][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.748845][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.800976][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.807414][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   68.548463][ T5965] dvmrp0: entered allmulticast mode
[   68.643352][ T5970] netlink: 24 bytes leftover after parsing attributes in process `syz.1.21'.
[   68.663225][ T5972] netlink: 8 bytes leftover after parsing attributes in process `syz.0.22'.
[   68.843297][   T55] Bluetooth: hci0: command tx timeout
[   68.919346][   T55] Bluetooth: hci1: command tx timeout
[   69.000149][   T55] Bluetooth: hci2: command tx timeout
[   69.135385][ T6002] netlink: 104 bytes leftover after parsing attributes in process `syz.0.36'.
[   69.155027][ T6004] netlink: 'syz.1.37': attribute type 1 has an invalid length.
[   69.450397][ T6023] netlink: 'syz.1.46': attribute type 4 has an invalid length.
[   69.453145][ T6023] netlink: 17 bytes leftover after parsing attributes in process `syz.1.46'.
[   69.726502][ T6035] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add()
[   70.412335][ T6062] warning: `syz.1.65' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   70.816747][ T6091] syz.0.78 uses obsolete (PF_INET,SOCK_PACKET)
[   70.851761][ T6095] netlink: 11 bytes leftover after parsing attributes in process `syz.1.81'.
[   70.855488][ T6095] netlink: 11 bytes leftover after parsing attributes in process `syz.1.81'.
[   70.861541][ T6095] netlink: 11 bytes leftover after parsing attributes in process `syz.1.81'.
[   70.864893][ T6095] netlink: 11 bytes leftover after parsing attributes in process `syz.1.81'.
[   70.919904][   T55] Bluetooth: hci0: command tx timeout
[   71.002264][   T55] Bluetooth: hci1: command tx timeout
[   71.079581][   T55] Bluetooth: hci2: command tx timeout
[   71.215194][ T6124] syzkaller0: entered promiscuous mode
[   71.217168][ T6124] syzkaller0: entered allmulticast mode
[   71.324856][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   71.327488][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   72.157418][ T6142] netlink: 8 bytes leftover after parsing attributes in process `syz.2.101'.
[   72.820860][ T6194] Bluetooth: MGMT ver 1.23
[   72.975111][ T6208] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[   73.000910][   T55] Bluetooth: hci0: command tx timeout
[   73.090564][   T55] Bluetooth: hci1: command tx timeout
[   73.103285][ T6212] bridge0: port 2(bridge_slave_1) entered disabled state
[   73.106031][ T6212] bridge0: port 1(bridge_slave_0) entered disabled state
[   73.159230][   T55] Bluetooth: hci2: command tx timeout
[   73.327875][ T6212] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   73.345241][ T6212] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   73.631171][ T5718] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.634586][ T5718] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.644959][ T5718] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.653839][ T5718] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.846226][ T6235] __nla_validate_parse: 1 callbacks suppressed
[   73.846236][ T6235] netlink: 10 bytes leftover after parsing attributes in process `syz.1.135'.
[   74.012269][ T6242] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode
[   74.015470][ T6242] macsec1: entered promiscuous mode
[   74.017593][ T6242] macsec1: entered allmulticast mode
[   74.020040][ T6242] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode
[   74.050833][ T6245] netlink: 'syz.1.140': attribute type 8 has an invalid length.
[   74.312965][ T6255] netlink: 'syz.1.145': attribute type 1 has an invalid length.
[   74.481186][ T6265] netlink: 32 bytes leftover after parsing attributes in process `syz.1.150'.
[   74.484791][ T6265] tipc: Invalid UDP bearer configuration
[   74.484836][ T6265] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[   74.872020][ T5718] nci: nci_add_new_protocol: the target found does not have the desired protocol
[   74.897303][ T6273] netlink: 8 bytes leftover after parsing attributes in process `syz.1.153'.
[   75.015402][ T6292] netlink: 'syz.0.160': attribute type 39 has an invalid length.
[   75.169820][ T6301] netlink: 12 bytes leftover after parsing attributes in process `syz.1.164'.
[   75.717000][ T6316] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144
[   75.721786][ T6318] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable
[   75.977233][ T6335] netlink: 56 bytes leftover after parsing attributes in process `syz.1.179'.
[   75.981845][ T6335] netlink: 8 bytes leftover after parsing attributes in process `syz.1.179'.
[   75.986518][ T6335] netlink: 24 bytes leftover after parsing attributes in process `syz.1.179'.
[   75.991912][ T6335] netlink: 44 bytes leftover after parsing attributes in process `syz.1.179'.
[   76.176073][ T6347] netlink: 28 bytes leftover after parsing attributes in process `syz.1.185'.
[   76.363054][ T6360] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   76.375924][ T6360] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[   77.150334][ T6422] netlink: 8 bytes leftover after parsing attributes in process `syz.2.218'.
[   77.444744][ T6449] netlink: 'syz.2.231': attribute type 10 has an invalid length.
[   77.456487][ T6449] bridge0: port 3(macsec0) entered blocking state
[   77.461872][ T6449] bridge0: port 3(macsec0) entered disabled state
[   77.464842][ T6449] macsec0: entered allmulticast mode
[   77.467000][ T6449] veth1_macvtap: entered allmulticast mode
[   77.471996][ T6449] macsec0: entered promiscuous mode
[   77.956682][ T6481] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   78.634194][ T6527] netlink: 'syz.2.266': attribute type 1 has an invalid length.
[   78.851052][ T6539] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   80.581983][ T6613] can: request_module (can-proto-0) failed.
[   81.164619][ T6638] __nla_validate_parse: 3 callbacks suppressed
[   81.164635][ T6638] netlink: 8 bytes leftover after parsing attributes in process `syz.1.314'.
[   81.444336][ T6658] syzkaller1: entered promiscuous mode
[   81.446614][ T6658] syzkaller1: entered allmulticast mode
[   81.716121][ T6676] Driver unsupported XDP return value 0 on prog  (id 55) dev N/A, expect packet loss!
[   82.094622][ T6703] netlink: 4 bytes leftover after parsing attributes in process `syz.2.345'.
[   82.112682][ T5876] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   82.112728][ T6703] netlink: 4 bytes leftover after parsing attributes in process `syz.2.345'.
[   82.118870][ T5876] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   82.123314][ T5876] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   82.126735][ T5876] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   82.131944][ T6703] Zero length message leads to an empty skb
[   82.233775][ T6707] netlink: 'syz.2.347': attribute type 3 has an invalid length.
[   83.160158][ T6719] netlink: 4 bytes leftover after parsing attributes in process `syz.0.351'.
[   83.244563][ T6731] netlink: 4 bytes leftover after parsing attributes in process `syz.1.357'.
[   83.256139][ T6731] netlink: 12 bytes leftover after parsing attributes in process `syz.1.357'.
[   83.393959][ T5876] nci: nci_add_new_protocol: the target found does not have the desired protocol
[   83.441175][ T6750] netlink: 8 bytes leftover after parsing attributes in process `syz.0.364'.
[   83.444853][ T6750] netlink: 20 bytes leftover after parsing attributes in process `syz.0.364'.
[   83.455468][ T6750] geneve2: entered promiscuous mode
[   83.457502][ T6750] geneve2: entered allmulticast mode
[   83.571688][ T6756] erspan0: entered promiscuous mode
[   83.576302][ T6756] netlink: 8 bytes leftover after parsing attributes in process `syz.0.367'.
[   84.233460][ T6767] netlink: 8 bytes leftover after parsing attributes in process `syz.1.372'.
[   85.082208][   T33] audit: type=1800 audit(1758801897.699:2): pid=6857 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.410" name="blkio.bfq.time_recursive" dev="tmpfs" ino=655 res=0 errno=0
[   85.145101][ T6865] netlink: 'syz.0.414': attribute type 1 has an invalid length.
[   85.291895][ T6880] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   85.375887][ T6888] netlink: 'syz.1.425': attribute type 4 has an invalid length.
[   85.902039][ T6907] tipc: Started in network mode
[   85.917079][ T6907] tipc: Node identity 9e5b083acc8, cluster identity 4711
[   85.924482][ T6907] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   85.927429][ T6908] syzkaller0: entered promiscuous mode
[   85.931287][ T6908] syzkaller0: entered allmulticast mode
[   86.043963][ T6907] tipc: Resetting bearer <eth:syzkaller0>
[   86.106130][ T6906] tipc: Resetting bearer <eth:syzkaller0>
[   86.124741][ T6906] tipc: Disabling bearer <eth:syzkaller0>
[   86.175929][ T6921] __nla_validate_parse: 9 callbacks suppressed
[   86.175947][ T6921] netlink: 24 bytes leftover after parsing attributes in process `syz.2.438'.
[   86.276067][ T6928] netlink: 36 bytes leftover after parsing attributes in process `syz.0.441'.
[   86.326322][ T6933] netlink: 'syz.2.444': attribute type 13 has an invalid length.
[   86.328933][ T6935] netlink: 12 bytes leftover after parsing attributes in process `syz.1.445'.
[   86.335474][ T6933] netlink: 'syz.2.444': attribute type 17 has an invalid length.
[   86.360767][ T6933] gretap0: refused to change device tx_queue_len
[   86.363622][ T6933] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[   86.595728][ T6955] netlink: 12 bytes leftover after parsing attributes in process `syz.1.454'.
[   86.612043][ T6957] netlink: 8 bytes leftover after parsing attributes in process `syz.0.456'.
[   86.691112][  T792] cfg80211: failed to load regulatory.db
[   86.733681][ T6967] netlink: 12 bytes leftover after parsing attributes in process `syz.0.460'.
[   86.737216][ T6967] netlink: 'syz.0.460': attribute type 11 has an invalid length.
[   86.751113][ T5876] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   86.754499][ T5876] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   86.757868][ T5876] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   86.763183][ T6967] netlink: 12 bytes leftover after parsing attributes in process `syz.0.460'.
[   86.764645][ T5876] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   86.766678][ T6967] netlink: 'syz.0.460': attribute type 11 has an invalid length.
[   86.975925][ T6990] netlink: 'syz.1.472': attribute type 2 has an invalid length.
[   86.990430][ T6991] netlink: 'syz.2.471': attribute type 6 has an invalid length.
[   87.045928][ T6997] netlink: 8 bytes leftover after parsing attributes in process `syz.2.475'.
[   87.261861][ T7015] netlink: 24 bytes leftover after parsing attributes in process `syz.0.485'.
[   87.375465][ T7028] netlink: 8 bytes leftover after parsing attributes in process `syz.1.491'.
[   87.873740][ T7060] 8021q: adding VLAN 0 to HW filter on device bond2
[   87.908313][ T7060] macvlan2: entered promiscuous mode
[   87.910672][ T7060] macvlan2: entered allmulticast mode
[   87.914192][ T7060] bond2: entered promiscuous mode
[   87.916569][ T7060] 8021q: adding VLAN 0 to HW filter on device macvlan2
[   87.922087][ T7060] bond2: left promiscuous mode
[   89.553044][ T7172] bridge_slave_1: left allmulticast mode
[   89.555350][ T7172] bridge_slave_1: left promiscuous mode
[   89.558427][ T7172] bridge0: port 2(bridge_slave_1) entered disabled state
[   89.567310][ T7172] bridge_slave_0: left allmulticast mode
[   89.570716][ T7172] bridge_slave_0: left promiscuous mode
[   89.573100][ T7172] bridge0: port 1(bridge_slave_0) entered disabled state
[   89.771576][ T7179] 8021q: adding VLAN 0 to HW filter on device bond0
[   89.775691][ T7179] 8021q: adding VLAN 0 to HW filter on device team0
[   89.793442][ T7179] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   89.835768][ T7193] tipc: Started in network mode
[   89.837754][ T7193] tipc: Node identity 2a1b7c7f66b4, cluster identity 4711
[   89.841194][ T7193] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   89.860093][ T7193] syzkaller0: entered promiscuous mode
[   89.862577][ T7193] syzkaller0: entered allmulticast mode
[   89.913368][ T7193] tipc: Resetting bearer <eth:syzkaller0>
[   89.922909][ T7192] tipc: Resetting bearer <eth:syzkaller0>
[   89.977505][ T7192] tipc: Disabling bearer <eth:syzkaller0>
[   90.548556][ T7232] syzkaller1: entered promiscuous mode
[   90.554717][ T7232] syzkaller1: entered allmulticast mode
[   91.281552][ T7280] syzkaller1: entered promiscuous mode
[   91.283969][ T7280] syzkaller1: entered allmulticast mode
[   91.443293][ T7286] macsec1: entered promiscuous mode
[   91.445197][ T7286] macsec0: entered promiscuous mode
[   91.447125][ T7286] macsec1: entered allmulticast mode
[   91.449589][ T7286] macsec0: entered allmulticast mode
[   91.451502][ T7286] veth1_macvtap: entered allmulticast mode
[   91.732787][ T7302] __nla_validate_parse: 5 callbacks suppressed
[   91.732841][ T7302] netlink: 16 bytes leftover after parsing attributes in process `syz.1.597'.
[   92.143623][ T7331] netlink: 'syz.2.610': attribute type 3 has an invalid length.
[   92.194594][ T7335] netlink: 'syz.2.614': attribute type 23 has an invalid length.
[   92.265167][ T7343] netlink: 'syz.2.615': attribute type 10 has an invalid length.
[   92.277498][ T7343] team0: Port device dummy0 added
[   92.292266][ T7343] netlink: 'syz.2.615': attribute type 10 has an invalid length.
[   92.302483][ T7343] team0: Failed to send port change of device dummy0 via netlink (err -105)
[   92.315529][ T7343] team0: Failed to send options change via netlink (err -105)
[   92.320003][ T7343] team0: Failed to send port change of device dummy0 via netlink (err -105)
[   92.327622][ T7343] team0: Port device dummy0 removed
[   92.357440][ T7343] bond0: (slave dummy0): Enslaving as an active interface with an up link
[   93.142804][ T7435] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) !
[   93.614273][ T7475] netlink: 'syz.1.654': attribute type 11 has an invalid length.
[   93.617346][ T7475] netlink: 44 bytes leftover after parsing attributes in process `syz.1.654'.
[   93.696514][ T7477] netlink: 40 bytes leftover after parsing attributes in process `syz.0.655'.
[   93.773480][ T7488] netlink: 'syz.0.660': attribute type 5 has an invalid length.
[   93.779793][ T7488] netlink: 28 bytes leftover after parsing attributes in process `syz.0.660'.
[   94.026476][ T7505] netlink: 'syz.1.668': attribute type 1 has an invalid length.
[   94.042039][ T7507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.669'.
[   94.086602][ T7505] bond1: (slave vcan1): The slave device specified does not support setting the MAC address
[   94.091087][ T7505] bond1: (slave vcan1): Setting fail_over_mac to active for active-backup mode
[   94.102908][ T7511] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   94.107249][ T7505] bond1: (slave vcan1): making interface the new active one
[   94.113545][ T7505] bond1: (slave vcan1): Enslaving as an active interface with an up link
[   94.135844][ T7505] bond1: (slave vcan2): The slave device specified does not support setting the MAC address
[   94.143087][ T7505] bond1: (slave vcan2): Enslaving as a backup interface with an up link
[   94.151297][ T7505] 8021q: adding VLAN 0 to HW filter on device bond1
[   94.322141][ T5852] cgroup: fork rejected by pids controller in /syz0
[   94.507297][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[   94.515414][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   94.591783][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[   94.595037][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   94.681162][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[   94.688743][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   94.784212][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[   94.787624][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   94.826111][ T7528] netlink: 596 bytes leftover after parsing attributes in process `syz.1.677'.
[   95.115772][ T5237] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   95.119497][ T5237] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   95.122705][ T5237] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   95.126693][ T5237] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   95.131136][ T5237] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   95.133947][ T7551] netlink: 548 bytes leftover after parsing attributes in process `syz.1.680'.
[   95.457909][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   95.464164][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   95.469002][   T13] bond0 (unregistering): Released all slaves
[   95.477195][ T7540] netlink: 'syz.1.680': attribute type 29 has an invalid length.
[   95.507057][ T7545] netlink: 'syz.1.680': attribute type 29 has an invalid length.
[   95.550216][   T13] tipc: Left network mode
[   95.902566][   T13] mac80211_hwsim hwsim2 wlan0 (unregistering): left allmulticast mode
[   96.025978][   T13] hsr_slave_0: left promiscuous mode
[   96.030326][   T13] hsr_slave_1: left promiscuous mode
[   96.033221][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   96.036141][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   96.042917][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   96.045933][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   96.063101][   T13] veth1_macvtap: left promiscuous mode
[   96.065690][   T13] veth0_macvtap: left promiscuous mode
[   96.067711][   T13] veth1_vlan: left promiscuous mode
[   96.079241][   T13] veth0_vlan: left promiscuous mode
[   96.535072][   T13] team0 (unregistering): Port device team_slave_1 removed
[   96.568535][   T13] team0 (unregistering): Port device team_slave_0 removed
[   96.875589][ T7590] tipc: Started in network mode
[   96.877539][ T7590] tipc: Node identity 7f000001, cluster identity 4711
[   96.881680][ T7590] tipc: Enabled bearer <udp:syz2>, priority 10
[   97.029823][ T7547] chnl_net:caif_netlink_parms(): no params data found
[   97.159635][   T55] Bluetooth: hci1: command tx timeout
[   97.246232][ T7547] bridge0: port 1(bridge_slave_0) entered blocking state
[   97.253862][ T7547] bridge0: port 1(bridge_slave_0) entered disabled state
[   97.264613][ T7547] bridge_slave_0: entered allmulticast mode
[   97.264639][ T7636] netlink: 'syz.2.708': attribute type 32 has an invalid length.
[   97.268485][ T7547] bridge_slave_0: entered promiscuous mode
[   97.276007][ T7547] bridge0: port 2(bridge_slave_1) entered blocking state
[   97.289022][ T7547] bridge0: port 2(bridge_slave_1) entered disabled state
[   97.291845][ T7547] bridge_slave_1: entered allmulticast mode
[   97.300698][ T7547] bridge_slave_1: entered promiscuous mode
[   97.334498][ T7635] veth3: entered promiscuous mode
[   97.357971][   T13] ------------[ cut here ]------------
[   97.360549][   T13] WARNING: CPU: 0 PID: 13 at net/xfrm/xfrm_state.c:3303 xfrm_state_fini+0x26d/0x2f0
[   97.364063][   T13] Modules linked in:
[   97.365942][   T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   97.370924][   T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   97.374529][   T13] Workqueue: netns cleanup_net
[   97.376370][   T13] RIP: 0010:xfrm_state_fini+0x26d/0x2f0
[   97.378068][   T13] Code: c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 fb 2a ff f7 48 8b 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 29 dc df f7 e8 f4 aa 9b f7 90 <0f> 0b 90 e9 fd fd ff ff e8 e6 aa 9b f7 90 0f 0b 90 e9 60 fe ff ff
[   97.385329][   T13] RSP: 0018:ffffc90000107898 EFLAGS: 00010293
[   97.387151][   T13] RAX: ffffffff8a24029c RBX: ffff888111748000 RCX: ffff88801c6c0000
[   97.390451][   T13] RDX: 0000000000000000 RSI: ffffffff8db9e84d RDI: ffff88801c6c0000
[   97.393152][   T13] RBP: ffffc900001079b0 R08: ffffffff8fa2ee37 R09: 1ffffffff1f45dc6
[   97.395346][ T7644] netlink: 36 bytes leftover after parsing attributes in process `syz.1.709'.
[   97.395978][   T13] R10: dffffc0000000000 R11: fffffbfff1f45dc7 R12: ffffffff8f633340
[   97.401438][   T13] R13: 1ffff92000020f40 R14: ffff888111749480 R15: dffffc0000000000
[   97.403971][   T13] FS:  0000000000000000(0000) GS:ffff8880b863d000(0000) knlGS:0000000000000000
[   97.406979][   T13] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   97.409791][   T13] CR2: 0000200000007038 CR3: 000000000df36000 CR4: 00000000000006f0
[   97.412558][   T13] Call Trace:
[   97.413832][   T13]  <TASK>
[   97.414751][   T13]  xfrm_net_exit+0x2d/0x70
[   97.416028][   T13]  ops_undo_list+0x49a/0x990
[   97.417790][   T13]  ? __pfx_ops_undo_list+0x10/0x10
[   97.420094][   T13]  ? do_raw_spin_unlock+0x4d/0x240
[   97.422476][   T13]  cleanup_net+0x4c5/0x800
[   97.424329][   T13]  ? __pfx_cleanup_net+0x10/0x10
[   97.426493][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[   97.428114][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[   97.430498][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[   97.432652][   T13]  process_scheduled_works+0xae1/0x17b0
[   97.434824][   T13]  ? __pfx_process_scheduled_works+0x10/0x10
[   97.437344][   T13]  worker_thread+0x8a0/0xda0
[   97.439459][   T13]  kthread+0x711/0x8a0
[   97.441049][   T13]  ? __pfx_worker_thread+0x10/0x10
[   97.443056][   T13]  ? __pfx_kthread+0x10/0x10
[   97.444701][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[   97.446730][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[   97.449082][   T13]  ? __pfx_kthread+0x10/0x10
[   97.450655][   T13]  ret_from_fork+0x439/0x7d0
[   97.452400][   T13]  ? __pfx_ret_from_fork+0x10/0x10
[   97.454189][   T13]  ? __switch_to_asm+0x39/0x70
[   97.456081][   T13]  ? __switch_to_asm+0x33/0x70
[   97.457960][   T13]  ? __pfx_kthread+0x10/0x10
[   97.460063][   T13]  ret_from_fork_asm+0x1a/0x30
[   97.461774][   T13]  </TASK>
[   97.462937][   T13] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   97.465285][   T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
[   97.468063][   T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   97.471546][   T13] Workqueue: netns cleanup_net
[   97.473045][   T13] Call Trace:
[   97.474100][   T13]  <TASK>
[   97.475028][   T13]  dump_stack_lvl+0x99/0x250
[   97.476532][   T13]  ? __asan_memcpy+0x40/0x70
[   97.478382][   T13]  ? __pfx_dump_stack_lvl+0x10/0x10
[   97.480119][   T13]  ? __pfx__printk+0x10/0x10
[   97.481609][   T13]  vpanic+0x281/0x750
[   97.483013][   T13]  ? __pfx__printk+0x10/0x10
[   97.484462][   T13]  ? __pfx_vpanic+0x10/0x10
[   97.485864][   T13]  ? is_bpf_text_address+0x292/0x2b0
[   97.487589][   T13]  panic+0xb9/0xc0
[   97.488808][   T13]  ? __pfx_panic+0x10/0x10
[   97.490248][   T13]  __warn+0x31b/0x4b0
[   97.491547][   T13]  ? xfrm_state_fini+0x26d/0x2f0
[   97.493215][   T13]  ? xfrm_state_fini+0x26d/0x2f0
[   97.494831][   T13]  report_bug+0x2be/0x4f0
[   97.496494][   T13]  ? xfrm_state_fini+0x26d/0x2f0
[   97.498088][   T13]  ? xfrm_state_fini+0x26d/0x2f0
[   97.499644][   T13]  ? xfrm_state_fini+0x26f/0x2f0
[   97.501166][   T13]  handle_bug+0x84/0x160
[   97.502492][   T13]  exc_invalid_op+0x1a/0x50
[   97.503925][   T13]  asm_exc_invalid_op+0x1a/0x20
[   97.505723][   T13] RIP: 0010:xfrm_state_fini+0x26d/0x2f0
[   97.507849][   T13] Code: c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 fb 2a ff f7 48 8b 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 29 dc df f7 e8 f4 aa 9b f7 90 <0f> 0b 90 e9 fd fd ff ff e8 e6 aa 9b f7 90 0f 0b 90 e9 60 fe ff ff
[   97.515085][   T13] RSP: 0018:ffffc90000107898 EFLAGS: 00010293
[   97.517444][   T13] RAX: ffffffff8a24029c RBX: ffff888111748000 RCX: ffff88801c6c0000
[   97.520317][   T13] RDX: 0000000000000000 RSI: ffffffff8db9e84d RDI: ffff88801c6c0000
[   97.522803][   T13] RBP: ffffc900001079b0 R08: ffffffff8fa2ee37 R09: 1ffffffff1f45dc6
[   97.525223][   T13] R10: dffffc0000000000 R11: fffffbfff1f45dc7 R12: ffffffff8f633340
[   97.527705][   T13] R13: 1ffff92000020f40 R14: ffff888111749480 R15: dffffc0000000000
[   97.530739][   T13]  ? xfrm_state_fini+0x26c/0x2f0
[   97.532486][   T13]  ? xfrm_state_fini+0x26c/0x2f0
[   97.534356][   T13]  xfrm_net_exit+0x2d/0x70
[   97.536069][   T13]  ops_undo_list+0x49a/0x990
[   97.537914][   T13]  ? __pfx_ops_undo_list+0x10/0x10
[   97.540006][   T13]  ? do_raw_spin_unlock+0x4d/0x240
[   97.542109][   T13]  cleanup_net+0x4c5/0x800
[   97.543934][   T13]  ? __pfx_cleanup_net+0x10/0x10
[   97.545878][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[   97.547962][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[   97.550316][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[   97.552681][   T13]  process_scheduled_works+0xae1/0x17b0
[   97.554988][   T13]  ? __pfx_process_scheduled_works+0x10/0x10
[   97.557499][   T13]  worker_thread+0x8a0/0xda0
[   97.559506][   T13]  kthread+0x711/0x8a0
[   97.561177][   T13]  ? __pfx_worker_thread+0x10/0x10
[   97.563277][   T13]  ? __pfx_kthread+0x10/0x10
[   97.565190][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[   97.567302][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[   97.569383][   T13]  ? __pfx_kthread+0x10/0x10
[   97.571315][   T13]  ret_from_fork+0x439/0x7d0
[   97.573236][   T13]  ? __pfx_ret_from_fork+0x10/0x10
[   97.575278][   T13]  ? __switch_to_asm+0x39/0x70
[   97.577129][   T13]  ? __switch_to_asm+0x33/0x70
[   97.579186][   T13]  ? __pfx_kthread+0x10/0x10
[   97.581060][   T13]  ret_from_fork_asm+0x1a/0x30
[   97.583040][   T13]  </TASK>
[   97.585017][   T13] Kernel Offset: disabled
[   97.586838][   T13] Rebooting in 86400 seconds..

VM DIAGNOSIS:
12:05:10  Registers:
info registers vcpu 0

CPU#0
RAX=000000000000005d RBX=000000000000005d RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000107030
R8 =ffff888020028237 R9 =1ffff11004005046 R10=dffffc0000000000 R11=ffffffff854fac30
R12=dffffc0000000000 R13=ffffffff99ad78d6 R14=ffffffff99dcc480 R15=0000000000000000
RIP=ffffffff854facac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b863d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000007038 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f950d5a7498 00007f950d5a7470 XMM03=00007f950d5a74a8 00007f950d5a74a0
XMM04=00007f950e10d100 00007f950d5a7460 XMM05=00007f950d5a7478 00007f950d5a74c0
XMM06=00007f950d5a74b8 00007f950d5a74b0 XMM07=00007f950d5a74a8 00007f950d5a74a0
XMM08=d874e901677f9758 68e5b8d29bb5c48f XMM09=0000000000000000 00007f950d412fed
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff81b44e7b RBX=1ffff11009608349 RCX=ffff8881072e9cc0 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc900030df700 RSP=ffffc900030df580
R8 =ffffffff8fa2ee37 R9 =1ffffffff1f45dc6 R10=dffffc0000000000 R11=fffffbfff1f45dc7
R12=ffff88804b041a48 R13=dffffc0000000000 R14=ffff88813663b1c0 R15=0000000000000000
RIP=ffffffff81b44e63 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c3d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f389f307d60 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00007f389e7a76c3 00007f389e7a76c3 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 00ff000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=010fffffffffffff 040387c608000100
XMM06=0002080606013be8 0808000410002810 XMM07=00060270cc001000 0fffffffffffff04
XMM08=01080006015cd201 80100004ed800401 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
