last executing test programs:

1.236319596s ago: executing program 1 (id=255):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000004c0)={0x14, 0x22, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x3}]}, 0x14}], 0x1}, 0x80)

1.171137257s ago: executing program 1 (id=257):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r0, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x20000101}, {{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000740)}, 0x80000000}], 0x4, 0x102, 0x0)

1.170488373s ago: executing program 0 (id=258):
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0xfffffffffffffdf8)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r2, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1d, 0x8e, 0xe365e39d0c265083}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x20048080)
r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r4 = openat$cgroup_int(r3, &(0x7f0000000480)='pids.max\x00', 0x2, 0x0)
write$cgroup_int(r4, &(0x7f0000000080)=0x30000000, 0x12)
bind$bt_sco(r0, &(0x7f0000000280)={0x1f, @fixed}, 0x8)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_TEST(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000000b0601"], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0xc00c0)
r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r6, &(0x7f0000000180)={0x1f, 0xffff, 0x3}, 0x6)
unshare(0x20000400)
r7 = socket$inet6(0xa, 0x3, 0x4)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x14, 0x30, 0x1}, 0x14}}, 0x0)
connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x8a2e, @loopback, 0x6}, 0x1c)
sendmmsg(r7, 0x0, 0x0, 0xffd8)
write(r6, &(0x7f0000000000)="38000300010003", 0x7)
r8 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$ARPT_SO_SET_REPLACE(r8, 0x0, 0x60, &(0x7f0000000f80)={'filter\x00', 0x7, 0x4, 0x3e8, 0x1f0, 0x1f0, 0x300, 0x1f0, 0x1f0, 0x300, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x1000, 0xc0, 0x3}}}, {{@uncond, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x7, 'syz0\x00', {0x10000}}}}, {{@arp={@broadcast, @rand_addr=0x64010100, 0x0, 0x0, 0x5, 0xd, {@empty, {[0xff, 0x0, 0xff, 0xff, 0x0, 0xff]}}, {}, 0xfffa, 0x6, 0x7, 0x0, 0xb2, 0x6, 'veth1_to_bond\x00', 'wg0\x00', {}, {0xff}, 0x0, 0x210}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @empty, @multicast1, @remote, 0xd, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438)
r9 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
r10 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000014006b47880000d86e6c1d0002887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64c9f4d4938037e786a6d0bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0)
mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r9, 0x0)
mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r9, 0x4c84c000)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r5)
setsockopt$bt_BT_VOICE(r0, 0x112, 0x13, 0x0, 0x2)

1.170071345s ago: executing program 1 (id=259):
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000073116800000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) (async)
r0 = socket$netlink(0x10, 0x3, 0x15)
unshare(0x62040200)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x8031, 0xffffffffffffffff, 0x1000) (async)
socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32)
r1 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32)
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x7c, 0x10, 0x401, 0x2000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x13101}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x24, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x5, @loopback}, @IFLA_GRE_IKEY={0x8}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_PROTO_DOWN={0x5, 0x27, 0x3}, @IFLA_ADDRESS={0xa, 0x1, @local}, @IFLA_PHYS_SWITCH_ID={0x4}, @IFLA_BROADCAST={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2d}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0) (async)
r3 = socket(0x10, 0x2, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000009c0)=ANY=[@ANYBLOB="4c0000001800dd88000000000000000002"], 0x4c}}, 0x0) (async, rerun: 64)
writev(r2, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) (async, rerun: 64)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x6, 0x9, &(0x7f0000000080)={{0x8, @rand_addr, 0x0, 0x0, 'wrr\x00'}, {@broadcast}}, 0x44)
getsockopt$inet_tcp_int(r4, 0x6, 0x9, 0x0, &(0x7f0000000040)) (async)
writev(r0, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) (async)
r5 = getpid()
sendmsg$nl_generic(r0, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000680)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000001e0004002cbd7000fcdbdf250c00000008001e00", @ANYRES32=r5, @ANYBLOB="fcc093fa66a333616b0eaaafae0623642aee07b85617cb5c91d80f200000000000f4b21bc4aa7e1259e5809ae340e3a1855011c99c97a0e0dfe3823f15b7cdb2fde3177366b6a57bd1a62008a4a887f8862dc8ebe239077724e3cc34b96bdfb30f6fda1e00b546652e6d212c2b8ed6fb080ca4235a41d24eb9ed7cd114e5ba8caa2c12587f74b5898dc93a7ed8779c6d7da57ffd904514023dfa3534d0c0bfc23b4a756fba9c9b315ff625a8c95962943f95b45c252db726200682b29faad1"], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40004) (async)
recvmmsg(r0, &(0x7f0000007600)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x2000, 0x0) (async)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async, rerun: 64)
r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (rerun: 64)
ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000180)={0xe000, 0x4, 0x55, 0x3, 0x5}) (async)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@cgroup=r6, 0x1f, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac14140f00000000000000001400020002000000ffffffff00000000000000000d0001007564703a73797a3200000000"], 0x54}}, 0x0) (async, rerun: 64)
r9 = socket$inet_udplite(0x2, 0x2, 0x88) (async, rerun: 64)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000500)={'gretap0\x00', &(0x7f0000000340)={'syztnl0\x00', <r10=>0x0, 0x40, 0x0, 0x8, 0xdab, {{0x14, 0x4, 0x1, 0x15, 0x50, 0x65, 0x0, 0x80, 0x2f, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0x2a}, {[@noop, @timestamp_addr={0x44, 0x14, 0xf4, 0x1, 0x7, [{@private=0xa010102, 0x5}, {@empty, 0xc}]}, @end, @noop, @timestamp_addr={0x44, 0x1c, 0xd1, 0x1, 0x4, [{@dev={0xac, 0x14, 0x14, 0x3a}, 0xfffffffc}, {@multicast2, 0x8}, {@multicast1, 0x4}]}, @generic={0x88, 0x6, "322df5c0"}]}}}}})
unshare(0x2000080) (async)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f00000005c0)={'ip_vti0\x00', &(0x7f0000000540)={'syztnl1\x00', r10, 0x7800, 0x10, 0x9, 0x5, {{0xa, 0x4, 0x1, 0x6, 0x28, 0x65, 0x0, 0x3, 0x4, 0x0, @remote, @empty, {[@timestamp_prespec={0x44, 0x14, 0x2b, 0x3, 0xc, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x6}, {@loopback, 0x3}]}]}}}}})
sendmsg$TIPC_NL_BEARER_SET(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00', @ANYRES16=r8, @ANYBLOB="0100280000000000000002000000200001800d0001007564703a73797a32"], 0x34}}, 0x0)

1.039861143s ago: executing program 0 (id=260):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="44000000000701010000000000000000020000080c000640001fffe000000000040007800c000240000000000000000708e50440000000010900010073797a3100000000"], 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
r1 = socket(0xb, 0x6, 0x40010)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="020300090e0000002abd70000000000005000600000000000a00000000000002000000000000000000000000000000e3979f6c5d2bfc00fd135a010000000000000000020001000000006b647b2771e704d85d05000500330000000a00000100010001ff0100000000000000000000000000010000000000000000"], 0x70}, 0x1, 0x7}, 0x0)
r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00')
ioctl$BTRFS_IOC_RM_DEV(r3, 0x40305839, &(0x7f0000000a00)={{r3}, "43034353bc9f685fc5d678c047a4a5292e3237ca30cb0f3a9420c9fba0ec4682958baa9e0e94da65970a1c631b5f0139cf3987ad6efa4f483175bc44153da819970a879c6f3ada010c83640ed4e74958a739e85472f4c4c77469644ceadcdc5c688787fd96c27af4ce68d4a65843bd76785c6e519ee90f9a6920bf477c4891a82b124921220cbe3b082be08d48c6ed9eb46a9dc47e23779e961a3f99ea4191028fc46a22e8aad0c413261138ed0b5e2056e522c88a23ad104748d91912d3a9d239ce3ef5ce9c223039b540070954e9505d511ad49ed448daf48cab80390481984f69d19168efdba082cd2a7655d6b0139b0df978c71cd3782f409d56bf0fe9a685e0f79624ac8eb9850ec36fdf31c73234e61c34de1be1c48b7bc738125753deb1f50a00415fb76765ea1155af266b7f6f3ecc7c7754a7209684c4384e6a0884561230064b245748e9fa9f40e206d6c0008730bc1c1bc1a5649e2c4252cab52fe3b883b9a0f3f8deb174325b2a1734809c927458120698ade675a545a0082dc1a3daa41ae2923d0531d18f8231909d20edb1475df9c0684bcbd764711d9df0fcc98375d8afb5b613b79af337615b069f10f2d445fc76905d8fa1a120b65a0d62c4bef582e7292ee61629555dfaece502e533d2789773100c9ddcc1080e9574db85ffc46167537683ecc535c0684b4f64ae228bc16b6236a85e74f61886ea3aba3c6e4faf1dbd2722af34655cbe76df53958323fa8a59e1543cf60721caa411cb9c824798756d3631c61d45bf5018d09f7a2884e3672fefa55c0d7222ef614598f80518d4067061a18ef791d1dc153131417515b13afd314a49370ab130756c19c344daec5c857a867cdd5e73e7f7f4e4611a83b484af2d8cfe7a70d248719ac90c463182edec6c2fb702d9c0a4a141fdfb2a88121532da6f7bee16a4bfd9aa342a744eb798d4c274ce2fe5395966f69736b1d8e8cc737d2b7d1be6dd133eb76e2697ef6a07766a5ec66348fa6373d085be3310936bf6c39807d670d2a68c9510142f55f48455ae19377d690acefb34294622c44384def20d9d2b5f2001f94ddf291945746b3c264acf6face324e50b919f5f36dad3cacd6e6a894d773068481821d478f196ac8a1b097cfe1176b4f46e1db657e56cbd482abe729e7fc4d2b11f094cbaedd342cf72738683c8f8a075e1a6f27edff0d9e891e22b4d51e0c6bcb612390b395ec9b6b6590ca6eae2f7a8a0ffe079b8083d4a0601441571cb3ad6a5da6c1ac4143c17937710d01ff9b3f00908d8c2a9d6950d02b47b3b282aad26980f2b30d4366d7ac3691a2ef8aa959aaabc5b306ad2597a2613fb7237040e95d950ba6b78dbc4522fa0af7711f448be54019bf002719f2450d36ba9e80291357360634df225a9fcf5699658a26243ac82c15b8d4fb5eca179f09cee87a8bef8fdacbcfa74f93bf2a9a79063c17c08995ed2fe5e41eafb99b6eb7090623e3147d04f94e21d0302b1e398c0e74863156a2e4cf34c0f65a7b927f8cb840ca7ea907a6ee218bf39e24134f0f33206ca13366041940d265009eb2ee66a9f0ab3335ab14ff5a19b9d18fc98c547880cc7bf19513a353395933f1df3ad602e718ff3c344234678ee263e6f1023470466899bda51ce5e4f82f403e273a0ea32bf813f4ce90f21acc91a38379cfa454c183d5cdf670d25dd6ad168b7c4fb74cc5e6e17af5eef96478df04de0f703716e592ff8f2f7f4d36eef28095151aa1082bf828e12ca9a331ddeefddcfdb52ad2b4e89448f309ee8756224ff1878e37f3a177c0d78d7f71013252377616fa9d6d547ed9e562eae85a4c7e8776770c58e6d77ff3376c0f5c16966b8545a5f1a336bf4d60eb606035f284e14c69ab8b909938dd4f8257f5da1e8d16513c0f1a561d55208db14d69d33259d9e2befde605014340018f26079860879627754ba9e924dc3efbec4fa1186d075666a87662113bfb8750fd83a26b227ca421d5a266fac72a4258462e0fb7b2ce5ac6e692d82c2c6c8383bbae39d884c23c4c47555f924b22b60f621f2db8d009da303c919c847962ddefa13f1a0195e3b33881f11d0a15faf5617b8af3e684f50cb3a53e13b18e23a93059ecc630f98832c3f9cc8617a307b7373971aa35ddcf474fce083578ed556fbb0dc9e5ccebcaccf9fc382931278e5ad16b73432287be57f9e9d746a1b0ed9558378a7e819fd808b3aa608203c9f62bfbe88785be6c4da06dca42dcac31c6d850b82166951524df711bc044e12abf6d1817be7dbeaf19dbe068db18d93e87e1101d8c09298a71fd891d5976fc311903c9977c45fd8c8f375fc2d3f2b2ef58bf4378f148ff3a4d378174e1f26085b22cee03e252e73c28c71fc4552f1f3b9198fb6fed1c2133a65c7eda35a21b5c891db6e9cfc78abae9d2caff25bbf982f665ebaa870e87d289eb59f9b8f6151545dedf74c4d27d4aff17b507bcd71fe12efa3195bdbf5b757758f3a4b77283f7e6cd56d566c2bb3918d860eb23db3933ab1bbbf5ca63b5026f72dab99dac9a4a613b2da18eac33a398d158763bef75f70e7fc5c75a7cb7ab56b325f95a1e6d9743dd2487b6c7b5709258add8b5019a2fc22f0d18822ac79c5b3b8d5b8f7dbf611a6b1143c21ffdfb4764d10899f84892a28034a5872f7ee1015141f76368762dbd61d68308746375f8f9640019a25dd3a11c4b3596d86c83e8047cf5c47739623cb9aab3e9273b741b89a12d00829ba96301bf35f9bc7164428a031edeab4c746c1f4a38c9c05e8b0d891b7cc03aa35e9c9aacecf158381241114806a91ee0d5c1f2523b5b9f7b8f38e083c05bca2200ac96dc63272004e9ef20fd577ea7ae4a3387306fa5656229c03e4f968ce39ef07b7a89051f4f577d65651fb64ac6265be9aa8dcb238343cedcafaf7c562225fd1840dc5ccb90322766d1634993360570ec7feb40cb3101bca80a58640d0bac91308437014df7c14da356427a6ecca491e6f9588ec2c7f896e39b099591086b04d0d568eb399f0bb8c841611931cb2fd6fd73ebb7f8b9b73d48fb3b294e052953b315a951019a043b7ebca3c4821d7c540facf4c2bb4534aa3445decfd270b8f03a9d71dc2a8e4c50439c956161e1ad4b067b197db3b86b8b4022f2ee27a7e9d4658c3cd641e34ad088969674f3cc7bcc6256221922fed4c749a0d41c095c0e3995056b43744ad9b8b6ba6565c2cc4fd43d8a9abeb60e5c2db0fee542869de33fd32ef72d7bc6a918763f187538a830280e326448dca9fa31403054357234592cc1d55504d9ab55cdaa369958626b476bdbf7c5913f38db214f1be91020b327346b1e05a90026b67915abbf1fd69103935e87699dd3f920da161441764598005fbd92ff22f287ca6809be5497322b42cc300e76e7877d42949a10c79cf8a7b22e46b34b4624a0550de07ef48547abac7d30e79d6028c70aa6942c8558d61c4d3e831cb586ed72e18fd5c1a15e4d81d1c35b5bd143ec188983c524a52f69ba844fdb3b20909d32997cdc822a5646adc597463c0f354aa55943d9eca6b01751902cd8ad8bb8e19f82cccbc696989332be3af34fc9547abfbee54267d775e85e65b2d5ecc0947b2772aeb7b41db3edd3025f5f2d57b0edda51b69191bbe8bfdc06ccb2bb1f55a104bc3b4298470d44531a1b1f1400a094453a9ebe3e06f522847be402b85aecc13422ca423c7357c7cefd5acb9b7dab1e724076b755323bf375918f0de79c78dd2b76963f35ca8c3c7bf3e9fa3b6e12b63646a717a92abac968286b1d0c6b4277b9a4a975fd6a5ad30e18aeae32040687265d0d1848d30190e43cdcf167f8db57ea04be0ce696f4257abe3427eb9b785ee619c52aef573266a886b298c4371ae2e7c141c5263dd6fa898171b3b6e3194a446fe27807bb685b700188acff8d10cf5ed0d8007db138dd93b5afc9dd60470e1639b712aa8669094c32f8c8652be3d2b7100281d7d9495795a97c3dff5a844ce6a2c2c1aa92356bc7b767db8bf3a9a438aaea4d3806afa53ba86922e4c4424485cc05dc26b44059528cbf208a6774eb6dfdf1492393d9c17268a97ead7700fb2d61e3b9378f09e5bafec089b2b8f971b78ac6b5dfda6ae423ad9fb162306912c76cc6c6936b4cc08598b5cf4f3037ce1c03f0dda1018d1600c3f452d2ad9a7b52eae3b55f1d9b0e0a3283cca3db142d3daf62a8c758b9a294779b645b05dcd478c42ad24e5cec8c25da6bd7271e9df0195e13737f86996da964b6b11fabce88258c5b628cc3368ebcb7c8350f0d17c9af5250516c8cf31407ed32704a5fb5d7da05750485c687452ad238bc7f645dc9efa61f88b3f8c3faeb1f8e44a9b907fc5c3ad527270732f3ebd574a75e8ff7b6e6537f54fbf0e8e3316efda3eab14e4f0d7c74d6e3f82e0145588106be9da5d1c74297cc72bf4783078d7ffee9ded2349a53305910998c2837254e864f31e2287dcc19a7d6fb6cdcf80a5dede163a6c3d36e2c5861b89a46eaf0504ad0c7d16ddf02bf6f1d90bf9feaa0b7d9cfefd47d08aac22ee4a6241191f4d6acbdcf6eceae1d2d2028b6e559fb550e1f4a5ee9866da456c7eb034c2f34238572f0d3e3085b1f03509cca9958701fc4a73539c4d446c065bc9e2a4ff1861471c31c6223882ccf0258dcd79634975b560a4905843e26ac6a99346e2de740e4deaa6925a7afdc98025b9b89fc02035efa1457f7b343d3a4c0feeff66f6c719db8528bc49bffcdae000b64fdf1cc755d993b9a77da4c26d8cb8700545c68e4ca1bfd30fb70ad2fe57ce2881cc5b1b6e5126e7705abcc0b8e553252ebc893b5f045e51acdb19944ace5182269f111d1a3533de0c38ec8db309dc44a1c5734846fd5d9e18b07df7ebdbb546f115dc5ef4423351f131c5739e4eed6136dfa022c99c1323144db427af9e3e5c2be67967a3b637413beca8c2081d664af22ac9058bbeeb0d843d09111245a36a245e77fccd3d4e7b359f6ba6521e5a6cbd99b2ef135df13d76d07d0e847ae16ce2b4050c58a775460b6ed86631074516667d590771b2809d55d32b1ed895531e1ee10b25eec4939b0360a2064076a40a8780611ec7f261132e5f7dca1e7284085795408d1385ed7fe4a5cb18c29108cde9b7cbe844d929838a231899e772a381403685446273a564ce6c35aa294ea02b91f61e093ef9191c2d4cf8b722b17093b16d6a3b34444ff9e22ca1dd429d40c2f655ddcf7564aa1cde88a652c5a8589b522ff88938203b09b2fca155be384af4c8d12a32e705ad1d2c4e4e3a9d1a151956ae0f19f9c88ab11137975a5ab53047f5ee69ebbb8c1a2b605e738584a29ad501c0f949aa6a9c0247f17b40f3d8ccbef3c9cc2602d2eb5bf84c7d5bd2480f3478b7975cfa90faf03bbea007baa6682bce23cd245ac372523cf758b939030ad185bc1d0f5753a7268bee39056345130353e0d44d5e46f4a1d933e553f7768071b41d08631a1165b5af7ca4e9d17a3c67ac57aea2d530b6b3a21c279708e71ed6464d01409da47dbadbce0583609105ea631eab93924c1937bf496afe2a4e0758ca521753f8e03e9998618a3304329f70f9a8358416b96c0b42a2287cbd435390a2131d33a8081d5199834a13de7d195ee118bd442af7f34ac1bcce9fad8d61ccc124ed99830dec1d77e90f061ff04043d5e0ea6f1e581a378d2bcbe128ac3756e6070b8321ee6a27634deb278e60e73b9a75083f470808b4b3c4e8661ca91ebed4d028c0683623dc8cbdc01baac0a9451319d960"})
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x10, 0x16, &(0x7f0000000580)=ANY=[@ANYBLOB="61123000000000006113100000000000bf2000000000000016000200071b48013d030100000000009500000000000000bc26000000000000bf67000000000000070200000fff07006702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586", @ANYRES64=r3], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_msg}, 0x94)
r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
r8 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x6}, 0x10)
sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)=ANY=[@ANYBLOB="300000001a00010000000000000000001c0000000000000000531193c71f0b942579b0334a4c4072e38e4ce1912af849452c76ff121dbb9d77d9622f73513ae5fb7d04ba96bc07a83f5029b6a3a379b9d18e0de426ae0f451f05b922efdcd03fca4c876b91dbce6eed6f", @ANYRES32=r8], 0x30}}, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c0000001a00010000000000000000000a001000000000000000000006001d000000000005001b0001"], 0x2c}}, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={0x1, <r9=>0xffffffffffffffff}, 0x4)
r10 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'veth0\x00', <r11=>0x0})
setsockopt$packet_add_memb(r10, 0x107, 0x1, &(0x7f00000001c0)={r11, 0x1, 0xffffffffffffffde, @remote}, 0x10)
r12 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000340), 0x4)
bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="1f000000cedb0000023e9540c6ce823a000000060000004c61b9da08d036b4931937604b3709fe2820b02ef969ed94b7c7deca0908ce0d7fc1955cbf32605992ad4199d7311ffae187de1ab083", @ANYRES32=r9, @ANYBLOB="c20a00"/20, @ANYRES32=r11, @ANYRES32=r12, @ANYBLOB="01000000030000000500"/28], 0x50)
setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000180), 0x4)
setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000140)=@ccm_128={{0x303}, "0bfe9002a9820cb4", "0000000000000000df000200", '\',@6', "ed07b5f5ca3ebb96"}, 0x28)
setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "2000a200009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28)
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYRES64=r5], 0x10)
openat$cgroup_freezer_state(r5, &(0x7f0000000140), 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'lo\x00', <r13=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x24eb, "000000000000000f000100000e00"}}}]}, 0x48}}, 0xc000)

980.055235ms ago: executing program 1 (id=262):
r0 = epoll_create(0x4)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
r2 = accept4$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10, 0x800)
setsockopt$inet_tcp_int(r2, 0x6, 0x9, &(0x7f0000000080)=0x1502, 0x4)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan1\x00', <r5=>0x0})
sendmsg$NL80211_CMD_SET_WDS_PEER(r3, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)=ANY=[@ANYBLOB="d661bb4f", @ANYRES64=r1, @ANYBLOB="080425bd7000fcdbdf25420000000a000300", @ANYRES32=r5, @ANYRESDEC=r4], 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x800)
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000240)={0xb0000000})
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_int(r6, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000600)=ANY=[@ANYBLOB="ffffff96d3883dbe22cba4000800450000b000000000fe019078ac1e0001ac1414aa0301907803240000450000000060780000010007ac1414aa640101028677ffffffff000ce256b28c59881681fb520009020007651442eb000e7434954373561de584b703c80009e706d30bd224f80207cfa11cab1a00108475be675de6a70a05a0dc91e5c6000a6580a5e97612fe86001273bc23f9ffffffa30900a301c84600000012c8f46976e79ea788f03d9d3205927e3d860600000020000000"], 0x0)
recvfrom$inet(r6, 0x0, 0x0, 0x7eabfcf2497233c6, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="04000000000000007111fcffffff00008510000002000000850000002a00000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70)
socket$can_raw(0x1d, 0x3, 0x1)
r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xf, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r7, @ANYRES16=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0xffff, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
listen(r9, 0x1ad72f7)
r10 = accept4(r9, 0x0, 0x0, 0x80000)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000300)='sys_enter\x00', r8}, 0x10)
r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
listen(r11, 0x8)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000740)={r11, &(0x7f00000006c0)="6b9fde97b9a3bac3d1717ebbd78e86bc1935af250c13a0ef9099fa4249d6d518348588ffa39eaef6b46035502676870b71fb7da774bbd368b45ce1a38222f58af560af46ff9eb67b62f2", &(0x7f0000000580)=@tcp6=r10, 0x4}, 0x20)
syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r11)

978.180782ms ago: executing program 0 (id=263):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe)
getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000040)=0xfff8, &(0x7f0000000180)=0x2)
ioctl(r0, 0x3, &(0x7f00000000c0)="90b8f8b59b311c7b63136493f770197349257c620167826465f9d44bfb00e368888f117f6408b3275ebc20ec5e8ed7459e877e249dddf87a53c2081f0f0854c27192531c38e9043cddb15292def3c320df1d5069f51c6b47e36f22a1ca39411a213c6928115a41c3405787e5a7ed27b4f901d20cbc60ba57ebc7f90208c08a675e5a2474eb5f3da4206c41c849dd928df493802d8f65dd8cc9cd92f8de602e99")
r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000080), 0x4)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="2400000026000100000000000000000008000000", @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32], 0x24}], 0x1}, 0x0)
socket$rxrpc(0x21, 0x2, 0x2)

930.229071ms ago: executing program 0 (id=264):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r0, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x20000101}, {{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000340)=""/238, 0xee}, {&(0x7f0000000240)=""/43, 0x2b}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f00000007c0)=""/69, 0x45}, {&(0x7f0000000500)=""/240, 0xf0}, {&(0x7f00000000c0)=""/193, 0xc1}], 0x6}, 0x80000000}], 0x4, 0x0, 0x0)

919.460886ms ago: executing program 0 (id=265):
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup/syz1\x00', 0x200002, 0x0)
r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='freezer.self_freezing\x00', 0x0, 0x0)
preadv(r1, &(0x7f00000000c0)=[{&(0x7f00000006c0)=""/147, 0x93}], 0x1, 0x4, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x12, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="2f25ebd8682ad1bdda8c000071123b006d7d9d43bd45e3e300"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @cgroup_sock_addr=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5b471ae2}, 0x94)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
recvmsg(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000100)}, 0x1f00)
sendmsg$tipc(r4, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
pipe(&(0x7f0000000600)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x22}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r6}, 0x10)
accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000380), &(0x7f0000000480)=0x60, 0x80000)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4000080)
write(r5, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c)
socket$inet_udp(0x2, 0x2, 0x0)
pipe(&(0x7f0000000500)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
splice(r7, 0x0, r5, 0x0, 0xffffffffffff8000, 0x0)
close(r8)
socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
socket$inet(0x2, 0x2, 0x0)
r9 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'veth0\x00', <r10=>0x0})
setsockopt$packet_add_memb(r9, 0x107, 0x1, &(0x7f00000004c0)={r10, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, 0x10)
r11 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$packet_add_memb(r9, 0x107, 0x1, &(0x7f0000000000)={r10, 0x1, 0x6, @random="790c7edd3d8d"}, 0x10)
sendmsg$nl_route_sched(r11, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0x70bd2c, 0x2000002, {0x0, 0x0, 0x0, r10, {0xffe0, 0xfff1}, {0xd, 0xb}, {0x1, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000)
socket$nl_netfilter(0x10, 0x3, 0xc)
splice(0xffffffffffffffff, 0x0, r11, 0x0, 0x1100000000f336, 0x4)
sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)

759.417961ms ago: executing program 2 (id=267):
r0 = socket(0x200000000000011, 0x2, 0xd)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @multicast}, 0x14)
connect$unix(r0, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x6e)
unshare(0x64000600)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x68)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000001540)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000e12020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000006fd6850000002d000000850000002300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='sys_enter\x00', r3}, 0x10)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47)
setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000100)=0xe11, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x9da, 0x8}, @timestamp, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x8)
sendto$inet(r5, &(0x7f00000003c0)="25d7196c03045396b9eff7846a812bfe75fa3496bb8e75411f", 0x19, 0x8014, 0x0, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000001c0), 0x4)
r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000180)={'wlan1\x00', <r8=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010027bd7000fcdbdf25440000000800030095591321606253589d2a17c3b13935ac11d05ca6050730de2c83ae892b68f8a21887425375053f1379fe1df8e4efe2ee5c474312c2f5fdda1e7a517d3b5f5672715c63dc7054eb9ac1aa58d03dd6ecfc49aad2e0305c508a139edffd0a6e577440f33ddfb0a1f2a402572127f1ad94a785a39187a27f43b12625182b4f917e169039ec11af8bb850eb48b5fe42089bf5d40d158f475efd744085e1e2428eb15f1b73c717b9c43b05d2309ffea23118315111a9e92ca5747f6995bfb479a4d090d53b9d4c9030b851478c0c48586b1a5221435a80d0084280d3f5cc0805b64d01c283ec38366eb74cc05fe66eac2ca843455f", @ANYRES32=r8, @ANYBLOB="04005a80040070001c002380080017000900000005000e000100000006000d009e0c0000"], 0x40}, 0x1, 0x0, 0x0, 0x4080}, 0x40810)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_SIOCGIFBR(r9, 0x8940, 0x0)
socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001800ef0100000000000000000a0000000000003f000000000c00090008000000", @ANYRES64=r7, @ANYBLOB="140005"], 0x3c}, 0x1, 0x11, 0x0, 0x21}, 0x0)
sendto$inet(r5, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0)
sendmsg$NFNL_MSG_COMPAT_GET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="30000000000b0102000000000100000003000000080002400000000008000340000000010b0001006d616e676c65"], 0x30}}, 0x20004084)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="b400000000000000611470000000a6e1f4f3af8d66e19dc60000a6000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48)

470.1246ms ago: executing program 2 (id=268):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
socket$nl_route(0x10, 0x3, 0x0) (async)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket(0x10, 0x803, 0x0) (async)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_GET_COALESCE(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0)
getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x8f)
socket$nl_route(0x10, 0x3, 0x0) (async)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r3, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r4], 0x3c}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newtfilter={0x34, 0x10, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x74, r3, {0xffe0}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0xf0ffffffffffff, 0x0, 0x4004140}, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0xe0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000380)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0], <r6=>0x0, 0x53, &(0x7f0000000440)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000480), &(0x7f00000004c0), 0x8, 0x9d, 0x8, 0x8, &(0x7f0000000500)}}, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) (async)
r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50)
r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xc, 0x17, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000100000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7020000000000408500000086000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x7, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r8, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c)
bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x13, 0x2, &(0x7f0000000200)=@raw=[@jmp={0x5, 0x1, 0x4, 0x1, 0x5, 0x80, 0xfffffffffffffff0}, @generic={0x26, 0x3, 0x9, 0x3, 0xe}], &(0x7f0000000240)='syzkaller\x00', 0x800, 0x7e, &(0x7f0000000280)=""/126, 0x41100, 0x40, '\x00', r3, @fallback=0x3, r5, 0x8, &(0x7f0000000300)={0x8, 0x4}, 0x8, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x6, 0x4}, 0x10, r6, r8, 0x3, 0x0, &(0x7f0000000680)=[{0x0, 0x4, 0x9, 0x7}, {0x5, 0x4, 0x6, 0xc}, {0x0, 0x4, 0xf, 0x9}], 0x10, 0x2}, 0x94) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x13, 0x2, &(0x7f0000000200)=@raw=[@jmp={0x5, 0x1, 0x4, 0x1, 0x5, 0x80, 0xfffffffffffffff0}, @generic={0x26, 0x3, 0x9, 0x3, 0xe}], &(0x7f0000000240)='syzkaller\x00', 0x800, 0x7e, &(0x7f0000000280)=""/126, 0x41100, 0x40, '\x00', r3, @fallback=0x3, r5, 0x8, &(0x7f0000000300)={0x8, 0x4}, 0x8, 0x10, &(0x7f0000000340)={0x5, 0x0, 0x6, 0x4}, 0x10, r6, r8, 0x3, 0x0, &(0x7f0000000680)=[{0x0, 0x4, 0x9, 0x7}, {0x5, 0x4, 0x6, 0xc}, {0x0, 0x4, 0xf, 0x9}], 0x10, 0x2}, 0x94)
r9 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0)
sendmsg$NFQNL_MSG_VERDICT(r9, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x78, 0x1, 0x3, 0x301, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffd, 0x62}}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x6f04}, @NFQA_PAYLOAD={0x41, 0xa, "bb43ef5c3f0ecd5d44f2452b533013e01a8309e6d1ebd2d42deb53413f7a7db52e0a2b5e268b4faeeccd2edb0ddcaf26d54fe260f2a0179801e0a685a2"}, @NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffe, 0x9}}]}, 0x78}, 0x1, 0x0, 0x0, 0x4000004}, 0x804)
readv(r9, &(0x7f0000000040)=[{&(0x7f0000001640)=""/244, 0xf4}], 0x1) (async)
readv(r9, &(0x7f0000000040)=[{&(0x7f0000001640)=""/244, 0xf4}], 0x1)

298.9359ms ago: executing program 2 (id=269):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r0, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x20000101}, {{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000340)=""/238, 0xee}, {&(0x7f0000000240)=""/43, 0x2b}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f00000007c0)=""/69, 0x45}, {&(0x7f0000000600)=""/249, 0xf9}, {&(0x7f00000000c0)=""/209, 0xd1}], 0x6}, 0x80000000}], 0x4, 0x10020, 0x0)

183.736951ms ago: executing program 2 (id=270):
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000040)=@sack_info={0x0, 0x10001, 0x5}, 0xc)
sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, 0x0, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="780000000206020416156ba830b0d74f5d9a36742540de0002000000000000000000002c0007800800114000000000050015000a00000018000080140302402001000000020900020073797a310000000011000300686173683a69702c6d61726b00000000050004000200007205"], 0x78}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000000)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000005c0), r3)
sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002ab97000ffdbdf25040000000800020005000000080007007f0000e0070008"], 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x24004854)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_RENAME(r5, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x20, 0x5, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x20040000)
sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r4, 0x800, 0x70bd29, 0x25dfdbfd}, 0x14}}, 0x4008894)
sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRESOCT=r1, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES8=r1], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
r6 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendto$inet6(r6, &(0x7f0000000240)="8a", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x20, @local, 0x9}, 0x1c)

69.358577ms ago: executing program 1 (id=271):
r0 = socket$netlink(0x10, 0x3, 0x0)
close(r0)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={0x20, 0x15, 0x1, 0x0, 0x0, {0xa}, [@typed={0x4}, @typed={0x8, 0x1, 0x0, 0x0, @ipv4=@remote}]}, 0x20}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@private0, 0x800005, 0x0, 0xff, 0x2, 0xe, 0x1}, 0x20)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl(r2, 0x8b32, &(0x7f0000000040))
recvmmsg(r1, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x20000101}, {{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000340)=""/238, 0xee}, {&(0x7f0000000240)=""/43, 0x2b}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f00000007c0)=""/69, 0x45}, {&(0x7f0000000500)=""/240, 0xf0}, {&(0x7f00000000c0)=""/193, 0xc1}], 0x6}, 0x80000000}], 0x4, 0x0, 0x0)

68.690663ms ago: executing program 2 (id=272):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0)
sendfile(0xffffffffffffffff, r0, 0x0, 0xffffffff000)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r1, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x20000101}, {{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000340)=""/238, 0xee}, {&(0x7f0000000240)=""/43, 0xb}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f00000007c0)=""/69, 0x50}, {&(0x7f0000000500)=""/240, 0xf0}, {&(0x7f00000000c0)=""/209, 0x7b}], 0x6}, 0x80000000}], 0x4, 0x0, 0x0)

843.355µs ago: executing program 0 (id=273):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="130000001000000008"], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001e40)={r1, &(0x7f0000000300), 0x0}, 0x20)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000160a03020000000000000000020000000900020073797a300000000008000740000000011400038008000140000000680800014000000000140000001100010000000000000000000000000a"], 0x64}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0xfffffffffffffcfa}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x60}, 0x1, 0x0, 0x0, 0x40080}, 0x0)

556.804µs ago: executing program 2 (id=274):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYRES64=0x0], &(0x7f0000000080)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
socket$inet6_udplite(0xa, 0x2, 0x88)
r1 = socket(0x1d, 0x2, 0x6)
bind$inet(r1, &(0x7f00000000c0)={0x1d, 0x4e20, @loopback}, 0x10)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000100)={0x0, r1}, 0x8)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r0, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x20000206, 0xc, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], <r2=>0x0, 0x4c, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f00000003c0), &(0x7f0000000400), 0x8, 0xc5, 0x8, 0x1a, &(0x7f0000000440)}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYRESDEC=r0], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0}, 0x94)
r3 = syz_init_net_socket$ax25(0x3, 0x5, 0xc5)
r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000640), r1)
sendmsg$SMC_PNETID_ADD(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, r4, 0x800, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'ipvlan1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_macvtap\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan0\x00'}]}, 0x74}, 0x1, 0x0, 0x0, 0x4}, 0x40000094)
ioctl$SIOCAX25DELUID(r3, 0x8918, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000040)={'lo\x00', 0x100})

0s ago: executing program 1 (id=275):
r0 = socket$rxrpc(0x21, 0x2, 0xa)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=ANY=[@ANYBLOB="58010000100001000000000000000000fe8000000000000000000000000000bb00000000000000000000ffffe000000200000025000000000000000032000000", @ANYRES16=r1, @ANYRES32=r1, @ANYBLOB="7f0000010000000000000000000000000010000032000000000000000000000000000000000000010000000000000000a3020000000000007f00000000000000ffffffffffffffff0000000000000000330000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000009200000000000000000000000a0002"], 0x158}, 0x1, 0x0, 0x0, 0x800}, 0x0)
sendto$rxrpc(r0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = socket$rxrpc(0x21, 0x2, 0xa)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
write$tun(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="000000070103050000000400ffff4a9a01070066000002029078ac1e0101640101004414d033e000000200000200ac1414bb0000381416039078ac1e0101b28a6a6231696542562d7716e2b1146d3df7458f6e7b3ed217d56fb189b4101c07fd9215173e158a4755209b340487cd6e595b6627ce05b093e8a84cbdbcac70923e6d73d2e5e5e01f08c434df95a7e6c33af65d2e36bee479039f568f7582ed97ffa6173c76f3e740d751c95f71aaf08f9111889d3bddb1a4800d6b2b42e50deff30a80c3f2ee4931fc6860370a5147ad80f72f31658feb5cd1f441eacf3aa0a291fbb6bda268f24ae22566d818367699258bcd62be3a9d0b8e34207f743fc9371992c6d93d6129ce06afa92ce0ae1be58adc453ef03eedfd39fd5e38e3a7d7b822f18d11c395e540644a373f204975479aa66569e9443504545cf2d07502ce4b78a0af71b404a726ce487d46b70496f3198d302c9d2c3158f81b301b3ff11e490debce719d0c000000003fd433288352ec64bfc041774799f22e78781dc6ff0dedf633bd50f2068bc7a55738d7afe2d1718398a3ba7e44ed085665152d3217e214dc9ebda4ed04c88d8adf2b8eb58bb644f775acd4bfaff70fd5c32bcecd00c9c4929ea1c44e95a9e3"], 0x115)
bind$rxrpc(r2, &(0x7f0000001280)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x0, 0x0, @empty}}, 0x24)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x7, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000007f00000000000000040000007110a8000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff54}, 0x94)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:58162' (ED25519) to the list of known hosts.
syzkaller login: [   48.425421][ T5755] cgroup: Unknown subsys name 'net'
[   48.517246][ T5755] cgroup: Unknown subsys name 'cpuset'
[   48.523276][ T5755] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.777443][ T5755] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   54.603185][   T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   54.606494][   T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   54.609477][   T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   54.614370][   T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   54.618545][ T5825] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   54.622900][ T5825] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   54.626038][ T5825] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   54.628689][ T5825] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   54.633173][ T5830] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   54.637424][ T5220] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   54.680215][ T5830] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   54.683529][ T5830] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   54.686918][ T5830] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   54.691171][ T5830] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   54.694742][ T5830] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   54.886215][ T5823] chnl_net:caif_netlink_parms(): no params data found
[   54.988175][ T5823] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.991401][ T5823] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.994153][ T5823] bridge_slave_0: entered allmulticast mode
[   54.997159][ T5823] bridge_slave_0: entered promiscuous mode
[   55.002850][ T5827] chnl_net:caif_netlink_parms(): no params data found
[   55.007686][ T5823] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.010736][ T5823] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.013384][ T5823] bridge_slave_1: entered allmulticast mode
[   55.016823][ T5823] bridge_slave_1: entered promiscuous mode
[   55.046428][ T5823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.060227][ T5823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.112801][ T5823] team0: Port device team_slave_0 added
[   55.131814][ T5823] team0: Port device team_slave_1 added
[   55.225612][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.228177][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.237807][ T5823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.242770][ T5827] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.245852][ T5827] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.249141][ T5827] bridge_slave_0: entered allmulticast mode
[   55.253783][ T5827] bridge_slave_0: entered promiscuous mode
[   55.258263][ T5827] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.261743][ T5827] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.264852][ T5827] bridge_slave_1: entered allmulticast mode
[   55.268720][ T5827] bridge_slave_1: entered promiscuous mode
[   55.278993][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.282291][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.294160][ T5823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.338699][ T5827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.344469][ T5831] chnl_net:caif_netlink_parms(): no params data found
[   55.355953][ T5827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.412648][ T5827] team0: Port device team_slave_0 added
[   55.444560][ T5827] team0: Port device team_slave_1 added
[   55.456482][ T5823] hsr_slave_0: entered promiscuous mode
[   55.461205][ T5823] hsr_slave_1: entered promiscuous mode
[   55.514223][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.517116][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.527897][ T5827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.566547][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.569505][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.578067][ T5827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.631271][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.634786][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.637422][ T5831] bridge_slave_0: entered allmulticast mode
[   55.640673][ T5831] bridge_slave_0: entered promiscuous mode
[   55.650381][ T5827] hsr_slave_0: entered promiscuous mode
[   55.652822][ T5827] hsr_slave_1: entered promiscuous mode
[   55.654970][ T5827] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   55.657653][ T5827] Cannot create hsr debugfs directory
[   55.661380][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.664123][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.666751][ T5831] bridge_slave_1: entered allmulticast mode
[   55.671248][ T5831] bridge_slave_1: entered promiscuous mode
[   55.760063][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.774927][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.820334][ T5831] team0: Port device team_slave_0 added
[   55.842868][ T5831] team0: Port device team_slave_1 added
[   55.933197][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.936036][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.946998][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.959823][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.962389][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.974797][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.978997][ T5823] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   55.994004][ T5823] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   56.002925][ T5823] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   56.014387][ T5823] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   56.071890][ T5831] hsr_slave_0: entered promiscuous mode
[   56.075230][ T5831] hsr_slave_1: entered promiscuous mode
[   56.078131][ T5831] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   56.082007][ T5831] Cannot create hsr debugfs directory
[   56.085762][ T5827] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   56.106129][ T5827] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   56.135941][ T5827] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   56.153852][ T5827] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   56.283320][ T5823] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.327540][ T5823] 8021q: adding VLAN 0 to HW filter on device team0
[   56.342962][ T4061] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.345557][ T4061] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.351144][ T5831] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.358779][ T5831] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.371734][ T5831] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.379041][ T5831] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.396024][ T5827] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.401230][ T4061] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.404176][ T4061] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.453123][ T5827] 8021q: adding VLAN 0 to HW filter on device team0
[   56.488978][ T1088] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.492284][ T1088] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.528949][ T1088] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.532167][ T1088] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.635598][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.657410][ T5830] Bluetooth: hci0: command tx timeout
[   56.687034][ T5831] 8021q: adding VLAN 0 to HW filter on device team0
[   56.707257][ T5823] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.729544][ T5830] Bluetooth: hci2: command tx timeout
[   56.732053][ T5830] Bluetooth: hci1: command tx timeout
[   56.745883][ T1016] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.748962][ T1016] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.763394][ T1016] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.766489][ T1016] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.867119][ T5823] veth0_vlan: entered promiscuous mode
[   56.895194][ T5827] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.909915][ T5823] veth1_vlan: entered promiscuous mode
[   56.988289][ T5823] veth0_macvtap: entered promiscuous mode
[   57.007560][ T5823] veth1_macvtap: entered promiscuous mode
[   57.013251][ T5827] veth0_vlan: entered promiscuous mode
[   57.027667][ T5827] veth1_vlan: entered promiscuous mode
[   57.036493][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.053447][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.080540][ T5823] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.084174][ T5823] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.087260][ T5823] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.091134][ T5823] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.102720][ T5827] veth0_macvtap: entered promiscuous mode
[   57.125288][ T5827] veth1_macvtap: entered promiscuous mode
[   57.132982][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.171796][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.181572][ T4061] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.183142][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.184183][ T4061] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.196384][ T5827] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.199997][ T5827] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.202878][ T5827] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.205717][ T5827] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.248291][ T4061] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.253672][ T4061] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.274723][ T5831] veth0_vlan: entered promiscuous mode
[   57.301392][ T5831] veth1_vlan: entered promiscuous mode
[   57.315373][ T5823] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   57.328694][ T1088] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.334722][ T1088] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.357247][ T5831] veth0_macvtap: entered promiscuous mode
[   57.366246][ T5831] veth1_macvtap: entered promiscuous mode
[   57.374012][ T1016] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.378368][ T1016] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.397684][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.412698][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.427778][ T5895] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4'.
[   57.429237][ T5831] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.438191][ T5831] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.444805][ T5831] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.448527][ T5831] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.527813][ T1016] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.541551][ T1016] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.564359][ T1088] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.567583][ T1088] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.914452][ T5929] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12'.
[   57.918340][ T5929] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12'.
[   57.922757][ T5929] 8021q: VLANs not supported on vcan0
[   58.004655][ T5934] netlink: 68 bytes leftover after parsing attributes in process `syz.1.14'.
[   58.119238][ T5938] netlink: 'syz.1.16': attribute type 21 has an invalid length.
[   58.130034][ T5938] netlink: 132 bytes leftover after parsing attributes in process `syz.1.16'.
[   58.132001][ T5942] syz.2.18 uses obsolete (PF_INET,SOCK_PACKET)
[   58.213887][ T5945] netlink: 'syz.2.18': attribute type 4 has an invalid length.
[   58.237923][ T5945] netlink: 'syz.2.18': attribute type 4 has an invalid length.
[   58.296738][ T5949] netlink: 'syz.1.21': attribute type 11 has an invalid length.
[   58.382549][ T5951] xt_policy: neither incoming nor outgoing policy selected
[   58.434490][ T5955] netlink: 'syz.0.24': attribute type 30 has an invalid length.
[   58.441251][ T5955] netlink: 4 bytes leftover after parsing attributes in process `syz.0.24'.
[   58.444109][ T5955] netlink: 4 bytes leftover after parsing attributes in process `syz.0.24'.
[   58.483001][ T5958] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.25'.
[   58.730157][   T55] Bluetooth: hci0: command tx timeout
[   58.738174][ T5969] netlink: 8 bytes leftover after parsing attributes in process `syz.0.28'.
[   58.742736][ T5969] netlink: 24 bytes leftover after parsing attributes in process `syz.0.28'.
[   58.809592][   T55] Bluetooth: hci1: command tx timeout
[   58.811560][ T5830] Bluetooth: hci2: command tx timeout
[   59.988844][ T6010] ip6erspan0: entered allmulticast mode
[   60.000843][ T6010] netlink: 'syz.0.41': attribute type 26 has an invalid length.
[   60.439239][ T6052] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   60.523561][ T6058] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   60.779525][   T33] audit: type=1800 audit(1752585445.414:2): pid=6097 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.64" name="blkio.bfq.time_recursive" dev="tmpfs" ino=70 res=0 errno=0
[   60.793418][   T33] audit: type=1800 audit(1752585445.424:3): pid=6097 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.64" name="blkio.bfq.time_recursive" dev="tmpfs" ino=70 res=0 errno=0
[   60.810883][   T55] Bluetooth: hci0: command tx timeout
[   60.890037][   T55] Bluetooth: hci1: command tx timeout
[   60.891874][   T55] Bluetooth: hci2: command tx timeout
[   60.962257][ T6109] IPv6: Can't replace route, no match found
[   61.015491][ T6116] netlink: 'syz.2.71': attribute type 11 has an invalid length.
[   61.018558][ T6116] netlink: 'syz.2.71': attribute type 4 has an invalid length.
[   61.221003][ T6140] team_slave_0: entered promiscuous mode
[   61.222906][ T6140] team_slave_1: entered promiscuous mode
[   61.224877][ T6140] macvtap1: entered promiscuous mode
[   61.227409][ T6140] team0: entered promiscuous mode
[   61.241407][ T6140] macvtap1: entered allmulticast mode
[   61.243125][ T6140] team0: entered allmulticast mode
[   61.245148][ T6140] team_slave_0: entered allmulticast mode
[   61.247870][ T6140] team_slave_1: entered allmulticast mode
[   61.254976][ T6140] 8021q: adding VLAN 0 to HW filter on device macvtap1
[   61.267141][ T6140] team0: left allmulticast mode
[   61.279618][ T6140] team_slave_0: left allmulticast mode
[   61.281873][ T6140] team_slave_1: left allmulticast mode
[   61.283494][ T6146] x_tables: duplicate underflow at hook 1
[   61.283974][ T6140] team0: left promiscuous mode
[   61.287904][ T6140] team_slave_0: left promiscuous mode
[   61.289956][ T6140] team_slave_1: left promiscuous mode
[   61.304210][ T6140] sch_tbf: burst 0 is lower than device vlan0 mtu (1514) !
[   61.347855][ T6148] netlink: 'syz.2.80': attribute type 1 has an invalid length.
[   61.496804][ T6154] netem: incorrect gi model size
[   61.498519][ T6154] netem: change failed
[   61.520908][ T6154] Zero length message leads to an empty skb
[   61.643026][ T6165] Bluetooth: MGMT ver 1.23
[   61.652352][ T6167] netlink: 'syz.2.89': attribute type 10 has an invalid length.
[   61.673736][ T6167] team0: Device ipvlan1 failed to register rx_handler
[   62.083602][ T6187] netlink: 'syz.1.93': attribute type 4 has an invalid length.
[   62.158247][ T6191] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check.
[   62.183926][ T5890] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[   62.208250][ T6194] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check.
[   62.229943][   T24] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[   62.345021][ T6192] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   62.640187][ T6211] __nla_validate_parse: 17 callbacks suppressed
[   62.640199][ T6211] netlink: 32 bytes leftover after parsing attributes in process `syz.0.100'.
[   62.859593][   T96] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[   62.880842][ T6217] batadv1: entered allmulticast mode
[   62.900145][   T55] Bluetooth: hci0: command tx timeout
[   62.910925][ T6217] 8021q: adding VLAN 0 to HW filter on device batadv1
[   62.969607][   T55] Bluetooth: hci2: command tx timeout
[   62.971353][   T55] Bluetooth: hci1: command tx timeout
[   63.041041][ T6226] netlink: 60 bytes leftover after parsing attributes in process `syz.2.102'.
[   63.045689][ T6226] netlink: 56 bytes leftover after parsing attributes in process `syz.2.102'.
[   63.079251][ T6226] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1
[   63.092164][ T6228] netlink: 16 bytes leftover after parsing attributes in process `syz.0.103'.
[   63.100106][ T6226] gretap1: entered promiscuous mode
[   63.101840][ T6226] gretap1: entered allmulticast mode
[   63.330377][ T6247] x_tables: duplicate underflow at hook 1
[   63.544676][ T6261] netlink: 4 bytes leftover after parsing attributes in process `syz.0.110'.
[   63.548557][ T6261] netlink: 4 bytes leftover after parsing attributes in process `syz.0.110'.
[   63.604890][ T6264] netlink: 'syz.2.111': attribute type 10 has an invalid length.
[   63.816271][ T6280] netlink: 'syz.2.116': attribute type 1 has an invalid length.
[   63.866744][ T6280] bond1: (slave bridge1): making interface the new active one
[   63.882024][ T6280] bond1: (slave bridge1): Enslaving as an active interface with an up link
[   64.004689][ T6287] netlink: 12 bytes leftover after parsing attributes in process `syz.2.119'.
[   64.068664][ T6292] netlink: 84 bytes leftover after parsing attributes in process `syz.2.121'.
[   64.138884][ T6295] x_tables: duplicate entry at hook 1
[   64.198189][ T6300] warning: `syz.2.124' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   64.229565][ T6298] netlink: 16 bytes leftover after parsing attributes in process `syz.1.123'.
[   64.234547][ T6298] netlink: 'syz.1.123': attribute type 1 has an invalid length.
[   64.276970][ T6298] 8021q: adding VLAN 0 to HW filter on device bond2
[   64.287513][ T6298] bond1: (slave bond2): making interface the new active one
[   64.290583][ T6298] bond1: (slave bond2): Enslaving as an active interface with an up link
[   64.297898][ T6298] netlink: 28 bytes leftover after parsing attributes in process `syz.1.123'.
[   64.304187][ T6298] 8021q: adding VLAN 0 to HW filter on device bond1
[   64.362152][ T6309] ieee802154 phy0 wpan0: encryption failed: -90
[   64.478851][ T6316] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode
[   64.482140][ T6316] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[   64.487643][ T6318] tipc: Started in network mode
[   64.490470][ T6318] tipc: Node identity 4, cluster identity 4711
[   64.493298][ T6318] tipc: Node number set to 4
[   64.695386][ T6326] netlink: 'syz.1.133': attribute type 1 has an invalid length.
[   64.890060][ T6350] syzkaller0: refused to change device tx_queue_len
[   65.049514][ T5220] Bluetooth: hci2: command 0x0405 tx timeout
[   65.339746][ T6378] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[   65.343697][ T6378] macsec0: entered promiscuous mode
[   65.345823][ T6378] macsec0: entered allmulticast mode
[   65.348489][ T6378] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode
[   66.350028][ T6403] syzkaller1: tun_chr_ioctl cmd 1074025673
[   66.353461][ T6404] syzkaller1: tun_chr_ioctl cmd 1074025677
[   66.356103][ T6404] syzkaller1: Linktype set failed because interface is up
[   66.366192][ T6405] syzkaller1: tun_chr_ioctl cmd 1074025677
[   66.368183][ T6405] syzkaller1: Linktype set failed because interface is up
[   66.390179][   T96] syzkaller1: tun_net_xmit 90
[   66.598865][   T47] syzkaller1: tun_net_xmit 90
[   66.649856][ T6407] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   67.167472][ T6458] netlink: 'syz.1.172': attribute type 4 has an invalid length.
[   67.185533][ T6464] IPVS: set_ctl: invalid protocol: 46 127.0.0.1:20001
[   67.520251][ T6495] mac80211_hwsim hwsim4 wlan0: left allmulticast mode
[   67.522610][ T6495] mac80211_hwsim hwsim4 wlan0: left promiscuous mode
[   67.524791][ T6495] macsec0: left allmulticast mode
[   67.528287][ T6495] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[   67.534387][ T6495] macsec0: left promiscuous mode
[   67.767679][ T6509] __nla_validate_parse: 12 callbacks suppressed
[   67.767696][ T6509] netlink: 24 bytes leftover after parsing attributes in process `syz.1.186'.
[   67.788926][ T5835] nci: nci_add_new_protocol: the target found does not have the desired protocol
[   67.796283][ T6505] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[   67.876688][ T6513] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes.
[   68.033826][ T6529] netlink: 'syz.0.192': attribute type 1 has an invalid length.
[   68.036506][ T6529] netlink: 'syz.0.192': attribute type 3 has an invalid length.
[   68.039107][ T6529] netlink: 224 bytes leftover after parsing attributes in process `syz.0.192'.
[   68.158599][ T6538] netlink: 156 bytes leftover after parsing attributes in process `syz.1.196'.
[   68.222217][ T6544] netlink: 20 bytes leftover after parsing attributes in process `syz.1.198'.
[   68.227608][ T6544] netlink: 40 bytes leftover after parsing attributes in process `syz.1.198'.
[   68.290636][ T6551] netlink: 24 bytes leftover after parsing attributes in process `syz.1.200'.
[   68.396658][ T6559] netlink: 172 bytes leftover after parsing attributes in process `syz.1.204'.
[   68.798193][ T6580] netlink: 48 bytes leftover after parsing attributes in process `syz.1.211'.
[   68.803087][ T6580] netlink: 'syz.1.211': attribute type 4 has an invalid length.
[   69.013603][ T6584] openvswitch: netlink: Unknown key attributes 2
[   69.018035][ T6585] netlink: 60 bytes leftover after parsing attributes in process `syz.1.212'.
[   69.023974][ T6585] netlink: 12 bytes leftover after parsing attributes in process `syz.1.212'.
[   69.140926][ T6592] xt_CT: No such helper "snmp_trap"
[   69.389648][ T6615] syzkaller0: entered promiscuous mode
[   69.391465][ T6615] syzkaller0: entered allmulticast mode
[   69.507932][ T6621] bridge2: entered allmulticast mode
[   69.666389][ T6631] (unnamed net_device) (uninitialized): option updelay: invalid value (18446744072284733443)
[   69.671303][ T6631] (unnamed net_device) (uninitialized): option updelay: allowed values 0 - 2147483647
[   69.946675][ T6644] netdevsim netdevsim0 netdevsim0: entered promiscuous mode
[   69.957628][ T6644] netdevsim netdevsim0 netdevsim0: entered allmulticast mode
[   69.974203][ T6649] pimreg: entered allmulticast mode
[   69.982570][ T6649] pimreg: left allmulticast mode
[   70.332005][    C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[   70.476686][ T6662] openvswitch: netlink: Missing key (keys=40, expected=2000)
[   70.695965][ T6670] net veth1_virt_wifi : renamed from virt_wifi0
[   70.853241][ T6682] openvswitch: netlink: nsh attr 0 has unexpected len 7 expected 0
[   70.856412][ T6682] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   70.866224][ T6682] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   70.901924][ T6682] batman_adv: batadv0: Removing interface: batadv_slave_1
[   70.985919][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   70.987934][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   71.022991][ T6692] netlink: 'syz.0.239': attribute type 1 has an invalid length.
[   71.187738][ T6705] bond0: entered promiscuous mode
[   71.191584][ T6705] bond_slave_0: entered promiscuous mode
[   71.193546][ T6705] bond_slave_1: entered promiscuous mode
[   71.197501][ T6705] batadv0: entered promiscuous mode
[   71.202419][ T6705] 8021q: adding VLAN 0 to HW filter on device hsr1
[   71.205715][ T6705] bond0: left promiscuous mode
[   71.207764][ T6705] bond_slave_0: left promiscuous mode
[   71.211342][ T6705] bond_slave_1: left promiscuous mode
[   71.214620][ T6705] batadv0: left promiscuous mode
[   72.142618][ T6765] veth0: entered promiscuous mode
[   72.934464][ T6792] lo: entered promiscuous mode
[   72.937916][ T6794] __nla_validate_parse: 14 callbacks suppressed
[   72.937926][ T6794] netlink: 104 bytes leftover after parsing attributes in process `syz.1.275'.
[   73.062488][ T6807] netlink: 16 bytes leftover after parsing attributes in process `syz.2.281'.
[   81.227815][    T9] cfg80211: failed to load regulatory.db
[   86.330072][    C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  118.330387][    C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  132.413210][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[  132.415319][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[  180.573171][ T5220] Bluetooth: hci1: command 0x0406 tx timeout
[  183.611520][    C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  190.809738][ T5220] Bluetooth: hci2: command 0x0405 tx timeout
[  193.863368][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[  193.866057][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[  255.291729][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[  255.294322][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[  311.611155][    C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[  316.733291][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[  316.736036][ T1361] ieee802154 phy1 wpan1: encryption failed: -22

VM DIAGNOSIS:
13:22:40  Registers:
info registers vcpu 0

CPU#0
RAX=7c8e4da03f6e7e00 RBX=ffffffff81976c78 RCX=7c8e4da03f6e7e00 RDX=0000000000000001
RSI=ffffffff8d998b14 RDI=ffffffff8be29dc0 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f5b R9 =1ffff110096065eb R10=dffffc0000000000 R11=ffffed10096065ec
R12=ffffffff8fa1f3f0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6f34d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055e35f6a6680 CR3=0000000025800000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 00000000000001a4 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=b0a5c05b854c9100 RBX=ffffffff81976c78 RCX=b0a5c05b854c9100 RDX=0000000000000001
RSI=ffffffff8d998b14 RDI=ffffffff8be29dc0 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f5b R9 =1ffff11026cc65eb R10=dffffc0000000000 R11=ffffed1026cc65ec
R12=ffffffff8fa1f3f0 R13=0000000000000001 R14=0000000000000001 R15=1ffff11020018000
RIP=ffffffff8b6f34d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055e35f6a5600 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=000000001628a994 000000000000000a XMM01=0100000000000100 0000000000000000
XMM02=65626d6520002e74 736f686c61636f6c XMM03=0000000000000000 0000000000000000
XMM04=ffffffffffffff00 0000000000000000 XMM05=1600000000000000 00000000000002ff
XMM06=1600000000000000 00000000000002ff XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
