last executing test programs:

2.051539864s ago: executing program 1 (id=381):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x17\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd}]}, 0x24}}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x1)
setsockopt$inet_int(r1, 0x0, 0x13, &(0x7f0000000040)=0x7, 0x4)
sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000200)="08001efbb0", 0x5}, {&(0x7f0000000180)="d0849e", 0x3}], 0x2, 0x0, 0x0, 0x60000000}, 0x20000004)
r2 = socket$packet(0x11, 0x3, 0x300)
r3 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'xfrm0\x00', <r4=>0x0})
setsockopt$packet_int(r3, 0x107, 0x8, &(0x7f0000000000)=0xf3e, 0x4)
sendto$packet(r3, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc9", 0x26, 0x0, &(0x7f0000000540)={0xc9, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$SEG6_CMD_SETHMAC(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r7, 0x1, 0x0, 0x0, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x7fff}]}, 0x1c}}, 0x0)
r8 = socket$inet_udplite(0x2, 0x2, 0x88)
setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000b00)=@filter={'filter\x00', 0x42, 0x4, 0x348, 0xffffffff, 0xd0, 0x1b8, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0xd0, 0x0, {0x100000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, [0x0, 0xffffff00, 0x0, 0xffffffff], 0x4e22, 0x4e20, 0x4e21, 0x4e23, 0x25, 0x81, 0xb, 0xfffffffa, 0x7f}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@inet=@socket3={{0x28, 'socket\x00', 0x2}}, @common=@unspec=@addrtype1={{0x28}}]}, @REJECT={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'wlan1\x00', 'pim6reg1\x00', {}, {}, 0x67}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@statistic={{0x38}, {0x0, 0x2000}}, @common=@ttl={{0x28}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8)
ioctl$sock_SIOCOUTQNSD(r6, 0x894b, &(0x7f0000000200))
r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r6)
sendmsg$TIPC_CMD_GET_NETID(r5, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r9, 0x4, 0x70bd28, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x10)
r10 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
writev(r10, &(0x7f0000000200)=[{&(0x7f0000000400)="fb", 0xffffff5c}, {&(0x7f00000197c0)="1902eb02d5e5f29e59e1a7caec33eb76d2430da474d87e367f6598d026438b65eda8341073b6752abdcee080c8e1e876b25227c37d7dd79886ce33f13e857c8eda1cecf6ac36c03dbf54e3cb5136da5a33fee76fb3113f8b6700e9e5fc006b8eed665fed48738d59395ad07438c3610ae3976aac75caf2facafa21c25be3c2", 0x7f}, {&(0x7f0000000280)="c6e5bf4e5ba26d3e5c9bb5360f92e67a44ba6b62e2274d6487af77d783d4c6693cee943690f5864e779d1beb21efed6e6d476f87"}, {&(0x7f0000000040)="dcbe422f5d028b81e662578f53c6471fd1c854f19dfa4247ae100a162723a5a403ccb3dd5913918efd77b8c43fbc4981d9bafc3b48e16322a5389908ee89a3c08fa633f1ae892c748b831b5b007a53f960f174194ce4812b382d45c202230aa6be00be2fbb427a3a"}, {&(0x7f00000000c0)="d1bc1a7600e5a60a93d380d591a3ee81db3154323e5c991f724a3fb2ef7fce391b98a4c3dee9b879f3c7f9c8ea68e307bd072d45d3b6d21ac4b6a820d8b9d3f6ab9c2a99257afdff89172e4c0118cd53e3620717e20c3f3a2f7d36a39493b166bcb349e584a2d14678b014398a181abcd2e3aef487a0667aabc0f4927dc0f23f897606e702a0ee605e8a0c3336b2936f03dbef8244cd3f87de18e4374edf5610cd7e53baa579063b65fdcc608037b6459e05632743841ec2ba0f81aaa631d64e2a33955d814e"}, {&(0x7f00000001c0)="93890dce91f8091f06ba66f5ad81571882d65b82d7ab4616336da4ecaf1965633209d1f7a7d363f8dadd4d6a3926d74bfec60d9d08bf196fe146"}], 0x1)
sendmsg$SEG6_CMD_GET_TUNSRC(r5, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x64, r7, 0x400, 0x70bd29, 0x25dfdbff, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xa}, @SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_DST={0x14, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x2}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x5}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x2}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x4]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4040}, 0x1)
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x4, &(0x7f0000000180)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x4a}]}, &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

1.172391603s ago: executing program 1 (id=384):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x4, &(0x7f0000000300)=@raw=[@ldst={0x3, 0x0, 0x5, 0x3, 0x5, 0x4, 0xfffffffffffffffc}, @generic={0x81, 0xd, 0x3, 0x101, 0x20000}, @call={0x85, 0x0, 0x0, 0x1}, @exit], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='contention_end\x00', r1}, 0x10) (async)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='contention_end\x00', r1}, 0x10)
r2 = socket$kcm(0x23, 0x5, 0x0)
sendmsg$kcm(r2, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0)
close(r2)
openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x40201, 0x0) (async)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x40201, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000380)={'syzkaller1\x00', 0xc201})
r4 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
r5 = socket$igmp6(0xa, 0x3, 0x2)
r6 = socket$packet(0x11, 0xa, 0x300)
pipe(&(0x7f00000000c0)) (async)
pipe(&(0x7f00000000c0))
r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYRESHEX=r6], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2608064c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) (async)
setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488)
write$tun(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="001c86dd2000280000004000000060ec97000fc83c00fe8000000000000000000000000000aaff020000"], 0xffe) (async)
write$tun(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="001c86dd2000280000004000000060ec97000fc83c00fe8000000000000000000000000000aaff020000"], 0xffe)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000a0db000000000000000000850000000e000000d50000002a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) (async)
r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000a0db000000000000000000850000000e000000d50000002a00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000000c0)='netlink_extack\x00', r8}, 0x11)
r9 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000006800011003001000fdffab97ff7b0000000000000000"], 0x18}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) (async)
sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000006800011003001000fdffab97ff7b0000000000000000"], 0x18}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x25}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="6000000011140100000000000000000008004a000200000008004b002800000008003e000400000000000300020000000800010002000000b9fd01000000000008003e000000000008004a000200000008004b000000000008003e000400000094cd113d51daf2d0205bb4fc2494"], 0x60}}, 0x40)
socket$nl_route(0x10, 0x3, 0x0) (async)
r10 = socket$nl_route(0x10, 0x3, 0x0)
getsockopt$netlink(r10, 0x10e, 0x6, 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_SYS_GET(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2202}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000000614260328bd7000fbdbe025080001000100000008000001000200000008000100000000000800010000000000"], 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x8000)

1.021999014s ago: executing program 1 (id=385):
r0 = socket$kcm(0x10, 0x2, 0x0) (async)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={<r1=>0xffffffffffffffff}) (async)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0)
setsockopt$sock_attach_bpf(r1, 0x1, 0x2a, &(0x7f0000000100)=r2, 0x4)
recvmsg$unix(r1, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002) (async)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000280), r3)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) (async)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000340)={'wlan0\x00', <r9=>0x0})
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000001240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000020000003900000008000300", @ANYRES32=r9, @ANYBLOB="24005a8020000480140005"], 0x40}, 0x1, 0x0, 0x0, 0x4040854}, 0x0)
sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x98, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0xffffffffffffff59, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}, @CTA_SEQ_ADJ_REPLY={0x14, 0x4, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8}]}]}, 0x98}}, 0x0) (async)
sendmsg$IEEE802154_LLSEC_DEL_DEV(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c00400018fdfd70f0d500ceb5a297678d42d73a2a33c98dd94da394bb9cbc8997623909bebf7f538b32323b7e2a9a980e484707f9503bc639fa8a819ccd39dd6a692f142e6089c520f7", @ANYRES16=r4, @ANYBLOB="010026bd7000fbdbdf252b00b624e8df3fd300000c00050000000000000000000a0001007770"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000050) (async)
sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000340)="5c00000013006bcd9e3fe3dc4e48aa31086b8703140000001f03000000000000040014000d000a000d0000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x8000)

1.021366461s ago: executing program 1 (id=386):
socket(0x10, 0x3, 0x0)
r0 = socket$kcm(0x10, 0x400000002, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1b0000001a007f029e", 0x9}, {&(0x7f0000000200)="68cabf2dfb58fc0a01008888ffff0200258f", 0x12}], 0x2}, 0x0)
close(0x3)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r3 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r2, &(0x7f0000000440)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x452c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffffdd86}}}}}}}, 0xfdef)

880.885232ms ago: executing program 1 (id=390):
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d4, &(0x7f0000000400)) (async)
setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000000)=0xc, 0x2) (async)
r1 = socket(0x2a, 0x6, 0x1ff)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_REG(r1, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="1291131ddec7d46b8ad42b84d4f5ca88c4b89ae6e400c63fe50df072e903eb7b57e9a4216a617eaa6507c1736bc036858c24f93bedb8cf89171aae7ecaff037bbd8c54579c38f37c912b", @ANYRES16=r2, @ANYBLOB="000029bd7000fcdbdf251a0000000800010025000000a00122800c000080080006000700000044000080080003000800000008000400d205000008000600018000000800070000000000080004000600000008000600010000000800060004000000080007000400000054000080080003000700000008000500000030000800070001000000080005000900000008000300180e00000800020004000000080005000500000008000600060000000800060002000000080006000900000044000080080007000900000008000700000000800800040000000080080004000000000008000500e900000008000700090000000800050080000000080007000300000014000080080003000600000008000300ff7f00004c000080080003000900000008000500010000000800050089000000080003000000000008000300940900000800030003000000080007002319000008000200ff7f000008000700b358000054000080080004000a000000080003000a0000000800030002000000080001000600000008000200979100000800020005000000080003000800000008000400ff07000008000600030000000800040001040000e000228054000080080003000200000008000600bad600000800060004000000080006000000000008000700fc000000080004009b0a000008000100b722418f080007000900000008000500ffff0000080006000e0000005400008008000300090000000800030001800000080007000700000008000300ff000000080005000800000008000200980e0000080006000700000008000300ff010000080004000100000008000400effcffff3400008008000400000000000800020008000000080003000d000000080004000200000008000400c100000008000200050000000800010048000000"], 0x2a4}, 0x1, 0x0, 0x0, 0x2000c004}, 0x20000800)

822.101227ms ago: executing program 1 (id=391):
r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r0, &(0x7f0000000300)={{0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48)
sendfile(r0, r0, &(0x7f0000000140)=0x3, 0x7)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
shutdown(r1, 0x1)
pselect6(0x2000, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000100)={0x8}, 0x0, 0x0)
r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
bind$netrom(r2, &(0x7f0000000000)={{0x6, @rose, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48)
listen(r2, 0x80)
accept4$netrom(r2, &(0x7f0000000080)={{}, [@netrom, @remote, @rose, @remote, @netrom, @default, @netrom]}, 0x0, 0x0)

398.05547ms ago: executing program 2 (id=396):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="d4010000400000001800000000000000000000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0xa5}, 0x90) (async)
r1 = socket(0x15, 0xd8f20da24dc7320f, 0x0) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket(0x10, 0x3, 0x0) (async)
r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async)
write(r4, &(0x7f0000000340)="07000000010000", 0x7)
setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) (async)
sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=@ipv6_getroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0x2}, [@RTA_PREF={0x5, 0x14, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x88c1}, 0x0) (async)
r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
r6 = socket$kcm(0x29, 0x7, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000240)={r2, r0}) (async, rerun: 32)
r7 = socket(0x2, 0x3, 0x100000001) (rerun: 32)
setsockopt(r7, 0xff, 0x1, 0x0, 0x0)
sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac14140f00000000000000001400020002000000ffffffff00000000000000000d0001007564703a73797a3200000000"], 0x54}}, 0x0) (async)
sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="00000244651ee8ba1f214a856efdcb3062b5ee5b5728defe426a8688605a636bcdbfa3cc4d5cb87a023fbae0ecb102b4634d761855e2ea29ca372c7983522b42b831ac226ef102128b4ce43e6a724ef5a65c6cfebab6fcde7f2fa3970cc37f46fc7f5e2b3fb774df044d0608f0576c467c7c4cdf598641bfd09c5fde12c95ea191c0e469e7c936c71676d94f166dc99f3e7695b68f7a1ed80763d0fa243ae1f8ec751f7f4229af6cfb2da6db2f2b8c776aaff694dff41d54559ad07c4877256b5f032f607c4f77d6dfc5d43e4a62a90a9213918838f0dae3f3db56a8d88f", @ANYRES16=r5, @ANYBLOB="02002dbd7000ffdbdf25050000001c0007800c00040003000000000000000c00040001000000000000003800078008000200080000000c00040006000000000000000c00030008000000000000000c000300000000080400000008000200040000004c0007800c000400400000000000000008000100ffff00000c000400080000000000000008000200010400000c00040000020000000000000c0004000900000000000000080001000008000034000980080002000d00000008000200050000000800020013000000080001000200000008000100060000000800020003000000"], 0xe8}, 0x1, 0x0, 0x0, 0x4}, 0x44091) (async)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x6, [@typedef={0x4, 0x0, 0x0, 0x7}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x2}}]}, {0x0, [0x0, 0x0, 0x0, 0xda]}}, 0x0, 0x52, 0x0, 0x1}, 0x28) (async, rerun: 32)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x9, 0x3, 0x270, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x3, &(0x7f0000000300), {[{{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x13, 0xa65, 0x6, 0xb, '\x00', 'syz1\x00', {0x4}}}}, {{@uncond, 0x0, 0x98, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x5}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x2, 0x6, 0x4, 0x5, 'snmp_trap\x00', 'syz1\x00', {0xffffffffffffffff}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d0) (rerun: 32)

397.950052ms ago: executing program 2 (id=397):
socket(0x10, 0x3, 0x0)
r0 = socket$kcm(0x10, 0x400000002, 0x0)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1b0000001a007f029e", 0x9}, {&(0x7f0000000200)="68cabf2dfb58fc0a01008888ffff0200258f", 0x12}], 0x2}, 0x0)
close(0x3)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r3 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r2, &(0x7f0000000440)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x452c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffffdd86}}}}}}}, 0xfdef)

308.661264ms ago: executing program 0 (id=399):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0xa4, 0x2, 0x7, 0x301, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0xe}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x5}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_FILTER={0x2c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x9}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x9}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x80}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x1}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x7}]}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x9}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0xff}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0xa4}}, 0x4080) (async)
ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000180)=0x80000001)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000240)={0x14c, r1, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x4}, @TIPC_NLA_BEARER={0x24, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800080}]}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x200}]}, @TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1ff}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffeff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x401}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfffffffc}]}, @TIPC_NLA_BEARER={0x80, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xcb}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'netpci0\x00'}}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x4004}, 0x6) (async)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x7, &(0x7f0000000440)=[{0x6, 0x40, 0x0, 0x1ff}, {0x1, 0x1, 0x6, 0x1}, {0x9, 0x2, 0x93, 0x4}, {0xf800, 0x2, 0x1, 0x9}, {0x2, 0x3, 0x6, 0x5}, {0xf0ce, 0x7, 0x3, 0x9}, {0x34d, 0x9, 0xfe, 0x7ff}]}, 0x10)
socketpair(0x2b, 0x5, 0x1, &(0x7f00000004c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
sendmsg$nl_xfrm(r2, &(0x7f0000000680)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)=@polexpire={0xc8, 0x1b, 0x100, 0x70bd2a, 0x25dfdbfb, {{{@in6=@loopback, @in=@multicast1, 0x4e24, 0x9, 0x4e23, 0x80, 0xa, 0x0, 0x0, 0x21}, {0x9, 0xba, 0x964, 0x5, 0xc, 0x1, 0x4fd2, 0x1}, {0x101, 0x2, 0x6, 0x5}, 0x7, 0x6e6bbf, 0x0, 0x0, 0x3, 0x3}, 0x5}, [@etimer_thresh={0x8, 0xc, 0x9f}]}, 0xc8}, 0x1, 0x0, 0x0, 0x20048840}, 0x400c000)
setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f00000006c0)=@req={0xffffff51, 0x40, 0x5, 0xfffff000}, 0x10) (async)
readv(r2, &(0x7f0000000800)=[{&(0x7f0000000700)=""/252, 0xfc}], 0x1)
ioctl$sock_TIOCINQ(r3, 0x541b, &(0x7f0000000840))
r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000880)={0xffffffffffffffff}, 0x4) (async)
r5 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000900)=@generic={&(0x7f00000008c0)='./file0\x00'}, 0x18)
bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000940)={0xffffffffffffffff, r4, 0x0, r5}, 0x10) (async)
r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000980)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f00000009c0)={'pimreg0\x00', @broadcast})
r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000a00)={0x1b, 0x0, 0x0, 0x18, 0x0, 0xffffffffffffffff, 0x687, '\x00', 0x0, r4, 0x5}, 0x50) (async)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000cc0)={'tunl0\x00', &(0x7f0000000c40)={'tunl0\x00', <r8=>0x0, 0x80, 0x25a6cfee2ca17af4, 0xfff, 0x7, {{0x9, 0x4, 0x1, 0x1b, 0x24, 0x65, 0x0, 0x4, 0x29, 0x0, @private=0xa010100, @remote, {[@generic={0x44, 0xd, "60a65e49d635ec02d5db7e"}]}}}}})
r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000e80)={&(0x7f0000000d00)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x9c, 0x9c, 0x3, [@ptr={0x6, 0x0, 0x0, 0x2, 0x1}, @type_tag={0x10, 0x0, 0x0, 0x12, 0x4}, @union={0x4, 0x6, 0x0, 0x5, 0x0, 0x9, [{0xe, 0x5, 0xdb00}, {0x7, 0x1, 0x3}, {0x8, 0x0, 0x9}, {0xc, 0x2, 0x101}, {0xd, 0x2, 0x9}, {0x5, 0x4, 0x7}]}, @restrict={0x1, 0x0, 0x0, 0xb, 0x3}, @float={0xb, 0x0, 0x0, 0x10, 0xc}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x5, 0x400}}]}, {0x0, [0x30]}}, &(0x7f0000000dc0)=""/153, 0xb7, 0x99, 0x1, 0x5}, 0x28)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000fc0)={0x18, 0x23, &(0x7f0000000a80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r6}}, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}}, @map_idx={0x18, 0x4, 0x5, 0x0, 0xc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000bc0)='syzkaller\x00', 0xfffffea8, 0x2e, &(0x7f0000000c00)=""/46, 0x41100, 0x26, '\x00', r8, 0x0, r9, 0x8, &(0x7f0000000ec0)={0x2, 0x3}, 0x8, 0x10, &(0x7f0000000f00)={0x0, 0x0, 0xd, 0x1}, 0x10, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000f40)=[{0x5, 0x5, 0xf, 0xc}, {0x5, 0x3, 0x5}, {0x3, 0x4, 0xd, 0xa}, {0x5, 0x2, 0x7, 0x4}, {0x4, 0x2, 0x2, 0x9}, {0x2, 0x5, 0x2, 0x8}, {0x3, 0x2, 0x5}], 0x10, 0x6}, 0x94)
r10 = syz_genetlink_get_family_id$mptcp(&(0x7f00000010c0), r3)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000001240)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x10050005}, 0xc, &(0x7f0000001200)={&(0x7f0000001100)={0xec, r10, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x3c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xb1}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x44, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xfffffffc}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x40000}, 0x1) (async)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000001280)={<r11=>0xffffffffffffffff, <r12=>0xffffffffffffffff})
ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000014c0)={'team0\x00', <r13=>0x0})
sendmsg$inet(r11, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001480)=[{&(0x7f00000012c0)="138f10172ab2f44741fe47acb5e9a57a960b3f46c7447354510a33be1df89091da90a1c6d5bfefd61dec7b03de768de56f22879340ef54c94c16ef7daf1185d68f784785b16dcbe1600eff8a2578d617dfc3ed1686813aa0b6cb669f1321091389a7daaf1af16ab85a78a4ced57d57a0cc7db3590bf81f886946e94ea77512059cd00aeea3a5f3555042e31b037463a468040b06b1b0f9cf898fb7601478b567da856c2cd4a08bbe", 0xa8}, {&(0x7f0000001380)="d7970f9e3d9de027c6b703ddfc1d1f6a7572d9da6bf5afdc5ea288dc75233c5cdc713c59642265034098e50a3bd5026bf8ad6c277552a4e5733de52cda0825f2ebdb5b0ca1844dd638d5f089f5991a62d968eb96621f141e", 0x58}, {&(0x7f0000001400)="74e06d9ecfc018a9b215c7c19f031c4a30ba9341b79195db5c32a6717da579e14b61f77448e915a659bd7a2a2b341a6dd0b740fd2ea94fa8aa1f1778319e3b11a3b51c5872dfc1c583e985904f94e80a197d18480c13056b572282fc8891c697df31", 0x62}], 0x3, &(0x7f0000001500)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x3}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x3}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r13, @empty, @loopback}}}], 0x70}, 0x40)
ioctl$VFAT_IOCTL_READDIR_BOTH(r11, 0x82307201, &(0x7f00000015c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000001880)={'syztnl2\x00', &(0x7f0000001800)={'ip6gre0\x00', r13, 0x29, 0x8, 0x7, 0x9, 0x0, @mcast2, @dev={0xfe, 0x80, '\x00', 0x32}, 0x40, 0x8000, 0x6, 0xa}})
ioctl$EXT4_IOC_SETFSUUID(r11, 0x4008662c, &(0x7f00000018c0)={0x10, 0x0, "2fea205fe663cea197476185801c0d2d"}) (async)
r14 = syz_genetlink_get_family_id$tipc(&(0x7f0000001940), r12)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f0000001a00)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x30, r14, 0x203, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x1, 0xa, 0x2, 0x3ff}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4010004}, 0x4044880)

242.467376ms ago: executing program 2 (id=400):
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x38, &(0x7f0000000000)=0x7ffd, 0x4)
bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) (async)
setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) (async)
recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) (async)
sendto$inet6(r0, 0x0, 0x0, 0x20000000, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) (async)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8864}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0)

242.122092ms ago: executing program 0 (id=401):
r0 = socket$l2tp6(0xa, 0x2, 0x73)
bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3f}, 0xd6, 0x2}, 0x20)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000ac0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000380)={'wpan0\x00', <r4=>0x0})
r5 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e40)=@newqdisc={0x40, 0x24, 0x3fe3aa0262d8c583, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xf}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x6}}]}, 0x40}, 0x1, 0x0, 0x0, 0xc083}, 0x2000400c)
sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010029bd7000fcdbdf252100000008000300", @ANYRES32=r4], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x24, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}]}, 0x24}}, 0x4)
r7 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r1)
r8 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000200))
sendmsg$IPCTNL_MSG_EXP_NEW(r8, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x2, 0x9f72f3b2050f89ac, 0x0, 0x0, {0x2, 0x0, 0x6}, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x40040c0)
sendmsg$NLBL_CALIPSO_C_ADD(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r7, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4040054)

242.049408ms ago: executing program 2 (id=402):
bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x12, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000ffffffc0000085000000bb000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000003100000095"], &(0x7f0000000480)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x42, '\x00', 0x0, @cgroup_sock_addr=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcc84}, 0x94)

159.885221ms ago: executing program 2 (id=403):
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fc", 0x39}], 0x1}, 0x0)
r1 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010"], 0x48}}, 0x0)
sendmmsg$alg(r1, &(0x7f00000000c0), 0x492492492492627, 0x0)

159.697379ms ago: executing program 0 (id=404):
socket$kcm(0x29, 0x2, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x5, 0xffffffff}]}}}, @IFLA_MASTER={0x8, 0x3}]}, 0x44}}, 0x0)
r1 = socket(0x1d, 0x80805, 0x40)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x7d, 0x0, &(0x7f0000000080))
r2 = socket$kcm(0x10, 0x400000002, 0x0)
sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000d80)="170000007a006bcd9e3fe3dc6e08170007000054250000", 0x17}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)

100.227069ms ago: executing program 2 (id=405):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a70000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000070000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10)
ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r0}, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1, 0x31, 0xffffffffffffffff, 0x8871b000)
ppoll(0x0, 0x0, 0x0, &(0x7f0000000500)={[0xfe9]}, 0x8)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a70000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000070000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) (async)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async)
ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) (async)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r0}, 0x10) (async)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) (async)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1, 0x31, 0xffffffffffffffff, 0x8871b000) (async)
ppoll(0x0, 0x0, 0x0, &(0x7f0000000500)={[0xfe9]}, 0x8) (async)

99.385956ms ago: executing program 0 (id=406):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="020000000400000008000000bc00000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010000b7080000003000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f00000001c0)='GPL\x00', 0x5, 0xff6, &(0x7f0000001e00)=""/4086, 0x0, 0xa}, 0x94)

94.285978ms ago: executing program 0 (id=407):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000100000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c00038008000140000000000800024000000000180003801400010076657468305f746f5f687372000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c0003801400010076657468305f746f5f68737200000000140001"], 0xfc}}, 0x0)

0s ago: executing program 0 (id=408):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYRESOCT=r0, @ANYRESHEX=r0, @ANYRES16=r0, @ANYRES16=r1], 0x68}, 0x1, 0x0, 0x0, 0x4000841}, 0x82)
r2 = socket$igmp6(0xa, 0x3, 0x2)
r3 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r5 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r4, &(0x7f0000000480)=ANY=[@ANYBLOB="000086dd020303009c000a004000623d885d009c11fffc000000000000000000000000000000ff0200000000000000000000000000014e224e21009c90"], 0xd2)
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x1}, 0x1})
write$tun(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0xfdef)
r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
bind$bt_sco(r6, &(0x7f00000000c0)={0x1f, @none}, 0x8)
socket$unix(0x1, 0x5, 0x0)
setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, 0x0, 0x0)
r7 = socket$packet(0x11, 0x2, 0x300)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xb, 0x4, &(0x7f00000000c0)=@framed={{0xffffffb4, 0x2, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c}, [@exit]}, &(0x7f0000000380)='GPL\x00', 0x5, 0xc3, &(0x7f00000003c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x8, &(0x7f0000000280), 0x8, 0x10, &(0x7f0000000000)={0x2}, 0x10}, 0x94)
socketpair(0x1, 0xa, 0x0, &(0x7f0000000000)={<r8=>0xffffffffffffffff})
getpeername$packet(r8, &(0x7f0000000000)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14)
r10 = socket$inet6_udplite(0xa, 0x2, 0x88)
socket$nl_route(0x10, 0x3, 0x0)
r11 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000c80)={'lo\x00', <r12=>0x0})
r13 = socket$netlink(0x10, 0x3, 0x8000000004)
sendmsg$nl_xfrm(r13, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x40)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r10, 0x89f1, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000080)={'syztnl2\x00', r12, 0x0, 0xff, 0x3, 0xffffff92, 0x2c, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x3a}, 0x80, 0x8000, 0x1, 0x660}})
sendmmsg(r7, &(0x7f0000005d40)=[{{&(0x7f0000000180)=@can={0x1d, r9}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)="af", 0x1}], 0x1}}, {{&(0x7f00000022c0)=@can={0x1d, r9}, 0x80, 0x0}}], 0x2, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:61395' (ED25519) to the list of known hosts.
syzkaller login: [   47.855471][ T5800] cgroup: Unknown subsys name 'net'
[   47.968636][ T5800] cgroup: Unknown subsys name 'cpuset'
[   47.975285][ T5800] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   49.746167][ T5800] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   54.036940][ T5817] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   54.040008][ T5817] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   54.042540][ T5817] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   54.045580][ T5817] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   54.048388][ T5817] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   54.063002][ T5819] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   54.067482][ T5819] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   54.069826][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   54.072284][ T5819] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   54.074134][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   54.075932][ T5819] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   54.082065][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   54.082479][ T5819] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   54.084865][   T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   54.090105][   T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   54.360775][ T5812] chnl_net:caif_netlink_parms(): no params data found
[   54.368312][ T5811] chnl_net:caif_netlink_parms(): no params data found
[   54.430085][ T5820] chnl_net:caif_netlink_parms(): no params data found
[   54.530572][ T5811] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.533592][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.536485][ T5811] bridge_slave_0: entered allmulticast mode
[   54.539503][ T5811] bridge_slave_0: entered promiscuous mode
[   54.543084][ T5820] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.546415][ T5820] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.548787][ T5820] bridge_slave_0: entered allmulticast mode
[   54.551483][ T5820] bridge_slave_0: entered promiscuous mode
[   54.555248][ T5820] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.557608][ T5820] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.559989][ T5820] bridge_slave_1: entered allmulticast mode
[   54.562683][ T5820] bridge_slave_1: entered promiscuous mode
[   54.565821][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.568753][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.571149][ T5812] bridge_slave_0: entered allmulticast mode
[   54.574194][ T5812] bridge_slave_0: entered promiscuous mode
[   54.577260][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.579671][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.582008][ T5812] bridge_slave_1: entered allmulticast mode
[   54.584886][ T5812] bridge_slave_1: entered promiscuous mode
[   54.587369][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.589879][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.592141][ T5811] bridge_slave_1: entered allmulticast mode
[   54.595052][ T5811] bridge_slave_1: entered promiscuous mode
[   54.641620][ T5820] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.647375][ T5812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.651613][ T5820] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.659539][ T5811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.664830][ T5812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.684645][ T5811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.705673][ T5820] team0: Port device team_slave_0 added
[   54.716592][ T5820] team0: Port device team_slave_1 added
[   54.720360][ T5812] team0: Port device team_slave_0 added
[   54.730379][ T5812] team0: Port device team_slave_1 added
[   54.735335][ T5811] team0: Port device team_slave_0 added
[   54.752958][ T5811] team0: Port device team_slave_1 added
[   54.779482][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.781818][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.791207][ T5820] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.796738][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.799061][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.807778][ T5820] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.811770][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.814841][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.822734][ T5812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.836057][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.838360][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.846793][ T5811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.854652][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.857219][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.866974][ T5812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.871351][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.873555][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.882461][ T5811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.937056][ T5820] hsr_slave_0: entered promiscuous mode
[   54.939418][ T5820] hsr_slave_1: entered promiscuous mode
[   54.945162][ T5811] hsr_slave_0: entered promiscuous mode
[   54.947413][ T5811] hsr_slave_1: entered promiscuous mode
[   54.949474][ T5811] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   54.952005][ T5811] Cannot create hsr debugfs directory
[   54.976936][ T5812] hsr_slave_0: entered promiscuous mode
[   54.979217][ T5812] hsr_slave_1: entered promiscuous mode
[   54.981364][ T5812] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   54.984101][ T5812] Cannot create hsr debugfs directory
[   55.217160][ T5820] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   55.225240][ T5820] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   55.230458][ T5820] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   55.242476][ T5820] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   55.279174][ T5820] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.281571][ T5820] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.284546][ T5820] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.287196][ T5820] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.294298][ T5811] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   55.302787][ T5811] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   55.309477][ T5811] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   55.316438][ T5811] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   55.380330][ T1202] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.384433][ T1202] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.405645][ T5812] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   55.418319][ T5812] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   55.436379][ T5812] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   55.447033][ T5812] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   55.477970][ T5820] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.502104][ T5811] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.516362][ T5820] 8021q: adding VLAN 0 to HW filter on device team0
[   55.523047][ T5811] 8021q: adding VLAN 0 to HW filter on device team0
[   55.530475][ T1202] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.533041][ T1202] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.544611][ T3011] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.547646][ T3011] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.557795][ T1202] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.560170][ T1202] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.570196][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.572504][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.612260][ T5812] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.644224][ T5812] 8021q: adding VLAN 0 to HW filter on device team0
[   55.665162][ T3011] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.667497][ T3011] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.672544][ T3011] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.675245][ T3011] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.774804][ T5811] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.782006][ T5820] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.817236][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.841049][ T5811] veth0_vlan: entered promiscuous mode
[   55.847036][ T5820] veth0_vlan: entered promiscuous mode
[   55.850199][ T5811] veth1_vlan: entered promiscuous mode
[   55.868346][ T5811] veth0_macvtap: entered promiscuous mode
[   55.875281][ T5820] veth1_vlan: entered promiscuous mode
[   55.878434][ T5811] veth1_macvtap: entered promiscuous mode
[   55.895960][ T5812] veth0_vlan: entered promiscuous mode
[   55.907247][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.915753][ T5812] veth1_vlan: entered promiscuous mode
[   55.922977][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.932840][ T5811] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.938057][ T5811] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.940883][ T5811] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.944691][ T5811] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.950127][ T5820] veth0_macvtap: entered promiscuous mode
[   55.955296][ T5820] veth1_macvtap: entered promiscuous mode
[   55.972783][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.992744][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.004338][ T5812] veth0_macvtap: entered promiscuous mode
[   56.015617][ T5820] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.018547][ T5820] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.021446][ T5820] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.025836][ T5820] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.035911][ T5812] veth1_macvtap: entered promiscuous mode
[   56.045320][   T28] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.049667][   T28] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.072556][   T28] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.076625][   T28] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.082636][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.101124][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.105083][ T5817] Bluetooth: hci0: command tx timeout
[   56.118412][ T5812] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.121304][ T5812] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.122740][ T5811] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   56.125044][ T5812] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.132490][ T5812] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.139084][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.144468][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.166862][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.171409][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.174577][ T5817] Bluetooth: hci2: command tx timeout
[   56.174616][ T5819] Bluetooth: hci1: command tx timeout
[   56.198588][ T5878] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3'.
[   56.211533][ T5878] netlink: 'syz.2.3': attribute type 1 has an invalid length.
[   56.250603][ T1202] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.256348][ T1202] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.286490][   T83] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   56.289049][   T83] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.320608][ T5887] syz.2.5 uses obsolete (PF_INET,SOCK_PACKET)
[   56.360668][ T5890] warning: `syz.1.2' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   56.376161][ T5889] netlink: 'syz.0.1': attribute type 10 has an invalid length.
[   56.378841][ T5889] openvswitch: netlink: Flow key attr not present in new flow.
[   56.436381][ T5889] sctp: [Deprecated]: syz.0.1 (pid 5889) Use of int in max_burst socket option deprecated.
[   56.436381][ T5889] Use struct sctp_assoc_value instead
[   57.258777][ T5907] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10'.
[   57.458187][ T5912] netdevsim netdevsim0 netdevsim0: entered promiscuous mode
[   57.461375][ T5912] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[   57.529349][ T5914] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13'.
[   57.532146][ T5914] vcan0: entered promiscuous mode
[   57.535579][ T5914] vcan0: entered allmulticast mode
[   57.983271][ T5948] netlink: 28 bytes leftover after parsing attributes in process `syz.2.24'.
[   57.986931][ T5948] netlink: 28 bytes leftover after parsing attributes in process `syz.2.24'.
[   58.089285][ T5961] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   58.120923][ T5962] netlink: 4 bytes leftover after parsing attributes in process `syz.0.26'.
[   58.179502][ T5819] Bluetooth: hci0: command tx timeout
[   58.254720][ T5819] Bluetooth: hci1: command tx timeout
[   58.263872][ T5819] Bluetooth: hci2: command tx timeout
[   59.168800][ T5980] syzkaller0: entered promiscuous mode
[   59.171789][ T5980] syzkaller0: entered allmulticast mode
[   59.183503][ T5980] netlink: 12 bytes leftover after parsing attributes in process `syz.2.34'.
[   59.438060][ T5990] netlink: 'syz.0.38': attribute type 11 has an invalid length.
[   59.706927][ T6004] 8021q: adding VLAN 0 to HW filter on device bond0
[   59.713133][ T6004] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   59.776527][ T5997] netlink: 'syz.0.41': attribute type 1 has an invalid length.
[   59.779452][ T5997] netlink: 56 bytes leftover after parsing attributes in process `syz.0.41'.
[   59.919128][ T6013] netlink: 68 bytes leftover after parsing attributes in process `syz.0.44'.
[   60.246677][ T6027] vcan0: left promiscuous mode
[   60.248297][ T6027] vcan0: left allmulticast mode
[   60.252040][ T6027] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   60.260865][ T5819] Bluetooth: hci0: command tx timeout
[   60.344291][ T5819] Bluetooth: hci2: command tx timeout
[   60.344315][ T5817] Bluetooth: hci1: command tx timeout
[   60.420538][ T6044] af_packet: tpacket_rcv: packet too big, clamped from 212960 to 3952. macoff=96
[   60.441836][ T6044] netlink: 134820 bytes leftover after parsing attributes in process `syz.2.55'.
[   60.680680][ T6069] Zero length message leads to an empty skb
[   60.683023][ T6069] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   60.718770][ T6075] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   61.143329][ T6080] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   61.207866][ T6099] __nla_validate_parse: 2 callbacks suppressed
[   61.207876][ T6099] netlink: 24 bytes leftover after parsing attributes in process `syz.2.69'.
[   61.222194][ T6075] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   61.290156][ T6080] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   61.534087][ T6112] netlink: 36 bytes leftover after parsing attributes in process `syz.2.73'.
[   61.619564][ T6116] netlink: zone id is out of range
[   61.621929][ T6116] netlink: zone id is out of range
[   61.627046][ T6116] netlink: zone id is out of range
[   61.627638][ T6118] netlink: 8 bytes leftover after parsing attributes in process `syz.0.76'.
[   61.629226][ T6116] netlink: zone id is out of range
[   61.636065][ T6116] netlink: zone id is out of range
[   61.638034][ T6116] netlink: zone id is out of range
[   61.639593][ T6118] netlink: 'syz.0.76': attribute type 1 has an invalid length.
[   61.639884][ T6116] netlink: zone id is out of range
[   61.642623][ T6118] netlink: 'syz.0.76': attribute type 2 has an invalid length.
[   61.646108][ T6116] netlink: zone id is out of range
[   61.648769][ T6116] netlink: zone id is out of range
[   61.650908][ T6116] netlink: zone id is out of range
[   61.807497][ T6080] syz.1.64 (6080) used greatest stack depth: 17848 bytes left
[   61.955906][ T6129] netlink: 28 bytes leftover after parsing attributes in process `syz.1.79'.
[   61.959161][ T6135] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   62.035734][ T6139] tipc: Started in network mode
[   62.044264][ T6139] tipc: Node identity deec85b1d079, cluster identity 4711
[   62.047198][ T6139] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   62.054395][ T6139] syzkaller0: entered promiscuous mode
[   62.057024][ T6139] syzkaller0: entered allmulticast mode
[   62.079576][ T6139] tipc: Resetting bearer <eth:syzkaller0>
[   62.096223][ T6137] tipc: Resetting bearer <eth:syzkaller0>
[   62.113138][ T6137] tipc: Disabling bearer <eth:syzkaller0>
[   62.179789][ T6151] netlink: 4 bytes leftover after parsing attributes in process `syz.0.87'.
[   62.305965][ T6163] netlink: 8 bytes leftover after parsing attributes in process `syz.1.92'.
[   62.335869][ T5817] Bluetooth: hci0: command tx timeout
[   62.414001][ T5817] Bluetooth: hci1: command tx timeout
[   62.423919][ T5817] Bluetooth: hci2: command tx timeout
[   62.555190][ T6173] netlink: 428 bytes leftover after parsing attributes in process `syz.1.97'.
[   62.563917][ T6173] netlink: 32 bytes leftover after parsing attributes in process `syz.1.97'.
[   62.709484][ T6184] netlink: 4388 bytes leftover after parsing attributes in process `syz.1.101'.
[   62.942339][ T6206] tipc: Enabling of bearer <5dp:s> rejected, media not registered
[   63.011838][ T6210] netlink: 'syz.1.111': attribute type 1 has an invalid length.
[   63.128737][ T6218] netlink: 'syz.2.113': attribute type 83 has an invalid length.
[   63.330651][ T6223] macsec1: entered promiscuous mode
[   63.332871][ T6223] macvlan1: entered promiscuous mode
[   63.346521][ T6223] macsec1: entered allmulticast mode
[   63.349150][ T6223] macvlan1: entered allmulticast mode
[   63.351983][ T6223] veth1_vlan: entered allmulticast mode
[   63.699814][ T6256] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.729090][ T6263] netlink: 8 bytes leftover after parsing attributes in process `syz.1.128'.
[   63.788285][ T6256] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.888957][ T6256] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.947121][ T6256] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   64.058628][ T6256] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.088322][ T6256] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.100235][ T6256] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.114624][ T6256] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.257096][ T6299] netlink: 'syz.1.144': attribute type 1 has an invalid length.
[   64.315783][ T6299] bond1: entered promiscuous mode
[   64.318029][ T6299] bond1: entered allmulticast mode
[   64.342349][ T6300] bond1: (slave ip6gretap2): making interface the new active one
[   64.354014][ T6300] ip6gretap2: entered promiscuous mode
[   64.356680][ T6300] ip6gretap2: entered allmulticast mode
[   64.360492][ T6300] bond1: (slave ip6gretap2): Enslaving as an active interface with an up link
[   64.439755][ T6311] trusted_key: syz.1.148 sent an empty control message without MSG_MORE.
[   64.499129][ T5817] Bluetooth: hci2: command tx timeout
[   64.696783][ T6324] : renamed from bond_slave_0 (while UP)
[   64.930675][ T6339] delete_channel: no stack
[   65.010097][ T6344] xt_CONNSECMARK: invalid mode: 254
[   65.161777][   T96] IPVS: starting estimator thread 0...
[   65.253852][ T6350] IPVS: using max 80 ests per chain, 192000 per kthread
[   65.541279][ T6360] delete_channel: no stack
[   65.617033][    C1] Illegal XDP return value 16128 on prog  (id 42) dev lo, expect packet loss!
[   65.722117][ T6375] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   65.726537][ T6375] batadv_slave_1: entered promiscuous mode
[   65.736457][ T6374] Bluetooth: MGMT ver 1.23
[   66.232575][ T6414] netlink: 'syz.0.185': attribute type 3 has an invalid length.
[   66.235649][ T6414] netlink: 'syz.0.185': attribute type 1 has an invalid length.
[   66.238592][ T6414] __nla_validate_parse: 11 callbacks suppressed
[   66.238599][ T6414] netlink: 192 bytes leftover after parsing attributes in process `syz.0.185'.
[   66.244356][ T6414] NCSI netlink: No device for ifindex 0
[   66.376144][ T6434] netlink: 'syz.0.191': attribute type 7 has an invalid length.
[   66.378798][ T6434] netlink: 'syz.0.191': attribute type 8 has an invalid length.
[   66.381391][ T6434] netlink: 'syz.0.191': attribute type 15 has an invalid length.
[   66.557409][ T5853] IPVS: starting estimator thread 0...
[   66.627840][ T6454] netlink: 48 bytes leftover after parsing attributes in process `syz.1.199'.
[   66.654281][ T6449] IPVS: using max 51 ests per chain, 122400 per kthread
[   66.660360][ T6457] netlink: 8 bytes leftover after parsing attributes in process `syz.0.201'.
[   66.700007][ T6462] netlink: 36 bytes leftover after parsing attributes in process `syz.2.205'.
[   66.724941][ T6457] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   66.757165][ T6457] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[   66.789079][ T6466] netlink: 'syz.2.206': attribute type 12 has an invalid length.
[   66.795096][ T6466] netlink: 9472 bytes leftover after parsing attributes in process `syz.2.206'.
[   66.885382][ T6473] xt_time: invalid argument - start or stop time greater than 23:59:59
[   67.024425][ T6482] netlink: 40 bytes leftover after parsing attributes in process `syz.1.212'.
[   67.067912][ T6484] net_ratelimit: 124 callbacks suppressed
[   67.067928][ T6484] openvswitch: netlink: Actions may not be safe on all matching packets
[   67.251930][ T6492] netlink: 134820 bytes leftover after parsing attributes in process `syz.0.218'.
[   67.350358][ T6502] netlink: 'syz.0.221': attribute type 1 has an invalid length.
[   67.353142][ T6502] netlink: 232 bytes leftover after parsing attributes in process `syz.0.221'.
[   67.364100][ T6502] netlink: 8 bytes leftover after parsing attributes in process `syz.0.221'.
[   67.370569][ T6498] netlink: 8 bytes leftover after parsing attributes in process `syz.1.220'.
[   67.641356][ T6518] netlink: 'syz.0.226': attribute type 2 has an invalid length.
[   67.644637][ T6518] netlink: 'syz.0.226': attribute type 5 has an invalid length.
[   67.658593][ T5842] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   67.661902][ T5842] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   67.683985][   T96] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   67.722594][ T6520] IPv6: NLM_F_CREATE should be specified when creating new route
[   67.779966][ T6525] netlink: 'syz.0.228': attribute type 1 has an invalid length.
[   67.835366][ T5281] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   67.853246][ T6536] tc_dump_action: action bad kind
[   67.874625][ T6538] netlink: 'syz.0.235': attribute type 1 has an invalid length.
[   67.889589][ T6538] 8021q: adding VLAN 0 to HW filter on device bond1
[   67.905353][ T5281] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   67.910633][ T6538] bond1: (slave veth3): Enslaving as an active interface with a down link
[   67.916171][ T6544] tipc: Started in network mode
[   67.917830][ T6544] tipc: Node identity ac14140f, cluster identity 4711
[   67.946613][ T6544] tipc: New replicast peer: 255.255.255.255
[   67.949438][ T6544] tipc: Enabled bearer <udp:syz2>, priority 10
[   68.024169][ T6557] netlink: 'syz.1.240': attribute type 1 has an invalid length.
[   68.332495][ T6579] netlink: 'syz.1.249': attribute type 2 has an invalid length.
[   68.380755][ T6587] netlink: 'syz.0.253': attribute type 1 has an invalid length.
[   68.475866][ T6595] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   68.613283][ T6609] netlink: 'syz.1.261': attribute type 2 has an invalid length.
[   69.074607][   T10] tipc: Node number set to 2886997007
[   69.286921][ T6676] netlink: 'syz.0.279': attribute type 11 has an invalid length.
[   70.376512][ T6785] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x5
[   70.687656][ T6809] x_tables: ip_tables: osf match: only valid for protocol 6
[   70.691896][ T6809] xt_hashlimit: size too large, truncated to 1048576
[   70.756240][ T6813] : renamed from veth1_to_bond (while UP)
[   70.951906][ T6828] xt_HMARK: proto mask must be zero with L3 mode
[   70.972615][ T6826] batman_adv: batadv0: Removing interface: batadv_slave_1
[   70.981797][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   70.984892][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   71.082952][ T6834] 8021q: adding VLAN 0 to HW filter on device bond2
[   71.267910][ T6855] __nla_validate_parse: 34 callbacks suppressed
[   71.267920][ T6855] netlink: 68 bytes leftover after parsing attributes in process `syz.0.346'.
[   71.289380][ T6855] 8021q: adding VLAN 0 to HW filter on device bond3
[   71.375398][ T6872] netlink: 36 bytes leftover after parsing attributes in process `syz.2.352'.
[   71.470267][ T6878] netlink: 566 bytes leftover after parsing attributes in process `syz.0.355'.
[   71.474091][ T6881] netlink: 566 bytes leftover after parsing attributes in process `syz.0.355'.
[   71.480862][ T6878] netlink: 4 bytes leftover after parsing attributes in process `syz.0.355'.
[   71.480874][ T6881] netlink: 4 bytes leftover after parsing attributes in process `syz.0.355'.
[   71.717770][ T6895] netlink: 36 bytes leftover after parsing attributes in process `syz.0.359'.
[   71.748596][ T6897] netdevsim netdevsim0: Direct firmware load for .. failed with error -2
[   71.751864][ T6897] netdevsim netdevsim0: Falling back to sysfs fallback for: ..
[   72.013960][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   72.580038][   T24] cfg80211: failed to load regulatory.db
[   72.620851][ T6916] netlink: 8 bytes leftover after parsing attributes in process `syz.0.367'.
[   72.787350][ T6928] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   72.843022][ T6933] netlink: 44 bytes leftover after parsing attributes in process `syz.0.372'.
[   72.860051][ T6935] netlink: 8 bytes leftover after parsing attributes in process `syz.1.373'.
[   72.866105][ T6935] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (34)
[   72.937537][ T6940] validate_nla: 11 callbacks suppressed
[   72.937560][ T6940] netlink: 'syz.1.375': attribute type 1 has an invalid length.
[   73.173109][ T6955] xt_HMARK: spi-set and port-set can't be combined
[   73.236052][ T6953] netlink: 'syz.0.380': attribute type 4 has an invalid length.
[   74.893958][ T5817] Bluetooth: hci0: Opcode 0x0401 failed: -110
[   74.897673][ T5819] Bluetooth: hci0: command 0x0401 tx timeout
[   74.900559][ T5817] Bluetooth: hci0: Opcode 0x0c1a failed: -110
[   75.038508][ T7031] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   75.042077][ T7031] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   75.045094][ T7031] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   75.047842][ T7031] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   75.057727][ T7033] (unnamed net_device) (uninitialized): option downdelay: invalid value (18446744073709551615)
[   75.061462][ T7033] (unnamed net_device) (uninitialized): option downdelay: allowed values 0 - 2147483647
[   75.223629][ T5842] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   75.310497][ T6600] ==================================================================
[   75.313118][ T6600] BUG: KASAN: slab-use-after-free in __mutex_lock+0x738/0xe80
[   75.315524][ T6600] Read of size 8 at addr ffff8881112180a0 by task khidpd_15c25886/6600
[   75.319223][ T6600] 
[   75.320008][ T6600] CPU: 1 UID: 0 PID: 6600 Comm: khidpd_15c25886 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[   75.320018][ T6600] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   75.320023][ T6600] Call Trace:
[   75.320027][ T6600]  <TASK>
[   75.320030][ T6600]  dump_stack_lvl+0x189/0x250
[   75.320045][ T6600]  ? __virt_addr_valid+0x1c8/0x5c0
[   75.320054][ T6600]  ? rcu_is_watching+0x15/0xb0
[   75.320065][ T6600]  ? __kasan_check_byte+0x12/0x40
[   75.320074][ T6600]  ? __pfx_dump_stack_lvl+0x10/0x10
[   75.320083][ T6600]  ? rcu_is_watching+0x15/0xb0
[   75.320093][ T6600]  ? lock_release+0x4b/0x3e0
[   75.320104][ T6600]  ? __virt_addr_valid+0x1c8/0x5c0
[   75.320111][ T6600]  ? __virt_addr_valid+0x4a5/0x5c0
[   75.320117][ T6600]  print_report+0xd2/0x2b0
[   75.320127][ T6600]  ? __mutex_lock+0x738/0xe80
[   75.320138][ T6600]  kasan_report+0x118/0x150
[   75.320145][ T6600]  ? __mutex_lock+0x738/0xe80
[   75.320156][ T6600]  __mutex_lock+0x738/0xe80
[   75.320166][ T6600]  ? __mutex_lock+0x51b/0xe80
[   75.320177][ T6600]  ? l2cap_unregister_user+0x6a/0x1b0
[   75.320189][ T6600]  ? __pfx___mutex_lock+0x10/0x10
[   75.320200][ T6600]  ? __pfx___timer_delete_sync+0x10/0x10
[   75.320210][ T6600]  l2cap_unregister_user+0x6a/0x1b0
[   75.320221][ T6600]  hidp_session_thread+0x3c9/0x410
[   75.320235][ T6600]  ? __pfx_hidp_session_thread+0x10/0x10
[   75.320244][ T6600]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   75.320254][ T6600]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   75.320265][ T6600]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   75.320274][ T6600]  ? __kthread_parkme+0x7b/0x200
[   75.320281][ T6600]  ? __kthread_parkme+0x1a1/0x200
[   75.320288][ T6600]  kthread+0x711/0x8a0
[   75.320296][ T6600]  ? __pfx_hidp_session_thread+0x10/0x10
[   75.320306][ T6600]  ? __pfx_kthread+0x10/0x10
[   75.320313][ T6600]  ? _raw_spin_unlock_irq+0x23/0x50
[   75.320322][ T6600]  ? lockdep_hardirqs_on+0x9c/0x150
[   75.320332][ T6600]  ? __pfx_kthread+0x10/0x10
[   75.320339][ T6600]  ret_from_fork+0x3fc/0x770
[   75.320351][ T6600]  ? __pfx_ret_from_fork+0x10/0x10
[   75.320360][ T6600]  ? __switch_to_asm+0x39/0x70
[   75.320367][ T6600]  ? __switch_to_asm+0x33/0x70
[   75.320373][ T6600]  ? __pfx_kthread+0x10/0x10
[   75.320380][ T6600]  ret_from_fork_asm+0x1a/0x30
[   75.320390][ T6600]  </TASK>
[   75.320393][ T6600] 
[   75.346182][ T5842] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   75.346985][ T6600] Allocated by task 5820:
[   75.346993][ T6600]  kasan_save_track+0x3e/0x80
[   75.347008][ T6600]  __kasan_kmalloc+0x93/0xb0
[   75.347015][ T6600]  __kmalloc_noprof+0x27a/0x4f0
[   75.347021][ T6600]  hci_alloc_dev_priv+0x28/0x2040
[   75.347032][ T6600]  vhci_create_device+0x120/0x6e0
[   75.409401][ T6600]  vhci_write+0x3ce/0x4a0
[   75.410913][ T6600]  vfs_write+0x54b/0xa90
[   75.412276][ T6600]  ksys_write+0x145/0x250
[   75.413658][ T6600]  do_syscall_64+0xfa/0x3b0
[   75.415131][ T6600]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   75.417201][ T6600] 
[   75.417977][ T6600] Freed by task 5820:
[   75.419226][ T6600]  kasan_save_track+0x3e/0x80
[   75.420748][ T6600]  kasan_save_free_info+0x46/0x50
[   75.422314][ T6600]  __kasan_slab_free+0x62/0x70
[   75.423864][ T6600]  kfree+0x18e/0x440
[   75.425098][ T6600]  bt_host_release+0x82/0x90
[   75.426733][ T6600]  device_release+0x9c/0x1c0
[   75.428205][ T6600]  kobject_put+0x22b/0x480
[   75.429584][ T6600]  vhci_release+0x88/0xd0
[   75.430979][ T6600]  __fput+0x44c/0xa70
[   75.432277][ T6600]  task_work_run+0x1d4/0x260
[   75.433767][ T6600]  do_exit+0x6b5/0x22e0
[   75.435225][ T6600]  do_group_exit+0x21c/0x2d0
[   75.436757][ T6600]  __x64_sys_exit_group+0x3f/0x40
[   75.438640][ T6600]  x64_sys_call+0x21ba/0x21c0
[   75.440120][ T6600]  do_syscall_64+0xfa/0x3b0
[   75.441636][ T6600]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   75.443809][ T6600] 
[   75.444610][ T6600] Last potentially related work creation:
[   75.446552][ T6600]  kasan_save_stack+0x3e/0x60
[   75.448254][ T6600]  kasan_record_aux_stack+0xbd/0xd0
[   75.449974][ T6600]  insert_work+0x3d/0x330
[   75.451325][ T6600]  __queue_work+0xbd9/0xfe0
[   75.452811][ T6600]  queue_work_on+0x181/0x270
[   75.454727][ T6600]  process_scheduled_works+0xae1/0x17b0
[   75.457078][ T6600]  worker_thread+0x8a0/0xda0
[   75.458621][ T6600]  kthread+0x711/0x8a0
[   75.460136][ T6600]  ret_from_fork+0x3fc/0x770
[   75.461669][ T6600]  ret_from_fork_asm+0x1a/0x30
[   75.463384][ T6600] 
[   75.464356][ T6600] Second to last potentially related work creation:
[   75.466440][ T6600]  kasan_save_stack+0x3e/0x60
[   75.468100][ T6600]  kasan_record_aux_stack+0xbd/0xd0
[   75.469858][ T6600]  insert_work+0x3d/0x330
[   75.471270][ T6600]  __queue_work+0xcfc/0xfe0
[   75.472746][ T6600]  call_timer_fn+0x17e/0x5f0
[   75.474251][ T6600]  __run_timer_base+0x646/0x860
[   75.475785][ T6600]  run_timer_softirq+0xb7/0x180
[   75.477417][ T6600]  handle_softirqs+0x286/0x870
[   75.478951][ T6600]  __irq_exit_rcu+0xca/0x1f0
[   75.480437][ T6600]  irq_exit_rcu+0x9/0x30
[   75.481813][ T6600]  sysvec_apic_timer_interrupt+0xa6/0xc0
[   75.483631][ T6600]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   75.485547][ T6600] 
[   75.486348][ T6600] The buggy address belongs to the object at ffff888111218000
[   75.486348][ T6600]  which belongs to the cache kmalloc-8k of size 8192
[   75.490792][ T6600] The buggy address is located 160 bytes inside of
[   75.490792][ T6600]  freed 8192-byte region [ffff888111218000, ffff88811121a000)
[   75.495844][ T6600] 
[   75.496686][ T6600] The buggy address belongs to the physical page:
[   75.499032][ T6600] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111218
[   75.502595][ T6600] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   75.505316][ T6600] ksm flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   75.508288][ T6600] page_type: f5(slab)
[   75.509777][ T6600] raw: 057ff00000000040 ffff88801a442280 ffffea000442b400 dead000000000003
[   75.512621][ T6600] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   75.515938][ T6600] head: 057ff00000000040 ffff88801a442280 ffffea000442b400 dead000000000003
[   75.519109][ T6600] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   75.521819][ T6600] head: 057ff00000000003 ffffea0004448601 00000000ffffffff 00000000ffffffff
[   75.524501][ T6600] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   75.527510][ T6600] page dumped because: kasan: bad access detected
[   75.529625][ T6600] page_owner tracks the page as allocated
[   75.531416][ T6600] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5551, tgid 5551 (sh), ts 29908848918, free_ts 29908755348
[   75.537601][ T6600]  post_alloc_hook+0x240/0x2a0
[   75.539133][ T6600]  get_page_from_freelist+0x21e4/0x22c0
[   75.540877][ T6600]  __alloc_frozen_pages_noprof+0x181/0x370
[   75.542645][ T6600]  alloc_pages_mpol+0x232/0x4a0
[   75.544200][ T6600]  allocate_slab+0x8a/0x3b0
[   75.545658][ T6600]  ___slab_alloc+0xbfc/0x1480
[   75.547285][ T6600]  __kmalloc_cache_noprof+0x296/0x3d0
[   75.549327][ T6600]  tomoyo_init_log+0x111f/0x1f70
[   75.551010][ T6600]  tomoyo_supervisor+0x340/0x1480
[   75.553001][ T6600]  tomoyo_env_perm+0x149/0x1e0
[   75.554893][ T6600]  tomoyo_find_next_domain+0x15cf/0x1aa0
[   75.557029][ T6600]  tomoyo_bprm_check_security+0x11c/0x180
[   75.559152][ T6600]  security_bprm_check+0x89/0x270
[   75.561176][ T6600]  bprm_execve+0x8ee/0x1450
[   75.563051][ T6600]  do_execveat_common+0x510/0x6a0
[   75.564721][ T6600]  __x64_sys_execve+0x94/0xb0
[   75.566369][ T6600] page last free pid 5551 tgid 5551 stack trace:
[   75.569151][ T6600]  __free_frozen_pages+0xc71/0xe70
[   75.570958][ T6600]  __put_partials+0x161/0x1c0
[   75.572940][ T6600]  put_cpu_partial+0x17c/0x250
[   75.574839][ T6600]  __slab_free+0x2f7/0x400
[   75.576433][ T6600]  qlist_free_all+0x97/0x140
[   75.578381][ T6600]  kasan_quarantine_reduce+0x148/0x160
[   75.580625][ T6600]  __kasan_slab_alloc+0x22/0x80
[   75.582728][ T6600]  __kmalloc_noprof+0x224/0x4f0
[   75.584746][ T6600]  tomoyo_supervisor+0xbd5/0x1480
[   75.586951][ T6600]  tomoyo_env_perm+0x149/0x1e0
[   75.588600][ T6600]  tomoyo_find_next_domain+0x15cf/0x1aa0
[   75.590927][ T6600]  tomoyo_bprm_check_security+0x11c/0x180
[   75.593278][ T6600]  security_bprm_check+0x89/0x270
[   75.594989][ T6600]  bprm_execve+0x8ee/0x1450
[   75.596476][ T6600]  do_execveat_common+0x510/0x6a0
[   75.598452][ T6600]  __x64_sys_execve+0x94/0xb0
[   75.600407][ T6600] 
[   75.601417][ T6600] Memory state around the buggy address:
[   75.603648][ T6600]  ffff888111217f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   75.606459][ T6600]  ffff888111218000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   75.609582][ T6600] >ffff888111218080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   75.612822][ T6600]                                ^
[   75.614996][ T6600]  ffff888111218100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   75.618386][ T6600]  ffff888111218180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   75.621722][ T6600] ==================================================================
[   75.625084][ T6600] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   75.627448][ T6600] CPU: 1 UID: 0 PID: 6600 Comm: khidpd_15c25886 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[   75.632027][ T6600] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   75.635290][ T6600] Call Trace:
[   75.636368][ T6600]  <TASK>
[   75.637312][ T6600]  dump_stack_lvl+0x99/0x250
[   75.638842][ T6600]  ? __asan_memcpy+0x40/0x70
[   75.640528][ T6600]  ? __pfx_dump_stack_lvl+0x10/0x10
[   75.642252][ T6600]  ? __pfx__printk+0x10/0x10
[   75.643808][ T6600]  panic+0x2db/0x790
[   75.645114][ T6600]  ? __pfx_panic+0x10/0x10
[   75.646602][ T6600]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[   75.648550][ T6600]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   75.650545][ T6600]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   75.652556][ T6600]  ? print_memory_metadata+0x314/0x400
[   75.654285][ T6600]  ? __mutex_lock+0x738/0xe80
[   75.655838][ T6600]  check_panic_on_warn+0x89/0xb0
[   75.657414][ T6600]  ? __mutex_lock+0x738/0xe80
[   75.658937][ T6600]  end_report+0x78/0x160
[   75.660685][ T6600]  kasan_report+0x129/0x150
[   75.662425][ T6600]  ? __mutex_lock+0x738/0xe80
[   75.664016][ T6600]  __mutex_lock+0x738/0xe80
[   75.665517][ T6600]  ? __mutex_lock+0x51b/0xe80
[   75.667091][ T6600]  ? l2cap_unregister_user+0x6a/0x1b0
[   75.668854][ T6600]  ? __pfx___mutex_lock+0x10/0x10
[   75.670728][ T6600]  ? __pfx___timer_delete_sync+0x10/0x10
[   75.672493][ T6600]  l2cap_unregister_user+0x6a/0x1b0
[   75.674157][ T6600]  hidp_session_thread+0x3c9/0x410
[   75.675864][ T6600]  ? __pfx_hidp_session_thread+0x10/0x10
[   75.677661][ T6600]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   75.679731][ T6600]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   75.682295][ T6600]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   75.684879][ T6600]  ? __kthread_parkme+0x7b/0x200
[   75.686961][ T6600]  ? __kthread_parkme+0x1a1/0x200
[   75.689056][ T6600]  kthread+0x711/0x8a0
[   75.690842][ T6600]  ? __pfx_hidp_session_thread+0x10/0x10
[   75.693148][ T6600]  ? __pfx_kthread+0x10/0x10
[   75.694687][ T6600]  ? _raw_spin_unlock_irq+0x23/0x50
[   75.696339][ T6600]  ? lockdep_hardirqs_on+0x9c/0x150
[   75.698035][ T6600]  ? __pfx_kthread+0x10/0x10
[   75.699619][ T6600]  ret_from_fork+0x3fc/0x770
[   75.701131][ T6600]  ? __pfx_ret_from_fork+0x10/0x10
[   75.702761][ T6600]  ? __switch_to_asm+0x39/0x70
[   75.704248][ T6600]  ? __switch_to_asm+0x33/0x70
[   75.705788][ T6600]  ? __pfx_kthread+0x10/0x10
[   75.707264][ T6600]  ret_from_fork_asm+0x1a/0x30
[   75.708859][ T6600]  </TASK>
[   75.710551][ T6600] Kernel Offset: disabled
[   75.712132][ T6600] Rebooting in 86400 seconds..

VM DIAGNOSIS:
01:14:35  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000001 RBX=0000000000000000 RCX=a31d233d74ad8500 RDX=0000000000000001
RSI=ffff88802240e130 RDI=ffff88802240d640 RBP=0000000000000001 RSP=ffffc9000322f5e0
R8 =0000000000000000 R9 =ffffffff81728af5 R10=ffffc9000322f848 R11=fffff52000645f15
R12=0000000000004008 R13=ffff88802240e130 R14=ffff88802240e130 R15=0ac0d5affe09d4ff
RIP=ffffffff8b6992a0 RFL=00000082 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555569674500 ffffffff 00c00000
GS =0000 ffff8880b8650000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055de17575d98 CR3=000000003983c000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fa836b84478 00007fa836b84450 XMM03=00007fa836b84488 00007fa836b84480
XMM04=00007fa8376ed100 00007fa836b84440 XMM05=00007fa836b84458 00007fa836b844a0
XMM06=00007fa836b84498 00007fa836b84490 XMM07=00007fa836b84488 00007fa836b84480
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000061 RBX=0000000000000061 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90008c8f370
R8 =ffff88801fb60237 R9 =1ffff11003f6c046 R10=dffffc0000000000 R11=ffffffff85474610
R12=dffffc0000000000 R13=ffffffff99ac48fd R14=ffffffff99dc9760 R15=0000000000000000
RIP=ffffffff8547468c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c50000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055de175d2dd8 CR3=000000010f168000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00ff000000000000 ff00000000000000 XMM05=0000000000000071 000000000034736f
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffff000000 XMM09=706d6f633a3a3474 75706e692f347475
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
