last executing test programs:

649.22938ms ago: executing program 0 (id=917):
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
sendmsg$kcm(r0, &(0x7f0000001900)={0x0, 0xffffffea, 0x0}, 0x20040005)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001)
r1 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="1400000023000b6c8cfffdfccabb00f90429fc60", 0x14}], 0x1}, 0x2400c000)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0)

570.245242ms ago: executing program 0 (id=920):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000048000000030a01030000000000000000050000030900010073797a30000000000900030073797a320000000008000a400000000314000480080002400000001a080002402b780af2140000001100010000004000000000000000000a"], 0x90}}, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
close(0xffffffffffffffff)
bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="12000000040000000800000008"], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f00000006c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df33c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50)
socketpair(0x1, 0x1, 0x0, 0x0)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r3}, 0x10)
r4 = socket$kcm(0x2, 0x3, 0x84)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000000200"/20, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0000000044010000ff"], 0x48)
ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x890b, &(0x7f0000000100))
bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYBLOB], 0x3c}}, 0x0)
bind$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f00000003c0)={'ip6gre0\x00', <r6=>r5, 0x4, 0x14, 0x2, 0xfffffffd, 0x3d, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, 0x700, 0x20, 0x8, 0x3}})
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000d00)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x5, '\x00', r6, 0xffffffffffffffff, 0x0, 0x0, 0x1}, 0x50)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000500)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x50)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb0006"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)

470.621125ms ago: executing program 0 (id=921):
r0 = socket$pppoe(0x18, 0x1, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x18}}, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0)
write$cgroup_pid(r3, &(0x7f0000000000), 0x2a979d)
ioctl$SIOCSIFHWADDR(r3, 0x401c5820, 0x0)
r4 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0xa, 0x0, 0x14, 0x2, 0x0, 0x70bd25, 0x25dfdbfc}, 0x10}}, 0x30004000)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014)
sendmsg$TIPC_NL_MON_SET(r3, &(0x7f0000000840)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000800)={&(0x7f0000000600)={0x1cc, r6, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0x50, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_LINK={0x13c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf28}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5e}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ec9a8f5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff7fff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x772}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xd}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}]}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x4}, 0x8000)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=@mpls_delroute={0x1c, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x10, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x800}}, 0x1c}, 0x1, 0x0, 0x0, 0x20040004}, 0x0)
connect$pppoe(r0, &(0x7f0000000400)={0x18, 0x0, {0x2, @broadcast, 'veth0\x00'}}, 0x1e)
r7 = socket$pppoe(0x18, 0x1, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x13, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="8500000088000000040000000000000095"], &(0x7f00000009c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xc, '\x00', 0x0, @fallback=0xbb428eaf468c6595, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
connect$pppoe(r7, &(0x7f0000000080)={0x18, 0x0, {0xd, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'veth1\x00'}}, 0x1e)
r8 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x40a40, 0x0)
ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000040)=0x2)
r9 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="24000000200001030000000000000000020000000000000002ff000005001600890000004849ac"], 0x24}, 0x1, 0x0, 0x0, 0x240088d4}, 0x0)
r10 = socket$inet6(0xa, 0x2, 0x0)
ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000380))
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'sit0\x00', <r11=>0x0})
ioctl$sock_inet6_SIOCSIFDSTADDR(r10, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r11})

470.072298ms ago: executing program 2 (id=923):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)={0xc8, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_EXPECT_MASTER={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @loopback}}}]}, @CTA_EXPECT_MASK={0x3c, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @remote}}}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @local}}}]}]}, 0xc8}}, 0x0)

406.561893ms ago: executing program 2 (id=924):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000002b80)={0x6, @empty, 0x4e21, 0x0, 'nq\x00', 0x29, 0xb, 0x21}, 0x2c)

406.100527ms ago: executing program 1 (id=925):
r0 = socket(0x10, 0x803, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=@getchain={0x24, 0x66, 0x0, 0x40000000, 0x2000, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x4}}}, 0x24}}, 0x0)
getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x38, 0x10, 0x401, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, 0x98, 0x1114}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x38}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x48, 0x10, 0x401, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, 0x1493cf2c54a75087, 0xac}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_SPORT={0x6, 0x11, 0x4e24}, @IFLA_IPTUN_COLLECT_METADATA={0x4}, @IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20040805}, 0x20004094)

329.189188ms ago: executing program 2 (id=926):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001400)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fedbdf252100000008000300", @ANYRES32=r3, @ANYBLOB="0400848014002c800800bdfdc9fd"], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x816)

250.547181ms ago: executing program 1 (id=927):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000c00)=ANY=[@ANYBLOB="bf16000000000000b70700000100000048700000e4ff0000bc700000000000009500faff000000008aa1210b29017b83c8e96e6405f798585fb5030b3388b0409a814343f1ae341b74efa745a12f5c0685e5261482e31e0cacc902c97e6145ef48004d26342c94f56a39359ba56724e4535d80ffbd6848d53382c26211a2b975eb4a9d08501c000c00000000000097e50f118c4a3b05489d1d1245cb774879b0871dd61703eefe87ff070000000000008cca1a363b2b28add613658171122dc01e0a77d7c44b009fdac91fc827f5797532750d4d4639f11089feb3f25b4695c6dac2cabfa04e2c16fa741b0665bb33be6f0e742213d0bf5528a601b5934b867f39f7d776ac00a434949b4455b7c6c678de4d9740d8dff6169c664b55ce550fb4e686ae169d9f7abbeb08e02799374ae0081858bdf144d8c7fb67dcec5e43a0e8099e543116b1b7d144b5613845cca4388344d82de45f0c1b7d041db040fd777791232d5db32d14bc1c3d000000000000000000000016a1049b6f094e504c28d7daa2f61b2a7c14d2343b4308b36e6b141371c958406e212b3accb45f87aef8bd5e2181fd7826b9e5cb2f6a63f113491239dca17e4fb33e670daf1cd7a99015ae9e1ca32b4e64dc38b55d525bd10971b0898be9d6e6154dfc99b20622b604b87ba03524c2fed51056d672b1b966657de5c86ab09195fba55af17663fecf1b5c5a76cf07615c7ee54c361449e275371a8c4243b9060ecdeecfb1603b061a8a62159830049061800953f7d00c43c95068c62c2ca1ad7fea9de97216dbc9c8e36a5607608e77d1d7d72b78b4f1eab8e40000000000000000adc90eb850f42f44e4b48c9cc39412c0ce6c9f4b95936ec36efc8dfbc54eb44affe1cd0f14d124df0c29c51b5628646b8155a1859358aa08f71fd2d9b2c4288a0d8870e8767173c65476e1a4f000c580f61d73f5be35ca1aa1235cf309650cdf8c6cd950c477890089be400b26dedec1199479b1b5adfaf2b6e05b7f90c9098ed4accddabd802ac5dc1b436e"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffcf8}, 0x48)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000640)=@raw={'raw\x00', 0xc01, 0x3, 0x490, 0x300, 0x5002004a, 0x6, 0x300, 0x3, 0x3f8, 0x3c8, 0x3c8, 0x3f8, 0x3c8, 0x7fffffe, 0x0, {[{{@ip={@dev, @broadcast=0xfeffffff, 0x0, 0x0, 'sit0\x00', 'bridge0\x00', {}, {0xff}, 0x0, 0x0, 0x20}, 0x0, 0x2a0, 0x300, 0x0, {0x0, 0x3fa}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [0x1, 0x1, 0x3, 0x7, 0x3, 0x2], 0x6, 0x4}, {0x4, [0x3, 0x0, 0x3, 0x1, 0x0, 0x6], 0x4, 0x1}}}}, {{@uncond, 0x0, 0x98, 0xf8, 0x0, {}, [@common=@inet=@dscp={{0x28}, {0xe3, 0x1}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @random="6ba06d3126df", 0x0, 0x0, [0x0, 0x0, 0x21, 0x2000, 0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xe13], 0x0, 0x0, 0xfffffffffffffffc}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4f0)

250.428457ms ago: executing program 2 (id=928):
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x11, 0xffffffff, 0x0, 0x0, 0x255}, 0x48)

250.034885ms ago: executing program 0 (id=929):
r0 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
listen(r0, 0x8)
r1 = accept4(r0, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0), 0x8)

177.536492ms ago: executing program 1 (id=930):
syz_emit_ethernet(0x5e, &(0x7f0000000200)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0xf, 0x4, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0, 0x5, 0x0, @dev, @rand_addr=0x64010102, {[@timestamp_addr={0x44, 0x14, 0x5, 0x3, 0x0, [{@multicast2}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}]}, @ssrr={0x89, 0xf, 0x77, [@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x32}]}, @generic={0x83, 0x2}]}}, {{0x4, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0)

177.307472ms ago: executing program 2 (id=931):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendmmsg$inet6(r0, &(0x7f0000002fc0)=[{{&(0x7f0000000340)={0xa, 0x4e23, 0xfffffff9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x9}, 0x1c, &(0x7f00000004c0)=[{&(0x7f00000005c0)="05", 0x1}], 0x1}}], 0x1, 0x4008004)
recvfrom$rxrpc(r0, 0x0, 0x0, 0x40000021, 0x0, 0x0)
shutdown(r0, 0x1)

177.077926ms ago: executing program 0 (id=932):
socket$nl_sock_diag(0x10, 0x3, 0x4)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
socket(0x10, 0x803, 0x0)
socket$kcm(0x10, 0x2, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0)

109.592467ms ago: executing program 1 (id=933):
socket(0x1d, 0x1, 0xfffffffb)

109.083995ms ago: executing program 0 (id=934):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x12, 0x4, 0x4, 0x12}, 0x48)
r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0)

108.985013ms ago: executing program 1 (id=935):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000a636000000007fffffff8500000050000000850000000700000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r0}, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xa, 0x1f, 0x1, 0x7}, 0x48)

231.909µs ago: executing program 1 (id=936):
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd6317ce22000000fffe80000000000000101000007f0600080000000000000071273fa7b49301641184a907"], 0xfdef)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48)

0s ago: executing program 2 (id=937):
r0 = epoll_create1(0x0)
r1 = socket$tipc(0x1e, 0x2, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000500)={0x14})

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:64039' (ED25519) to the list of known hosts.
syzkaller login: [   56.472383][ T5759] cgroup: Unknown subsys name 'net'
[   56.560835][ T5759] cgroup: Unknown subsys name 'cpuset'
[   56.567737][ T5759] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   59.112252][ T5759] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   64.612614][ T5835] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   64.615908][ T5835] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   64.618788][ T5835] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   64.621500][ T5835] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   64.624690][ T5835] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   64.673554][   T54] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   64.676471][   T54] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   64.679748][   T54] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   64.682766][   T54] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   64.685388][   T54] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   64.748446][ T5835] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   64.753862][ T5835] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   64.764838][ T5835] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   64.772649][ T5835] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   64.778869][ T5835] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   64.935247][ T5833] chnl_net:caif_netlink_parms(): no params data found
[   64.992835][ T5838] chnl_net:caif_netlink_parms(): no params data found
[   65.190025][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.192946][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.196438][ T5833] bridge_slave_0: entered allmulticast mode
[   65.203042][ T5833] bridge_slave_0: entered promiscuous mode
[   65.222434][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.224860][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.227675][ T5833] bridge_slave_1: entered allmulticast mode
[   65.231090][ T5833] bridge_slave_1: entered promiscuous mode
[   65.289817][ T5838] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.292685][ T5838] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.295310][ T5838] bridge_slave_0: entered allmulticast mode
[   65.299594][ T5838] bridge_slave_0: entered promiscuous mode
[   65.302808][ T5840] chnl_net:caif_netlink_parms(): no params data found
[   65.327141][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.335174][ T5838] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.339221][ T5838] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.341650][ T5838] bridge_slave_1: entered allmulticast mode
[   65.344640][ T5838] bridge_slave_1: entered promiscuous mode
[   65.349216][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.420709][ T5833] team0: Port device team_slave_0 added
[   65.425528][ T5838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.441938][ T5838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.444948][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.447620][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.450303][ T5840] bridge_slave_0: entered allmulticast mode
[   65.453476][ T5840] bridge_slave_0: entered promiscuous mode
[   65.460055][ T5833] team0: Port device team_slave_1 added
[   65.462711][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.465651][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.471958][ T5840] bridge_slave_1: entered allmulticast mode
[   65.476004][ T5840] bridge_slave_1: entered promiscuous mode
[   65.563672][ T5838] team0: Port device team_slave_0 added
[   65.568719][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.572806][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.584437][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.592832][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.599329][ T5838] team0: Port device team_slave_1 added
[   65.601995][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.604790][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.615408][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.634184][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.689082][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.691807][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.700707][ T5838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.705797][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.708464][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.716742][ T5838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.724853][ T5840] team0: Port device team_slave_0 added
[   65.751005][ T5840] team0: Port device team_slave_1 added
[   65.805992][ T5833] hsr_slave_0: entered promiscuous mode
[   65.810352][ T5833] hsr_slave_1: entered promiscuous mode
[   65.845442][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.848473][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.859282][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.871055][ T5838] hsr_slave_0: entered promiscuous mode
[   65.874262][ T5838] hsr_slave_1: entered promiscuous mode
[   65.877433][ T5838] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   65.880596][ T5838] Cannot create hsr debugfs directory
[   65.883593][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.885916][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.895708][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   66.062810][ T5840] hsr_slave_0: entered promiscuous mode
[   66.066013][ T5840] hsr_slave_1: entered promiscuous mode
[   66.071372][ T5840] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   66.073951][ T5840] Cannot create hsr debugfs directory
[   66.339240][ T5838] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   66.349481][ T5838] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   66.375220][ T5838] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   66.393418][ T5838] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   66.427952][ T5833] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   66.441638][ T5833] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   66.453116][ T5833] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   66.487432][ T5833] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   66.550932][ T5840] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   66.564122][ T5840] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   66.579679][ T5840] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   66.596702][ T5840] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   66.666898][ T5838] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.697882][   T54] Bluetooth: hci0: command tx timeout
[   66.735631][ T5838] 8021q: adding VLAN 0 to HW filter on device team0
[   66.745284][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.759563][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.762886][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.779929][   T54] Bluetooth: hci1: command tx timeout
[   66.786051][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.789153][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.823061][ T5833] 8021q: adding VLAN 0 to HW filter on device team0
[   66.847408][   T54] Bluetooth: hci2: command tx timeout
[   66.852608][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.855122][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.869033][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.878478][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.881044][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.911971][ T5840] 8021q: adding VLAN 0 to HW filter on device team0
[   66.943619][   T66] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.946430][   T66] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.965451][ T5833] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   66.970768][ T5833] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   67.002406][   T66] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.005361][   T66] bridge0: port 2(bridge_slave_1) entered forwarding state
[   67.056913][ T5840] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   67.077412][ T5840] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   67.169772][ T5838] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.225103][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.279283][ T5838] veth0_vlan: entered promiscuous mode
[   67.305750][ T5838] veth1_vlan: entered promiscuous mode
[   67.310920][ T5833] veth0_vlan: entered promiscuous mode
[   67.321362][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.334065][ T5833] veth1_vlan: entered promiscuous mode
[   67.371208][ T5838] veth0_macvtap: entered promiscuous mode
[   67.378654][ T5838] veth1_macvtap: entered promiscuous mode
[   67.414093][ T5833] veth0_macvtap: entered promiscuous mode
[   67.428817][ T5840] veth0_vlan: entered promiscuous mode
[   67.431849][ T5833] veth1_macvtap: entered promiscuous mode
[   67.439406][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.469480][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.476864][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.482005][ T5840] veth1_vlan: entered promiscuous mode
[   67.490191][ T5838] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.493998][ T5838] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.498508][ T5838] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.501987][ T5838] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.524573][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.552937][ T5833] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.556633][ T5833] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.562136][ T5833] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.565803][ T5833] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.580247][ T5840] veth0_macvtap: entered promiscuous mode
[   67.624117][ T5840] veth1_macvtap: entered promiscuous mode
[   67.678670][ T3010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.681430][ T3010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.698440][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.713016][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.730628][ T5840] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.734558][ T5840] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.744178][ T5840] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.747807][ T5840] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.762730][ T3010] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.765228][ T3010] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.797855][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.800732][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.846884][   T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.853443][   T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.868733][ T5838] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   67.889355][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.891901][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.968179][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.974522][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.980941][ T5901] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   68.506240][ T5931] syz_tun: entered allmulticast mode
[   68.519846][ T5930] syz_tun: left allmulticast mode
[   68.550525][ T5933] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15'.
[   68.614376][ T5937] syz.1.17 uses obsolete (PF_INET,SOCK_PACKET)
[   68.638813][ T5939] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18'.
[   68.641730][ T5939] netlink: 4 bytes leftover after parsing attributes in process `syz.0.18'.
[   68.659885][ T5939] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   68.662936][ T5939] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   68.665705][ T5939] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   68.669359][ T5939] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   68.770620][   T54] Bluetooth: hci0: command tx timeout
[   68.849356][   T54] Bluetooth: hci1: command tx timeout
[   68.887811][ T5950] Zero length message leads to an empty skb
[   68.927734][   T54] Bluetooth: hci2: command tx timeout
[   69.558494][ T5984] netlink: 128 bytes leftover after parsing attributes in process `syz.2.37'.
[   69.732912][ T5993] netlink: 240 bytes leftover after parsing attributes in process `syz.0.40'.
[   70.059531][ T6003] nbd1: detected capacity change from 0 to 127
[   70.070451][   T56] block nbd1: Receive control failed (result -32)
[   70.070709][ T5837] block nbd1: Send control failed (result -32)
[   70.076181][ T5837] block nbd1: Request send failed, requeueing
[   70.081498][  T129] block nbd1: Dead connection, failed to find a fallback
[   70.084207][  T129] block nbd1: shutting down sockets
[   70.086735][  T129] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.090512][  T129] Buffer I/O error on dev nbd1, logical block 0, async page read
[   70.094330][ T5837] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.100127][ T5837] Buffer I/O error on dev nbd1, logical block 1, async page read
[   70.104218][ T5837] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.109443][ T5837] Buffer I/O error on dev nbd1, logical block 2, async page read
[   70.112177][ T5837] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.115017][ T5837] Buffer I/O error on dev nbd1, logical block 3, async page read
[   70.119490][ T5837] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.122501][ T5837] Buffer I/O error on dev nbd1, logical block 0, async page read
[   70.125275][ T5837] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.130688][ T5837] Buffer I/O error on dev nbd1, logical block 1, async page read
[   70.133653][ T5837] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.136698][ T5837] Buffer I/O error on dev nbd1, logical block 2, async page read
[   70.141115][ T5837] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.144560][ T5837] Buffer I/O error on dev nbd1, logical block 3, async page read
[   70.147708][ T5837] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.152539][ T5837] Buffer I/O error on dev nbd1, logical block 0, async page read
[   70.156102][ T5837] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   70.160243][ T5837] Buffer I/O error on dev nbd1, logical block 1, async page read
[   70.166614][ T5837] ldm_validate_partition_table(): Disk read failed.
[   70.176761][ T5837] Dev nbd1: unable to read RDB block 0
[   70.181269][ T6012] geneve1: entered promiscuous mode
[   70.183472][ T6012] geneve1: entered allmulticast mode
[   70.188538][ T5837]  nbd1: unable to read partition table
[   70.203642][ T5837] ldm_validate_partition_table(): Disk read failed.
[   70.211317][ T5837] Dev nbd1: unable to read RDB block 0
[   70.215591][ T5837]  nbd1: unable to read partition table
[   70.354940][   T13] nci: nci_add_new_protocol: the target found does not have the desired protocol
[   70.847372][   T54] Bluetooth: hci0: command tx timeout
[   70.927292][   T54] Bluetooth: hci1: command tx timeout
[   71.007231][   T54] Bluetooth: hci2: command tx timeout
[   71.400618][ T6041] syzkaller1: entered promiscuous mode
[   71.403098][ T6041] syzkaller1: entered allmulticast mode
[   71.925819][ T6074] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   71.934715][ T6074] netlink: 28 bytes leftover after parsing attributes in process `syz.2.75'.
[   72.022943][    C0] IPv4: Oversized IP packet from 127.0.0.1
[   72.400067][ T6096] netlink: 4 bytes leftover after parsing attributes in process `syz.1.82'.
[   72.414262][ T6096] macvlan1: entered promiscuous mode
[   72.416745][ T6096] macvlan1: entered allmulticast mode
[   72.424210][ T6096] veth1_vlan: entered allmulticast mode
[   72.431837][ T6096] netlink: 4 bytes leftover after parsing attributes in process `syz.1.82'.
[   72.436022][ T6096] veth1_vlan: left allmulticast mode
[   72.453011][ T6096] veth1_vlan: left promiscuous mode
[   72.596923][ T6106] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   72.928956][   T54] Bluetooth: hci0: command tx timeout
[   73.008093][   T54] Bluetooth: hci1: command tx timeout
[   73.016012][ T6129] netlink: 'syz.0.100': attribute type 1 has an invalid length.
[   73.032183][ T6129] netlink: 'syz.0.100': attribute type 4 has an invalid length.
[   73.034653][ T6129] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.100'.
[   73.043380][ T6133] netlink: 8 bytes leftover after parsing attributes in process `syz.2.101'.
[   73.089869][   T54] Bluetooth: hci2: command tx timeout
[   73.364299][ T6152] vlan2: entered allmulticast mode
[   74.203250][ T6171] tipc: Started in network mode
[   74.205229][ T6171] tipc: Node identity ac14140f, cluster identity 4711
[   74.247886][ T6171] tipc: New replicast peer: 255.255.255.255
[   74.260491][ T6171] tipc: Enabled bearer <udp:syz2>, priority 10
[   74.263452][ T6172] __nla_validate_parse: 1 callbacks suppressed
[   74.263467][ T6172] netlink: 12 bytes leftover after parsing attributes in process `syz.2.117'.
[   74.278249][ T6172] tipc: Disabling bearer <udp:syz2>
[   75.045016][ T6174] netlink: 'syz.1.120': attribute type 1 has an invalid length.
[   75.048506][ T6174] netlink: 'syz.1.120': attribute type 2 has an invalid length.
[   75.083192][ T6176] netlink: 'syz.0.119': attribute type 1 has an invalid length.
[   75.086213][ T6176] netlink: 224 bytes leftover after parsing attributes in process `syz.0.119'.
[   75.886723][ T6204] tun0: tun_chr_ioctl cmd 1074025681
[   76.388017][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   76.390129][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   76.998339][ T6266] netlink: 830 bytes leftover after parsing attributes in process `syz.1.161'.
[   77.167522][ T6272] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   77.714309][ T6304] netlink: 16 bytes leftover after parsing attributes in process `syz.0.175'.
[   77.724407][ T6306] netlink: 4 bytes leftover after parsing attributes in process `syz.1.174'.
[   77.820861][    T9] cfg80211: failed to load regulatory.db
[   78.155715][ T6333] openvswitch: netlink: Geneve opt len 126 is not a multiple of 4.
[   78.959231][ T6379] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   79.010229][ T6383] netlink: 8 bytes leftover after parsing attributes in process `syz.2.212'.
[   79.025209][ T6383] syz_tun: entered allmulticast mode
[   79.134537][ T6392] openvswitch: netlink: IP tunnel TTL not specified.
[   79.176876][ T6393] Bluetooth: MGMT ver 1.23
[   79.191218][ T6393] netlink: 24 bytes leftover after parsing attributes in process `syz.1.216'.
[   79.256725][ T6396] netlink: 'syz.0.218': attribute type 10 has an invalid length.
[   79.289898][ T6396] netlink: 1041 bytes leftover after parsing attributes in process `syz.0.218'.
[   79.555570][ T6419] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000
[   79.746414][ T6435] netlink: 36 bytes leftover after parsing attributes in process `syz.2.235'.
[   79.759131][ T6433] netlink: 4 bytes leftover after parsing attributes in process `syz.1.233'.
[   79.989184][ T6453] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.244'.
[   80.242316][ T6470] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491
[   80.529269][ T6493] netlink: 16 bytes leftover after parsing attributes in process `syz.1.262'.
[   80.538584][ T6493] netlink: 16 bytes leftover after parsing attributes in process `syz.1.262'.
[   80.541632][ T6493] netlink: 128 bytes leftover after parsing attributes in process `syz.1.262'.
[   80.760404][ T6509] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[   80.764212][ T6509] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[   80.803499][ T6512] netlink: 16 bytes leftover after parsing attributes in process `syz.1.269'.
[   80.924167][ T6518] x_tables: unsorted underflow at hook 2
[   80.975820][ T6520] team0: Device gtp0 is of different type
[   81.249797][   T54] Bluetooth: hci0: Opcode 0x0c03 failed: -110
[   81.554549][ T6548] netlink: 20 bytes leftover after parsing attributes in process `syz.0.287'.
[   81.641130][ T6543] dvmrp8: entered allmulticast mode
[   81.664550][ T6542] dvmrp8: left allmulticast mode
[   81.789780][ T6558] netlink: 'syz.2.293': attribute type 30 has an invalid length.
[   82.089517][ T6576] netlink: 24 bytes leftover after parsing attributes in process `syz.1.302'.
[   82.288163][   T54] Bluetooth: hci2: command 0x0405 tx timeout
[   82.614597][ T6612] netlink: 'syz.0.319': attribute type 3 has an invalid length.
[   82.799239][ T6624] x_tables: arp_tables: .0 target: invalid size 8 (kernel) != (user) 0
[   83.333997][ T6645] xt_CT: You must specify a L4 protocol and not use inversions on it
[   83.622692][ T6663] tipc: Started in network mode
[   83.624841][ T6663] tipc: Node identity ac14142f, cluster identity 4711
[   83.628440][ T6663] tipc: New replicast peer: 0.0.0.0
[   83.631417][ T6663] tipc: Enabled bearer <udp:syz2>, priority 10
[   83.635416][ T6663] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00aa
[   83.918823][ T6684] netlink: 'syz.0.349': attribute type 15 has an invalid length.
[   83.926293][ T6683] netlink: 'syz.1.350': attribute type 1 has an invalid length.
[   84.749096][ T5884] tipc: Node number set to 2886997039
[   85.321319][ T6770] __nla_validate_parse: 3 callbacks suppressed
[   85.321330][ T6770] netlink: 14 bytes leftover after parsing attributes in process `syz.2.391'.
[   85.533672][ T6770] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   85.542673][ T6770] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   85.550828][ T6770] bond0 (unregistering): Released all slaves
[   86.055484][ T6812] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING
[   86.133858][ T6817] netlink: 4 bytes leftover after parsing attributes in process `syz.2.413'.
[   87.286368][ T6849] dummy0: entered allmulticast mode
[   87.667417][ T6858] netlink: 236 bytes leftover after parsing attributes in process `syz.1.432'.
[   87.671378][ T6858] netlink: 1 bytes leftover after parsing attributes in process `syz.1.432'.
[   88.134023][ T6890] netlink: 8 bytes leftover after parsing attributes in process `syz.2.447'.
[   88.217165][ T6897] netlink: 'syz.1.449': attribute type 10 has an invalid length.
[   88.227394][ T6897] netlink: 40 bytes leftover after parsing attributes in process `syz.1.449'.
[   88.262617][ T6890] syzkaller0: entered promiscuous mode
[   88.264651][ T6890] syzkaller0: entered allmulticast mode
[   88.276409][ T6897] bridge0: port 3(batadv0) entered blocking state
[   88.280423][ T6897] bridge0: port 3(batadv0) entered disabled state
[   88.284783][ T6897] batadv0: entered allmulticast mode
[   88.290768][ T6897] batadv0: entered promiscuous mode
[   88.292976][ T6897] bridge0: port 3(batadv0) entered blocking state
[   88.295501][ T6897] bridge0: port 3(batadv0) entered forwarding state
[   88.428837][ T6909] Cannot find del_set index 286 as target
[   88.651552][ T5844] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled
[   88.655510][ T5844] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled
[   90.015860][ T6921] bridge: RTM_NEWNEIGH with invalid ether address
[   90.192896][ T6928] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[   90.193206][ T6888] IPVS: starting estimator thread 0...
[   90.347411][ T6935] IPVS: using max 57 ests per chain, 136800 per kthread
[   90.533312][ T6955] netlink: 168 bytes leftover after parsing attributes in process `syz.1.467'.
[   90.810602][ T6977] netlink: 28 bytes leftover after parsing attributes in process `syz.1.475'.
[   90.834423][ T6977] netlink: 28 bytes leftover after parsing attributes in process `syz.1.475'.
[   91.205253][ T6984] netlink: 8 bytes leftover after parsing attributes in process `syz.0.476'.
[   91.564110][ T7022] netlink: 'syz.1.487': attribute type 2 has an invalid length.
[   91.605493][ T7024] netlink: 'syz.0.488': attribute type 5 has an invalid length.
[   91.706190][ T7020] syz_tun: left allmulticast mode
[   91.719539][ T7020] bridge0: port 2(bridge_slave_1) entered disabled state
[   91.723527][ T7020] bridge0: port 1(bridge_slave_0) entered disabled state
[   91.890821][ T7020] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   91.911399][ T7020] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   92.030465][ T7036] netlink: 20 bytes leftover after parsing attributes in process `syz.1.492'.
[   92.051119][ T7020] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   92.055403][ T7020] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   92.061335][ T7020] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   92.065060][ T7020] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   92.147930][ T7037] warning: `syz.1.492' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   92.451336][ T7059] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   92.601396][ T7067] netlink: 'syz.1.506': attribute type 1 has an invalid length.
[   92.612148][ T7067] netlink: 236 bytes leftover after parsing attributes in process `syz.1.506'.
[   92.773417][ T7079] netlink: 8 bytes leftover after parsing attributes in process `syz.2.511'.
[   92.776955][ T7079] netlink: 4 bytes leftover after parsing attributes in process `syz.2.511'.
[   92.782103][ T7079] netlink: 'syz.2.511': attribute type 18 has an invalid length.
[   92.991294][ T7085] netlink: 32 bytes leftover after parsing attributes in process `syz.2.513'.
[   93.916277][ T7135] netlink: 24 bytes leftover after parsing attributes in process `syz.2.536'.
[   94.789808][ T7181] ip6t_REJECT: TCP_RESET illegal for non-tcp
[   95.336918][ T7208] delete_channel: no stack
[   95.759251][ T7230] SET target dimension over the limit!
[   96.557312][ T7271] __nla_validate_parse: 7 callbacks suppressed
[   96.557328][ T7271] netlink: 12 bytes leftover after parsing attributes in process `syz.0.599'.
[   96.566515][ T7271] netlink: 'syz.0.599': attribute type 20 has an invalid length.
[   96.649265][ T7271] netlink: 12 bytes leftover after parsing attributes in process `syz.0.599'.
[   96.652031][ T7271] netlink: 'syz.0.599': attribute type 20 has an invalid length.
[   97.003092][ T7294] netlink: 4 bytes leftover after parsing attributes in process `syz.0.605'.
[   97.006171][ T7294] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   97.009102][ T7294] batman_adv: batadv0: Removing interface: batadv_slave_0
[   97.018268][ T7294] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   97.020694][ T7294] batman_adv: batadv0: Removing interface: batadv_slave_1
[   97.261854][ T7312] netlink: 'syz.0.613': attribute type 2 has an invalid length.
[   97.265093][ T7312] netlink: 244 bytes leftover after parsing attributes in process `syz.0.613'.
[   97.593058][ T7329] vlan2: entered promiscuous mode
[   97.595518][ T7329] vlan2: entered allmulticast mode
[   97.603226][ T7329] hsr_slave_1: entered allmulticast mode
[   97.673154][ T7329] netlink: 4 bytes leftover after parsing attributes in process `syz.0.621'.
[   97.809250][ T7335] ip6gre1: entered promiscuous mode
[   97.848785][ T7335] netlink: 8 bytes leftover after parsing attributes in process `syz.1.624'.
[   97.852421][ T7335] netlink: 8 bytes leftover after parsing attributes in process `syz.1.624'.
[   98.375443][ T7367] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[   98.380851][ T7367] macsec1: entered promiscuous mode
[   98.383273][ T7367] macsec1: entered allmulticast mode
[   98.385353][ T7367] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode
[   98.989837][ T7399] xt_hashlimit: max too large, truncated to 1048576
[   98.993253][ T7399] Cannot find add_set index 3 as target
[   99.136494][ T7408] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[   99.391261][ T7430] netlink: 'syz.1.667': attribute type 142 has an invalid length.
[   99.507823][ T7439] netlink: 24 bytes leftover after parsing attributes in process `syz.0.671'.
[   99.615996][ T7445] lo: entered promiscuous mode
[   99.621024][ T7445] lo: entered allmulticast mode
[   99.812239][ T7455] xt_CT: You must specify a L4 protocol and not use inversions on it
[  100.242006][ T7478] netlink: 'syz.0.689': attribute type 1 has an invalid length.
[  100.244510][ T7478] netlink: 244 bytes leftover after parsing attributes in process `syz.0.689'.
[  100.426511][ T7488] netlink: 8 bytes leftover after parsing attributes in process `syz.2.694'.
[  101.186637][ T7535] syzkaller1: entered promiscuous mode
[  101.189842][ T7535] syzkaller1: entered allmulticast mode
[  102.070691][ T7585] C: renamed from lo
[  102.075413][ T7585] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[  102.443696][   T12] nci: nci_rsp_packet: unknown rsp opcode 0x204
[  103.335293][ T7627] __nla_validate_parse: 3 callbacks suppressed
[  103.335313][ T7627] netlink: 64 bytes leftover after parsing attributes in process `syz.0.744'.
[  103.638264][ T7647] netlink: 'syz.2.754': attribute type 3 has an invalid length.
[  103.645556][ T7649] netlink: 8 bytes leftover after parsing attributes in process `syz.1.755'.
[  104.931188][ T7698] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  105.080759][ T7721] netlink: 'syz.0.782': attribute type 14 has an invalid length.
[  105.116845][ T7721] netlink: 'syz.0.782': attribute type 14 has an invalid length.
[  105.278686][ T7736] netlink: 16 bytes leftover after parsing attributes in process `syz.0.788'.
[  105.506348][ T7754] netlink: 'syz.0.796': attribute type 23 has an invalid length.
[  105.539286][ T7756] netlink: 24 bytes leftover after parsing attributes in process `syz.1.798'.
[  105.605839][ T7756] netlink: 68 bytes leftover after parsing attributes in process `syz.1.798'.
[  105.606901][ T7762] netlink: 'syz.0.800': attribute type 7 has an invalid length.
[  105.613539][ T7762] netlink: 'syz.0.800': attribute type 3 has an invalid length.
[  105.615980][ T7762] netlink: 224 bytes leftover after parsing attributes in process `syz.0.800'.
[  105.933275][ T7786] netlink: 'syz.0.811': attribute type 1 has an invalid length.
[  105.959406][ T7786] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link
[  105.966706][   T12] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  105.973378][ T7786] 8021q: adding VLAN 0 to HW filter on device bond2
[  106.007610][ T7786] veth3: entered promiscuous mode
[  106.015120][ T7786] bond2: (slave veth3): Enslaving as a backup interface with a down link
[  106.088583][   T12] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  106.214969][ T7807] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-rr(0)
[  106.222595][ T7807] netlink: 8 bytes leftover after parsing attributes in process `syz.2.818'.
[  106.226001][ T7807] netlink: 12 bytes leftover after parsing attributes in process `syz.2.818'.
[  106.349943][ T7819] ieee802154 phy0 wpan0: encryption failed: -22
[  106.534286][ T7837] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic
[  106.666147][ T7850] netlink: 16 bytes leftover after parsing attributes in process `syz.2.836'.
[  106.669876][ T7850] netlink: 16 bytes leftover after parsing attributes in process `syz.2.836'.
[  106.747945][ T7857] 8021q: adding VLAN 0 to HW filter on device bond0
[  106.759891][ T7857] bond0: (slave ip_vti0): The slave device specified does not support setting the MAC address
[  106.764874][ T7857] bond0: (slave ip_vti0): Error -95 calling set_mac_address
[  107.410798][ T7916] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  107.689095][ T7940] wireguard0: entered promiscuous mode
[  107.691276][ T7940] wireguard0: entered allmulticast mode
[  107.845748][ T7950] ip6erspan0: entered allmulticast mode
[  108.353456][ T7972] trusted_key: syz.1.887 sent an empty control message without MSG_MORE.
[  108.433931][ T7976] __nla_validate_parse: 3 callbacks suppressed
[  108.434051][ T7976] netlink: 60 bytes leftover after parsing attributes in process `syz.1.888'.
[  108.441792][ T7976] netlink: 35 bytes leftover after parsing attributes in process `syz.1.888'.
[  108.615742][ T7986] netlink: 'syz.1.890': attribute type 13 has an invalid length.
[  108.619367][ T7986] netlink: 'syz.1.890': attribute type 17 has an invalid length.
[  108.732467][ T7986] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  108.812514][ T7990] netlink: 'syz.0.895': attribute type 3 has an invalid length.
[  108.815572][ T7990] netlink: 'syz.0.895': attribute type 3 has an invalid length.
[  108.868666][ T7978] netlink: 16 bytes leftover after parsing attributes in process `syz.1.890'.
[  109.039839][ T7999] netlink: 256 bytes leftover after parsing attributes in process `syz.1.899'.
[  109.268887][ T8015] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.907'.
[  109.694666][ T8040] netlink: 'syz.2.918': attribute type 1 has an invalid length.
[  109.701947][ T8042] Illegal XDP return value 4294967274 on prog  (id 132) dev N/A, expect packet loss!
[  109.709511][ T8042] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  109.994742][ T8057] Cannot find add_set index 2 as target
[  110.104191][ T8067] netlink: 28 bytes leftover after parsing attributes in process `syz.0.932'.
[  110.107472][ T8067] netlink: 'syz.0.932': attribute type 7 has an invalid length.
[  110.110108][ T8067] netlink: 'syz.0.932': attribute type 8 has an invalid length.
[  110.112665][ T8067] netlink: 4 bytes leftover after parsing attributes in process `syz.0.932'.
[  110.164413][ T8072] netlink: 20 bytes leftover after parsing attributes in process `syz.0.934'.
[  110.249200][ T8072] nbd: socks must be embedded in a SOCK_ITEM attr
[  110.255661][ T5837] block nbd64: NBD_DISCONNECT
[  110.279584][   T66] 
[  110.280638][   T66] ======================================================
[  110.283314][   T66] WARNING: possible circular locking dependency detected
[  110.285923][   T66] 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 Not tainted
[  110.289471][   T66] ------------------------------------------------------
[  110.292497][   T66] kworker/u10:4/66 is trying to acquire lock:
[  110.294799][   T66] ffff88811b1f2358 (&disk->open_mutex){+.+.}-{4:4}, at: __del_gendisk+0x129/0x9e0
[  110.298330][   T66] 
[  110.298330][   T66] but task is already holding lock:
[  110.301141][   T66] ffff88811bfdc188 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160
[  110.304774][   T66] 
[  110.304774][   T66] which lock already depends on the new lock.
[  110.304774][   T66] 
[  110.308712][   T66] 
[  110.308712][   T66] the existing dependency chain (in reverse order) is:
[  110.312433][   T66] 
[  110.312433][   T66] -> #2 (&set->update_nr_hwq_lock){++++}-{4:4}:
[  110.315532][   T66]        lock_acquire+0x120/0x360
[  110.317489][   T66]        down_write+0x96/0x1f0
[  110.319359][   T66]        blk_mq_update_nr_hw_queues+0x3b/0x14c0
[  110.321933][   T66]        nbd_start_device+0x16c/0xac0
[  110.324074][   T66]        nbd_genl_connect+0x1250/0x1930
[  110.326280][   T66]        genl_family_rcv_msg_doit+0x215/0x300
[  110.328674][   T66]        genl_rcv_msg+0x60e/0x790
[  110.330650][   T66]        netlink_rcv_skb+0x208/0x470
[  110.332768][   T66]        genl_rcv+0x28/0x40
[  110.334620][   T66]        netlink_unicast+0x75c/0x8e0
[  110.336685][   T66]        netlink_sendmsg+0x805/0xb30
[  110.338705][   T66]        __sock_sendmsg+0x21c/0x270
[  110.340733][   T66]        ____sys_sendmsg+0x505/0x830
[  110.342382][   T66]        ___sys_sendmsg+0x21f/0x2a0
[  110.344706][   T66]        __x64_sys_sendmsg+0x19b/0x260
[  110.346405][   T66]        do_syscall_64+0xfa/0x3b0
[  110.347958][   T66]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.349954][   T66] 
[  110.349954][   T66] -> #1 (&nbd->config_lock){+.+.}-{4:4}:
[  110.352429][   T66]        lock_acquire+0x120/0x360
[  110.354160][   T66]        __mutex_lock+0x182/0xe80
[  110.355717][   T66]        refcount_dec_and_mutex_lock+0x30/0xa0
[  110.357653][   T66]        nbd_config_put+0x2c/0x790
[  110.359215][   T66]        nbd_release+0xfe/0x140
[  110.360771][   T66]        bdev_release+0x536/0x650
[  110.362394][   T66]        blkdev_release+0x15/0x20
[  110.363940][   T66]        __fput+0x44c/0xa70
[  110.365393][   T66]        fput_close_sync+0x119/0x200
[  110.367024][   T66]        __x64_sys_close+0x7f/0x110
[  110.368640][   T66]        do_syscall_64+0xfa/0x3b0
[  110.370227][   T66]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.372286][   T66] 
[  110.372286][   T66] -> #0 (&disk->open_mutex){+.+.}-{4:4}:
[  110.375147][   T66]        validate_chain+0xb9b/0x2140
[  110.377489][   T66]        __lock_acquire+0xab9/0xd20
[  110.379526][   T66]        lock_acquire+0x120/0x360
[  110.381890][   T66]        __mutex_lock+0x182/0xe80
[  110.383896][   T66]        __del_gendisk+0x129/0x9e0
[  110.385668][   T66]        del_gendisk+0xe8/0x160
[  110.387257][   T66]        nbd_dev_remove_work+0x47/0xe0
[  110.389254][   T66]        process_scheduled_works+0xae1/0x17b0
[  110.391752][   T66]        worker_thread+0x8a0/0xda0
[  110.393531][   T66]        kthread+0x711/0x8a0
[  110.395163][   T66]        ret_from_fork+0x3fc/0x770
[  110.396821][   T66]        ret_from_fork_asm+0x1a/0x30
[  110.398704][   T66] 
[  110.398704][   T66] other info that might help us debug this:
[  110.398704][   T66] 
[  110.401844][   T66] Chain exists of:
[  110.401844][   T66]   &disk->open_mutex --> &nbd->config_lock --> &set->update_nr_hwq_lock
[  110.401844][   T66] 
[  110.406817][   T66]  Possible unsafe locking scenario:
[  110.406817][   T66] 
[  110.409197][   T66]        CPU0                    CPU1
[  110.410888][   T66]        ----                    ----
[  110.412926][   T66]   rlock(&set->update_nr_hwq_lock);
[  110.414655][   T66]                                lock(&nbd->config_lock);
[  110.416885][   T66]                                lock(&set->update_nr_hwq_lock);
[  110.419654][   T66]   lock(&disk->open_mutex);
[  110.421549][   T66] 
[  110.421549][   T66]  *** DEADLOCK ***
[  110.421549][   T66] 
[  110.424763][   T66] 3 locks held by kworker/u10:4/66:
[  110.427190][   T66]  #0: ffff888020a84148 ((wq_completion)nbd-del){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  110.431629][   T66]  #1: ffffc9000174fbc0 ((work_completion)(&nbd->remove_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  110.435861][   T66]  #2: ffff88811bfdc188 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160
[  110.439366][   T66] 
[  110.439366][   T66] stack backtrace:
[  110.441183][   T66] CPU: 1 UID: 0 PID: 66 Comm: kworker/u10:4 Not tainted 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 PREEMPT(full) 
[  110.441196][   T66] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  110.441204][   T66] Workqueue: nbd-del nbd_dev_remove_work
[  110.441223][   T66] Call Trace:
[  110.441230][   T66]  <TASK>
[  110.441250][   T66]  dump_stack_lvl+0x189/0x250
[  110.441265][   T66]  ? __pfx_dump_stack_lvl+0x10/0x10
[  110.441279][   T66]  ? __pfx__printk+0x10/0x10
[  110.441290][   T66]  ? print_lock_name+0xde/0x100
[  110.441301][   T66]  print_circular_bug+0x2ee/0x310
[  110.441314][   T66]  check_noncircular+0x134/0x160
[  110.441325][   T66]  validate_chain+0xb9b/0x2140
[  110.441336][   T66]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  110.441350][   T66]  ? arch_stack_walk+0x11c/0x150
[  110.441363][   T66]  __lock_acquire+0xab9/0xd20
[  110.441372][   T66]  ? __del_gendisk+0x129/0x9e0
[  110.441383][   T66]  lock_acquire+0x120/0x360
[  110.441391][   T66]  ? __del_gendisk+0x129/0x9e0
[  110.441401][   T66]  ? check_path+0x21/0x40
[  110.441411][   T66]  __mutex_lock+0x182/0xe80
[  110.441421][   T66]  ? __del_gendisk+0x129/0x9e0
[  110.441432][   T66]  ? __del_gendisk+0x129/0x9e0
[  110.441442][   T66]  ? __pfx___mutex_lock+0x10/0x10
[  110.441450][   T66]  ? __pfx___might_resched+0x10/0x10
[  110.441462][   T66]  ? __lock_acquire+0xab9/0xd20
[  110.441469][   T66]  ? disk_del_events+0xb5/0x210
[  110.441481][   T66]  ? __del_gendisk+0xc1/0x9e0
[  110.441491][   T66]  __del_gendisk+0x129/0x9e0
[  110.441501][   T66]  ? del_gendisk+0xe0/0x160
[  110.441511][   T66]  ? __pfx___del_gendisk+0x10/0x10
[  110.441522][   T66]  ? down_read+0x1ad/0x2e0
[  110.441531][   T66]  del_gendisk+0xe8/0x160
[  110.441541][   T66]  nbd_dev_remove_work+0x47/0xe0
[  110.441550][   T66]  ? process_scheduled_works+0x9ef/0x17b0
[  110.441560][   T66]  process_scheduled_works+0xae1/0x17b0
[  110.441574][   T66]  ? __pfx_process_scheduled_works+0x10/0x10
[  110.441586][   T66]  worker_thread+0x8a0/0xda0
[  110.441596][   T66]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  110.441612][   T66]  ? __kthread_parkme+0x7b/0x200
[  110.441623][   T66]  kthread+0x711/0x8a0
[  110.441635][   T66]  ? __pfx_worker_thread+0x10/0x10
[  110.441644][   T66]  ? __pfx_kthread+0x10/0x10
[  110.441654][   T66]  ? _raw_spin_unlock_irq+0x23/0x50
[  110.441666][   T66]  ? lockdep_hardirqs_on+0x9c/0x150
[  110.441674][   T66]  ? __pfx_kthread+0x10/0x10
[  110.441685][   T66]  ret_from_fork+0x3fc/0x770
[  110.441694][   T66]  ? __pfx_ret_from_fork+0x10/0x10
[  110.441703][   T66]  ? __switch_to_asm+0x39/0x70
[  110.441713][   T66]  ? __switch_to_asm+0x33/0x70
[  110.441723][   T66]  ? __pfx_kthread+0x10/0x10
[  110.441733][   T66]  ret_from_fork_asm+0x1a/0x30
[  110.441747][   T66]  </TASK>
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  116.694001][ T5862] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  116.697319][ T5862] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  116.761055][ T5862] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  116.765194][ T5862] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  116.803692][ T5862] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  116.806840][ T5862] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  116.863984][ T5862] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  116.869180][ T5862] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  116.934702][ T5862] bridge_slave_1: left allmulticast mode
[  116.936823][ T5862] bridge_slave_1: left promiscuous mode
[  116.944913][ T5862] bridge0: port 2(bridge_slave_1) entered disabled state
[  116.959958][ T5862] bridge_slave_0: left allmulticast mode
[  116.962188][ T5862] bridge_slave_0: left promiscuous mode
[  116.964327][ T5862] bridge0: port 1(bridge_slave_0) entered disabled state
[  117.013291][ T5862] bond2 (unregistering): (slave ip6gretap1): Removing an active aggregator
[  117.020980][ T5862] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface
[  117.024253][ T5862] bond2 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - be:c0:66:d0:3b:7f - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  117.114751][ T5862] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  117.119400][ T5862] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  117.123333][ T5862] bond0 (unregistering): Released all slaves
[  117.129696][ T5862] bond1 (unregistering): Released all slaves
[  117.140078][ T5862] bond2 (unregistering): (slave veth3): Releasing backup interface
[  117.144645][ T5862] bond2 (unregistering): Released all slaves
[  117.305848][ T5862] mac80211_hwsim hwsim4 wlan0 (unregistering): left allmulticast mode
[  117.360600][ T5862] hsr_slave_0: left promiscuous mode
[  117.364603][ T5862] veth1_macvtap: left promiscuous mode
[  117.366361][ T5862] veth0_macvtap: left promiscuous mode
[  117.368672][ T5862] veth1_vlan: left promiscuous mode
[  117.370590][ T5862] veth0_vlan: left promiscuous mode
[  117.519671][ T5862] team0 (unregistering): Port device team_slave_1 removed
[  117.539173][ T5862] team0 (unregistering): Port device team_slave_0 removed

VM DIAGNOSIS:
12:50:16  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000001 RBX=ffffffff8222078e RCX=e84127a8afae0a00 RDX=ffffc90003d0f801
RSI=ffffffff8be28c20 RDI=ffffffff8222078e RBP=ffffc90003d0f850 RSP=ffffc90003d0f798
R8 =ffffc90003d0f900 R9 =0000000000000000 R10=ffffc90003d0f818 R11=fffff520007a1f05
R12=ffff88801ef3b980 R13=0000000000000000 R14=dffffc0000000000 R15=1ffff920007a1f02
RIP=ffffffff818d4cec RFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555578e23500 ffffffff 00c00000
GS =0000 ffff8880b8626000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c3c35f6 CR3=0000000025c6e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=ffffffffffffffff ffff00ff00000000 XMM05=0000000000000031 0000000000313230
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffff000000 XMM09=6c696b66722f3031 7968702f31313230
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=1ffffffff33be605 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9
RSI=0000000000000000 RDI=0000000000000020 RBP=ffffc9000174eff0 RSP=ffffc9000174ee18
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff85460ce0
R12=dffffc0000000000 R13=dffffc0000000000 R14=ffffffff99df32e0 R15=0000000000000000
RIP=ffffffff85460d57 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c26000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffdceac2030 CR3=00000000289d2000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007fe425411ec1
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
