last executing test programs:

539.851611ms ago: executing program 0 (id=292):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2})
ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x4d, 0x1, 0x3, 0x80000000}, {0x61}, {}, {0x2}, {0x6}]})

440.329249ms ago: executing program 0 (id=294):
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
socket$inet_sctp(0x2, 0x5, 0x84)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20004015}, 0x2404c8c0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41000, 0xc8302b063a7e25fe, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x200008, 0x5, 0x1}, 0x10}, 0x94)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r0], 0x4c}}, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0)

389.725149ms ago: executing program 0 (id=296):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r0, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={<r1=>0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x7, @loopback}]}, &(0x7f0000000280)=0x10)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000080)={r1, 0x7f}, &(0x7f0000000180)=0x8)

320.598165ms ago: executing program 2 (id=298):
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c)
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x37}, 0x1}, 0x1c)
bind$inet6(r1, &(0x7f0000000040)={0xa, 0xe22, 0x4000003, @mcast1}, 0x1c)

320.225128ms ago: executing program 0 (id=300):
socket$netlink(0x10, 0x3, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x2}, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a0000000c0000800800", @ANYRES16=r0], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0)

256.625925ms ago: executing program 1 (id=301):
socket(0x18, 0x2, 0x3)

256.422338ms ago: executing program 2 (id=302):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan0\x00', <r1=>0x0})
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_ADD_DEV(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x1c, r3, 0x852dd6c070cd7e4d, 0x0, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x1c}, 0x4, 0x700000000000000, 0x0, 0x20000090}, 0x850)

256.202644ms ago: executing program 0 (id=303):
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94)
r0 = socket$inet6(0xa, 0x3, 0x8000000003c)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000240)='syzkaller\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x1300, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

198.665364ms ago: executing program 2 (id=304):
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x1ff, 0x4)
bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xffffffff}, 0x1c)
r1 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x1}]}, 0x10)
bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e20, 0x4000b, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x12}}, 0x80ad}, 0x1c)

198.517337ms ago: executing program 1 (id=305):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r0, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000000600)={0x14, 0x1b, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x3ffe}]}, 0x14}], 0x1}, 0x0)

147.602805ms ago: executing program 2 (id=306):
sendto$inet6(0xffffffffffffffff, 0x0, 0xfffffffffffffd2f, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$bt_hci(r0, 0x84, 0x84, &(0x7f0000000080)=""/4096, &(0x7f0000001200)=0x1000)

147.291863ms ago: executing program 2 (id=307):
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4)
setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000180)=@req={0x0, 0x6, 0x5, 0x8}, 0x10)

80.303623ms ago: executing program 1 (id=308):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001a00010000000000fdffffff0a000000", @ANYRES32=0x0, @ANYBLOB="000000091400030007"], 0x30}}, 0x0)

80.13996ms ago: executing program 1 (id=309):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48)
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000040000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000530000008500000005000000bca90000000000003509020000d44a6be5000d0000000000b702000000000000739af0ff00000000c509040004100000c3aaf0ff00000000bf8600000000000007080000f8ffffffbfa400000000000007060000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

784.794µs ago: executing program 1 (id=310):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
shutdown(r0, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={<r1=>0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000080)=0x10)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000180)={r1, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x9, 0x0, 0x81, 0x693fffd, 0x80, 0x9}, &(0x7f0000000380)=0x9c)

438.107µs ago: executing program 2 (id=311):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800dd8d00000000000000000200000000000005000800000600150005000000280016"], 0x4c}}, 0x0)

274.016µs ago: executing program 1 (id=312):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendmmsg$inet6(r0, &(0x7f0000001c80)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x8000001, @private0, 0x3}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f0000000300)={0xa, 0x4e24, 0x1, @dev={0xfe, 0x80, '\x00', 0x28}, 0x8}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000800)='M', 0x1}], 0x1}}], 0x2, 0x931766f6319eed40)
shutdown(r0, 0x1)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, [0x6, 0x7, 0x3, 0x7fffffffffffffff, 0x80000001, 0x6, 0x8, 0x9, 0x29f9238, 0xfffffffffffffffe, 0x8000000000000000, 0x5, 0xcc76, 0x0, 0x912]}, &(0x7f0000000100)=0x100)

0s ago: executing program 0 (id=313):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48)
mmap(&(0x7f0000f21000/0x4000)=nil, 0x4000, 0x3000000, 0x11, r0, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:1306' (ED25519) to the list of known hosts.
syzkaller login: [   48.813676][ T5785] cgroup: Unknown subsys name 'net'
[   48.939984][ T5785] cgroup: Unknown subsys name 'cpuset'
[   48.943816][ T5785] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.746493][ T5785] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   55.075410][ T5218] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   55.078852][ T5218] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   55.093608][ T5835] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   55.116308][ T5838] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   55.120126][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   55.123750][ T5838] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   55.124280][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   55.127943][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   55.130114][ T5839] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   55.133945][ T5838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   55.136176][ T5839] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   55.141152][ T5839] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   55.178987][   T54] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   55.183406][   T54] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   55.187052][   T54] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   55.409780][ T5840] chnl_net:caif_netlink_parms(): no params data found
[   55.431040][ T5832] chnl_net:caif_netlink_parms(): no params data found
[   55.552291][ T5836] chnl_net:caif_netlink_parms(): no params data found
[   55.618579][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.621762][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.624994][ T5840] bridge_slave_0: entered allmulticast mode
[   55.630047][ T5840] bridge_slave_0: entered promiscuous mode
[   55.648923][ T5832] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.651280][ T5832] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.654209][ T5832] bridge_slave_0: entered allmulticast mode
[   55.658646][ T5832] bridge_slave_0: entered promiscuous mode
[   55.672596][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.675079][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.677830][ T5840] bridge_slave_1: entered allmulticast mode
[   55.680539][ T5840] bridge_slave_1: entered promiscuous mode
[   55.690717][ T5832] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.693751][ T5832] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.697526][ T5832] bridge_slave_1: entered allmulticast mode
[   55.700333][ T5832] bridge_slave_1: entered promiscuous mode
[   55.734550][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.753643][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.772986][ T5832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.803666][ T5832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.850138][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.853340][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.856564][ T5836] bridge_slave_0: entered allmulticast mode
[   55.862210][ T5836] bridge_slave_0: entered promiscuous mode
[   55.881040][ T5840] team0: Port device team_slave_0 added
[   55.883997][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.887951][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.890873][ T5836] bridge_slave_1: entered allmulticast mode
[   55.894921][ T5836] bridge_slave_1: entered promiscuous mode
[   55.902629][ T5832] team0: Port device team_slave_0 added
[   55.907193][ T5840] team0: Port device team_slave_1 added
[   55.923930][ T5832] team0: Port device team_slave_1 added
[   55.969264][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.000660][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.005187][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.008840][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.020187][ T5832] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.026039][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.029357][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.040362][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.060693][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.063741][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.075779][ T5832] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.081177][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.083855][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.095279][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.138789][ T5836] team0: Port device team_slave_0 added
[   56.142835][ T5836] team0: Port device team_slave_1 added
[   56.164033][ T5832] hsr_slave_0: entered promiscuous mode
[   56.167503][ T5832] hsr_slave_1: entered promiscuous mode
[   56.226425][ T5840] hsr_slave_0: entered promiscuous mode
[   56.230167][ T5840] hsr_slave_1: entered promiscuous mode
[   56.233348][ T5840] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   56.237839][ T5840] Cannot create hsr debugfs directory
[   56.251466][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.253988][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.264634][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.270652][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.273088][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.282312][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.399628][ T5836] hsr_slave_0: entered promiscuous mode
[   56.402600][ T5836] hsr_slave_1: entered promiscuous mode
[   56.404938][ T5836] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   56.407977][ T5836] Cannot create hsr debugfs directory
[   56.544976][ T5832] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   56.574439][ T5832] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   56.598777][ T5832] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   56.604775][ T5832] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   56.664876][ T5840] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   56.672633][ T5840] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   56.679549][ T5840] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   56.694359][ T5840] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   56.738194][ T5836] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.742572][ T5836] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.754016][ T5836] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.764744][ T5836] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.892019][ T5832] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.918377][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.925127][ T5832] 8021q: adding VLAN 0 to HW filter on device team0
[   56.942753][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.945261][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.968136][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.972786][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.975991][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.989397][ T5840] 8021q: adding VLAN 0 to HW filter on device team0
[   57.002267][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.005297][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.022503][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.025542][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.048369][ T5836] 8021q: adding VLAN 0 to HW filter on device team0
[   57.080908][ T2248] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.083815][ T2248] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.089367][ T2248] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.092370][ T2248] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.111089][ T5832] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   57.142715][ T5840] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   57.148036][ T5840] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   57.197757][   T54] Bluetooth: hci1: command tx timeout
[   57.200473][   T54] Bluetooth: hci0: command tx timeout
[   57.202923][   T54] Bluetooth: hci2: command tx timeout
[   57.304310][ T5832] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.355062][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.374742][ T5832] veth0_vlan: entered promiscuous mode
[   57.385922][ T5832] veth1_vlan: entered promiscuous mode
[   57.422233][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.429543][ T5832] veth0_macvtap: entered promiscuous mode
[   57.443834][ T5832] veth1_macvtap: entered promiscuous mode
[   57.450051][ T5840] veth0_vlan: entered promiscuous mode
[   57.464522][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.473587][ T5840] veth1_vlan: entered promiscuous mode
[   57.478765][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.485254][ T5832] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.489776][ T5832] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.492454][ T5832] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.495290][ T5832] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.572983][ T5836] veth0_vlan: entered promiscuous mode
[   57.578110][ T5840] veth0_macvtap: entered promiscuous mode
[   57.608609][ T2248] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.610113][ T5840] veth1_macvtap: entered promiscuous mode
[   57.611864][ T2248] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.615688][ T5836] veth1_vlan: entered promiscuous mode
[   57.652270][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.655009][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.660900][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.669982][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.676280][ T5836] veth0_macvtap: entered promiscuous mode
[   57.684609][ T5840] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.688905][ T5840] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.692412][ T5840] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.695389][ T5840] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.702224][ T5836] veth1_macvtap: entered promiscuous mode
[   57.715525][ T5832] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   57.731367][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.752307][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.770241][ T5836] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.773199][ T5836] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.776034][ T5836] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.788557][ T5836] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.871780][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.874920][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.932747][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.935676][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.994656][ T1092] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.999303][ T1092] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.044255][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.047477][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.102636][ T5914] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3'.
[   58.149220][ T5916] netlink: 'syz.0.1': attribute type 4 has an invalid length.
[   58.816805][ T5958] openvswitch: netlink: nsh attribute has 2 unknown bytes.
[   58.914327][ T5966] netlink: 24 bytes leftover after parsing attributes in process `syz.0.27'.
[   58.920599][ T5966] netlink: 'syz.0.27': attribute type 1 has an invalid length.
[   58.924227][ T5966] netlink: 'syz.0.27': attribute type 2 has an invalid length.
[   58.929139][ T5966] netlink: 16 bytes leftover after parsing attributes in process `syz.0.27'.
[   59.002285][ T5969] netlink: 28 bytes leftover after parsing attributes in process `syz.1.29'.
[   59.005044][ T5969] openvswitch: netlink: Flow key attr not present in new flow.
[   59.112258][ T5979] Driver unsupported XDP return value 0 on prog  (id 5) dev N/A, expect packet loss!
[   59.277752][ T5218] Bluetooth: hci2: command tx timeout
[   59.279656][ T5218] Bluetooth: hci0: command tx timeout
[   59.281508][ T5218] Bluetooth: hci1: command tx timeout
[   59.647008][ T6020] dvmrp0: entered allmulticast mode
[   59.720599][ T6025] wg1 speed is unknown, defaulting to 1000
[   59.723008][ T6025] wg1 speed is unknown, defaulting to 1000
[   59.731726][ T6025] wg1 speed is unknown, defaulting to 1000
[   59.735989][ T6025] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   59.744659][ T6025] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[   59.773974][ T6025] wg1 speed is unknown, defaulting to 1000
[   59.782196][ T6025] wg1 speed is unknown, defaulting to 1000
[   59.784925][ T6025] wg1 speed is unknown, defaulting to 1000
[   59.853243][ T6038] sctp: [Deprecated]: syz.0.61 (pid 6038) Use of struct sctp_assoc_value in delayed_ack socket option.
[   59.853243][ T6038] Use struct sctp_sack_info instead
[   59.932320][ T6043] Zero length message leads to an empty skb
[   59.986308][ T6047] syz.2.65 uses obsolete (PF_INET,SOCK_PACKET)
[   60.037027][ T6052] warning: `syz.0.66' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   60.203480][ T6059] wg1 speed is unknown, defaulting to 1000
[   60.375787][ T6063] erspan0: entered promiscuous mode
[   60.380193][ T6063] batman_adv: batadv0: Adding interface: macvlan2
[   60.382511][ T6063] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   60.393647][ T6063] batman_adv: batadv0: Interface activated: macvlan2
[   60.430343][ T6063] netlink: 12 bytes leftover after parsing attributes in process `syz.1.70'.
[   60.775229][ T6070] Bluetooth: MGMT ver 1.23
[   60.934259][ T6074] GUP no longer grows the stack in syz.1.75 (6074): 200000006000-20000000a000 (200000005000)
[   60.950702][ T6074] CPU: 0 UID: 0 PID: 6074 Comm: syz.1.75 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   60.950723][ T6074] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   60.950730][ T6074] Call Trace:
[   60.950737][ T6074]  <TASK>
[   60.950743][ T6074]  dump_stack_lvl+0x189/0x250
[   60.950767][ T6074]  ? __pfx_dump_stack_lvl+0x10/0x10
[   60.950782][ T6074]  ? __pfx__printk+0x10/0x10
[   60.950798][ T6074]  ? find_vma+0xe7/0x160
[   60.950825][ T6074]  __get_user_pages+0x2a60/0x30b0
[   60.950898][ T6074]  ? __pfx___get_user_pages+0x10/0x10
[   60.950913][ T6074]  ? __gup_longterm_locked+0xbf7/0x15b0
[   60.950926][ T6074]  ? down_read_killable+0x1d1/0x350
[   60.950939][ T6074]  ? try_get_folio+0x633/0x660
[   60.950956][ T6074]  __gup_longterm_locked+0xd66/0x15b0
[   60.950973][ T6074]  ? try_grab_folio_fast+0x1be/0x4f0
[   60.950994][ T6074]  ? gup_fast_fallback+0x1afc/0x2260
[   60.951008][ T6074]  gup_fast_fallback+0x1cd4/0x2260
[   60.951058][ T6074]  ? __pfx_gup_fast_fallback+0x10/0x10
[   60.951070][ T6074]  ? trace_contention_end+0x39/0x120
[   60.951086][ T6074]  ? __mutex_lock+0x330/0xe80
[   60.951099][ T6074]  ? futex_unqueue+0x22/0x240
[   60.951114][ T6074]  ? futex_unqueue+0x22/0x240
[   60.951127][ T6074]  ? futex_unqueue+0x22/0x240
[   60.951140][ T6074]  ? is_valid_gup_args+0x11f/0x200
[   60.951154][ T6074]  ? get_user_pages_fast+0x4d/0xb0
[   60.951167][ T6074]  __iov_iter_get_pages_alloc+0x39a/0xb40
[   60.951188][ T6074]  ? __pfx_pipe_clear_nowait+0x10/0x10
[   60.951204][ T6074]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   60.951220][ T6074]  ? wait_for_space+0x24d/0x2d0
[   60.951236][ T6074]  iov_iter_get_pages2+0x5e/0xa0
[   60.951252][ T6074]  __se_sys_vmsplice+0x548/0x10d0
[   60.951282][ T6074]  ? __pfx___se_sys_vmsplice+0x10/0x10
[   60.951298][ T6074]  ? __pfx_futex_wait+0x10/0x10
[   60.951318][ T6074]  ? __lock_acquire+0xab9/0xd20
[   60.951360][ T6074]  ? do_pipe2+0xf7/0x170
[   60.951378][ T6074]  ? rcu_is_watching+0x15/0xb0
[   60.951395][ T6074]  ? do_syscall_64+0xbe/0x3b0
[   60.951410][ T6074]  do_syscall_64+0xfa/0x3b0
[   60.951421][ T6074]  ? lockdep_hardirqs_on+0x9c/0x150
[   60.951438][ T6074]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   60.951450][ T6074]  ? exc_page_fault+0x9f/0xf0
[   60.951469][ T6074]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   60.951481][ T6074] RIP: 0033:0x7f8d4938e929
[   60.951492][ T6074] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   60.951504][ T6074] RSP: 002b:00007f8d4a27a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000116
[   60.951518][ T6074] RAX: ffffffffffffffda RBX: 00007f8d495b5fa0 RCX: 00007f8d4938e929
[   60.951526][ T6074] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000e
[   60.951534][ T6074] RBP: 00007f8d49410b39 R08: 0000000000000000 R09: 0000000000000000
[   60.951542][ T6074] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
[   60.951549][ T6074] R13: 0000000000000000 R14: 00007f8d495b5fa0 R15: 00007ffd9ea945a8
[   60.951571][ T6074]  </TASK>
[   61.096035][ T6076] wg1 speed is unknown, defaulting to 1000
[   61.143860][ T6078] netlink: 'syz.0.76': attribute type 13 has an invalid length.
[   61.146396][ T6078] netlink: 'syz.0.76': attribute type 17 has an invalid length.
[   61.213168][ T6078] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   61.259572][ T6087] netlink: 8 bytes leftover after parsing attributes in process `syz.1.80'.
[   61.359191][ T5218] Bluetooth: hci1: command tx timeout
[   61.359436][ T5839] Bluetooth: hci0: command tx timeout
[   61.361492][ T5218] Bluetooth: hci2: command tx timeout
[   61.552429][ T6110] netlink: 24 bytes leftover after parsing attributes in process `syz.1.84'.
[   61.561267][ T6110] netlink: 24 bytes leftover after parsing attributes in process `syz.1.84'.
[   61.571513][ T6110] veth0_to_team: entered promiscuous mode
[   61.573463][ T6110] veth0_to_team: entered allmulticast mode
[   61.581741][ T6110] netlink: 40 bytes leftover after parsing attributes in process `syz.1.84'.
[   61.770958][ T6127] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   62.330901][ T6157] xt_CT: No such helper "syz0"
[   62.403306][ T6168] netlink: 'syz.0.110': attribute type 1 has an invalid length.
[   62.521003][ T6175] TCP: tcp_parse_options: Illegal window scaling value 236 > 14 received
[   62.542209][ T6178] netlink: 'syz.2.114': attribute type 21 has an invalid length.
[   62.544975][ T6178] netlink: 132 bytes leftover after parsing attributes in process `syz.2.114'.
[   62.732966][ T6198] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   63.437124][ T5838] Bluetooth: hci0: command tx timeout
[   63.439169][ T5838] Bluetooth: hci1: command tx timeout
[   63.446767][ T5218] Bluetooth: hci2: command 0x0419 tx timeout
[   63.582445][ T6228] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   63.730555][ T6234] __nla_validate_parse: 2 callbacks suppressed
[   63.730565][ T6234] netlink: 24 bytes leftover after parsing attributes in process `syz.1.140'.
[   63.879983][ T6248] netlink: 8 bytes leftover after parsing attributes in process `syz.1.147'.
[   63.882887][ T6248] netlink: 32 bytes leftover after parsing attributes in process `syz.1.147'.
[   64.043707][ T6264] xt_CT: No such helper "pptp"
[   64.069140][ T6269] dvmrp1: entered allmulticast mode
[   64.073193][ T6269] dvmrp1: left allmulticast mode
[   64.192247][ T6285] raw_sendmsg: syz.1.166 forgot to set AF_INET. Fix it!
[   64.269012][ T6294] netlink: 24 bytes leftover after parsing attributes in process `syz.1.170'.
[   64.310835][ T6299] tipc: Enabling of bearer <et:g> rejected, media not registered
[   64.338438][ T6302] netlink: 410 bytes leftover after parsing attributes in process `syz.1.175'.
[   64.370931][ T6307] netlink: 16 bytes leftover after parsing attributes in process `syz.1.176'.
[   64.471766][ T6322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.183'.
[   64.475101][ T6322] netlink: 36 bytes leftover after parsing attributes in process `syz.1.183'.
[   64.585443][ T6330] veth3: entered promiscuous mode
[   64.954717][ T6360] tipc: Started in network mode
[   64.961219][ T6360] tipc: Node identity f6d853ec1f88, cluster identity 4711
[   64.964487][ T6360] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   64.968919][ T6360] syzkaller0: entered promiscuous mode
[   64.971242][ T6360] syzkaller0: entered allmulticast mode
[   64.988370][ T6360] tipc: Resetting bearer <eth:syzkaller0>
[   64.996058][ T6359] tipc: Resetting bearer <eth:syzkaller0>
[   65.009977][ T6359] tipc: Disabling bearer <eth:syzkaller0>
[   65.336355][ T6388] netlink: 104 bytes leftover after parsing attributes in process `syz.1.214'.
[   65.516899][ T5218] Bluetooth: hci2: command 0x0419 tx timeout
[   65.591202][    T9] hid-generic 0005:0C45:1012.0001: item fetching failed at offset 0/1
[   65.608209][    T9] hid-generic 0005:0C45:1012.0001: probe with driver hid-generic failed with error -22
[   65.730492][ T6426] netlink: 8 bytes leftover after parsing attributes in process `syz.0.230'.
[   65.733820][ T6426] netlink: 'syz.0.230': attribute type 18 has an invalid length.
[   65.738598][ T6424] trusted_key: syz.2.229 sent an empty control message without MSG_MORE.
[   65.766159][ T6428] vlan2: entered allmulticast mode
[   65.768243][ T6428] veth1: entered allmulticast mode
[   65.818761][ T6436] netlink: 'syz.0.235': attribute type 18 has an invalid length.
[   66.303423][ T6476] netlink: 'syz.1.243': attribute type 1 has an invalid length.
[   66.315634][ T6472] bond0: entered promiscuous mode
[   66.320880][ T6472] bond_slave_0: entered promiscuous mode
[   66.323381][ T6472] bond_slave_1: entered promiscuous mode
[   66.330290][ T6472] 8021q: adding VLAN 0 to HW filter on device macvlan3
[   66.337533][ T6472] bond0: left promiscuous mode
[   66.339720][ T6472] bond_slave_0: left promiscuous mode
[   66.342368][ T6472] bond_slave_1: left promiscuous mode
[   67.192829][ T6536] nbd: couldn't find a device at index 65546
[   67.288931][ T6546] netlink: 'syz.1.278': attribute type 1 has an invalid length.
[   67.291907][ T6546] netlink: 'syz.1.278': attribute type 4 has an invalid length.
[   67.852611][ T6600] xt_hashlimit: size too large, truncated to 1048576
[   67.987752][ T6612] netlink: 'syz.1.308': attribute type 3 has an invalid length.
Connection to localhost closed by remote host.
[   68.375037][ T6406] ==================================================================
[   68.378417][ T6406] BUG: KASAN: slab-use-after-free in __mutex_lock+0x738/0xe80
[   68.381482][ T6406] Read of size 8 at addr ffff888108e200a0 by task khidpd_0c451012/6406
[   68.385822][ T6406] 
[   68.386879][ T6406] CPU: 0 UID: 0 PID: 6406 Comm: khidpd_0c451012 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   68.386894][ T6406] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   68.386901][ T6406] Call Trace:
[   68.386910][ T6406]  <TASK>
[   68.386915][ T6406]  dump_stack_lvl+0x189/0x250
[   68.386933][ T6406]  ? __virt_addr_valid+0x1c8/0x5c0
[   68.386948][ T6406]  ? rcu_is_watching+0x15/0xb0
[   68.386961][ T6406]  ? __kasan_check_byte+0x12/0x40
[   68.386976][ T6406]  ? __pfx_dump_stack_lvl+0x10/0x10
[   68.386988][ T6406]  ? rcu_is_watching+0x15/0xb0
[   68.387000][ T6406]  ? lock_release+0x4b/0x3e0
[   68.387013][ T6406]  ? __virt_addr_valid+0x1c8/0x5c0
[   68.387033][ T6406]  ? __virt_addr_valid+0x4a5/0x5c0
[   68.387048][ T6406]  print_report+0xd2/0x2b0
[   68.387059][ T6406]  ? __mutex_lock+0x738/0xe80
[   68.387070][ T6406]  kasan_report+0x118/0x150
[   68.387085][ T6406]  ? __mutex_lock+0x738/0xe80
[   68.387097][ T6406]  __mutex_lock+0x738/0xe80
[   68.387109][ T6406]  ? __mutex_lock+0x51b/0xe80
[   68.387121][ T6406]  ? l2cap_unregister_user+0x6a/0x1b0
[   68.387139][ T6406]  ? __pfx___mutex_lock+0x10/0x10
[   68.387152][ T6406]  ? __pfx___timer_delete_sync+0x10/0x10
[   68.387171][ T6406]  l2cap_unregister_user+0x6a/0x1b0
[   68.387189][ T6406]  hidp_session_thread+0x3c9/0x410
[   68.387201][ T6406]  ? __pfx_hidp_session_thread+0x10/0x10
[   68.387210][ T6406]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   68.387226][ T6406]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   68.387239][ T6406]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   68.387250][ T6406]  ? __kthread_parkme+0x7b/0x200
[   68.387264][ T6406]  ? __kthread_parkme+0x1a1/0x200
[   68.387279][ T6406]  kthread+0x711/0x8a0
[   68.387296][ T6406]  ? __pfx_hidp_session_thread+0x10/0x10
[   68.387307][ T6406]  ? __pfx_kthread+0x10/0x10
[   68.387322][ T6406]  ? _raw_spin_unlock_irq+0x23/0x50
[   68.387337][ T6406]  ? lockdep_hardirqs_on+0x9c/0x150
[   68.387353][ T6406]  ? __pfx_kthread+0x10/0x10
[   68.387368][ T6406]  ret_from_fork+0x3fc/0x770
[   68.387381][ T6406]  ? __pfx_ret_from_fork+0x10/0x10
[   68.387395][ T6406]  ? __switch_to_asm+0x39/0x70
[   68.387409][ T6406]  ? __switch_to_asm+0x33/0x70
[   68.387422][ T6406]  ? __pfx_kthread+0x10/0x10
[   68.387437][ T6406]  ret_from_fork_asm+0x1a/0x30
[   68.387455][ T6406]  </TASK>
[   68.387459][ T6406] 
[   68.484356][ T6406] Allocated by task 5840:
[   68.486376][ T6406]  kasan_save_track+0x3e/0x80
[   68.488531][ T6406]  __kasan_kmalloc+0x93/0xb0
[   68.490590][ T6406]  __kmalloc_noprof+0x27a/0x4f0
[   68.492573][ T6406]  hci_alloc_dev_priv+0x28/0x2040
[   68.494586][ T6406]  vhci_create_device+0x120/0x6e0
[   68.496670][ T6406]  vhci_write+0x3ce/0x4a0
[   68.498563][ T6406]  vfs_write+0x54b/0xa90
[   68.500290][ T6406]  ksys_write+0x145/0x250
[   68.502102][ T6406]  do_syscall_64+0xfa/0x3b0
[   68.503955][ T6406]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   68.506528][ T6406] 
[   68.507602][ T6406] Freed by task 5840:
[   68.509357][ T6406]  kasan_save_track+0x3e/0x80
[   68.511412][ T6406]  kasan_save_free_info+0x46/0x50
[   68.513608][ T6406]  __kasan_slab_free+0x62/0x70
[   68.515678][ T6406]  kfree+0x18e/0x440
[   68.517413][ T6406]  bt_host_release+0x82/0x90
[   68.519407][ T6406]  device_release+0x9c/0x1c0
[   68.521339][ T6406]  kobject_put+0x22b/0x480
[   68.523196][ T6406]  vhci_release+0x88/0xd0
[   68.525044][ T6406]  __fput+0x44c/0xa70
[   68.526764][ T6406]  task_work_run+0x1d4/0x260
[   68.528673][ T6406]  do_exit+0x6b5/0x22e0
[   68.530407][ T6406]  do_group_exit+0x21c/0x2d0
[   68.532449][ T6406]  __x64_sys_exit_group+0x3f/0x40
[   68.534625][ T6406]  x64_sys_call+0x21ba/0x21c0
[   68.536666][ T6406]  do_syscall_64+0xfa/0x3b0
[   68.538627][ T6406]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   68.541175][ T6406] 
[   68.542277][ T6406] Last potentially related work creation:
[   68.544570][ T6406]  kasan_save_stack+0x3e/0x60
[   68.546618][ T6406]  kasan_record_aux_stack+0xbd/0xd0
[   68.548730][ T6406]  insert_work+0x3d/0x330
[   68.550475][ T6406]  __queue_work+0xbd9/0xfe0
[   68.552338][ T6406]  queue_work_on+0x181/0x270
[   68.554285][ T6406]  process_scheduled_works+0xae1/0x17b0
[   68.556678][ T6406]  worker_thread+0x8a0/0xda0
[   68.558700][ T6406]  kthread+0x711/0x8a0
[   68.560476][ T6406]  ret_from_fork+0x3fc/0x770
[   68.562445][ T6406]  ret_from_fork_asm+0x1a/0x30
[   68.564514][ T6406] 
[   68.565593][ T6406] Second to last potentially related work creation:
[   68.568386][ T6406]  kasan_save_stack+0x3e/0x60
[   68.570461][ T6406]  kasan_record_aux_stack+0xbd/0xd0
[   68.572782][ T6406]  insert_work+0x3d/0x330
[   68.574723][ T6406]  __queue_work+0xcfc/0xfe0
[   68.576648][ T6406]  call_timer_fn+0x17e/0x5f0
[   68.578535][ T6406]  __run_timer_base+0x646/0x860
[   68.580618][ T6406]  run_timer_softirq+0xb7/0x180
[   68.582616][ T6406]  handle_softirqs+0x286/0x870
[   68.584690][ T6406]  __irq_exit_rcu+0xca/0x1f0
[   68.586736][ T6406]  irq_exit_rcu+0x9/0x30
[   68.588657][ T6406]  sysvec_apic_timer_interrupt+0x57/0xc0
[   68.591055][ T6406]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   68.593521][ T6406] 
[   68.594561][ T6406] The buggy address belongs to the object at ffff888108e20000
[   68.594561][ T6406]  which belongs to the cache kmalloc-8k of size 8192
[   68.600406][ T6406] The buggy address is located 160 bytes inside of
[   68.600406][ T6406]  freed 8192-byte region [ffff888108e20000, ffff888108e22000)
[   68.606102][ T6406] 
[   68.607133][ T6406] The buggy address belongs to the physical page:
[   68.609829][ T6406] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108e20
[   68.613606][ T6406] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   68.617130][ T6406] anon flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   68.620543][ T6406] page_type: f5(slab)
[   68.622240][ T6406] raw: 057ff00000000040 ffff88801a442280 ffffea0004237e00 dead000000000005
[   68.625926][ T6406] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   68.629602][ T6406] head: 057ff00000000040 ffff88801a442280 ffffea0004237e00 dead000000000005
[   68.633208][ T6406] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   68.636878][ T6406] head: 057ff00000000003 ffffea0004238801 00000000ffffffff 00000000ffffffff
[   68.640608][ T6406] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   68.644170][ T6406] page dumped because: kasan: bad access detected
[   68.646923][ T6406] page_owner tracks the page as allocated
[   68.649356][ T6406] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5276, tgid 5276 (rcS), ts 21405627531, free_ts 21404604251
[   68.657475][ T6406]  post_alloc_hook+0x240/0x2a0
[   68.659559][ T6406]  get_page_from_freelist+0x21e4/0x22c0
[   68.661943][ T6406]  __alloc_frozen_pages_noprof+0x181/0x370
[   68.664331][ T6406]  alloc_pages_mpol+0x232/0x4a0
[   68.666408][ T6406]  allocate_slab+0x8a/0x3b0
[   68.668369][ T6406]  ___slab_alloc+0xbfc/0x1480
[   68.670530][ T6406]  __kmalloc_cache_noprof+0x296/0x3d0
[   68.672799][ T6406]  tomoyo_init_log+0x111f/0x1f70
[   68.674935][ T6406]  tomoyo_supervisor+0x340/0x1480
[   68.677007][ T6406]  tomoyo_env_perm+0x149/0x1e0
[   68.679019][ T6406]  tomoyo_find_next_domain+0x15cf/0x1aa0
[   68.681472][ T6406]  tomoyo_bprm_check_security+0x11c/0x180
[   68.683945][ T6406]  security_bprm_check+0x89/0x270
[   68.686091][ T6406]  bprm_execve+0x8ee/0x1450
[   68.688007][ T6406]  do_execveat_common+0x510/0x6a0
[   68.690175][ T6406]  __x64_sys_execve+0x94/0xb0
[   68.692307][ T6406] page last free pid 5276 tgid 5276 stack trace:
[   68.695061][ T6406]  __free_frozen_pages+0xc71/0xe70
[   68.697267][ T6406]  __put_partials+0x161/0x1c0
[   68.699304][ T6406]  put_cpu_partial+0x17c/0x250
[   68.701347][ T6406]  __slab_free+0x2f7/0x400
[   68.703280][ T6406]  qlist_free_all+0x97/0x140
[   68.705271][ T6406]  kasan_quarantine_reduce+0x148/0x160
[   68.707636][ T6406]  __kasan_slab_alloc+0x22/0x80
[   68.709803][ T6406]  __kmalloc_noprof+0x224/0x4f0
[   68.711935][ T6406]  tomoyo_supervisor+0xbd5/0x1480
[   68.714005][ T6406]  tomoyo_find_next_domain+0x488/0x1aa0
[   68.716375][ T6406]  tomoyo_bprm_check_security+0x11c/0x180
[   68.718784][ T6406]  security_bprm_check+0x89/0x270
[   68.720877][ T6406]  bprm_execve+0x8ee/0x1450
[   68.722745][ T6406]  do_execveat_common+0x510/0x6a0
[   68.724877][ T6406]  __x64_sys_execve+0x94/0xb0
[   68.726941][ T6406]  do_syscall_64+0xfa/0x3b0
[   68.728883][ T6406] 
[   68.729928][ T6406] Memory state around the buggy address:
[   68.732185][ T6406]  ffff888108e1ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   68.735426][ T6406]  ffff888108e20000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   68.738641][ T6406] >ffff888108e20080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   68.741882][ T6406]                                ^
[   68.744004][ T6406]  ffff888108e20100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   68.747384][ T6406]  ffff888108e20180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   68.750566][ T6406] ==================================================================
[   68.754258][ T6406] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   68.757113][ T6406] CPU: 0 UID: 0 PID: 6406 Comm: khidpd_0c451012 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   68.762149][ T6406] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   68.766505][ T6406] Call Trace:
[   68.767976][ T6406]  <TASK>
[   68.769244][ T6406]  dump_stack_lvl+0x99/0x250
[   68.771216][ T6406]  ? __asan_memcpy+0x40/0x70
[   68.773191][ T6406]  ? __pfx_dump_stack_lvl+0x10/0x10
[   68.775376][ T6406]  ? __pfx__printk+0x10/0x10
[   68.777309][ T6406]  panic+0x2db/0x790
[   68.779005][ T6406]  ? __pfx_panic+0x10/0x10
[   68.780933][ T6406]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[   68.783457][ T6406]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   68.785941][ T6406]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   68.788645][ T6406]  ? print_memory_metadata+0x314/0x400
[   68.791000][ T6406]  ? __mutex_lock+0x738/0xe80
[   68.793018][ T6406]  check_panic_on_warn+0x89/0xb0
[   68.795093][ T6406]  ? __mutex_lock+0x738/0xe80
[   68.797036][ T6406]  end_report+0x78/0x160
[   68.798884][ T6406]  kasan_report+0x129/0x150
[   68.800816][ T6406]  ? __mutex_lock+0x738/0xe80
[   68.802795][ T6406]  __mutex_lock+0x738/0xe80
[   68.804721][ T6406]  ? __mutex_lock+0x51b/0xe80
[   68.806807][ T6406]  ? l2cap_unregister_user+0x6a/0x1b0
[   68.809052][ T6406]  ? __pfx___mutex_lock+0x10/0x10
[   68.811114][ T6406]  ? __pfx___timer_delete_sync+0x10/0x10
[   68.813471][ T6406]  l2cap_unregister_user+0x6a/0x1b0
[   68.815759][ T6406]  hidp_session_thread+0x3c9/0x410
[   68.817918][ T6406]  ? __pfx_hidp_session_thread+0x10/0x10
[   68.820249][ T6406]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   68.822728][ T6406]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   68.825407][ T6406]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   68.828127][ T6406]  ? __kthread_parkme+0x7b/0x200
[   68.830239][ T6406]  ? __kthread_parkme+0x1a1/0x200
[   68.832427][ T6406]  kthread+0x711/0x8a0
[   68.834191][ T6406]  ? __pfx_hidp_session_thread+0x10/0x10
[   68.836662][ T6406]  ? __pfx_kthread+0x10/0x10
[   68.838761][ T6406]  ? _raw_spin_unlock_irq+0x23/0x50
[   68.841148][ T6406]  ? lockdep_hardirqs_on+0x9c/0x150
[   68.843388][ T6406]  ? __pfx_kthread+0x10/0x10
[   68.845383][ T6406]  ret_from_fork+0x3fc/0x770
[   68.847439][ T6406]  ? __pfx_ret_from_fork+0x10/0x10
[   68.849723][ T6406]  ? __switch_to_asm+0x39/0x70
[   68.851734][ T6406]  ? __switch_to_asm+0x33/0x70
[   68.853773][ T6406]  ? __pfx_kthread+0x10/0x10
[   68.855692][ T6406]  ret_from_fork_asm+0x1a/0x30
[   68.857682][ T6406]  </TASK>
[   68.859744][ T6406] Kernel Offset: disabled
[   68.861471][ T6406] Rebooting in 86400 seconds..

VM DIAGNOSIS:
06:23:59  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000038 RBX=0000000000000038 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900033df370
R8 =ffff8880209d0237 R9 =1ffff1100413a046 R10=dffffc0000000000 R11=ffffffff85478780
R12=dffffc0000000000 R13=ffffffff99af98a5 R14=ffffffff99dfe6e0 R15=0000000000000000
RIP=ffffffff854787fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000564a067dfe08 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=ffffffffffffffff ffffffffffffff00 XMM03=ffff00ff00000000 ffffffffffffffff
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000030 0000000000003100
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffffff00ff XMM09=313030302e323130 313a353443303a35
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff822d08cf RBX=00000000079c0210 RCX=0000000000000000 RDX=0000000000000000
RSI=0000000000000000 RDI=00000000079c0210 RBP=0000000000000001 RSP=ffffc9000360f880
R8 =ffff88801be18907 R9 =1ffff110037c3120 R10=dffffc0000000000 R11=ffffed10037c3121
R12=0000000000000000 R13=ffffea0000bad408 R14=ffffea0000bad400 R15=0000000fec012547
RIP=ffffffff84f6cde4 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055558a221500 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000564a067dfe08 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=ffff000000000000 ffffffff00000000 XMM05=72732f2a6272652a 5f64003062626e65
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000ff0000000000 XMM09=76752f7362726576 5f646e6162696e69
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
