last executing test programs:

609.257797ms ago: executing program 2 (id=410):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes-aesni)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)

404.042946ms ago: executing program 2 (id=409):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
ioctl$int_in(r0, 0x5421, &(0x7f0000000000)=0xc711)
writev(r0, &(0x7f0000019880)=[{&(0x7f0000000400)="fb", 0xffffff5c}, {&(0x7f00000197c0)="1902eb02d5e5f29e59e1a7caec33eb76d2430da474d87e367f6598d026438b65eda8341073b6752abdcee080c8e1e876b25227c37d7dd79886ce33f13e857c8eda1cecf6ac36c03dbf54e3cb5136da5a33fee76fb3113f8b6700e9e5fc006b8eed665fed48738d59395ad07438c3610ae3976aac75caf2facafa21c25be3c2", 0x7f}], 0x2)

350.768053ms ago: executing program 2 (id=412):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000a40)={'sit0\x00', &(0x7f00000009c0)={'syztnl2\x00', 0x0, 0x8, 0x1, 0x7, 0xa00, {{0x5, 0x4, 0x1, 0x3, 0x14, 0x66, 0x0, 0x4, 0x2f, 0x0, @empty, @empty}}}})

350.322831ms ago: executing program 1 (id=415):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a017f7f00000000000000050000000900010073797a30000000000900030073797a300000000008000a400000000328000480080002400000001208000140000000000d0003"], 0xac}}, 0x0)

287.103407ms ago: executing program 2 (id=417):
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={<r1=>0xffffffffffffffff})
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@bridge_delneigh={0x28, 0x1e, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r2, 0x0, 0x2}, [@NDA_LLADDR={0xa}]}, 0x28}}, 0x0)

236.920831ms ago: executing program 0 (id=418):
r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xca)
setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10)

236.541284ms ago: executing program 2 (id=419):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x8, 0x8, 0x8}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000085000000a000000095"], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

236.373326ms ago: executing program 1 (id=420):
syz_emit_ethernet(0x56, &(0x7f0000000400)={@local, @random="df00004000", @void, {@ipv4={0x800, @tcp={{0xd, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x11}, {[@ssrr={0x89, 0x7, 0xa2, [@broadcast]}, @timestamp={0x44, 0x10, 0x5, 0x3, 0x0, [0x0, 0x0, 0x0]}, @cipso={0x86, 0x6, 0x1}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0)

236.067961ms ago: executing program 0 (id=421):
socket(0x2a, 0x2, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
socket$inet6(0xa, 0x80003, 0xff)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet6(0xa, 0x80003, 0xff)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000100)={0x0, 0xcc}, 0x8)
r1 = socket$inet6(0xa, 0x802, 0x0)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback, 0x7}], 0x1c)
sendmmsg$inet6(r0, &(0x7f0000000640)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x2, @loopback, 0x3}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000300)="06", 0x1}], 0x1}}], 0x1, 0x3404c8d4)
setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES16=r0, @ANYRES16=r1], 0x1000f)

154.68718ms ago: executing program 1 (id=422):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r0}, 0x10)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0)
bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8)

154.204435ms ago: executing program 0 (id=423):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000006c0f00000a"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0), 0x0, 0x0, 0x0, 0x2663}, 0x0)
syz_emit_ethernet(0x0, 0x0, &(0x7f0000000180)={0x1, 0x1, [0xac1, 0xd28, 0xd74, 0x4bd]})
bpf$MAP_CREATE(0x0, 0x0, 0x48)
socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff})
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14)
sendmsg$nl_route_sched(r3, &(0x7f0000006280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newtaction={0x68, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x2}, 0x2, r5}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xffdff7e8}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffff7}, 0x2}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0)
socket$packet(0x11, 0xa, 0x300)
r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000002000000000000000000001e95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7336b5d}, 0x94)
r7 = socket$nl_route(0x10, 0x3, 0x0)
r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r9=>0x0})
sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="7400000010000305000900"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000004c0012800c0001006d6163766c616e003c00028008000100100000001c0005800a000400aaaaaaaaaaaa00000a000400aaaaaaaaaaaa000008000300030000000a000400aaaaaaaaaabb000008000500", @ANYRES32=r9], 0x74}, 0x1, 0x0, 0x0, 0x20000004}, 0x0)
r10 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="f000000010000d0400"/20, @ANYRES32=0x0, @ANYBLOB="0008000000020000bc0012800c0001006d6163766c616e00ac000280080003000100000008000100100000000a0004000180c200000300000a00040000000000030000000800070005000000080007000a0000004c0005800a000400aaaaaaaaaabb00000a000400aaaaaaaaaabb00000a0004004ac92f9d35ed00000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaabb00000a000400aaaaaaaaaaaa000006000200010000000a000400aaaaaaaaaabb0000100005800a000400b25b12b8e5000000140035006d6163766c616e30"], 0xf0}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
r12 = syz_genetlink_get_family_id$fou(&(0x7f00000020c0), 0xffffffffffffffff)
sendmsg$FOU_CMD_DEL(r11, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000002180)={&(0x7f0000002100)=ANY=[@ANYBLOB, @ANYRES16=r12, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x20000800)
mmap(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x2000000, 0x12, r11, 0xc92c000)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x2000000, 0xd50, 0x0, &(0x7f00000002c0)="fef351f6b11f421a5b4e415288ca", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50)

153.996ms ago: executing program 2 (id=424):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000540)=ANY=[@ANYBLOB="4800000010000305000000000000000000cf0000", @ANYRES32=0x0, @ANYBLOB="03000000000000002000128008000100677265001400028008000600ac14142e08000700e000030a08000a00", @ANYRES32], 0x48}, 0x1, 0x0, 0x0, 0x24040000}, 0x2000800)
syz_init_net_socket$x25(0x9, 0x5, 0x0)
r1 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c)
setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4)
r2 = socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', <r3=>0x0})
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4)
bind$xdp(r1, &(0x7f0000000180)={0x2c, 0x2, r3}, 0x10)
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000740)={0x0, 0x206000, 0x0, 0x3}, 0x20)
socket$inet6_sctp(0xa, 0x801, 0x84)

55.40115ms ago: executing program 1 (id=425):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newlink={0x2c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, r1, 0x19465, 0x1a704}, [@IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044)

54.90548ms ago: executing program 0 (id=426):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007040)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0)

1.551662ms ago: executing program 0 (id=427):
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r1, 0x0)
close(0x3)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={<r2=>0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f0000000040)={0x0, @in6={{0x2, 0x0, 0x0, @empty}}}, &(0x7f0000000300)=0x90)

1.285961ms ago: executing program 1 (id=428):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000800), r0)
sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000840)={0x44, r1, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x12, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @rand_addr=0x64010102}, @NLBL_UNLABEL_A_IPV6MASK={0x12, 0x3, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000801}, 0x448c0)

323.789µs ago: executing program 0 (id=429):
r0 = socket(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x78, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x198, 0x4, 0x9, 0x2, 0x68}, 0xb, 0x1, 0x5, 0x1, 0x5, 0x16, 0x15, 0x1d, 0x6, 0x4, {0x5, 0xb, 0x41, 0x0, 0x16, 0x3ff}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x44080)
sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@newqdisc={0x30, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x55}, 0x4000)

0s ago: executing program 1 (id=430):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0xc, 0xffff, 0x4, 0x0, 0xffffffffffffffff, 0x352}, 0x48)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r0, &(0x7f0000001440), 0x0}, 0x20)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:38434' (ED25519) to the list of known hosts.
syzkaller login: [   48.597547][ T5786] cgroup: Unknown subsys name 'net'
[   48.739024][ T5786] cgroup: Unknown subsys name 'cpuset'
[   48.743184][ T5786] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.476048][ T5786] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   54.541301][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   54.556829][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   54.560193][   T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   54.574279][ T5819] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   54.578046][ T5819] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   54.580545][ T5819] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   54.583004][ T5819] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   54.584407][ T5817] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   54.585936][ T5819] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   54.588875][ T5817] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   54.597004][ T5817] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   54.611860][ T5823] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   54.618819][   T54] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   54.622044][ T5823] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   54.625333][ T5823] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   54.888453][ T5811] chnl_net:caif_netlink_parms(): no params data found
[   54.893295][ T5820] chnl_net:caif_netlink_parms(): no params data found
[   54.938927][ T5816] chnl_net:caif_netlink_parms(): no params data found
[   55.001630][ T5820] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.004794][ T5820] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.007591][ T5820] bridge_slave_0: entered allmulticast mode
[   55.010584][ T5820] bridge_slave_0: entered promiscuous mode
[   55.032806][ T5820] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.035290][ T5820] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.037784][ T5820] bridge_slave_1: entered allmulticast mode
[   55.040707][ T5820] bridge_slave_1: entered promiscuous mode
[   55.050647][ T5811] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.053025][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.055369][ T5811] bridge_slave_0: entered allmulticast mode
[   55.058369][ T5811] bridge_slave_0: entered promiscuous mode
[   55.080742][ T5820] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.083866][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.086164][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.088987][ T5811] bridge_slave_1: entered allmulticast mode
[   55.092025][ T5811] bridge_slave_1: entered promiscuous mode
[   55.110822][ T5820] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.113876][ T5816] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.116770][ T5816] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.119339][ T5816] bridge_slave_0: entered allmulticast mode
[   55.123176][ T5816] bridge_slave_0: entered promiscuous mode
[   55.144888][ T5816] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.148738][ T5816] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.151452][ T5816] bridge_slave_1: entered allmulticast mode
[   55.155234][ T5816] bridge_slave_1: entered promiscuous mode
[   55.159900][ T5811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.185620][ T5811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.190785][ T5820] team0: Port device team_slave_0 added
[   55.194203][ T5816] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.208322][ T5820] team0: Port device team_slave_1 added
[   55.219807][ T5816] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.232207][ T5811] team0: Port device team_slave_0 added
[   55.250620][ T5811] team0: Port device team_slave_1 added
[   55.253338][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.255653][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.265010][ T5820] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.270103][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.272376][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.281292][ T5820] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.298722][ T5816] team0: Port device team_slave_0 added
[   55.316041][ T5816] team0: Port device team_slave_1 added
[   55.344555][ T5816] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.347298][ T5816] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.355742][ T5816] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.361888][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.364731][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.374465][ T5811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.379820][ T5816] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.382150][ T5816] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.391665][ T5816] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.395822][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.398320][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.406737][ T5811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.435501][ T5820] hsr_slave_0: entered promiscuous mode
[   55.438640][ T5820] hsr_slave_1: entered promiscuous mode
[   55.484743][ T5811] hsr_slave_0: entered promiscuous mode
[   55.487942][ T5811] hsr_slave_1: entered promiscuous mode
[   55.490178][ T5811] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   55.493103][ T5811] Cannot create hsr debugfs directory
[   55.498476][ T5816] hsr_slave_0: entered promiscuous mode
[   55.500946][ T5816] hsr_slave_1: entered promiscuous mode
[   55.503122][ T5816] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   55.505674][ T5816] Cannot create hsr debugfs directory
[   55.734757][ T5820] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   55.743917][ T5820] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   55.755843][ T5820] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   55.764690][ T5820] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   55.798494][ T5816] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   55.803554][ T5816] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   55.817427][ T5816] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   55.827816][ T5816] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   55.834202][ T5820] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.837416][ T5820] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.840863][ T5820] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.843195][ T5820] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.859632][  T718] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.863498][  T718] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.891257][ T5811] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   55.898322][ T5811] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   55.906188][ T5811] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   55.913116][ T5811] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   55.974439][ T5820] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.993088][ T5820] 8021q: adding VLAN 0 to HW filter on device team0
[   56.003528][  T718] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.005892][  T718] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.022934][  T718] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.025333][  T718] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.046885][ T5816] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.075794][ T5816] 8021q: adding VLAN 0 to HW filter on device team0
[   56.089458][  T718] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.092269][  T718] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.107435][  T156] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.109844][  T156] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.120807][ T5811] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.147218][ T5811] 8021q: adding VLAN 0 to HW filter on device team0
[   56.158723][   T35] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.161354][   T35] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.165345][   T35] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.167771][   T35] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.214230][ T5811] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   56.221388][ T5811] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   56.270231][ T5820] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.309096][ T5811] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.345942][ T5820] veth0_vlan: entered promiscuous mode
[   56.353867][ T5816] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.369638][ T5820] veth1_vlan: entered promiscuous mode
[   56.385158][ T5811] veth0_vlan: entered promiscuous mode
[   56.405776][ T5811] veth1_vlan: entered promiscuous mode
[   56.423687][ T5820] veth0_macvtap: entered promiscuous mode
[   56.428786][ T5816] veth0_vlan: entered promiscuous mode
[   56.434300][ T5816] veth1_vlan: entered promiscuous mode
[   56.442232][ T5820] veth1_macvtap: entered promiscuous mode
[   56.464106][ T5811] veth0_macvtap: entered promiscuous mode
[   56.470436][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.481338][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.484866][ T5811] veth1_macvtap: entered promiscuous mode
[   56.497685][ T5820] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.501302][ T5820] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.504615][ T5820] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.508626][ T5820] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.521638][ T5816] veth0_macvtap: entered promiscuous mode
[   56.535516][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.542528][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.552627][ T5816] veth1_macvtap: entered promiscuous mode
[   56.561640][ T5811] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.565387][ T5811] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.569727][ T5811] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.573045][ T5811] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.634467][ T5816] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.638077][ T5823] Bluetooth: hci2: command tx timeout
[   56.646862][ T5823] Bluetooth: hci0: command tx timeout
[   56.658897][ T5816] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.672854][ T5816] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.675796][ T5816] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.681285][ T5816] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.684051][ T5816] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.710172][ T1088] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.712981][ T1088] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.717081][ T5823] Bluetooth: hci1: command tx timeout
[   56.733940][ T1088] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.738284][ T1088] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.779577][  T718] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.780994][   T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.782613][  T718] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.785456][   T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.810395][   T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.813201][   T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.855161][   T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.858517][   T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.879566][ T5820] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   56.963594][ T5885] openvswitch: netlink: Either Ethernet header or EtherType is required.
[   57.352324][ T5919] netlink: 44 bytes leftover after parsing attributes in process `syz.2.16'.
[   57.355327][ T5919] netlink: 43 bytes leftover after parsing attributes in process `syz.2.16'.
[   57.373924][ T5919] netlink: 'syz.2.16': attribute type 5 has an invalid length.
[   57.380860][ T5919] netlink: 43 bytes leftover after parsing attributes in process `syz.2.16'.
[   57.722068][ T5950] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   57.738742][ T5950] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.738995][ T5951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.31'.
[   57.746174][ T5950] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.750303][ T5951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.31'.
[   57.848768][ T5958] netlink: 'syz.2.34': attribute type 1 has an invalid length.
[   57.957037][ T5950] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   57.965277][ T5950] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   58.009277][ T5950] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   58.014815][ T5950] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   58.020336][ T5950] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   58.025942][ T5950] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   58.256048][ T5968] veth3: entered promiscuous mode
[   58.258222][ T5984] sctp: [Deprecated]: syz.1.41 (pid 5984) Use of int in max_burst socket option.
[   58.258222][ T5984] Use struct sctp_assoc_value instead
[   58.366199][ T5990] netlink: 40 bytes leftover after parsing attributes in process `syz.0.45'.
[   58.369598][ T5990] netlink: 260 bytes leftover after parsing attributes in process `syz.0.45'.
[   58.380809][ T5986] 8021q: adding VLAN 0 to HW filter on device ipvlan2
[   58.384006][ T5986] team0: Device ipvlan2 is already an upper device of the team interface
[   58.452838][ T5994] netlink: 'syz.0.46': attribute type 6 has an invalid length.
[   58.601197][ T6008] netlink: 8 bytes leftover after parsing attributes in process `syz.1.53'.
[   58.604229][ T6008] netlink: 8 bytes leftover after parsing attributes in process `syz.1.53'.
[   58.637237][ T6011] netlink: 'syz.2.54': attribute type 1 has an invalid length.
[   58.719400][ T5823] Bluetooth: hci2: command tx timeout
[   58.797820][ T5823] Bluetooth: hci1: command tx timeout
[   59.016446][ T6038] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   59.344661][ T6059] syz.0.73 uses obsolete (PF_INET,SOCK_PACKET)
[   59.485211][ T6061] vlan2: entered promiscuous mode
[   59.488093][ T6061] veth0_to_hsr: entered promiscuous mode
[   59.989268][ T6079] netlink: 12 bytes leftover after parsing attributes in process `syz.2.82'.
[   59.992757][ T6079] netlink: 'syz.2.82': attribute type 1 has an invalid length.
[   60.055556][ T6079] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0
[   60.302401][ T6099] netlink: 'syz.1.91': attribute type 39 has an invalid length.
[   60.797235][ T5823] Bluetooth: hci2: command tx timeout
[   60.876587][ T5823] Bluetooth: hci1: command tx timeout
[   61.274557][ T6182] Zero length message leads to an empty skb
[   62.205078][ T6232] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies.
[   62.250848][ T6234] netlink: 'syz.1.154': attribute type 2 has an invalid length.
[   62.362736][ T6249] netlink: 'syz.2.161': attribute type 1 has an invalid length.
[   62.365001][ T6250] __nla_validate_parse: 12 callbacks suppressed
[   62.365089][ T6250] netlink: 12 bytes leftover after parsing attributes in process `syz.1.160'.
[   62.365251][ T6249] netlink: 224 bytes leftover after parsing attributes in process `syz.2.161'.
[   62.445301][ T6254] netlink: 248 bytes leftover after parsing attributes in process `syz.1.163'.
[   62.619576][ T6272] syzkaller1: entered promiscuous mode
[   62.621714][ T6272] syzkaller1: entered allmulticast mode
[   62.715513][ T6280] netlink: 4 bytes leftover after parsing attributes in process `syz.2.172'.
[   62.722606][ T6280] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode
[   62.725658][ T6280] macsec1: entered allmulticast mode
[   62.729715][ T6280] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode
[   62.734330][ T6280] mac80211_hwsim hwsim2 wlan0: left allmulticast mode
[   62.737535][ T6280] mac80211_hwsim hwsim2 wlan0: left promiscuous mode
[   62.876591][ T5823] Bluetooth: hci2: command tx timeout
[   62.956483][ T5823] Bluetooth: hci1: command tx timeout
[   63.073028][ T6313] netlink: 20 bytes leftover after parsing attributes in process `syz.2.185'.
[   63.228738][ T6331] netlink: 'syz.0.194': attribute type 32 has an invalid length.
[   63.526126][ T6365] bridge: RTM_NEWNEIGH with invalid state 0x31
[   63.716944][ T6380] netlink: 'syz.2.216': attribute type 16 has an invalid length.
[   63.719524][ T6380] netlink: 'syz.2.216': attribute type 17 has an invalid length.
[   63.784603][ T6380] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.787628][ T6380] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.824826][ T6388] IPv6: NLM_F_REPLACE set, but no existing node found!
[   63.895533][ T6380] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   63.907125][ T6380] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   63.972701][ T6380] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   63.975570][ T6380] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   63.978773][ T6380] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   63.981597][ T6380] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   63.999013][ T6391] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate.
[   64.912348][ T6471] can: request_module (can-proto-0) failed.
[   64.917107][ T6471] Bluetooth: MGMT ver 1.23
[   66.287773][ T6537] block nbd0: server does not support multiple connections per device.
[   66.291802][ T6537] block nbd0: shutting down sockets
[   66.392249][ T6542] xt_l2tp: wrong L2TP version: 0
[   66.511082][ T6551] netlink: 4 bytes leftover after parsing attributes in process `syz.0.291'.
[   66.525179][ T6551] team_slave_0: entered promiscuous mode
[   66.527299][ T6551] team_slave_1: entered promiscuous mode
[   66.551790][ T6551] team_slave_0: left promiscuous mode
[   66.553768][ T6551] team_slave_1: left promiscuous mode
[   66.656874][ T6559] netlink: 60 bytes leftover after parsing attributes in process `syz.1.294'.
[   66.664402][ T6556] netlink: 60 bytes leftover after parsing attributes in process `syz.1.294'.
[   66.684609][ T5847] IPVS: starting estimator thread 0...
[   66.776621][ T6564] IPVS: using max 81 ests per chain, 194400 per kthread
[   66.856009][ T6579] netlink: 'syz.1.298': attribute type 13 has an invalid length.
[   66.867346][ T6579] netlink: 'syz.1.298': attribute type 17 has an invalid length.
[   67.129987][ T6598] netlink: 40 bytes leftover after parsing attributes in process `syz.2.313'.
[   67.283612][ T6607] netlink: 8 bytes leftover after parsing attributes in process `syz.0.315'.
[   67.309449][ T6608] tipc: Started in network mode
[   67.311157][ T6608] tipc: Node identity 02defc108dce, cluster identity 4711
[   67.313906][ T6608] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   67.319713][ T6608] syzkaller0: entered promiscuous mode
[   67.321880][ T6608] syzkaller0: entered allmulticast mode
[   67.333387][ T6608] tipc: Resetting bearer <eth:syzkaller0>
[   67.349789][ T6606] tipc: Resetting bearer <eth:syzkaller0>
[   67.359135][ T6606] tipc: Disabling bearer <eth:syzkaller0>
[   67.369368][ T6612] bridge1: entered allmulticast mode
[   67.630365][   T13] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[   67.643257][ T6637] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[   67.745685][ T6647] __nla_validate_parse: 1 callbacks suppressed
[   67.745697][ T6647] netlink: 16 bytes leftover after parsing attributes in process `syz.2.333'.
[   68.589541][ T6669] netlink: 4 bytes leftover after parsing attributes in process `syz.1.343'.
[   68.856001][ T6683] warning: `syz.2.350' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   68.990996][ T6693] netlink: 8 bytes leftover after parsing attributes in process `syz.2.354'.
[   68.995160][ T6693] netlink: 8 bytes leftover after parsing attributes in process `syz.2.354'.
[   69.345748][ T6719] netlink: 10 bytes leftover after parsing attributes in process `syz.1.365'.
[   69.696124][ T6738] netlink: 'syz.0.375': attribute type 3 has an invalid length.
[   69.969571][ T6749] gretap1: entered allmulticast mode
[   70.170404][ T6765] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0)
[   70.176013][ T6763] netlink: 'syz.0.387': attribute type 4 has an invalid length.
[   70.222017][ T6767] tipc: Started in network mode
[   70.224194][ T6767] tipc: Node identity 080211, cluster identity 4711
[   70.227636][ T6767] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   70.462892][ T6781] netlink: 'syz.0.396': attribute type 39 has an invalid length.
[   70.495327][ T6787] netlink: 'syz.2.399': attribute type 4 has an invalid length.
[   70.749788][ T6807] netdevsim netdevsim0 netdevsim0: entered allmulticast mode
[   70.881148][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   70.883822][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   70.945941][ T6826] netlink: 8 bytes leftover after parsing attributes in process `syz.1.415'.
[   70.966378][ T6826] netlink: 4 bytes leftover after parsing attributes in process `syz.1.415'.
[   71.158565][ T6842] netlink: 'syz.0.423': attribute type 4 has an invalid length.
[   71.320602][ T6855] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI
[   71.325464][ T6855] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
[   71.329946][ T6855] CPU: 0 UID: 0 PID: 6855 Comm: syz.0.429 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[   71.334741][ T6855] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   71.338988][ T6855] RIP: 0010:__list_del_entry_valid_or_report+0x25/0x190
[   71.341854][ T6855] Code: 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 89 fb 49 bd 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 9f 2d 5c fd 4c 8b 7b 08 48 89 d8 48 c1 e8
[   71.349836][ T6855] RSP: 0018:ffffc9000378ef80 EFLAGS: 00010202
[   71.352358][ T6855] RAX: 000000000000000b RBX: 0000000000000050 RCX: 0000000000080000
[   71.355570][ T6855] RDX: ffffc90020c1b000 RSI: 0000000000000b55 RDI: 0000000000000058
[   71.358736][ T6855] RBP: dffffc0000000000 R08: ffff8881084e9cc0 R09: 0000000000000002
[   71.362041][ T6855] R10: 00000000ffffffff R11: ffffffff897eac80 R12: 0000000000000000
[   71.365306][ T6855] R13: dffffc0000000000 R14: 0000000000000050 R15: ffff888104d5e000
[   71.368528][ T6855] FS:  00007fd4d166e6c0(0000) GS:ffff8880b8650000(0000) knlGS:0000000000000000
[   71.372214][ T6855] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   71.374846][ T6855] CR2: 0000200000000240 CR3: 0000000104cf6000 CR4: 00000000000006f0
[   71.378299][ T6855] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   71.381663][ T6855] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   71.385024][ T6855] Call Trace:
[   71.386404][ T6855]  <TASK>
[   71.387606][ T6855]  drr_qlen_notify+0x2c/0xf0
[   71.389503][ T6855]  qdisc_tree_reduce_backlog+0x29c/0x480
[   71.391736][ T6855]  ? qdisc_tree_reduce_backlog+0x3c/0x480
[   71.394137][ T6855]  fq_change+0x1519/0x1f50
[   71.396049][ T6855]  ? __pfx_fq_change+0x10/0x10
[   71.398070][ T6855]  ? __hrtimer_setup+0x187/0x210
[   71.400162][ T6855]  fq_init+0x699/0x960
[   71.401847][ T6855]  ? __pfx_fq_init+0x10/0x10
[   71.403714][ T6855]  ? lockdep_rtnl_is_held+0x26/0x40
[   71.405794][ T6855]  ? qdisc_lookup+0x36d/0x6d0
[   71.407719][ T6855]  ? __pfx_fq_init+0x10/0x10
[   71.409728][ T6855]  qdisc_create+0x7ac/0xea0
[   71.411696][ T6855]  tc_modify_qdisc+0x1426/0x2010
[   71.413766][ T6855]  ? __pfx_tc_modify_qdisc+0x10/0x10
[   71.415993][ T6855]  ? __pfx_tc_modify_qdisc+0x10/0x10
[   71.418094][ T6855]  rtnetlink_rcv_msg+0x77c/0xb70
[   71.420104][ T6855]  ? rtnetlink_rcv_msg+0x1ab/0xb70
[   71.422213][ T6855]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   71.424431][ T6855]  ? ref_tracker_free+0x63a/0x7d0
[   71.426585][ T6855]  ? __copy_skb_header+0xa7/0x550
[   71.428727][ T6855]  ? __pfx_ref_tracker_free+0x10/0x10
[   71.430894][ T6855]  ? __skb_clone+0x63/0x7a0
[   71.432753][ T6855]  netlink_rcv_skb+0x208/0x470
[   71.434738][ T6855]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   71.437077][ T6855]  ? __pfx_netlink_rcv_skb+0x10/0x10
[   71.439239][ T6855]  ? netlink_deliver_tap+0x2e/0x1b0
[   71.441360][ T6855]  ? netlink_deliver_tap+0x2e/0x1b0
[   71.443592][ T6855]  netlink_unicast+0x75b/0x8d0
[   71.445510][ T6855]  netlink_sendmsg+0x805/0xb30
[   71.447223][ T6855]  ? __pfx_netlink_sendmsg+0x10/0x10
[   71.449263][ T6855]  ? aa_sock_msg_perm+0x94/0x160
[   71.451386][ T6855]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   71.453626][ T6855]  ? __pfx_netlink_sendmsg+0x10/0x10
[   71.455853][ T6855]  __sock_sendmsg+0x21c/0x270
[   71.457790][ T6855]  ____sys_sendmsg+0x505/0x830
[   71.459752][ T6855]  ? __pfx_____sys_sendmsg+0x10/0x10
[   71.461986][ T6855]  ? import_iovec+0x74/0xa0
[   71.463841][ T6855]  ___sys_sendmsg+0x21f/0x2a0
[   71.465844][ T6855]  ? __pfx____sys_sendmsg+0x10/0x10
[   71.468085][ T6855]  ? __fget_files+0x2a/0x420
[   71.470033][ T6855]  ? __fget_files+0x3a0/0x420
[   71.471856][ T6855]  __x64_sys_sendmsg+0x19b/0x260
[   71.473874][ T6855]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   71.476213][ T6855]  ? do_syscall_64+0xbe/0x3b0
[   71.478223][ T6855]  do_syscall_64+0xfa/0x3b0
[   71.480155][ T6855]  ? lockdep_hardirqs_on+0x9c/0x150
[   71.482368][ T6855]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   71.484444][ T6855]  ? exc_page_fault+0x9f/0xf0
[   71.486214][ T6855]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   71.488680][ T6855] RIP: 0033:0x7fd4d078e929
[   71.490592][ T6855] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   71.498444][ T6855] RSP: 002b:00007fd4d166e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   71.501495][ T6855] RAX: ffffffffffffffda RBX: 00007fd4d09b5fa0 RCX: 00007fd4d078e929
[   71.504582][ T6855] RDX: 0000000000004000 RSI: 0000200000000280 RDI: 0000000000000003
[   71.507465][ T6855] RBP: 00007fd4d0810b39 R08: 0000000000000000 R09: 0000000000000000
[   71.510152][ T6855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   71.513015][ T6855] R13: 0000000000000000 R14: 00007fd4d09b5fa0 R15: 00007fffec1c0ad8
[   71.515782][ T6855]  </TASK>
[   71.516864][ T6855] Modules linked in:
[   71.518321][ T6855] ---[ end trace 0000000000000000 ]---
[   71.520146][ T6855] RIP: 0010:__list_del_entry_valid_or_report+0x25/0x190
[   71.523009][ T6855] Code: 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 89 fb 49 bd 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 9f 2d 5c fd 4c 8b 7b 08 48 89 d8 48 c1 e8
[   71.530548][ T6855] RSP: 0018:ffffc9000378ef80 EFLAGS: 00010202
[   71.533062][ T6855] RAX: 000000000000000b RBX: 0000000000000050 RCX: 0000000000080000
[   71.536517][ T6855] RDX: ffffc90020c1b000 RSI: 0000000000000b55 RDI: 0000000000000058
[   71.539752][ T6855] RBP: dffffc0000000000 R08: ffff8881084e9cc0 R09: 0000000000000002
[   71.543099][ T6855] R10: 00000000ffffffff R11: ffffffff897eac80 R12: 0000000000000000
[   71.546317][ T6855] R13: dffffc0000000000 R14: 0000000000000050 R15: ffff888104d5e000
[   71.549494][ T6855] FS:  00007fd4d166e6c0(0000) GS:ffff8880b8650000(0000) knlGS:0000000000000000
[   71.552988][ T6855] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   71.555612][ T6855] CR2: 0000200000000240 CR3: 0000000104cf6000 CR4: 00000000000006f0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   71.559064][ T6855] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   71.562508][ T6855] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   71.565719][ T6855] Kernel panic - not syncing: Fatal exception in interrupt
[   71.569692][ T6855] Kernel Offset: disabled
[   71.571539][ T6855] Rebooting in 86400 seconds..

VM DIAGNOSIS:
00:27:23  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000030 RBX=0000000000000030 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000001806 RDI=0000000000001807 RBP=00000000000003f8 RSP=ffffc9000378e7b0
R8 =ffff888020240237 R9 =1ffff11004048046 R10=dffffc0000000000 R11=ffffffff85474610
R12=dffffc0000000000 R13=ffffffff99ac48fc R14=ffffffff99dc9760 R15=0000000000000000
RIP=ffffffff8547468c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fd4d166e6c0 ffffffff 00c00000
GS =0000 ffff8880b8650000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000240 CR3=0000000104cf6000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fd4d0984478 00007fd4d0984450 XMM03=00007fd4d0984488 00007fd4d0984480
XMM04=00007fd4d14ed100 00007fd4d0984440 XMM05=00007fd4d0984458 00007fd4d09844a0
XMM06=00007fd4d0984498 00007fd4d0984490 XMM07=00007fd4d0984488 00007fd4d0984480
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 00007fd4d0811c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000000 RBX=ffff88813663b1c0 RCX=ffff88810d4c3980 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc900034076c0 RSP=ffffc90003407560
R8 =ffffffff8fa10cf7 R9 =1ffffffff1f4219e R10=dffffc0000000000 R11=fffffbfff1f4219f
R12=1ffff11009608385 R13=dffffc0000000000 R14=0000000000000000 R15=ffff88804b041c28
RIP=ffffffff81b4d90e RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00005555940fe500 ffffffff 00c00000
GS =0000 ffff8881a3c50000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2f408ff8 CR3=0000000113ae6000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007ff111611c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
