last executing test programs:

1m40.348301428s ago: executing program 1 (id=1454):
perf_event_open(&(0x7f0000000380)={0x1, 0x80, 0x0, 0x0, 0x0, 0x3, 0x0, 0xfffffffffffffffd, 0x10800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0xa5}, 0x2880, 0xc8, 0x0, 0x0, 0x0, 0x40000}, 0x0, 0x0, 0xffffffffffffffff, 0x9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(r1)
recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r2=>0xffffffffffffffff]}}], 0x18}, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="8fedcb791f6f9875f37538e486dd6317ce8100072b00fe08000e40000200875a65969ff57b00ff020000000000000000000000000001"], 0xfdef)

1m40.241315473s ago: executing program 1 (id=1455):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x6}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0x20040885}, 0x40000)

1m39.804371928s ago: executing program 1 (id=1456):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50)
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfe04}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x1}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xe1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

1m39.700469538s ago: executing program 1 (id=1458):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000002c0)={0x2, 0x1, 0x0, 0x0, 0x8, 0x0, 0x2000000, 0x0, [@sadb_address={0x3, 0x6, 0x6c, 0x0, 0xe, @in={0x2, 0x0, @loopback}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0xfffc, @multicast1}}]}, 0x40}}, 0x900)

1m39.693360562s ago: executing program 1 (id=1460):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x6, 0x4, 0x7fe2, 0x1}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x4000004}, [@call={0x85, 0x0, 0x0, 0xae}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10)

1m39.54510549s ago: executing program 1 (id=1462):
socket$nl_netfilter(0x10, 0x3, 0xc)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8000001946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
sendmsg$NFT_BATCH(r0, 0x0, 0x40)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x8183, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext, 0x40, 0x0, 0x0, 0x0, 0xc360, 0xfffffffe}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$kcm(0x2, 0x200000000000001, 0x106)
setsockopt$sock_attach_bpf(r1, 0x6, 0x3, &(0x7f00000000c0), 0x4)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001860000000000000e9ff00000400000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000001800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r2}, 0x10)
r3 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d80000001c0081044e81f782db44b904021d08020e0000008100e0a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
socket$kcm(0xa, 0x2, 0x0)
close(r1)
socket$kcm(0x10, 0x2, 0x0)
socket$kcm(0xa, 0x2, 0x0)
r4 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=[{0x18, 0x110, 0xb, "11"}], 0x18}, 0x0)
socket$kcm(0xf, 0x3, 0x2)
openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0)
bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x45057bf4ccb05c67, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc9b}, 0x94)

1m39.544310798s ago: executing program 0 (id=1464):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x26e1, 0x0)
close(r0)
r1 = socket$kcm(0xa, 0x2, 0x88)
sendmsg$kcm(r1, &(0x7f0000000340)={&(0x7f00000000c0)=@in6={0xa, 0x4e21, 0x0, @loopback, 0x7}, 0x80, 0x0}, 0x200ce0c0)
write$cgroup_subtree(r0, 0x0, 0xfe33)

1m39.543745379s ago: executing program 2 (id=1465):
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000044000b35d25a806f8c6394f90124fc60", 0x14}], 0x1}, 0x0)

1m39.543442914s ago: executing program 2 (id=1466):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000000314010029bd7000fcdbdf250900020000007a31000000000800410072786500140033"], 0x38}, 0x1, 0x0, 0x0, 0x4040815}, 0x800)

1m39.436154979s ago: executing program 2 (id=1467):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x28, 0x3, 0x8, 0x101, 0x0, 0x0, {0x3, 0x0, 0x8}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @gre=[@CTA_TIMEOUT_GRE_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x5}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}]}, 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x40000)

1m38.360013319s ago: executing program 0 (id=1468):
r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={r0, 0xe0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001640)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)

1m38.35978549s ago: executing program 2 (id=1469):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x3c, 0x3c, 0x107, 0x0, 0xfffffffe, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x15}]}, @typed={0x8, 0x5, 0x0, 0x0, @u32=0xd}, @nested={0x8, 0x8, 0x0, 0x1, [@nested={0x4, 0x48}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x4040)

1m38.358869599s ago: executing program 0 (id=1470):
r0 = socket$kcm(0xa, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@l2tp={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000000240)=ANY=[@ANYRESOCT=r0], 0x70}, 0x41)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="d80000001d0081044e81f782db44b9040a1d080005000000e8fe54a1180015000600142603600e1208000f0000000401a80016000a0001", 0x37}], 0x1}, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x4040)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)=ANY=[@ANYRES32, @ANYRES32, @ANYRES32, @ANYRES64=0x0], 0x20)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x5000, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000580)={<r2=>0xffffffffffffffff})
recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$kcm(0x2b, 0x1, 0xfe)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r3)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xffffffff, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x15)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0)
r4 = socket$alg(0x26, 0x5, 0x0)
close(r4)
r5 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r5, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e24, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x200008c0)
sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0)
sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, "dc"}], 0x18}, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfe33)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETSETELEM(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)={0x20, 0xd, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0xffffffff, 0x4, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)

1m36.074050706s ago: executing program 2 (id=1471):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x3a, 0x301, 0x70bd25, 0xfffffffc, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x0)

1m36.073371613s ago: executing program 2 (id=1472):
r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0, r0}, 0x18)
syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0)
socket$kcm(0x11, 0x200000000000002, 0x300)
r1 = socket$kcm(0x11, 0x3, 0x0)
setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000001240)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x941aca29b1132872}, 0xc, &(0x7f0000001200)={&(0x7f0000000f40)={0x104, 0x1, 0x2, 0x101, 0x0, 0x0, {0x7, 0x0, 0x9}, [@CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0xc851}, @CTA_EXPECT_TUPLE={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast1}}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT={0xa0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_TUPLE={0x1c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x60, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @rand_addr=0x64010101}}}]}, @CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_DIR={0x8}]}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x100}]}, 0x104}, 0x1, 0x0, 0x0, 0x80}, 0x40000)
sendmsg$IPCTNL_MSG_CT_GET_DYING(r2, &(0x7f0000000500)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0x5, 0x0, 0x3}, ["", "", "", "", "", "", "", ""]}, 0x14}}, 0x890)

1m26.253027002s ago: executing program 0 (id=1473):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000001a00)={&(0x7f0000001980)={0x20, 0x17, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20004000)

1m25.744221114s ago: executing program 0 (id=1474):
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200400000000000020000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000009fb3964d00000000000000850000000500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)

1m23.599357961s ago: executing program 0 (id=1475):
perf_event_open(&(0x7f00000039c0)={0x2, 0x80, 0xea, 0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x74, 0x0, 0x9, 0x7ffffd, 0x0, 0x0, 0x484, 0x0, 0x40}, 0x0, 0x2, 0xffffffffffffffff, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x5}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x5, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0)
r2 = socket$kcm(0x2, 0x1000000000000002, 0x0)
setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000002c0)=r1, 0x161)
sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000007880)=ANY=[@ANYBLOB="11000000000000000040030001", @ANYBLOB="ac1414bbe0000001000000001c0000000000", @ANYBLOB], 0x98}, 0x0)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r0, 0x0, 0x0}, 0x10)
bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080), 0xc)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004b74ffec850000006d000000850000000700000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r5 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x400000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x24}, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1f, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000490000000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000008c0)="89", 0x0}, 0x32)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000000)='mm_lru_insertion\x00', r3}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000003a40)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000f0ffffff0000000000000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0xfffffeab)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
recvmsg$unix(r9, &(0x7f0000003980)={0x0, 0x0, &(0x7f00000038c0)=[{&(0x7f0000000500)=""/164, 0xa4}, {0x0}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f00000005c0)=""/252, 0xfc}, {0x0}, {0x0}, {&(0x7f0000002780)=""/49, 0x31}, {&(0x7f0000002800)=""/4096, 0x1000}, {0x0}], 0x9}, 0x40)
ioctl$PERF_EVENT_IOC_PERIOD(r8, 0x4030582a, &(0x7f0000000040)=0x7)

1m17.696981592s ago: executing program 32 (id=1462):
socket$nl_netfilter(0x10, 0x3, 0xc)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8000001946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
sendmsg$NFT_BATCH(r0, 0x0, 0x40)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x8183, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext, 0x40, 0x0, 0x0, 0x0, 0xc360, 0xfffffffe}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$kcm(0x2, 0x200000000000001, 0x106)
setsockopt$sock_attach_bpf(r1, 0x6, 0x3, &(0x7f00000000c0), 0x4)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001860000000000000e9ff00000400000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000001800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000380)='neigh_update\x00', r2}, 0x10)
r3 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d80000001c0081044e81f782db44b904021d08020e0000008100e0a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
socket$kcm(0xa, 0x2, 0x0)
close(r1)
socket$kcm(0x10, 0x2, 0x0)
socket$kcm(0xa, 0x2, 0x0)
r4 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=[{0x18, 0x110, 0xb, "11"}], 0x18}, 0x0)
socket$kcm(0xf, 0x3, 0x2)
openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0)
bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x45057bf4ccb05c67, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc9b}, 0x94)

1m17.696755389s ago: executing program 33 (id=1472):
r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0, r0}, 0x18)
syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0)
socket$kcm(0x11, 0x200000000000002, 0x300)
r1 = socket$kcm(0x11, 0x3, 0x0)
setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000001240)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x941aca29b1132872}, 0xc, &(0x7f0000001200)={&(0x7f0000000f40)={0x104, 0x1, 0x2, 0x101, 0x0, 0x0, {0x7, 0x0, 0x9}, [@CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0xc851}, @CTA_EXPECT_TUPLE={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast1}}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT={0xa0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_TUPLE={0x1c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x60, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @rand_addr=0x64010101}}}]}, @CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_DIR={0x8}]}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x100}]}, 0x104}, 0x1, 0x0, 0x0, 0x80}, 0x40000)
sendmsg$IPCTNL_MSG_CT_GET_DYING(r2, &(0x7f0000000500)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0x5, 0x0, 0x3}, ["", "", "", "", "", "", "", ""]}, 0x14}}, 0x890)

1m10.661536791s ago: executing program 34 (id=1475):
perf_event_open(&(0x7f00000039c0)={0x2, 0x80, 0xea, 0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x74, 0x0, 0x9, 0x7ffffd, 0x0, 0x0, 0x484, 0x0, 0x40}, 0x0, 0x2, 0xffffffffffffffff, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x5}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x5, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0)
r2 = socket$kcm(0x2, 0x1000000000000002, 0x0)
setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000002c0)=r1, 0x161)
sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000007880)=ANY=[@ANYBLOB="11000000000000000040030001", @ANYBLOB="ac1414bbe0000001000000001c0000000000", @ANYBLOB], 0x98}, 0x0)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r0, 0x0, 0x0}, 0x10)
bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080), 0xc)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004b74ffec850000006d000000850000000700000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r5 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x400000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x24}, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1f, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000490000000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000008c0)="89", 0x0}, 0x32)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000000)='mm_lru_insertion\x00', r3}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000003a40)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000f0ffffff0000000000000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0xfffffeab)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
recvmsg$unix(r9, &(0x7f0000003980)={0x0, 0x0, &(0x7f00000038c0)=[{&(0x7f0000000500)=""/164, 0xa4}, {0x0}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f00000005c0)=""/252, 0xfc}, {0x0}, {0x0}, {&(0x7f0000002780)=""/49, 0x31}, {&(0x7f0000002800)=""/4096, 0x1000}, {0x0}], 0x9}, 0x40)
ioctl$PERF_EVENT_IOC_PERIOD(r8, 0x4030582a, &(0x7f0000000040)=0x7)

10.22145952s ago: executing program 3 (id=1655):
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000004080000000000000003000000000000000000000002000000000000000000000000000002000000000000000000000004"], 0x0, 0x56}, 0x20)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000017c0)={0x2, 0x4, 0x8, 0x180, 0x80, 0x1, 0x0, '\x00', 0x0, r0, 0x0, 0x1}, 0x48)

10.221115339s ago: executing program 3 (id=1656):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f00000008c0)={0x0, 0xfffffffffffffe1d, &(0x7f0000000080)=[{&(0x7f0000000300)="d8000000190081054e81f783db4cb9040a1d080006007c02e8f655a10a0015000600142603600e1208001e0000000401a8000700fec0ffff00000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbaceac3c2fb14c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775820d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace0d81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300"/216, 0xd8}], 0x1}, 0x0)
fstat(0xffffffffffffffff, 0x0)
fstat(0xffffffffffffffff, 0x0)

10.118575832s ago: executing program 3 (id=1660):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0)
sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x1c, 0x13, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x20048818)

10.048456686s ago: executing program 3 (id=1663):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
socketpair(0x18, 0x80000, 0x1, &(0x7f0000000480))

9.874937491s ago: executing program 3 (id=1666):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x2}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='/proc///\x00\x82q\xee\x00!\xbd\xc2\x98#YP\xee\x9c2G\xf0\x81x\x97'}, 0x30)
mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b)
mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0)

9.816256193s ago: executing program 3 (id=1667):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000025000a20000000000a01030000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000003740000001e0a01020000000000000000010000000900020073797a32000000003400038030000080090006400000000024000b802000018007000100637400001400028008000160ee00000000000040000000000900010073797a30"], 0xe4}}, 0x0)

4.037829921s ago: executing program 4 (id=1687):
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0xfffffffd, 0x1}, 0x0, 0x100000001, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0)
recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))

3.91039128s ago: executing program 4 (id=1688):
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)="fb6bba8839fe8bc048c0cdafd1f8a9918bc4055eaaeb6db4ee9bcb25b1811dbf40b3a7da5a8a64db04ed6dd26eea2e37229c339b1f91201c2796173864", 0x3d}], 0x1, 0x0, 0x0, 0x4000001}, 0x0)
recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)=""/60, 0x3c}], 0x1}, 0x40fd)
r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kmem_cache_free\x00', r3}, 0x10)
close(r0)

3.849143317s ago: executing program 4 (id=1689):
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x1c, 0x24, 0x301, 0x70bd25, 0xfffffffc, {0x11}, [@typed={0x8, 0x3, 0x0, 0x0, @binary='G\x00\x00\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c0d3}, 0x0)

3.609924752s ago: executing program 4 (id=1692):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="d0000000130a0300"], 0xd0}, 0x1, 0x0, 0x0, 0x8000000}, 0x20000004)

3.529727368s ago: executing program 4 (id=1693):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x2, 0x201, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x80000001, 0x1946}, 0x0, 0x0, 0x0, 0x1, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x80, 0x2, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000080)=@bpf_lsm={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socket$kcm(0x2, 0x200000000000001, 0x0)
r0 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000e00)=@newtaction={0x70, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x9, 0x0, 0x6, 0xfffffffc, 0x3ff}}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x7}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x4}}}]}]}, 0x70}}, 0x0)

2.719874599s ago: executing program 4 (id=1695):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x2, 0x4, 0x4, 0x9}, 0x50)
bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x6, r0}, 0x38)

2.587262459s ago: executing program 35 (id=1695):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x2, 0x4, 0x4, 0x9}, 0x50)
bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x6, r0}, 0x38)

747.355763ms ago: executing program 5 (id=1714):
r0 = socket$kcm(0x11, 0x200000000000002, 0x300)
setsockopt$sock_attach_bpf(r0, 0x107, 0x8, 0x0, 0x4)

650.719003ms ago: executing program 5 (id=1715):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0xfffffffffffffe46, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae8000000000a01010000000000000000050000000900010073797a3000000000ba000600e9eec003775c64e64f439fc0b5fb34bcd039590bba579a25436e11f718b64e3e01796b9e930a3d8eefa0bccf8429a311f3ce5ec5a0a7bb9e08c60e03cbcdd726725fb9b1bd1000cf2a77ab6ab91f2294632773ea59b8de2361cdd8045c5fdb81611e843cb814e4cfe672542287ebd3b2ed48dca1a08690b05bb9bbbcc05551bd05e4c6e0625fcae04323e0f29dbad3c57456d2ca020462188e1236ebe6da1442c71ab0a8ebfaacef2710111417370a0f8cd19c5f9e1a00000900010073797a300000000014010000030a01030000000000000000050000000900010073797a30000000000800054000000000af000c008451bef8928cf9ec5c3c0fca5cedf6b9ae811484cd4abbaec9eba3118a64f7b105ab0e5c8e377ddaf98490703415da6a50c72a1434c93ef4daa32cd2b643c4ab99e8adc29f67b58cd27b71b30213e6acd60b8fa2190c3fd64f382e41b97f4b12379ce9470cbfdb02cc2a2d8e0e7aec144e2df705b37b99cafc9b141b0f3176897eba9802e14cc423ecff994b4ff320f5786bd4fba343449446d922b94ac3f8621197db4c2dc061e9278f5a000900030073797a32000000000b00070066696c746572000024000480080002406b10a6210800014000000004080002404e73b858080001400000000014000000020a030000000000000000000500000014000000110001"], 0x238}}, 0x0)
close(r1)

646.874021ms ago: executing program 5 (id=1716):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0xb, 0x0, 0x0, 0x9, 0x800000, 0x4, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$kcm(0x11, 0x2, 0x0)
setsockopt$sock_attach_bpf(r0, 0x107, 0x12, &(0x7f0000000240)=r0, 0x4)

501.138273ms ago: executing program 5 (id=1717):
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000020000006b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x3, 0x5}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

450.872882ms ago: executing program 5 (id=1718):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newtaction={0x90, 0x30, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [{0x7c, 0x1, [@m_bpf={0x78, 0x1, 0x0, 0x0, {{0x8}, {0x50, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x5}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0x2c, 0x4, [{0x1, 0x7, 0x4, 0x6}, {0x30, 0x98, 0x81, 0xfffffff9}, {0xc, 0x90, 0xa, 0x5}, {0xe54, 0x6a, 0x1, 0xfffffff6}, {0xff01, 0x3, 0x81, 0x4}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800)

370.610722ms ago: executing program 5 (id=1719):
perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0xe51}, 0x0, 0x0, 0x0, 0x4, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xc, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd63"], 0xfdef)
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
r2 = getpid()
sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x14, 0x4, 0x1, 0x801, 0x0, 0x0, {0x5, 0x0, 0x4}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x6044)
r3 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x7fff, 0x7fffffff}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, 0xffffffffffffffff)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x5, 0x3}, 0x0, 0x0, 0x40000, 0x0, 0x21, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = socket$kcm(0x10, 0x400000002, 0x0)
sendmsg$inet(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1b0000001a007f029e", 0x9}, {&(0x7f0000000200)="68cabf2dfb58fc0a01008888ffff0200258f", 0x12}], 0x2}, 0x0)
sendmsg$nl_xfrm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=@newsa={0x138, 0x10, 0x1, 0x8000000, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@empty, 0x2, 0x0, 0x4e20, 0x0, 0x0, 0x20, 0x0, 0x33}, {@in=@broadcast, 0x0, 0x33}, @in=@local, {0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x5680000000}, {0x5, 0x9}, 0x0, 0x0, 0x2, 0x1}, [@algo_auth={0x48, 0x1, {{'sha256\x00'}}}]}, 0x138}}, 0x0)
perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x400000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x24}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
socket$kcm(0x11, 0x200000000000002, 0x300)
r5 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000022003505d25a806f8c6394f90235fc60", 0x14}], 0x1}, 0x0)

127.679088ms ago: executing program 6 (id=1696):
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x40)

0s ago: executing program 6 (id=1720):
socket$kcm(0x2, 0x200000000000001, 0x0)
r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_config_ext={0x3, 0x8001}, 0x0, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800"/31], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
r2 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$kcm(0x10, 0x2, 0x10)
r4 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000640)={0x0, r2}, 0x8)
r5 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x69, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
recvmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000d00)=""/242, 0xfffffd63}, {&(0x7f0000000240)=""/205, 0xcd}, {&(0x7f0000000380)=""/210, 0xd2}, {&(0x7f00000006c0)=""/188, 0xc9}, {&(0x7f0000000f40)=""/213, 0xd5}, {&(0x7f0000002100)=""/4077, 0xfed}, {&(0x7f00000007c0)=""/211, 0xd3}, {&(0x7f0000000b00)=""/231, 0xe7}, {&(0x7f0000000480)=""/176, 0xb0}, {&(0x7f0000000c00)=""/208, 0xd0}], 0xa}, 0x40012100)
recvmsg$kcm(r5, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x0)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801})
recvmsg$kcm(r5, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0)
r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x24, &(0x7f0000001040)=ANY=[@ANYBLOB="18000000030000000000000000000000005e009a000000000000000008000000181100003aa98d6544c2059f2fb9b928826c2d68353e3262b54682859d7e7685f6cb0999de953b2305c7e5f088f9c24c350e0e17280f894043407c7c6ba7480e7364dcec2f6e6b038a", @ANYRES32=r7, @ANYBLOB="0000000000000000b7020000000000008500000086000000b7080000000000007b8af8ff00000000b7080000370000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a500000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000085100000fbffffff18120000", @ANYRES32=r7, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500000000000000186500000e00000000000000010000009500000000000000"], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x37584dd6821d7e9a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @value=r4}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r8}, 0x10)
sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000030000b02d25a806f8c6394f90424fc60", 0x14}], 0x1}, 0x0)
r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0xc, 0x42, 0x40, 0xc0, 0x1}, 0x50)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r9}, &(0x7f0000000200), &(0x7f0000000240)='%+9llu \x00'}, 0x20)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f00000000c0)='syzkaller\x00'}, 0x90)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffdd, 0xa}, [@ldst={0x3, 0x2, 0x3, 0x1c10a1, 0x0, 0x6c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x68000000}, 0x48)
perf_event_open(&(0x7f0000000540)={0x0, 0x80, 0x4, 0x1, 0x3, 0x3, 0x0, 0x5, 0xbb48, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4, 0x1, @perf_config_ext={0xfc9, 0x3}, 0x102, 0x7, 0x4, 0x9, 0x40, 0x9, 0xb2, 0x0, 0xdfe1, 0x0, 0x8}, 0x0, 0xb, r2, 0x9)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000001c0)='inet_sk_error_report\x00', r10}, 0x10)
r11 = socket$kcm(0xa, 0x1, 0x106)
sendmsg$kcm(r11, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011)
sendmsg$kcm(r11, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @dev, 0x2}, 0xff3c, 0x0}, 0xe07e872420dfefca)
r12 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="1400000023000b6c8cfffdfccabb00f90429fc60", 0x14}], 0x1}, 0x2400c000)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:7700' (ED25519) to the list of known hosts.
syzkaller login: [   56.388078][ T5771] cgroup: Unknown subsys name 'net'
[   56.520631][ T5771] cgroup: Unknown subsys name 'cpuset'
[   56.528848][ T5771] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.257485][ T5771] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   70.379027][   T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   70.386726][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   70.389944][   T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   70.399550][ T5875] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   70.420256][ T5874] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   70.422757][ T5875] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   70.425914][ T5875] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   70.430283][ T5874] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   70.436219][ T5235] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   70.444018][ T5873] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   70.447869][ T5873] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   70.450876][ T5873] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   70.456014][ T5235] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   70.459280][ T5873] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   70.463454][ T5869] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   70.876841][ T5864] chnl_net:caif_netlink_parms(): no params data found
[   70.973024][ T5865] chnl_net:caif_netlink_parms(): no params data found
[   71.004781][ T5871] chnl_net:caif_netlink_parms(): no params data found
[   71.131915][ T5864] bridge0: port 1(bridge_slave_0) entered blocking state
[   71.136780][ T5864] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.139582][ T5864] bridge_slave_0: entered allmulticast mode
[   71.143797][ T5864] bridge_slave_0: entered promiscuous mode
[   71.155963][ T5865] bridge0: port 1(bridge_slave_0) entered blocking state
[   71.158828][ T5865] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.161477][ T5865] bridge_slave_0: entered allmulticast mode
[   71.165832][ T5865] bridge_slave_0: entered promiscuous mode
[   71.169504][ T5865] bridge0: port 2(bridge_slave_1) entered blocking state
[   71.171773][ T5865] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.174076][ T5865] bridge_slave_1: entered allmulticast mode
[   71.176837][ T5865] bridge_slave_1: entered promiscuous mode
[   71.180331][ T5864] bridge0: port 2(bridge_slave_1) entered blocking state
[   71.183568][ T5864] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.186492][ T5864] bridge_slave_1: entered allmulticast mode
[   71.190336][ T5864] bridge_slave_1: entered promiscuous mode
[   71.257893][ T5871] bridge0: port 1(bridge_slave_0) entered blocking state
[   71.260376][ T5871] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.263949][ T5871] bridge_slave_0: entered allmulticast mode
[   71.267849][ T5871] bridge_slave_0: entered promiscuous mode
[   71.286482][ T5864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   71.290297][ T5871] bridge0: port 2(bridge_slave_1) entered blocking state
[   71.293135][ T5871] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.295303][ T5871] bridge_slave_1: entered allmulticast mode
[   71.297889][ T5871] bridge_slave_1: entered promiscuous mode
[   71.313773][ T5865] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   71.319342][ T5864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   71.346673][ T5865] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   71.353752][ T5871] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   71.385826][ T5871] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   71.405328][ T5864] team0: Port device team_slave_0 added
[   71.409062][ T5865] team0: Port device team_slave_0 added
[   71.424203][ T5865] team0: Port device team_slave_1 added
[   71.428236][ T5864] team0: Port device team_slave_1 added
[   71.478510][ T5871] team0: Port device team_slave_0 added
[   71.481560][ T5865] batman_adv: batadv0: Adding interface: batadv_slave_0
[   71.485553][ T5865] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   71.496292][ T5865] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   71.514980][ T5871] team0: Port device team_slave_1 added
[   71.518152][ T5865] batman_adv: batadv0: Adding interface: batadv_slave_1
[   71.520774][ T5865] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   71.530662][ T5865] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   71.536137][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_0
[   71.538480][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   71.548180][ T5864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   71.570918][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_1
[   71.573604][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   71.581779][ T5864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   71.644827][ T5871] batman_adv: batadv0: Adding interface: batadv_slave_0
[   71.647379][ T5871] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   71.657490][ T5871] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   71.670638][ T5865] hsr_slave_0: entered promiscuous mode
[   71.673872][ T5865] hsr_slave_1: entered promiscuous mode
[   71.691653][ T5864] hsr_slave_0: entered promiscuous mode
[   71.694813][ T5864] hsr_slave_1: entered promiscuous mode
[   71.697323][ T5864] debugfs: 'hsr0' already exists in 'hsr'
[   71.699554][ T5864] Cannot create hsr debugfs directory
[   71.702225][ T5871] batman_adv: batadv0: Adding interface: batadv_slave_1
[   71.704701][ T5871] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   71.714113][ T5871] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   71.812624][ T5871] hsr_slave_0: entered promiscuous mode
[   71.815752][ T5871] hsr_slave_1: entered promiscuous mode
[   71.818605][ T5871] debugfs: 'hsr0' already exists in 'hsr'
[   71.820994][ T5871] Cannot create hsr debugfs directory
[   72.068034][ T5865] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   72.086681][ T5865] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   72.111181][ T5865] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   72.126682][ T5865] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   72.189522][ T5864] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   72.205237][ T5864] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   72.211021][ T5864] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   72.227619][ T5864] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   72.277246][ T5871] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   72.292802][ T5871] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   72.300639][ T5871] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   72.307609][ T5871] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   72.416128][ T5865] 8021q: adding VLAN 0 to HW filter on device bond0
[   72.449795][ T5865] 8021q: adding VLAN 0 to HW filter on device team0
[   72.459446][ T5864] 8021q: adding VLAN 0 to HW filter on device bond0
[   72.478114][  T358] bridge0: port 1(bridge_slave_0) entered blocking state
[   72.481072][  T358] bridge0: port 1(bridge_slave_0) entered forwarding state
[   72.491831][ T5871] 8021q: adding VLAN 0 to HW filter on device bond0
[   72.504781][  T358] bridge0: port 2(bridge_slave_1) entered blocking state
[   72.507528][  T358] bridge0: port 2(bridge_slave_1) entered forwarding state
[   72.524100][ T5868] Bluetooth: hci1: command tx timeout
[   72.524272][ T5873] Bluetooth: hci0: command tx timeout
[   72.526738][ T5869] Bluetooth: hci2: command tx timeout
[   72.529743][ T5864] 8021q: adding VLAN 0 to HW filter on device team0
[   72.551328][  T358] bridge0: port 1(bridge_slave_0) entered blocking state
[   72.554176][  T358] bridge0: port 1(bridge_slave_0) entered forwarding state
[   72.567043][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   72.569849][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   72.577541][ T5871] 8021q: adding VLAN 0 to HW filter on device team0
[   72.611939][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   72.614379][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   72.638337][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   72.641261][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   72.821301][ T5864] 8021q: adding VLAN 0 to HW filter on device batadv0
[   72.837667][ T5865] 8021q: adding VLAN 0 to HW filter on device batadv0
[   72.881329][ T5864] veth0_vlan: entered promiscuous mode
[   72.887621][ T5871] 8021q: adding VLAN 0 to HW filter on device batadv0
[   72.903624][ T5864] veth1_vlan: entered promiscuous mode
[   72.945822][ T5865] veth0_vlan: entered promiscuous mode
[   72.955952][ T5864] veth0_macvtap: entered promiscuous mode
[   72.969447][ T5865] veth1_vlan: entered promiscuous mode
[   72.980695][ T5864] veth1_macvtap: entered promiscuous mode
[   73.007288][ T5871] veth0_vlan: entered promiscuous mode
[   73.017065][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_0
[   73.029720][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_1
[   73.037518][ T5871] veth1_vlan: entered promiscuous mode
[   73.050036][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   73.064971][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   73.068711][ T5865] veth0_macvtap: entered promiscuous mode
[   73.075782][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   73.080366][ T5865] veth1_macvtap: entered promiscuous mode
[   73.092659][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   73.120471][ T5871] veth0_macvtap: entered promiscuous mode
[   73.142708][ T5865] batman_adv: batadv0: Interface activated: batadv_slave_0
[   73.147677][ T5871] veth1_macvtap: entered promiscuous mode
[   73.181286][ T5865] batman_adv: batadv0: Interface activated: batadv_slave_1
[   73.214495][   T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   73.226531][   T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   73.229618][   T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   73.243367][ T5871] batman_adv: batadv0: Interface activated: batadv_slave_0
[   73.246104][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   73.256101][ T5871] batman_adv: batadv0: Interface activated: batadv_slave_1
[   73.259262][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.270755][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.278338][ T5715] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   73.297632][ T5715] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   73.300413][ T5715] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   73.329868][ T5715] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   73.349108][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.358018][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.441037][ T5864] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   73.453057][   T28] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.456181][   T28] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.524710][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.534312][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.562607][   T28] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.564985][   T28] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.631669][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   73.637094][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   73.692065][    C0] hrtimer: interrupt took 59967 ns
[   73.784641][ T5942] netlink: 10 bytes leftover after parsing attributes in process `syz.2.11'.
[   74.013341][ T5956] Zero length message leads to an empty skb
[   74.118667][ T5960] netlink: 830 bytes leftover after parsing attributes in process `syz.1.22'.
[   74.603398][ T5869] Bluetooth: hci0: command tx timeout
[   74.684205][ T5873] Bluetooth: hci1: command tx timeout
[   74.687210][ T5869] Bluetooth: hci2: command tx timeout
[   74.886287][ T5964] netlink: 'syz.1.24': attribute type 21 has an invalid length.
[   74.889316][ T5964] netlink: 16166 bytes leftover after parsing attributes in process `syz.1.24'.
[   74.911151][ T5962] netlink: 'syz.2.23': attribute type 13 has an invalid length.
[   74.915010][ T5962] netlink: 'syz.2.23': attribute type 17 has an invalid length.
[   75.136069][ T5962] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   75.154419][ T5973] netlink: 'syz.1.28': attribute type 11 has an invalid length.
[   75.524463][ T5995] netlink: 60 bytes leftover after parsing attributes in process `syz.0.37'.
[   75.823732][ T6010] openvswitch: netlink: Tunnel attr 7 has unexpected len 12 expected 0
[   76.450806][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   76.453994][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   76.578072][ T6030] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   76.631891][ T6030] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[   76.691994][ T5873] Bluetooth: hci0: command tx timeout
[   76.762430][ T5873] Bluetooth: hci1: command tx timeout
[   76.764708][ T5873] Bluetooth: hci2: command tx timeout
[   76.859083][ T6043] netlink: 8 bytes leftover after parsing attributes in process `syz.0.60'.
[   76.954499][ T6047] warning: `syz.0.61' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   78.181723][   T33] audit: type=1107 audit(1758219314.557:2): pid=6065 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''
[   78.588112][ T6082] netlink: 'syz.0.76': attribute type 1 has an invalid length.
[   78.591611][ T6082] netlink: 'syz.0.76': attribute type 4 has an invalid length.
[   78.597244][ T6082] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.76'.
[   78.622460][ T6082] netlink: 'syz.0.76': attribute type 1 has an invalid length.
[   78.625841][ T6082] netlink: 'syz.0.76': attribute type 4 has an invalid length.
[   78.642980][ T6082] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.76'.
[   78.790979][ T5869] Bluetooth: hci0: command tx timeout
[   79.056899][ T5869] Bluetooth: hci2: command tx timeout
[   79.059345][ T5869] Bluetooth: hci1: command tx timeout
[   79.324733][ T6094] netlink: 'syz.0.80': attribute type 10 has an invalid length.
[   79.328030][ T6094] netlink: 40 bytes leftover after parsing attributes in process `syz.0.80'.
[   79.369299][ T6094] vcan0: entered promiscuous mode
[   79.375507][ T6094] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check.
[   79.459812][ T6098] netlink: 8 bytes leftover after parsing attributes in process `syz.2.81'.
[   79.542840][ T6088] netlink: 'syz.1.78': attribute type 4 has an invalid length.
[   79.547147][ T6088] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.78'.
[   79.694744][ T6106] netlink: 132 bytes leftover after parsing attributes in process `syz.0.85'.
[   79.920694][ T6118] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.89'.
[   79.971484][ T6121] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   80.215851][   T33] audit: type=1107 audit(1758219316.597:3): pid=6129 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''
[   80.407071][ T6142] =======================================================
[   80.407071][ T6142] WARNING: The mand mount option has been deprecated and
[   80.407071][ T6142]          and is ignored by this kernel. Remove the mand
[   80.407071][ T6142]          option from the mount to silence this warning.
[   80.407071][ T6142] =======================================================
[   80.429236][ T6140] netlink: 4 bytes leftover after parsing attributes in process `syz.1.100'.
[   80.564604][ T6148] netlink: 830 bytes leftover after parsing attributes in process `syz.0.103'.
[   80.854539][ T6159] TCP: TCP_TX_DELAY enabled
[   81.238602][ T6165] netlink: 294 bytes leftover after parsing attributes in process `syz.2.111'.
[   81.246885][ T6169] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   82.710477][ T6202] openvswitch: netlink: IP tunnel dst address not specified
[   85.108749][ T6257] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   85.406765][ T6269] validate_nla: 2 callbacks suppressed
[   85.406805][ T6269] netlink: 'syz.1.159': attribute type 2 has an invalid length.
[   85.415149][ T6269] netlink: 'syz.1.159': attribute type 8 has an invalid length.
[   85.418322][ T6269] netlink: 132 bytes leftover after parsing attributes in process `syz.1.159'.
[   86.713679][   T47] cfg80211: failed to load regulatory.db
[   86.990320][ T6289] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes.
[   88.201615][ T6324] netlink: 17023 bytes leftover after parsing attributes in process `syz.2.183'.
[   88.222622][ T6326] netlink: 'syz.0.181': attribute type 10 has an invalid length.
[   88.994866][    C1] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 1211892852 wd_nsec: 1211892856
[   89.441858][ T6326] bond0: (slave bond_slave_0): Releasing backup interface
[   90.834322][ T6365] netlink: 'syz.0.199': attribute type 7 has an invalid length.
[   90.854368][ T6363] netlink: 'syz.1.198': attribute type 16 has an invalid length.
[   90.857229][ T6363] netlink: 'syz.1.198': attribute type 17 has an invalid length.
[   91.434885][ T6377] xt_l2tp: unknown flags: 51
[   91.716865][ T6363] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   93.664472][ T6419] netlink: 'syz.1.222': attribute type 2 has an invalid length.
[   93.667486][ T6419] netlink: 119 bytes leftover after parsing attributes in process `syz.1.222'.
[   94.056133][ T6448] netlink: 56 bytes leftover after parsing attributes in process `syz.1.235'.
[   94.318276][ T6458] veth0_vlan: entered allmulticast mode
[   94.530132][ T6458] veth0_vlan: left promiscuous mode
[   94.561241][ T6458] veth0_vlan: entered promiscuous mode
[   94.596858][ T6468] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.245'.
[   94.691879][ T6475] netlink: 4 bytes leftover after parsing attributes in process `syz.2.248'.
[   95.017528][ T6489] syz.0.252: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[   95.031894][ T6489] CPU: 1 UID: 0 PID: 6489 Comm: syz.0.252 Not tainted syzkaller #0 PREEMPT(full) 
[   95.031911][ T6489] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   95.031918][ T6489] Call Trace:
[   95.031923][ T6489]  <TASK>
[   95.031929][ T6489]  dump_stack_lvl+0x189/0x250
[   95.031958][ T6489]  ? __pfx_dump_stack_lvl+0x10/0x10
[   95.031970][ T6489]  ? __pfx__printk+0x10/0x10
[   95.031983][ T6489]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   95.031994][ T6489]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   95.032004][ T6489]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[   95.032014][ T6489]  warn_alloc+0x214/0x310
[   95.032028][ T6489]  ? stack_depot_save_flags+0x41b/0x860
[   95.032042][ T6489]  ? __pfx_warn_alloc+0x10/0x10
[   95.032057][ T6489]  ? kasan_save_track+0x4f/0x80
[   95.032068][ T6489]  ? xskq_create+0x56/0x170
[   95.032077][ T6489]  ? xsk_init_queue+0xb0/0x110
[   95.032083][ T6489]  ? xsk_setsockopt+0x57b/0x8d0
[   95.032095][ T6489]  ? do_sock_setsockopt+0x17c/0x1b0
[   95.032105][ T6489]  ? __x64_sys_setsockopt+0x13f/0x1b0
[   95.032115][ T6489]  ? do_syscall_64+0xfa/0x3b0
[   95.032126][ T6489]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   95.032139][ T6489]  __vmalloc_node_range_noprof+0x125/0x12f0
[   95.032164][ T6489]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[   95.032179][ T6489]  ? __kasan_kmalloc+0x93/0xb0
[   95.032191][ T6489]  vmalloc_user_noprof+0xad/0xf0
[   95.032203][ T6489]  ? xskq_create+0xbf/0x170
[   95.032211][ T6489]  xskq_create+0xbf/0x170
[   95.032220][ T6489]  xsk_init_queue+0xb0/0x110
[   95.032229][ T6489]  xsk_setsockopt+0x57b/0x8d0
[   95.032242][ T6489]  ? __pfx_xsk_setsockopt+0x10/0x10
[   95.032254][ T6489]  ? __pfx_aa_sk_perm+0x10/0x10
[   95.032268][ T6489]  ? __fget_files+0x2a/0x420
[   95.032274][ T6489]  ? aa_sock_opt_perm+0xff/0x1b0
[   95.032283][ T6489]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[   95.032292][ T6489]  ? __pfx_xsk_setsockopt+0x10/0x10
[   95.032305][ T6489]  do_sock_setsockopt+0x17c/0x1b0
[   95.032317][ T6489]  __x64_sys_setsockopt+0x13f/0x1b0
[   95.032330][ T6489]  do_syscall_64+0xfa/0x3b0
[   95.032339][ T6489]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   95.032346][ T6489]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   95.032357][ T6489]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   95.032365][ T6489] RIP: 0033:0x7fea17b8eba9
[   95.032374][ T6489] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   95.032382][ T6489] RSP: 002b:00007fea18acd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[   95.032392][ T6489] RAX: ffffffffffffffda RBX: 00007fea17dd6090 RCX: 00007fea17b8eba9
[   95.032398][ T6489] RDX: 0000000000000002 RSI: 000000000000011b RDI: 000000000000000b
[   95.032404][ T6489] RBP: 00007fea17c11e19 R08: 0000000000000004 R09: 0000000000000000
[   95.032409][ T6489] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000
[   95.032414][ T6489] R13: 00007fea17dd6128 R14: 00007fea17dd6090 R15: 00007ffdab541fb8
[   95.032429][ T6489]  </TASK>
[   95.201392][ T6498] netlink: 'syz.2.257': attribute type 3 has an invalid length.
[   95.205326][ T6498] netlink: 132 bytes leftover after parsing attributes in process `syz.2.257'.
[   95.278350][ T6489] Mem-Info:
[   95.280306][ T6489] active_anon:5420 inactive_anon:0 isolated_anon:0
[   95.280306][ T6489]  active_file:11328 inactive_file:38257 isolated_file:0
[   95.280306][ T6489]  unevictable:1768 dirty:313 writeback:0
[   95.280306][ T6489]  slab_reclaimable:9507 slab_unreclaimable:65688
[   95.280306][ T6489]  mapped:18097 shmem:2431 pagetables:944
[   95.280306][ T6489]  sec_pagetables:0 bounce:0
[   95.280306][ T6489]  kernel_misc_reclaimable:0
[   95.280306][ T6489]  free:269836 free_pcp:25631 free_cma:0
[   95.379309][ T6489] Node 0 active_anon:12568kB inactive_anon:0kB active_file:34244kB inactive_file:146108kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:20776kB dirty:784kB writeback:0kB shmem:4668kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:3712kB pagetables:2020kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   95.401827][ T6489] Node 1 active_anon:9044kB inactive_anon:0kB active_file:11068kB inactive_file:6920kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:51612kB dirty:468kB writeback:0kB shmem:5056kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7712kB pagetables:1824kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   95.535193][ T6489] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[   95.556723][ T6489] lowmem_reserve[]: 0 811 811 811 811
[   95.560200][ T6489] Node 0 DMA32 free:270376kB boost:0kB min:33660kB low:42072kB high:50484kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12568kB inactive_anon:0kB active_file:34244kB inactive_file:146108kB unevictable:3536kB writepending:784kB present:1556484kB managed:830852kB mlocked:0kB bounce:0kB free_pcp:46656kB local_pcp:14544kB free_cma:0kB
[   95.595601][ T6489] lowmem_reserve[]: 0 0 0 0 0
[   95.600151][ T6489] Node 1 DMA32 free:458492kB boost:0kB min:19192kB low:23988kB high:28784kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:116kB local_pcp:116kB free_cma:0kB
[   95.653948][ T6489] lowmem_reserve[]: 0 0 854 854 854
[   95.658603][ T6489] Node 1 Normal free:334540kB boost:0kB min:36612kB low:45764kB high:54916kB reserved_highatomic:0KB free_highatomic:0KB active_anon:8976kB inactive_anon:0kB active_file:11068kB inactive_file:6920kB unevictable:3536kB writepending:468kB present:1048576kB managed:874952kB mlocked:0kB bounce:0kB free_pcp:55332kB local_pcp:35480kB free_cma:0kB
[   95.682486][ T6489] lowmem_reserve[]: 0 0 0 0 0
[   95.690167][ T6489] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[   95.748570][ T6489] Node 0 DMA32: 844*4kB (UME) 259*8kB (UME) 78*16kB (UME) 214*32kB (UME) 47*64kB (UM) 15*128kB (UM) 7*256kB (UME) 4*512kB (M) 4*1024kB (UME) 3*2048kB (UME) 58*4096kB (UM) = 270120kB
[   95.756932][ T6489] Node 1 DMA32: 3*4kB (UM) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 3*2048kB (UM) 109*4096kB (M) = 458492kB
[   95.764462][ T6489] Node 1 Normal: 69*4kB (UME) 761*8kB (UME) 525*16kB (UM) 172*32kB (UM) 124*64kB (UM) 43*128kB (UME) 5*256kB (UE) 3*512kB (UE) 3*1024kB (UME) 0*2048kB 72*4096kB (M) = 334508kB
[   95.773064][ T6489] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   95.776771][ T6489] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   95.796338][ T6489] 52016 total pagecache pages
[   95.798254][ T6489] 0 pages in swap cache
[   95.800097][ T6489] Free swap  = 124996kB
[   95.804408][ T6489] Total swap = 124996kB
[   95.805783][ T6489] 786301 pages RAM
[   95.808089][ T6489] 0 pages HighMem/MovableOnly
[   95.809642][ T6489] 241356 pages reserved
[   95.810987][ T6489] 0 pages cma reserved
[   96.013139][ T6519] syz.2.266 uses obsolete (PF_INET,SOCK_PACKET)
[   96.327169][ T6535] syzkaller0: entered promiscuous mode
[   96.329679][ T6535] syzkaller0: entered allmulticast mode
[   98.902277][ T6559] netlink: 'syz.0.283': attribute type 10 has an invalid length.
[   99.140349][ T6557] netlink: 830 bytes leftover after parsing attributes in process `syz.2.282'.
[   99.145877][ T6559] bridge0: port 2(bridge_slave_1) entered disabled state
[   99.150912][ T6559] bridge0: port 1(bridge_slave_0) entered disabled state
[   99.181901][ T6561] netlink: 132 bytes leftover after parsing attributes in process `syz.2.284'.
[   99.192453][ T6559] bridge0: port 2(bridge_slave_1) entered blocking state
[   99.195577][ T6559] bridge0: port 2(bridge_slave_1) entered forwarding state
[   99.200378][ T6559] bridge0: port 1(bridge_slave_0) entered blocking state
[   99.203707][ T6559] bridge0: port 1(bridge_slave_0) entered forwarding state
[   99.219524][ T6559] bond0: (slave bridge0): Enslaving as an active interface with an up link
[   99.234582][ T6561] netlink: 132 bytes leftover after parsing attributes in process `syz.2.284'.
[   99.359443][ T6571] netlink: 64 bytes leftover after parsing attributes in process `syz.2.288'.
[   99.658284][ T6590] netlink: 10 bytes leftover after parsing attributes in process `syz.0.297'.
[  100.575295][ T6607] openvswitch: netlink: Flow actions attr not present in new flow.
[  100.683824][ T6613] netlink: 'syz.0.306': attribute type 2 has an invalid length.
[  100.686388][ T6613] netlink: 'syz.0.306': attribute type 1 has an invalid length.
[  100.688854][ T6613] netlink: 199820 bytes leftover after parsing attributes in process `syz.0.306'.
[  100.691891][ T6613] block nbd5: not configured, cannot reconfigure
[  101.053613][ T6625] netlink: 28 bytes leftover after parsing attributes in process `syz.1.312'.
[  101.057835][ T6625] netlink: 28 bytes leftover after parsing attributes in process `syz.1.312'.
[  101.103315][ T6628] syzkaller1: tun_chr_ioctl cmd 1074025677
[  101.106182][ T6628] syzkaller1: linktype set to 1
[  101.850224][ T6648] netlink: 48 bytes leftover after parsing attributes in process `syz.2.323'.
[  101.906299][ T6650] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  102.364642][ T6659] netlink: 'syz.2.327': attribute type 3 has an invalid length.
[  102.368419][ T6659] netlink: 'syz.2.327': attribute type 1 has an invalid length.
[  102.384251][ T6659] netlink: 199820 bytes leftover after parsing attributes in process `syz.2.327'.
[  103.294868][ T6678] veth0_vlan: entered allmulticast mode
[  103.756413][ T6678] veth0_vlan: left promiscuous mode
[  103.782862][ T6678] veth0_vlan: entered promiscuous mode
[  104.328716][ T6686] netlink: 24 bytes leftover after parsing attributes in process `syz.0.336'.
[  104.334000][ T6686] netlink: 24 bytes leftover after parsing attributes in process `syz.0.336'.
[  104.438360][ T6688] netlink: 132 bytes leftover after parsing attributes in process `syz.0.337'.
[  104.659078][ T6698] netlink: 8 bytes leftover after parsing attributes in process `syz.2.342'.
[  104.701251][ T6698] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[  104.713019][ T6698] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[  105.112266][ T6712] netlink: 'syz.1.348': attribute type 4 has an invalid length.
[  105.115352][ T6712] netlink: 12 bytes leftover after parsing attributes in process `syz.1.348'.
[  105.427301][ T6724] netlink: 'syz.0.353': attribute type 2 has an invalid length.
[  105.431595][ T6724] netlink: 132 bytes leftover after parsing attributes in process `syz.0.353'.
[  105.899335][ T6743] netlink: 100 bytes leftover after parsing attributes in process `syz.2.361'.
[  105.938627][ T6746] netlink: 4 bytes leftover after parsing attributes in process `syz.2.362'.
[  106.206177][ T6761] netlink: 180 bytes leftover after parsing attributes in process `syz.0.369'.
[  106.206869][ T6754] syzkaller0: entered promiscuous mode
[  106.212575][ T6754] syzkaller0: entered allmulticast mode
[  106.266186][ T6759] sit0: entered allmulticast mode
[  106.396486][ T6765] wg2: entered promiscuous mode
[  106.398859][ T6765] wg2: entered allmulticast mode
[  106.404371][ T6765] netlink: 36 bytes leftover after parsing attributes in process `syz.0.371'.
[  108.021656][ T6816] netlink: 'syz.2.388': attribute type 28 has an invalid length.
[  108.852485][ T6857] lo speed is unknown, defaulting to 1000
[  108.867349][ T6857] lo speed is unknown, defaulting to 1000
[  108.878206][ T6857] lo speed is unknown, defaulting to 1000
[  109.816554][    T9] lo speed is unknown, defaulting to 1000
[  109.819336][ T6857] infiniband syz2: set active
[  109.821862][ T6857] infiniband syz2: added lo
[  109.827412][ T6857] syz2: rxe_create_cq: returned err = -12
[  109.830344][ T6857] infiniband syz2: Couldn't create ib_mad CQ
[  109.833442][ T6857] infiniband syz2: Couldn't open port 1
[  109.873656][ T6857] RDS/IB: syz2: added
[  109.875453][ T6857] smc: adding ib device syz2 with port count 1
[  109.887683][ T6857] smc:    ib device syz2 port 1 has no pnetid
[  109.891451][    T9] lo speed is unknown, defaulting to 1000
[  109.898689][ T6869] __nla_validate_parse: 4 callbacks suppressed
[  109.898699][ T6869] netlink: 12 bytes leftover after parsing attributes in process `syz.0.409'.
[  109.904661][ T6857] lo speed is unknown, defaulting to 1000
[  110.145366][ T6857] lo speed is unknown, defaulting to 1000
[  110.414514][ T6857] lo speed is unknown, defaulting to 1000
[  110.876755][ T6897] netlink: 'syz.2.420': attribute type 27 has an invalid length.
[  110.887614][ T6897] netlink: 'syz.2.420': attribute type 4 has an invalid length.
[  110.894079][ T6897] netlink: 144 bytes leftover after parsing attributes in process `syz.2.420'.
[  111.229676][ T6904] netlink: 4 bytes leftover after parsing attributes in process `syz.0.422'.
[  112.269299][ T6941] netlink: 'syz.0.432': attribute type 4 has an invalid length.
[  112.275178][ T6941] netlink: 116 bytes leftover after parsing attributes in process `syz.0.432'.
[  112.428195][ T6947] syzkaller0: entered promiscuous mode
[  113.584915][ T6956] vxcan1: entered allmulticast mode
[  113.790166][ T6964] delete_channel: no stack
[  114.800821][ T7005] bridge_slave_1: left allmulticast mode
[  114.803527][ T7005] bridge_slave_1: left promiscuous mode
[  114.806160][ T7005] bridge0: port 2(bridge_slave_1) entered disabled state
[  115.525547][ T7005] bridge_slave_0: left allmulticast mode
[  115.527873][ T7005] bridge_slave_0: left promiscuous mode
[  115.530350][ T7005] bridge0: port 1(bridge_slave_0) entered disabled state
[  115.660187][ T7008] netlink: 4 bytes leftover after parsing attributes in process `syz.2.453'.
[  115.663576][ T7008] netlink: 52 bytes leftover after parsing attributes in process `syz.2.453'.
[  116.336730][ T7050] netlink: 'syz.1.476': attribute type 29 has an invalid length.
[  116.951721][ T7064] netlink: 16 bytes leftover after parsing attributes in process `syz.0.482'.
[  117.595593][ T7078] netlink: 16 bytes leftover after parsing attributes in process `syz.0.486'.
[  118.413549][ T7090] netlink: 'syz.1.490': attribute type 4 has an invalid length.
[  118.416046][ T7090] netlink: 152 bytes leftover after parsing attributes in process `syz.1.490'.
[  118.420545][ T7090] .`: renamed from bond0 (while UP)
[  118.493719][ T7096] netlink: 180 bytes leftover after parsing attributes in process `syz.2.493'.
[  119.476791][ T7110] : entered promiscuous mode
[  120.236959][ T7137] netlink: 8 bytes leftover after parsing attributes in process `syz.2.509'.
[  121.094972][ T7151] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  121.148239][ T7139] delete_channel: no stack
[  121.148939][ T7151] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  122.725072][ T7190] netlink: 'syz.0.527': attribute type 21 has an invalid length.
[  122.728409][ T7190] netlink: 'syz.0.527': attribute type 20 has an invalid length.
[  123.460530][ T7202] netlink: 'syz.2.533': attribute type 3 has an invalid length.
[  123.463794][ T7202] netlink: 201336 bytes leftover after parsing attributes in process `syz.2.533'.
[  124.127460][ T7232] netlink: 8 bytes leftover after parsing attributes in process `syz.0.548'.
[  124.179943][ T7234] tap0: tun_chr_ioctl cmd 1074025675
[  124.187739][ T7234] tap0: persist disabled
[  124.206812][ T7235] netlink: 32 bytes leftover after parsing attributes in process `syz.2.547'.
[  124.210766][ T7235] netlink: 12 bytes leftover after parsing attributes in process `syz.2.547'.
[  124.398553][ T7246] netlink: 'syz.0.553': attribute type 39 has an invalid length.
[  124.409513][ T7251] netlink: 'syz.1.557': attribute type 21 has an invalid length.
[  124.693044][ T7263] netlink: 'syz.1.561': attribute type 4 has an invalid length.
[  124.696267][ T7263] netlink: 152 bytes leftover after parsing attributes in process `syz.1.561'.
[  124.797397][ T7263] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check.
[  125.567567][ T7291] netlink: 'syz.1.573': attribute type 29 has an invalid length.
[  125.572510][ T7291] netlink: 'syz.1.573': attribute type 29 has an invalid length.
[  126.028509][ T7313] netlink: 232 bytes leftover after parsing attributes in process `syz.2.582'.
[  126.235423][ T7317] netlink: 'syz.0.585': attribute type 10 has an invalid length.
[  126.459117][ T7317] bond0: (slave hsr0): The slave device specified does not support setting the MAC address
[  126.480243][ T7317] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets).
[  126.485894][ T7317] bond0: (slave hsr0): Error -22 calling dev_set_mtu
[  126.565987][ T7330] netlink: 8 bytes leftover after parsing attributes in process `syz.0.591'.
[  126.597786][ T7332] netlink: 'syz.0.592': attribute type 29 has an invalid length.
[  126.666802][ T7336] netlink: 132 bytes leftover after parsing attributes in process `syz.0.594'.
[  127.397719][ T7363] netlink: 168 bytes leftover after parsing attributes in process `syz.0.607'.
[  127.600777][ T7374] netlink: 12 bytes leftover after parsing attributes in process `syz.2.612'.
[  129.088961][ T7406] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  129.183456][ T7404] __nla_validate_parse: 1 callbacks suppressed
[  129.183476][ T7404] netlink: 4 bytes leftover after parsing attributes in process `syz.0.625'.
[  129.431152][ T7417] netlink: 60 bytes leftover after parsing attributes in process `syz.0.629'.
[  129.439030][ T7417] netlink: 60 bytes leftover after parsing attributes in process `syz.0.629'.
[  129.444400][ T7417] netlink: 60 bytes leftover after parsing attributes in process `syz.0.629'.
[  131.166018][ T5873] Bluetooth: hci0: unexpected event 0x04 length: 15 > 10
[  131.389244][ T7447] : renamed from team_slave_1 (while UP)
[  131.468111][ T7453] xt_socket: unknown flags 0x6
[  131.504255][ T7455] validate_nla: 3 callbacks suppressed
[  131.504272][ T7455] netlink: 'syz.0.645': attribute type 1 has an invalid length.
[  131.508985][ T7455] netlink: 4 bytes leftover after parsing attributes in process `syz.0.645'.
[  131.971962][ T7465] netlink: 112 bytes leftover after parsing attributes in process `syz.0.649'.
[  132.619610][ T7484] netlink: 'syz.1.657': attribute type 4 has an invalid length.
[  132.622964][ T7484] netlink: 152 bytes leftover after parsing attributes in process `syz.1.657'.
[  132.627452][ T7484] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check.
[  132.721695][ T7488] netlink: 188 bytes leftover after parsing attributes in process `syz.1.659'.
[  133.309042][ T7520] netlink: 16 bytes leftover after parsing attributes in process `syz.1.670'.
[  133.359714][ T5873] Bluetooth: hci0: command tx timeout
[  133.381562][ T7511] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  133.386758][ T7511] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  133.406254][ T7520] netlink: 128 bytes leftover after parsing attributes in process `syz.1.670'.
[  133.406446][ T7520] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  133.716328][ T7544] netlink: 'syz.0.684': attribute type 2 has an invalid length.
[  135.536863][ T7599] __nla_validate_parse: 1 callbacks suppressed
[  135.536881][ T7599] netlink: 28 bytes leftover after parsing attributes in process `syz.2.710'.
[  135.967282][ T7622] netlink: 'syz.1.720': attribute type 4 has an invalid length.
[  136.080987][ T7626] netlink: 'syz.1.722': attribute type 29 has an invalid length.
[  136.085017][ T7626] netlink: 'syz.1.722': attribute type 29 has an invalid length.
[  136.088501][ T7626] netlink: 'syz.1.722': attribute type 29 has an invalid length.
[  136.623445][ T7648] openvswitch: netlink: ERSPAN option length err (len 256, max 255).
[  137.060448][ T7664] netlink: 17 bytes leftover after parsing attributes in process `syz.2.740'.
[  137.078718][ T7664] netlink: zone id is out of range
[  137.081823][ T7664] netlink: zone id is out of range
[  137.087084][ T7664] netlink: zone id is out of range
[  137.089047][ T7664] netlink: zone id is out of range
[  137.090729][ T7664] netlink: zone id is out of range
[  137.092863][ T7664] netlink: zone id is out of range
[  137.094732][ T7664] netlink: zone id is out of range
[  137.299664][ T7664] syz.2.740 (7664) used obsolete PPPIOCDETACH ioctl
[  137.302290][ T7675] Illegal XDP return value 4294967274 on prog  (id 290) dev N/A, expect packet loss!
[  137.367579][ T7677] netlink: 'syz.0.746': attribute type 13 has an invalid length.
[  137.370214][ T7677] netlink: 'syz.0.746': attribute type 17 has an invalid length.
[  137.889518][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[  137.895001][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[  138.719860][ T7677] vcan0: left promiscuous mode
[  138.729695][ T7677] net_ratelimit: 78 callbacks suppressed
[  138.729717][ T7677] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  139.209862][ T7715] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.764'.
[  139.747058][ T7733] netlink: 'syz.0.771': attribute type 1 has an invalid length.
[  139.913559][ T7747] netlink: 65015 bytes leftover after parsing attributes in process `syz.0.778'.
[  140.230237][ T7754] netlink: 16 bytes leftover after parsing attributes in process `syz.1.779'.
[  140.311239][ T7766] netlink: 156 bytes leftover after parsing attributes in process `syz.2.787'.
[  141.515494][ T7794] netlink: 4856 bytes leftover after parsing attributes in process `syz.0.799'.
[  141.519276][ T7794] openvswitch: netlink: Message has 5588 unknown bytes.
[  141.522383][ T7794] openvswitch: netlink: Actions may not be safe on all matching packets
[  142.039449][ T7803] netlink: 4 bytes leftover after parsing attributes in process `syz.0.803'.
[  142.722126][ T7829] netlink: 17 bytes leftover after parsing attributes in process `syz.0.813'.
[  143.035875][ T7854] netlink: 'syz.2.815': attribute type 1 has an invalid length.
[  143.345575][ T7923] netlink: 'syz.0.819': attribute type 3 has an invalid length.
[  143.348183][ T7923] netlink: 199752 bytes leftover after parsing attributes in process `syz.0.819'.
[  143.545975][ T7945] netlink: 'syz.0.821': attribute type 3 has an invalid length.
[  143.549249][ T7945] netlink: 201372 bytes leftover after parsing attributes in process `syz.0.821'.
[  143.640105][ T7953] rdma_rxe: rxe_newlink: failed to add vcan0
[  143.718669][ T5873] Bluetooth: hci2: adv larger than maximum supported
[  144.237929][ T7983] netlink: 4 bytes leftover after parsing attributes in process `syz.2.838'.
[  144.966148][ T8018] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.848'.
[  144.970911][ T8018] netlink: zone id is out of range
[  144.975961][ T8018] netlink: zone id is out of range
[  144.978217][ T8018] netlink: get zone limit has 8 unknown bytes
[  145.026113][ T8021] netlink: 'syz.2.849': attribute type 4 has an invalid length.
[  145.135859][ T8027] netlink: 'syz.0.851': attribute type 10 has an invalid length.
[  145.139190][ T8027] netlink: 40 bytes leftover after parsing attributes in process `syz.0.851'.
[  145.152483][ T8027] team0: entered promiscuous mode
[  145.154863][ T8027] team_slave_0: entered promiscuous mode
[  145.158712][ T8027] team_slave_1: entered promiscuous mode
[  145.161160][ T8027] team0: entered allmulticast mode
[  145.171355][ T8027] team_slave_0: entered allmulticast mode
[  145.176599][ T8027] team_slave_1: entered allmulticast mode
[  145.189082][ T8027] bridge0: port 3(team0) entered blocking state
[  145.204476][ T8027] bridge0: port 3(team0) entered disabled state
[  145.239322][ T8027] bridge0: port 3(team0) entered blocking state
[  145.242154][ T8027] bridge0: port 3(team0) entered forwarding state
[  146.153159][ T8040] netlink: 68 bytes leftover after parsing attributes in process `syz.2.856'.
[  146.311282][ T8050] netlink: 164 bytes leftover after parsing attributes in process `syz.0.861'.
[  146.372646][ T8048] netlink: 'syz.2.856': attribute type 10 has an invalid length.
[  147.297053][ T8094] netlink: 'syz.1.881': attribute type 10 has an invalid length.
[  149.086872][ T8148] __nla_validate_parse: 1 callbacks suppressed
[  149.086891][ T8148] netlink: 5844 bytes leftover after parsing attributes in process `syz.0.908'.
[  152.196068][ T8161] netlink: 5 bytes leftover after parsing attributes in process `syz.0.914'.
[  152.231276][ T8166] netlink: 8 bytes leftover after parsing attributes in process `syz.0.917'.
[  152.399755][ T8182] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.925'.
[  152.751413][ T8198] netlink: 'syz.0.932': attribute type 21 has an invalid length.
[  152.755972][ T8198] netlink: 'syz.0.932': attribute type 6 has an invalid length.
[  152.758848][ T8198] netlink: 132 bytes leftover after parsing attributes in process `syz.0.932'.
[  154.505832][ T8254] netlink: 8 bytes leftover after parsing attributes in process `syz.1.956'.
[  155.630189][ T8307] syzkaller0: entered promiscuous mode
[  155.636321][ T8307] syzkaller0: entered allmulticast mode
[  155.651862][ T8307] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 65487
[  159.981726][ T8388] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1017'.
[  160.202839][ T8398] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1022'.
[  160.206269][ T8398] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1022'.
[  160.479424][ T8417] raw_sendmsg: syz.2.1028 forgot to set AF_INET. Fix it!
[  160.520769][ T8417] netlink: 180 bytes leftover after parsing attributes in process `syz.2.1028'.
[  160.599173][ T5873] Bluetooth: hci0: unexpected event 0x08 length: 151 > 4
[  161.380513][ T8441] netlink: 'syz.1.1040': attribute type 1 has an invalid length.
[  162.045858][ T8464] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1049'.
[  162.110118][ T8472] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.1053'.
[  162.181306][ T8478] netlink: 'syz.1.1056': attribute type 21 has an invalid length.
[  162.187003][ T8478] netlink: 14548 bytes leftover after parsing attributes in process `syz.1.1056'.
[  162.267594][ T8484] netlink: 'syz.1.1059': attribute type 2 has an invalid length.
[  162.502879][ T8486] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.1060'.
[  162.813168][ T8507] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1071'.
[  162.816504][ T8507] netlink: 356 bytes leftover after parsing attributes in process `syz.0.1071'.
[  163.023946][ T5715] syzkaller0: tun_net_xmit 76
[  163.025898][ T5715] syzkaller0: tun_net_xmit 48
[  163.029286][ T8520] syzkaller0: create flow: hash 3479544260 index 1
[  163.052338][  T792] syzkaller0: tun_net_xmit 76
[  163.109548][ T8520] syzkaller0: delete flow: hash 3479544260 index 1
[  163.154247][ T8533] netlink: 'syz.2.1083': attribute type 4 has an invalid length.
[  165.003842][ T8575] __nla_validate_parse: 3 callbacks suppressed
[  165.003887][ T8575] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1103'.
[  165.144205][ T8590] netlink: 'syz.2.1109': attribute type 1 has an invalid length.
[  165.468075][ T8611] netlink: 'syz.0.1117': attribute type 1 has an invalid length.
[  165.477804][ T8611] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1117'.
[  165.947351][ T8636] netlink: 'syz.0.1128': attribute type 9 has an invalid length.
[  165.950898][ T8636] netlink: 211924 bytes leftover after parsing attributes in process `syz.0.1128'.
[  166.194828][ T8652] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1133'.
[  166.198127][ T8646] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1133'.
[  166.727731][ T8680] netlink: 'syz.2.1146': attribute type 22 has an invalid length.
[  166.731457][ T8680] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1146'.
[  166.873473][ T8684] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  167.019261][ T8692] IPv6: Can't replace route, no match found
[  167.524634][ T8716] netlink: 'syz.0.1164': attribute type 21 has an invalid length.
[  167.605781][ T8720] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1165'.
[  167.955787][ T5873] Bluetooth: hci2: ISO packet for unknown connection handle 0
[  169.098330][ T8755] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1183'.
[  169.929767][ T8696] Set syz1 is full, maxelem 65536 reached
[  170.511644][ T8794] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1199'.
[  170.527431][ T8792] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1198'.
[  170.704170][ T8792] netlink: 'syz.1.1198': attribute type 1 has an invalid length.
[  170.707313][ T8792] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.1198'.
[  170.950441][ T8812] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1208'.
[  171.076022][ T8820] netlink: 'syz.1.1211': attribute type 29 has an invalid length.
[  171.083359][ T8820] netlink: 'syz.1.1211': attribute type 29 has an invalid length.
[  171.087290][ T8820] netlink: 'syz.1.1211': attribute type 29 has an invalid length.
[  171.090880][ T8820] netlink: 'syz.1.1211': attribute type 29 has an invalid length.
[  171.295236][ T8837] netlink: 'syz.1.1219': attribute type 1 has an invalid length.
[  171.297844][ T8837] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  171.342043][    C1] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[  171.399385][ T8839] netlink: 17279 bytes leftover after parsing attributes in process `syz.1.1220'.
[  173.608386][ T8918] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1256'.
[  173.734576][ T8925] netlink: 'syz.0.1259': attribute type 11 has an invalid length.
[  173.742168][ T8925] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1259'.
[  173.848249][ T8929] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.1261'.
[  173.963643][ T8923] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  175.124002][ T8951] netlink: 'syz.2.1271': attribute type 21 has an invalid length.
[  175.127525][ T8951] IPv6: NLM_F_CREATE should be specified when creating new route
[  175.353910][ T8964] openvswitch: netlink: Unknown VXLAN extension attribute 0
[  175.458507][ T5873] Bluetooth: hci0: unexpected subevent 0x0c length: 150 > 5
[  175.543031][ T8970] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1279'.
[  175.969433][ T9003] netlink: 'syz.1.1295': attribute type 13 has an invalid length.
[  175.976476][ T9003] netlink: 24859 bytes leftover after parsing attributes in process `syz.1.1295'.
[  176.004169][ T9006] netlink: 'syz.0.1296': attribute type 1 has an invalid length.
[  176.007622][ T9006] netlink: 'syz.0.1296': attribute type 4 has an invalid length.
[  176.453889][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1315'.
[  176.703826][ T9053] delete_channel: no stack
[  177.364669][ T9057] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.1319'.
[  177.640406][ T9067] netlink: 'syz.1.1324': attribute type 13 has an invalid length.
[  177.655145][ T9067] netlink: 'syz.1.1324': attribute type 17 has an invalid length.
[  177.928629][ T9067] 8021q: adding VLAN 0 to HW filter on device .`
[  177.963893][ T9067] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  177.971178][   T10] lo speed is unknown, defaulting to 1000
[  179.386062][ T9091] netlink: 92 bytes leftover after parsing attributes in process `syz.1.1334'.
[  179.389550][ T9091] netlink: 92 bytes leftover after parsing attributes in process `syz.1.1334'.
[  179.780318][ T9124] netlink: 92 bytes leftover after parsing attributes in process `syz.0.1348'.
[  179.948991][ T9134] netlink: 'syz.1.1351': attribute type 39 has an invalid length.
[  180.358207][ T9143] netlink: 16255 bytes leftover after parsing attributes in process `syz.1.1356'.
[  181.168496][ T9179] syzkaller0: entered promiscuous mode
[  181.170586][ T9179] syzkaller0: entered allmulticast mode
[  182.549632][ T9185] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1374'.
[  182.554610][ T9185] netlink: 312 bytes leftover after parsing attributes in process `syz.2.1374'.
[  182.944371][ T9198] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.1380'.
[  183.577745][ T9210] netlink: 7 bytes leftover after parsing attributes in process `syz.2.1385'.
[  183.581306][ T9210] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1385'.
[  184.521252][ T9214] bond_slave_1: mtu less than device minimum
[  184.574688][ T9225] netlink: 64535 bytes leftover after parsing attributes in process `syz.2.1391'.
[  185.096133][ T9249] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1401'.
[  185.821859][ T9278] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  187.011771][ T9296] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  187.103675][ T9301] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[  187.321039][ T9305] netlink: 'syz.1.1421': attribute type 12 has an invalid length.
[  187.354871][ T9305] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1421'.
[  187.722197][ T5873] Bluetooth: hci2: Opcode 0x206a failed: -110
[  187.882972][ T5873] Bluetooth: hci2: command 0x206a tx timeout
[  188.032656][ T9335] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1438'.
[  188.248771][ T9343] netlink: 'syz.1.1442': attribute type 4 has an invalid length.
[  188.252573][ T9343] netlink: 'syz.1.1442': attribute type 2 has an invalid length.
[  188.256505][ T9343] netlink: 199408 bytes leftover after parsing attributes in process `syz.1.1442'.
[  188.304161][ T9344] IPv6: Can't replace route, no match found
[  188.516608][ T9350] syzkaller0: entered promiscuous mode
[  188.518959][ T9350] syzkaller0: entered allmulticast mode
[  188.546811][ T9352] netlink: 22 bytes leftover after parsing attributes in process `syz.2.1445'.
[  188.591214][ T5873] Bluetooth: hci0: unexpected subevent 0x03 length: 150 > 9
[  188.907267][ T9367] netlink: 'syz.2.1453': attribute type 1 has an invalid length.
[  188.911359][ T9367] netlink: 'syz.2.1453': attribute type 3 has an invalid length.
[  188.919409][ T9367] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1453'.
[  189.645199][ T9377] hsr_slave_0: hsr_addr_subst_dest: Unknown node
[  189.648066][ T9377] hsr_slave_1: hsr_addr_subst_dest: Unknown node
[  189.688978][ T9377] xt_time: unknown flags 0xf4
[  189.917897][ T9400] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1462'.
[  191.024591][ T9406] : entered promiscuous mode
[  192.811623][    C1] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 3294990274 wd_nsec: 3294990154
[  200.310582][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[  200.313328][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[  201.482338][ T5235] Bluetooth: hci1: command 0x0406 tx timeout
[  201.484874][ T5235] Bluetooth: hci2: command 0x206a tx timeout
[  201.492693][ T5874] Bluetooth: hci0: command 0x0406 tx timeout
[  205.611467][ T5874] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  205.616525][ T5874] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  205.621081][ T5874] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  205.626485][ T5874] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  205.632421][ T5874] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  205.700814][ T9428] lo speed is unknown, defaulting to 1000
[  205.929125][ T9428] chnl_net:caif_netlink_parms(): no params data found
[  206.718787][ T5235] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  206.724267][ T5235] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  206.727765][ T5235] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  206.730992][ T5235] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  206.734255][ T5235] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  210.669513][ T9441] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  210.674415][ T9441] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  210.678146][ T9441] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  210.685555][ T9441] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  210.689853][ T9441] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  258.874468][ T5874] Bluetooth: hci3: command tx timeout
[  258.882172][ T5875] Bluetooth: hci4: command tx timeout
[  259.142186][ T9428] bridge0: port 1(bridge_slave_0) entered blocking state
[  259.144446][ T9428] bridge0: port 1(bridge_slave_0) entered disabled state
[  259.147143][ T9428] bridge_slave_0: entered allmulticast mode
[  259.150161][ T9428] bridge_slave_0: entered promiscuous mode
[  259.174072][ T9428] bridge0: port 2(bridge_slave_1) entered blocking state
[  259.176262][ T9428] bridge0: port 2(bridge_slave_1) entered disabled state
[  259.178497][ T9428] bridge_slave_1: entered allmulticast mode
[  259.181964][ T9428] bridge_slave_1: entered promiscuous mode
[  259.327973][ T9428] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  259.341093][ T9428] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  259.407875][ T9439] lo speed is unknown, defaulting to 1000
[  259.466087][ T9428] team0: Port device team_slave_0 added
[  259.469746][ T9428] team0: Port device team_slave_1 added
[  259.494004][ T9428] batman_adv: batadv0: Adding interface: batadv_slave_0
[  259.496254][ T9428] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  259.505051][ T9428] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  259.509581][ T9428] batman_adv: batadv0: Adding interface: batadv_slave_1
[  259.511783][ T9428] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  259.520628][ T9428] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  259.552323][ T9436] lo speed is unknown, defaulting to 1000
[  259.581311][ T9428] hsr_slave_0: entered promiscuous mode
[  259.587645][ T9428] hsr_slave_1: entered promiscuous mode
[  259.590143][ T9428] debugfs: 'hsr0' already exists in 'hsr'
[  259.593242][ T9428] Cannot create hsr debugfs directory
[  259.673776][ T5879] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  259.738494][ T5879] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  259.785747][ T5879] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  259.833973][ T5879] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  259.953048][ T9439] chnl_net:caif_netlink_parms(): no params data found
[  260.097340][ T5879] bridge_slave_1: left allmulticast mode
[  260.099915][ T5879] bridge_slave_1: left promiscuous mode
[  260.104542][ T5879] bridge0: port 2(bridge_slave_1) entered disabled state
[  260.111344][ T5879] bridge_slave_0: left allmulticast mode
[  260.114171][ T5879] bridge_slave_0: left promiscuous mode
[  260.116525][ T5879] bridge0: port 1(bridge_slave_0) entered disabled state
[  260.501021][ T5879] .` (unregistering): (slave bond_slave_0): Releasing backup interface
[  260.508883][ T5879] .` (unregistering): (slave bond_slave_1): Releasing backup interface
[  260.516031][ T5879] .` (unregistering): Released all slaves
[  260.529839][ T9436] chnl_net:caif_netlink_parms(): no params data found
[  260.547815][ T5866] s: Port: 1 Link DOWN
[  260.553708][ T9428] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  260.561524][ T9428] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  260.594748][ T9428] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  260.631177][ T9428] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  260.638400][ T9439] bridge0: port 1(bridge_slave_0) entered blocking state
[  260.641709][ T9439] bridge0: port 1(bridge_slave_0) entered disabled state
[  260.645866][ T9439] bridge_slave_0: entered allmulticast mode
[  260.650082][ T9439] bridge_slave_0: entered promiscuous mode
[  260.662779][ T9439] bridge0: port 2(bridge_slave_1) entered blocking state
[  260.665828][ T9439] bridge0: port 2(bridge_slave_1) entered disabled state
[  260.668925][ T9439] bridge_slave_1: entered allmulticast mode
[  260.675175][ T9439] bridge_slave_1: entered promiscuous mode
[  260.721922][ T9439] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  260.755015][ T9439] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  260.765446][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[  260.768185][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[  260.799059][ T9436] bridge0: port 1(bridge_slave_0) entered blocking state
[  260.802396][ T9436] bridge0: port 1(bridge_slave_0) entered disabled state
[  260.805759][ T9436] bridge_slave_0: entered allmulticast mode
[  260.809876][ T9436] bridge_slave_0: entered promiscuous mode
[  260.815331][ T9436] bridge0: port 2(bridge_slave_1) entered blocking state
[  260.818480][ T9436] bridge0: port 2(bridge_slave_1) entered disabled state
[  260.821609][ T9436] bridge_slave_1: entered allmulticast mode
[  260.826795][ T9436] bridge_slave_1: entered promiscuous mode
[  260.842716][ T9439] team0: Port device team_slave_0 added
[  260.861456][ T9439] team0: Port device team_slave_1 added
[  260.895076][ T9436] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  260.912235][ T9436] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  260.921118][ T9439] batman_adv: batadv0: Adding interface: batadv_slave_0
[  260.926808][ T9439] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  260.932590][ T5875] Bluetooth: hci5: command tx timeout
[  260.937321][ T9439] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  260.940329][ T5874] Bluetooth: hci3: command tx timeout
[  260.945716][ T9439] batman_adv: batadv0: Adding interface: batadv_slave_1
[  260.949016][ T9439] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  260.949029][ T5873] Bluetooth: hci4: command tx timeout
[  260.959369][ T9439] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  261.009032][ T9436] team0: Port device team_slave_0 added
[  261.015974][ T9436] team0: Port device team_slave_1 added
[  261.064322][ T9436] batman_adv: batadv0: Adding interface: batadv_slave_0
[  261.067257][ T9436] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  261.078827][ T9436] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  261.105896][ T9439] hsr_slave_0: entered promiscuous mode
[  261.109061][ T9439] hsr_slave_1: entered promiscuous mode
[  261.111987][ T9439] debugfs: 'hsr0' already exists in 'hsr'
[  261.114976][ T9439] Cannot create hsr debugfs directory
[  261.125681][ T9436] batman_adv: batadv0: Adding interface: batadv_slave_1
[  261.128692][ T9436] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  261.139923][ T9436] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  261.219574][ T9436] hsr_slave_0: entered promiscuous mode
[  261.224736][ T9436] hsr_slave_1: entered promiscuous mode
[  261.227782][ T9436] debugfs: 'hsr0' already exists in 'hsr'
[  261.230126][ T9436] Cannot create hsr debugfs directory
[  261.471702][ T9428] 8021q: adding VLAN 0 to HW filter on device bond0
[  261.521620][ T9428] 8021q: adding VLAN 0 to HW filter on device team0
[  261.534398][ T9439] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  261.541954][ T9439] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  261.550862][ T9439] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  261.561843][ T9439] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  261.576837][ T3643] bridge0: port 1(bridge_slave_0) entered blocking state
[  261.579767][ T3643] bridge0: port 1(bridge_slave_0) entered forwarding state
[  261.609424][ T3643] bridge0: port 2(bridge_slave_1) entered blocking state
[  261.612436][ T3643] bridge0: port 2(bridge_slave_1) entered forwarding state
[  261.689965][ T9436] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  261.696737][ T9436] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  261.707887][ T9436] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  261.718327][ T9436] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  261.904901][ T9439] 8021q: adding VLAN 0 to HW filter on device bond0
[  261.936306][ T9436] 8021q: adding VLAN 0 to HW filter on device bond0
[  261.946644][ T9428] 8021q: adding VLAN 0 to HW filter on device batadv0
[  261.951885][ T9439] 8021q: adding VLAN 0 to HW filter on device team0
[  261.971714][   T53] bridge0: port 1(bridge_slave_0) entered blocking state
[  261.974804][   T53] bridge0: port 1(bridge_slave_0) entered forwarding state
[  261.991911][   T53] bridge0: port 2(bridge_slave_1) entered blocking state
[  261.994960][   T53] bridge0: port 2(bridge_slave_1) entered forwarding state
[  262.015073][ T9436] 8021q: adding VLAN 0 to HW filter on device team0
[  262.038005][   T53] bridge0: port 1(bridge_slave_0) entered blocking state
[  262.040969][   T53] bridge0: port 1(bridge_slave_0) entered forwarding state
[  262.066179][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[  262.068555][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[  262.110534][ T9428] veth0_vlan: entered promiscuous mode
[  262.148226][ T9428] veth1_vlan: entered promiscuous mode
[  262.234198][ T9428] veth0_macvtap: entered promiscuous mode
[  262.241253][ T9428] veth1_macvtap: entered promiscuous mode
[  262.273970][ T9428] batman_adv: batadv0: Interface activated: batadv_slave_0
[  262.298042][ T9428] batman_adv: batadv0: Interface activated: batadv_slave_1
[  262.315845][   T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  262.321629][   T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  262.326622][   T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  262.330179][   T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  262.345080][ T9439] 8021q: adding VLAN 0 to HW filter on device batadv0
[  262.391844][ T9436] 8021q: adding VLAN 0 to HW filter on device batadv0
[  262.460687][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  262.473267][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  262.522909][   T28] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  262.526060][   T28] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  262.671587][ T9439] veth0_vlan: entered promiscuous mode
[  262.693958][ T9439] veth1_vlan: entered promiscuous mode
[  262.749455][ T9517] netlink: 'syz.3.1479': attribute type 29 has an invalid length.
[  262.760252][ T9436] veth0_vlan: entered promiscuous mode
[  262.768762][ T9517] netlink: 'syz.3.1479': attribute type 29 has an invalid length.
[  262.780321][ T9517] netlink: 'syz.3.1479': attribute type 29 has an invalid length.
[  262.787653][ T9517] netlink: 'syz.3.1479': attribute type 29 has an invalid length.
[  262.795925][ T9439] veth0_macvtap: entered promiscuous mode
[  262.812991][ T9436] veth1_vlan: entered promiscuous mode
[  262.816764][ T9439] veth1_macvtap: entered promiscuous mode
[  262.854714][ T9439] batman_adv: batadv0: Interface activated: batadv_slave_0
[  262.870600][ T9439] batman_adv: batadv0: Interface activated: batadv_slave_1
[  262.907214][ T9436] veth0_macvtap: entered promiscuous mode
[  262.911092][   T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  262.915264][   T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  262.933925][   T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  262.941917][   T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  262.954529][ T9436] veth1_macvtap: entered promiscuous mode
[  263.003095][ T5873] Bluetooth: hci4: command tx timeout
[  263.003152][ T5875] Bluetooth: hci5: command tx timeout
[  263.005200][ T5873] Bluetooth: hci3: command tx timeout
[  263.011826][ T9436] batman_adv: batadv0: Interface activated: batadv_slave_0
[  263.043656][ T9436] batman_adv: batadv0: Interface activated: batadv_slave_1
[  263.062425][   T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  263.065542][   T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  263.100541][   T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  263.105754][   T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  263.124070][ T3643] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  263.126987][ T3643] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  263.216322][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  263.223140][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  263.240480][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  263.247438][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  263.305672][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  263.308734][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  263.560509][ T9527] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1477'.
[  264.498548][ T9550] netlink: 'syz.3.1493': attribute type 41 has an invalid length.
[  264.507528][ T9550] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1493'.
[  264.581648][ T9554] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1495'.
[  264.712445][ T9556] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1495'.
[  265.140425][ T5873] Bluetooth: hci5: command tx timeout
[  265.143238][ T5873] Bluetooth: hci4: command tx timeout
[  265.258987][ T5874] Bluetooth: hci3: command tx timeout
[  266.867417][ T9586] bpf: Bad value for 'uid'
[  266.910849][ T9588] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1508'.
[  266.917542][ T9588] openvswitch: netlink: nsh attribute has 5276 unknown bytes.
[  266.920387][ T9588] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  266.947952][ T9592] netlink: 'syz.3.1510': attribute type 17 has an invalid length.
[  266.950690][ T9592] netlink: 160 bytes leftover after parsing attributes in process `syz.3.1510'.
[  267.059104][ T9599] netlink: 'syz.5.1513': attribute type 21 has an invalid length.
[  267.068505][ T9599] netlink: 'syz.5.1513': attribute type 6 has an invalid length.
[  267.073872][ T9599] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1513'.
[  267.177226][ T5874] Bluetooth: hci5: command tx timeout
[  267.243409][ T9607] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1518'.
[  267.317640][ T9609] netlink: 160 bytes leftover after parsing attributes in process `syz.4.1515'.
[  267.466089][ T9612] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1519'.
[  268.318741][ T9629] netlink: 'syz.4.1525': attribute type 21 has an invalid length.
[  269.031394][ T9658] netlink: 'syz.5.1536': attribute type 1 has an invalid length.
[  269.064285][ T9660] __nla_validate_parse: 2 callbacks suppressed
[  269.064298][ T9660] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1537'.
[  269.203730][ T9664] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1539'.
[  269.346206][ T9672] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1542'.
[  269.549264][ T9674] netlink: zone id is out of range
[  269.553930][ T9674] netlink: zone id is out of range
[  269.557018][ T9674] netlink: zone id is out of range
[  269.559723][ T9674] netlink: zone id is out of range
[  269.564346][ T9674] netlink: zone id is out of range
[  269.567012][ T9674] netlink: zone id is out of range
[  269.569721][ T9674] netlink: zone id is out of range
[  269.608679][ T9674] netlink: zone id is out of range
[  269.614690][ T9678] netlink: 'syz.5.1545': attribute type 2 has an invalid length.
[  269.621051][ T9678] netlink: 137592 bytes leftover after parsing attributes in process `syz.5.1545'.
[  270.545690][ T9694] netlink: 76 bytes leftover after parsing attributes in process `syz.5.1550'.
[  270.935861][ T9705] netlink: 'syz.3.1555': attribute type 11 has an invalid length.
[  270.939079][ T9705] netlink: 'syz.3.1555': attribute type 11 has an invalid length.
[  270.957270][ T9696] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1551'.
[  270.975396][ T9696] netlink: 532 bytes leftover after parsing attributes in process `syz.5.1551'.
[  270.979130][ T9696] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1551'.
[  274.572345][ T9785] netlink: 'syz.5.1586': attribute type 29 has an invalid length.
[  274.576537][ T9785] netlink: 'syz.5.1586': attribute type 29 has an invalid length.
[  274.610343][ T9787] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1587'.
[  274.629627][ T9787] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1587'.
[  274.633462][ T9787] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1587'.
[  274.928298][ T9802] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1594'.
[  275.065333][ T9808] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1597'.
[  275.077628][ T9808] bridge0: port 1(bridge_slave_0) entered disabled state
[  275.444759][ T9808] bridge_slave_0 (unregistering): left allmulticast mode
[  275.447575][ T9808] bridge_slave_0 (unregistering): left promiscuous mode
[  275.450464][ T9808] bridge0: port 1(bridge_slave_0) entered disabled state
[  275.898660][ T9818] netlink: 'syz.3.1601': attribute type 1 has an invalid length.
[  275.901952][ T9818] netlink: 'syz.3.1601': attribute type 2 has an invalid length.
[  276.389211][ T5874] Bluetooth: hci5: unexpected subevent 0x01 length: 150 > 18
[  277.987988][ T9881] netlink: 3787 bytes leftover after parsing attributes in process `syz.4.1630'.
[  278.430235][ T9904] syzkaller0: entered promiscuous mode
[  278.434129][ T9904] syzkaller0: entered allmulticast mode
[  278.651418][ T9915] netlink: 'syz.5.1645': attribute type 21 has an invalid length.
[  278.654351][ T9915] netlink: 'syz.5.1645': attribute type 1 has an invalid length.
[  278.959153][ T9926] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1650'.
[  279.210971][ T9939] netlink: 'syz.3.1656': attribute type 21 has an invalid length.
[  279.309575][ T9946] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1660'.
[  279.356223][ T9950] netlink: 'syz.4.1662': attribute type 6 has an invalid length.
[  279.359365][ T9950] netlink: 140 bytes leftover after parsing attributes in process `syz.4.1662'.
[  280.324943][ T5874] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  280.329386][ T5874] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  280.333834][ T5874] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  280.337383][ T5874] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  280.340750][ T5874] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  280.381949][ T9965] lo speed is unknown, defaulting to 1000
[  280.521688][ T9969] netlink: 'syz.5.1672': attribute type 13 has an invalid length.
[  280.773942][ T9965] chnl_net:caif_netlink_parms(): no params data found
[  280.896117][ T9965] bridge0: port 1(bridge_slave_0) entered blocking state
[  280.899330][ T9965] bridge0: port 1(bridge_slave_0) entered disabled state
[  280.904447][ T9965] bridge_slave_0: entered allmulticast mode
[  280.908828][ T9965] bridge_slave_0: entered promiscuous mode
[  280.915176][ T9965] bridge0: port 2(bridge_slave_1) entered blocking state
[  280.918310][ T9965] bridge0: port 2(bridge_slave_1) entered disabled state
[  280.921603][ T9965] bridge_slave_1: entered allmulticast mode
[  280.931438][ T9965] bridge_slave_1: entered promiscuous mode
[  280.979351][ T9965] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  280.988986][ T9965] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  281.033800][ T9965] team0: Port device team_slave_0 added
[  281.039569][ T9965] team0: Port device team_slave_1 added
[  281.080014][ T9965] batman_adv: batadv0: Adding interface: batadv_slave_0
[  281.085386][ T9965] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  281.097182][ T9965] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  281.104735][ T9965] batman_adv: batadv0: Adding interface: batadv_slave_1
[  281.107717][ T9965] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  281.120023][ T9965] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  281.163497][ T9965] hsr_slave_0: entered promiscuous mode
[  281.166386][ T9965] hsr_slave_1: entered promiscuous mode
[  281.169234][ T9965] debugfs: 'hsr0' already exists in 'hsr'
[  281.171475][ T9965] Cannot create hsr debugfs directory
[  281.305773][ T9965] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  281.399637][ T9965] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  281.410989][ T9977] netlink: 'syz.5.1673': attribute type 1 has an invalid length.
[  281.464146][ T9965] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  281.540196][ T9965] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  281.551129][ T9979] mac80211_hwsim hwsim12 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[  281.758589][ T9965] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  281.775138][ T9965] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  281.785581][ T9965] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  281.803895][ T9965] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  281.951598][ T9965] 8021q: adding VLAN 0 to HW filter on device bond0
[  281.986067][ T9965] 8021q: adding VLAN 0 to HW filter on device team0
[  282.005801][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[  282.008464][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[  282.038234][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[  282.041166][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[  282.372862][ T5873] Bluetooth: hci0: command tx timeout
[  282.405224][ T9965] 8021q: adding VLAN 0 to HW filter on device batadv0
[  282.774748][ T9965] veth0_vlan: entered promiscuous mode
[  282.782001][ T9965] veth1_vlan: entered promiscuous mode
[  282.810661][ T9965] veth0_macvtap: entered promiscuous mode
[  282.821805][ T9965] veth1_macvtap: entered promiscuous mode
[  282.847733][ T9965] batman_adv: batadv0: Interface activated: batadv_slave_0
[  282.854691][ T9965] batman_adv: batadv0: Interface activated: batadv_slave_1
[  282.870207][   T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  282.873752][   T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  282.884551][   T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  282.896669][   T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  282.978308][ T3643] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  282.981196][ T3643] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  283.019477][ T3643] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  283.023865][ T3643] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  283.803742][T10010] netlink: 830 bytes leftover after parsing attributes in process `syz.4.1679'.
[  284.443179][ T5873] Bluetooth: hci0: command tx timeout
[  284.715980][T10018] netlink: 'syz.4.1683': attribute type 21 has an invalid length.
[  284.817802][T10022] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1686'.
[  284.858862][T10024] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  284.861920][T10024] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  285.774486][T10035] netlink: 188 bytes leftover after parsing attributes in process `syz.4.1692'.
[  287.086807][ T5874] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  287.093914][ T5874] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  287.097738][ T5874] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  287.106321][ T5874] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  287.109648][ T5874] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  287.131613][T10051] lo speed is unknown, defaulting to 1000
[  287.501661][T10051] chnl_net:caif_netlink_parms(): no params data found
[  287.651188][T10051] bridge0: port 1(bridge_slave_0) entered blocking state
[  287.658324][T10051] bridge0: port 1(bridge_slave_0) entered disabled state
[  287.661431][T10051] bridge_slave_0: entered allmulticast mode
[  287.673710][T10051] bridge_slave_0: entered promiscuous mode
[  287.678290][T10051] bridge0: port 2(bridge_slave_1) entered blocking state
[  287.680748][T10051] bridge0: port 2(bridge_slave_1) entered disabled state
[  287.692894][T10051] bridge_slave_1: entered allmulticast mode
[  287.696364][T10051] bridge_slave_1: entered promiscuous mode
[  287.728965][T10051] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  287.739413][T10051] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  287.775612][T10051] team0: Port device team_slave_0 added
[  287.779426][T10051] team0: Port device team_slave_1 added
[  287.847373][T10051] batman_adv: batadv0: Adding interface: batadv_slave_0
[  287.849602][T10051] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  287.861564][T10051] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  287.868234][T10051] batman_adv: batadv0: Adding interface: batadv_slave_1
[  287.874898][T10051] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  287.887239][T10051] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  287.960623][T10051] hsr_slave_0: entered promiscuous mode
[  287.964696][T10051] hsr_slave_1: entered promiscuous mode
[  287.967804][T10051] debugfs: 'hsr0' already exists in 'hsr'
[  287.970204][T10051] Cannot create hsr debugfs directory
[  288.146925][T10051] netdevsim netdevsim6 netdevsim0: renamed from eth0
[  288.161191][T10078] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1708'.
[  288.163429][T10051] netdevsim netdevsim6 netdevsim1: renamed from eth1
[  288.171362][T10051] netdevsim netdevsim6 netdevsim2: renamed from eth2
[  288.186785][T10051] netdevsim netdevsim6 netdevsim3: renamed from eth3
[  288.261671][T10051] bridge0: port 2(bridge_slave_1) entered blocking state
[  288.264537][T10051] bridge0: port 2(bridge_slave_1) entered forwarding state
[  288.267866][T10051] bridge0: port 1(bridge_slave_0) entered blocking state
[  288.270951][T10051] bridge0: port 1(bridge_slave_0) entered forwarding state
[  288.351461][T10051] 8021q: adding VLAN 0 to HW filter on device bond0
[  288.367507][   T36] bridge0: port 1(bridge_slave_0) entered disabled state
[  288.371454][   T36] bridge0: port 2(bridge_slave_1) entered disabled state
[  288.385288][T10051] 8021q: adding VLAN 0 to HW filter on device team0
[  288.395359][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[  288.398353][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[  288.416348][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[  288.418956][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[  288.491302][T10088] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1710'.
[  288.667555][T10051] 8021q: adding VLAN 0 to HW filter on device batadv0
[  288.870979][T10051] veth0_vlan: entered promiscuous mode
[  288.880152][T10051] veth1_vlan: entered promiscuous mode
[  288.915323][T10051] veth0_macvtap: entered promiscuous mode
[  288.919986][T10051] veth1_macvtap: entered promiscuous mode
[  288.935743][T10051] batman_adv: batadv0: Interface activated: batadv_slave_0
[  288.946802][T10051] batman_adv: batadv0: Interface activated: batadv_slave_1
[  288.954325][ T5715] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  288.957587][ T5715] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  288.960939][ T5715] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  288.969273][ T5715] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  289.078937][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  289.081594][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  289.115556][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  289.118688][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  289.162223][ T5873] Bluetooth: hci0: command tx timeout
[  289.421752][T10120] netlink: 'syz.6.1720': attribute type 29 has an invalid length.
[  289.435819][T10120] netlink: 'syz.6.1720': attribute type 29 has an invalid length.
[  289.457298][T10116] ==================================================================
[  289.460023][T10116] BUG: KASAN: slab-use-after-free in __xfrm_state_lookup+0x6ad/0x8d0
[  289.462680][T10116] Read of size 2 at addr ffff888108ade9c2 by task syz.5.1719/10116
[  289.465442][T10116] 
[  289.466254][T10120] netlink: 'syz.6.1720': attribute type 29 has an invalid length.
[  289.466746][T10116] CPU: 1 UID: 0 PID: 10116 Comm: syz.5.1719 Not tainted syzkaller #0 PREEMPT(full) 
[  289.466765][T10116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  289.466773][T10116] Call Trace:
[  289.466782][T10116]  <TASK>
[  289.466789][T10116]  dump_stack_lvl+0x189/0x250
[  289.466807][T10116]  ? __kasan_check_byte+0x12/0x40
[  289.466823][T10116]  ? __pfx_dump_stack_lvl+0x10/0x10
[  289.466833][T10116]  ? lock_release+0x4b/0x3e0
[  289.466850][T10116]  ? __virt_addr_valid+0x4a5/0x5c0
[  289.466864][T10116]  print_report+0xca/0x240
[  289.466874][T10116]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  289.466889][T10116]  kasan_report+0x118/0x150
[  289.466902][T10116]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  289.466916][T10116]  __xfrm_state_lookup+0x6ad/0x8d0
[  289.466933][T10116]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  289.466947][T10116]  xfrm_state_add+0x27d/0xc40
[  289.466962][T10116]  xfrm_add_sa+0x35a1/0x4070
[  289.466972][T10116]  ? __pfx_xfrm_add_sa+0x10/0x10
[  289.466979][T10116]  ? apparmor_capable+0x137/0x1b0
[  289.466991][T10116]  ? __nla_parse+0x40/0x60
[  289.467001][T10116]  xfrm_user_rcv_msg+0x7a3/0xab0
[  289.467009][T10116]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  289.467025][T10116]  ? netlink_rcv_skb+0x102/0x470
[  289.467038][T10116]  ? kasan_check_range+0x9b/0x2c0
[  289.467051][T10116]  netlink_rcv_skb+0x208/0x470
[  289.467061][T10116]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  289.467069][T10116]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  289.467080][T10116]  ? netlink_deliver_tap+0x2e/0x1b0
[  289.467089][T10116]  ? netlink_deliver_tap+0x2e/0x1b0
[  289.467098][T10116]  xfrm_netlink_rcv+0x79/0x90
[  289.467106][T10116]  netlink_unicast+0x82f/0x9e0
[  289.467117][T10116]  ? __pfx_netlink_unicast+0x10/0x10
[  289.467124][T10116]  ? netlink_sendmsg+0x642/0xb30
[  289.467133][T10116]  ? skb_put+0x11b/0x210
[  289.467145][T10116]  netlink_sendmsg+0x805/0xb30
[  289.467156][T10116]  ? __pfx_netlink_sendmsg+0x10/0x10
[  289.467166][T10116]  ? aa_sock_msg_perm+0xf1/0x1d0
[  289.467174][T10116]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  289.467184][T10116]  ? __pfx_netlink_sendmsg+0x10/0x10
[  289.467482][T10116]  __sock_sendmsg+0x21c/0x270
[  289.467494][T10116]  ____sys_sendmsg+0x505/0x830
[  289.467508][T10116]  ? __pfx_____sys_sendmsg+0x10/0x10
[  289.467522][T10116]  ? import_iovec+0x74/0xa0
[  289.467536][T10116]  ___sys_sendmsg+0x21f/0x2a0
[  289.467549][T10116]  ? __pfx____sys_sendmsg+0x10/0x10
[  289.467567][T10116]  ? __fget_files+0x2a/0x420
[  289.467574][T10116]  ? __fget_files+0x3a0/0x420
[  289.467583][T10116]  __x64_sys_sendmsg+0x19b/0x260
[  289.467618][T10116]  ? clockevents_program_event+0x24d/0x360
[  289.467633][T10116]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  289.467656][T10116]  ? do_syscall_64+0xbe/0x3b0
[  289.467668][T10116]  do_syscall_64+0xfa/0x3b0
[  289.467678][T10116]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  289.467688][T10116]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  289.467699][T10116]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  289.467708][T10116] RIP: 0033:0x7fa4cd98eba9
[  289.467720][T10116] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  289.467728][T10116] RSP: 002b:00007fa4ce7e2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  289.467741][T10116] RAX: ffffffffffffffda RBX: 00007fa4cdbd5fa0 RCX: 00007fa4cd98eba9
[  289.467748][T10116] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000004
[  289.467754][T10116] RBP: 00007fa4cda11e19 R08: 0000000000000000 R09: 0000000000000000
[  289.467760][T10116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  289.467765][T10116] R13: 00007fa4cdbd6038 R14: 00007fa4cdbd5fa0 R15: 00007fffe7fb9108
[  289.467776][T10116]  </TASK>
[  289.467780][T10116] 
[  289.598833][T10116] Allocated by task 9921:
[  289.600280][T10116]  kasan_save_track+0x3e/0x80
[  289.602159][T10116]  __kasan_slab_alloc+0x6c/0x80
[  289.603966][T10116]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  289.606123][T10116]  xfrm_state_alloc+0x24/0x2f0
[  289.608079][T10116]  __find_acq_core+0x8a7/0x1c00
[  289.610039][T10116]  xfrm_find_acq+0x78/0xa0
[  289.611849][T10116]  xfrm_alloc_userspi+0x6b3/0xc90
[  289.613839][T10116]  xfrm_user_rcv_msg+0x7a3/0xab0
[  289.615735][T10116]  netlink_rcv_skb+0x208/0x470
[  289.617380][T10116]  xfrm_netlink_rcv+0x79/0x90
[  289.619216][T10116]  netlink_unicast+0x82f/0x9e0
[  289.621093][T10116]  netlink_sendmsg+0x805/0xb30
[  289.622957][T10116]  __sock_sendmsg+0x21c/0x270
[  289.624776][T10116]  ____sys_sendmsg+0x505/0x830
[  289.626647][T10116]  ___sys_sendmsg+0x21f/0x2a0
[  289.628475][T10116]  __x64_sys_sendmsg+0x19b/0x260
[  289.630419][T10116]  do_syscall_64+0xfa/0x3b0
[  289.632220][T10116]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  289.634514][T10116] 
[  289.635468][T10116] Freed by task 9444:
[  289.637059][T10116]  kasan_save_track+0x3e/0x80
[  289.638933][T10116]  kasan_save_free_info+0x46/0x50
[  289.640911][T10116]  __kasan_slab_free+0x5b/0x80
[  289.642800][T10116]  kmem_cache_free+0x18f/0x400
[  289.644718][T10116]  xfrm_state_gc_task+0x52d/0x6b0
[  289.646737][T10116]  process_scheduled_works+0xae1/0x17b0
[  289.648938][T10116]  worker_thread+0x8a0/0xda0
[  289.650758][T10116]  kthread+0x711/0x8a0
[  289.652331][T10116]  ret_from_fork+0x439/0x7d0
[  289.654132][T10116]  ret_from_fork_asm+0x1a/0x30
[  289.655976][T10116] 
[  289.656947][T10116] The buggy address belongs to the object at ffff888108ade880
[  289.656947][T10116]  which belongs to the cache xfrm_state of size 928
[  289.662228][T10116] The buggy address is located 322 bytes inside of
[  289.662228][T10116]  freed 928-byte region [ffff888108ade880, ffff888108adec20)
[  289.667479][T10116] 
[  289.668445][T10116] The buggy address belongs to the physical page:
[  289.670914][T10116] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888108ade880 pfn:0x108adc
[  289.674876][T10116] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  289.678061][T10116] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  289.681140][T10116] page_type: f5(slab)
[  289.682713][T10116] raw: 057ff00000000040 ffff888104f363c0 dead000000000122 0000000000000000
[  289.686035][T10116] raw: ffff888108ade880 00000000800e0009 00000000f5000000 0000000000000000
[  289.689397][T10116] head: 057ff00000000040 ffff888104f363c0 dead000000000122 0000000000000000
[  289.692201][T10116] head: ffff888108ade880 00000000800e0009 00000000f5000000 0000000000000000
[  289.695320][T10116] head: 057ff00000000002 ffffea000422b701 00000000ffffffff 00000000ffffffff
[  289.698700][T10116] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  289.702125][T10116] page dumped because: kasan: bad access detected
[  289.704632][T10116] page_owner tracks the page as allocated
[  289.706896][T10116] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6039, tgid 6038 (syz.2.57), ts 76792275040, free_ts 76792112018
[  289.714075][T10116]  post_alloc_hook+0x240/0x2a0
[  289.716009][T10116]  get_page_from_freelist+0x21e4/0x22c0
[  289.718243][T10116]  __alloc_frozen_pages_noprof+0x181/0x370
[  289.720600][T10116]  alloc_pages_mpol+0x232/0x4a0
[  289.722518][T10116]  allocate_slab+0x8a/0x370
[  289.724316][T10116]  ___slab_alloc+0xbeb/0x1420
[  289.726172][T10116]  kmem_cache_alloc_noprof+0x283/0x3c0
[  289.728470][T10116]  xfrm_state_alloc+0x24/0x2f0
[  289.730360][T10116]  __find_acq_core+0x8a7/0x1c00
[  289.732304][T10116]  xfrm_find_acq+0x78/0xa0
[  289.734070][T10116]  pfkey_getspi+0x65d/0xee0
[  289.735820][T10116]  pfkey_sendmsg+0xbfe/0x1090
[  289.737622][T10116]  __sock_sendmsg+0x21c/0x270
[  289.739433][T10116]  ____sys_sendmsg+0x505/0x830
[  289.741290][T10116]  ___sys_sendmsg+0x21f/0x2a0
[  289.743103][T10116]  __x64_sys_sendmsg+0x19b/0x260
[  289.745086][T10116] page last free pid 6039 tgid 6038 stack trace:
[  289.747493][T10116]  __free_frozen_pages+0xbc4/0xd30
[  289.749519][T10116]  stack_depot_save_flags+0x436/0x860
[  289.751612][T10116]  kasan_save_track+0x4f/0x80
[  289.753457][T10116]  __kasan_slab_alloc+0x6c/0x80
[  289.755381][T10116]  kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[  289.757681][T10116]  __alloc_skb+0x112/0x2d0
[  289.759413][T10116]  pfkey_sendmsg+0x1dd/0x1090
[  289.761236][T10116]  __sock_sendmsg+0x21c/0x270
[  289.763078][T10116]  ____sys_sendmsg+0x505/0x830
[  289.764629][T10116]  ___sys_sendmsg+0x21f/0x2a0
[  289.766193][T10116]  __x64_sys_sendmsg+0x19b/0x260
[  289.768003][T10116]  do_syscall_64+0xfa/0x3b0
[  289.769649][T10116]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  289.771733][T10116] 
[  289.772580][T10116] Memory state around the buggy address:
[  289.774477][T10116]  ffff888108ade880: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  289.777187][T10116]  ffff888108ade900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  289.779680][T10116] >ffff888108ade980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  289.782194][T10116]                                            ^
[  289.783939][T10116]  ffff888108adea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  289.786705][T10116]  ffff888108adea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  289.789695][T10116] ==================================================================
[  289.793022][T10116] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  289.795548][T10116] CPU: 1 UID: 0 PID: 10116 Comm: syz.5.1719 Not tainted syzkaller #0 PREEMPT(full) 
[  289.798747][T10116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  289.802067][T10116] Call Trace:
[  289.803202][T10116]  <TASK>
[  289.804313][T10116]  dump_stack_lvl+0x99/0x250
[  289.806107][T10116]  ? __asan_memcpy+0x40/0x70
[  289.807895][T10116]  ? __pfx_dump_stack_lvl+0x10/0x10
[  289.809954][T10116]  ? __pfx__printk+0x10/0x10
[  289.811607][T10116]  vpanic+0x281/0x750
[  289.812869][T10116]  ? __pfx_vpanic+0x10/0x10
[  289.814393][T10116]  ? irqentry_exit+0x74/0x90
[  289.815879][T10116]  panic+0xb9/0xc0
[  289.817027][T10116]  ? __pfx_panic+0x10/0x10
[  289.818498][T10116]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  289.820495][T10116]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  289.822646][T10116]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  289.824336][T10116]  check_panic_on_warn+0x89/0xb0
[  289.825918][T10116]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  289.828001][T10116]  end_report+0x78/0x160
[  289.829759][T10116]  kasan_report+0x129/0x150
[  289.831434][T10116]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  289.833483][T10116]  __xfrm_state_lookup+0x6ad/0x8d0
[  289.835477][T10116]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  289.837697][T10116]  xfrm_state_add+0x27d/0xc40
[  289.839544][T10116]  xfrm_add_sa+0x35a1/0x4070
[  289.841407][T10116]  ? __pfx_xfrm_add_sa+0x10/0x10
[  289.843294][T10116]  ? apparmor_capable+0x137/0x1b0
[  289.845092][T10116]  ? __nla_parse+0x40/0x60
[  289.846525][T10116]  xfrm_user_rcv_msg+0x7a3/0xab0
[  289.848126][T10116]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  289.850017][T10116]  ? netlink_rcv_skb+0x102/0x470
[  289.851771][T10116]  ? kasan_check_range+0x9b/0x2c0
[  289.853492][T10116]  netlink_rcv_skb+0x208/0x470
[  289.855092][T10116]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  289.857007][T10116]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  289.858812][T10116]  ? netlink_deliver_tap+0x2e/0x1b0
[  289.860765][T10116]  ? netlink_deliver_tap+0x2e/0x1b0
[  289.862696][T10116]  xfrm_netlink_rcv+0x79/0x90
[  289.864409][T10116]  netlink_unicast+0x82f/0x9e0
[  289.866050][T10116]  ? __pfx_netlink_unicast+0x10/0x10
[  289.867899][T10116]  ? netlink_sendmsg+0x642/0xb30
[  289.869589][T10116]  ? skb_put+0x11b/0x210
[  289.870960][T10116]  netlink_sendmsg+0x805/0xb30
[  289.872479][T10116]  ? __pfx_netlink_sendmsg+0x10/0x10
[  289.874124][T10116]  ? aa_sock_msg_perm+0xf1/0x1d0
[  289.875688][T10116]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  289.877435][T10116]  ? __pfx_netlink_sendmsg+0x10/0x10
[  289.879325][T10116]  __sock_sendmsg+0x21c/0x270
[  289.881005][T10116]  ____sys_sendmsg+0x505/0x830
[  289.882734][T10116]  ? __pfx_____sys_sendmsg+0x10/0x10
[  289.884859][T10116]  ? import_iovec+0x74/0xa0
[  289.886692][T10116]  ___sys_sendmsg+0x21f/0x2a0
[  289.888602][T10116]  ? __pfx____sys_sendmsg+0x10/0x10
[  289.890694][T10116]  ? __fget_files+0x2a/0x420
[  289.892229][T10116]  ? __fget_files+0x3a0/0x420
[  289.893795][T10116]  __x64_sys_sendmsg+0x19b/0x260
[  289.895395][T10116]  ? clockevents_program_event+0x24d/0x360
[  289.897384][T10116]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  289.899204][T10116]  ? do_syscall_64+0xbe/0x3b0
[  289.900752][T10116]  do_syscall_64+0xfa/0x3b0
[  289.902266][T10116]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  289.904172][T10116]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  289.906494][T10116]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  289.908822][T10116] RIP: 0033:0x7fa4cd98eba9
[  289.910412][T10116] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  289.917066][T10116] RSP: 002b:00007fa4ce7e2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  289.920190][T10116] RAX: ffffffffffffffda RBX: 00007fa4cdbd5fa0 RCX: 00007fa4cd98eba9
[  289.922922][T10116] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000004
[  289.925874][T10116] RBP: 00007fa4cda11e19 R08: 0000000000000000 R09: 0000000000000000
[  289.928705][T10116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  289.931496][T10116] R13: 00007fa4cdbd6038 R14: 00007fa4cdbd5fa0 R15: 00007fffe7fb9108
[  289.934733][T10116]  </TASK>
[  289.936580][T10116] Kernel Offset: disabled
[  289.938163][T10116] Rebooting in 86400 seconds..

VM DIAGNOSIS:
18:18:46  Registers:
info registers vcpu 0

CPU#0
RAX=00000000000001e8 RBX=ffff88804b023900 RCX=0000000000000838 RDX=0000000000000000
RSI=00000000000001e8 RDI=0000000000000838 RBP=0000000000000000 RSP=ffffc90000007e50
R8 =0000000000000000 R9 =ffffffff81ae150e R10=0000000000000003 R11=ffffffff81704490
R12=00000000100064a9 R13=dffffc0000000000 R14=00000000000001e8 R15=0000000000000020
RIP=ffffffff81717179 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fa46181e6c0 ffffffff 00c00000
GS =0000 ffff8880b8613000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b30e17ff8 CR3=000000001f72e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fa460ba7498 00007fa460ba7470 XMM03=00007fa460ba74a8 00007fa460ba74a0
XMM04=00007fa46170d100 00007fa460ba7460 XMM05=00007fa460ba7478 00007fa460ba74c0
XMM06=00007fa460ba74b8 00007fa460ba74b0 XMM07=00007fa460ba74a8 00007fa460ba74a0
XMM08=0000000000000000 00007fa460a12ee7 XMM09=0000000000000000 00007fa460a12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff8b77364a RBX=0000000000000025 RCX=0000000000000002 RDX=ffff88810e5d9cc0
RSI=0000000000000025 RDI=0000000000000000 RBP=ffffffff8da5f615 RSP=ffffc90002c4e858
R8 =ffff88810e5d9cc0 R9 =0000000000000002 R10=0000000000000025 R11=0000000000000002
R12=ffffffff8da5f615 R13=ffffc90002c4e908 R14=0000000000000001 R15=ffffffff8da5f615
RIP=ffffffff8b7dec20 RFL=00000097 [--S-APC] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fa4ce7e26c0 ffffffff 00c00000
GS =0000 ffff8881a3c13000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b33019ff8 CR3=0000000039ede000 CR4=000006f0
DR0=0000200000000300 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fa4cdba7498 00007fa4cdba7470 XMM03=00007fa4cdba74a8 00007fa4cdba74a0
XMM04=00007fa4ce70d100 00007fa4cdba7460 XMM05=00007fa4cdba7478 00007fa4cdba74c0
XMM06=00007fa4cdba74b8 00007fa4cdba74b0 XMM07=00007fa4cdba74a8 00007fa4cdba74a0
XMM08=0000000000000000 00007fa4cda12ee7 XMM09=0000000000000000 00007fa4cda12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
