last executing test programs:

3.629341788s ago: executing program 2 (id=582):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xb, 0xd, 0x200cc, 0x6, 0x5}, 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)='D', &(0x7f0000000240), 0x4b2, r0}, 0x38)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000700)={0x0, &(0x7f0000000540)=""/245, &(0x7f0000000640), &(0x7f0000001740), 0x2, r0}, 0x38)

3.50917054s ago: executing program 2 (id=584):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_emit_ethernet(0x4e, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaadf0000400000e9ff4b0000400000000000069078ac1e0001ac1414118903a2440c0503000100000000000086060000000100000000189ce1", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, 0x0, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r1}, 0x10)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @random}, 0x0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000180), 0xffffffffffffffff)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={<r4=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000280)={<r7=>r0, 0x9, 0x3f, 0x4c})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={<r8=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={<r9=>0xffffffffffffffff})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000100), 0xc, &(0x7f00000003c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="08002dbd7000fddbdf25010000000c00050008000000000000004c0007800c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r5, @ANYBLOB="00000000006b92a6f67acf9051a66596e9e979ddcadef7be479d55", @ANYRES32=r7, @ANYRES8=r2, @ANYRES32=r8, @ANYBLOB="0c000180080000dd", @ANYRES32=r9, @ANYBLOB], 0x6c}, 0x1, 0x0, 0x0, 0xc4}, 0x40000)
r10 = socket$pppl2tp(0x18, 0x1, 0x1)
sendmsg$NL80211_CMD_SET_PMKSA(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000940)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x40000)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000600)={'wlan1\x00', <r11=>0x0})
sendmsg$NL80211_CMD_START_NAN(r0, &(0x7f0000000840)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x4c, 0x0, 0x2, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x7}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x9}, @NL80211_ATTR_BANDS={0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0xc}, @NL80211_ATTR_BANDS={0x8, 0xef, 0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4000)
r12 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000003800010325bd7000fadbdb2504000000802fb7021f24e23fd0f36d79347a31793e2c7fce3a86a0588f2f260c3afbc352e404a5edb2ec98a8c57dfa49331f6c1c07aca24d"], 0x14}}, 0x0)
r13 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r10, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r13, 0x9, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32)
setsockopt$SO_BINDTODEVICE(r13, 0x1, 0x19, &(0x7f0000000000)='ip_vti0\x00', 0x10)
sendmmsg$inet(r10, &(0x7f0000008b80)=[{{0x0, 0x0, 0x0}}], 0x1a000, 0x40000)
bind$l2tp6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0xc, @private2={0xfc, 0x2, '\x00', 0x1}, 0xfffffffc}, 0x20)
r14 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r14, 0x6, 0x20, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$smc(0x0, 0xffffffffffffffff)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, 0x0, 0x0)

3.359195534s ago: executing program 1 (id=587):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newqdisc={0x74, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x8, 0x2, 0x1000}}, @qdisc_kind_options=@q_fq_codel={{0xd}, {0x2c, 0x2, [@TCA_FQ_CODEL_LIMIT={0x8, 0x2, 0x5}, @TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0x5}, @TCA_FQ_CODEL_QUANTUM={0xffffffffffffffcf, 0x6, 0x7}, @TCA_FQ_CODEL_DROP_BATCH_SIZE={0x8, 0x8, 0x8af9}, @TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0xd}]}}]}, 0x74}}, 0x4000010)

3.359059906s ago: executing program 1 (id=588):
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000800)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@func_proto={0x0, 0x0, 0x0, 0xd, 0xa}, @enum]}}, &(0x7f0000000f40)=""/4089, 0x32, 0xff9, 0x8}, 0x28)

3.270087722s ago: executing program 1 (id=589):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a006030"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x4000000)

3.26994618s ago: executing program 1 (id=590):
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = openat$cgroup_int(r0, &(0x7f0000000080)='pids.max\x00', 0x2, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000580)=ANY=[@ANYBLOB='-', @ANYRESOCT=r1], 0x9)

3.210204742s ago: executing program 2 (id=591):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="090000000700000001000000011e000000", @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/27], 0x48)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73f72cc9f0ba1f8483d0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0, <r2=>0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0xd, &(0x7f00000002c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x23}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000))
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94)
bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff, 0x6ec}, 0x0, 0x0)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f0000000040), 0x0}, 0x20)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r3}, 0x10)

3.210008601s ago: executing program 1 (id=592):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
recvmmsg(r0, &(0x7f0000005c80), 0x400030f, 0x0, 0x0)

2.950364381s ago: executing program 1 (id=593):
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000200)=@bpf_lsm={0x10, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="7910480000000000790048000000000095"], &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94)

2.339180104s ago: executing program 2 (id=600):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000003f80)=ANY=[@ANYBLOB="18020000feffffff00000000000000008500000041000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000010400000850000000600000095"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x44, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r0, 0x27, 0xe, 0x0, &(0x7f00000002c0)="f8ad00c5fce2b5cbaaadc5829fda", 0x0, 0x9, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50)

1.492831615s ago: executing program 2 (id=601):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000340)=@framed={{}, [@printk={@p, {}, {}, {}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x5}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000400)='percpu_alloc_percpu\x00', r0}, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xffe, 0x7, 0x0, 0xffffffffffffffff, 0x1}, 0x50)

1.439590727s ago: executing program 2 (id=602):
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0))
socket$nl_route(0x10, 0x3, 0x0)
socket(0x10, 0x3, 0x0)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x10)
setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x3}, {0xfffffffffffffffc}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x30}, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8)
sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0)
sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x50}, 0x0)
r5 = socket(0x10, 0x3, 0xc)
write(r5, &(0x7f0000000040), 0x0)
unshare(0x40020000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$packet(0x11, 0x2, 0x300)

743.610385ms ago: executing program 0 (id=608):
r0 = socket$kcm(0x10, 0x2, 0x0)
recvmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000047c0)=""/4060, 0xfdc}, {&(0x7f00000017c0)=""/4075, 0xfeb}, {&(0x7f0000000700)=""/244, 0xf4}, {&(0x7f00000005c0)=""/133, 0x85}, {&(0x7f0000000200)=""/62, 0x3e}], 0x5}, 0x40000100)
sendmsg$inet(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)="5c00000012006bab9a3fe3d86e17aa0a046b4877c4aaf68187bae53dca2b20dd9dc19d7fac80841b6234ead9f6aea35be46a876c1d0048007ea608649e7524765f0ef82e3c0000a705259a3651f60a84c9f4d4938037e70e4509c5bb", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40000000)

439.94468ms ago: executing program 0 (id=609):
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000100)=[@in={0x2, 0x4e23, @local}], 0x10)
ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)=ANY=[@ANYBLOB='..'])
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0)
syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/ipc\x00')

339.468307ms ago: executing program 0 (id=610):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x8, 0xa}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x6d}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe80, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c)

129.694315ms ago: executing program 0 (id=611):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x6, &(0x7f0000000380)={0x7d, {{0x29, 0xfffc, 0x2000000, @dev={0xfe, 0x80, '\x00', 0x30}, 0x7}}}, 0x88)

58.092794ms ago: executing program 0 (id=612):
r0 = socket(0x1e, 0x2, 0x0)
setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000480), 0x4)
sendmsg$tipc(r0, &(0x7f0000000200)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x2, {0x1, 0x0, 0x2}}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000080)="00497ac3c19cd0467645752a368321d12b8866b6f34302b5b0d2", 0x1a}], 0x1}, 0x4000001)
recvmmsg(r0, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000a40)=""/188, 0xbc}], 0x1, &(0x7f0000000500)=""/87, 0x57}}], 0x1, 0x0, 0x0)

0s ago: executing program 0 (id=613):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = getpid()
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={r2, r3, 0x0, 0x0, 0x0}, 0x30)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000000)="2e000400010002", 0x7)
sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_BROADCAST={0xa}, @IFLA_NET_NS_PID={0x8, 0x13, r2}, @IFLA_MTU={0x8, 0x4, 0xffe1}]}, 0x50}}, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030080e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000040}, 0x24004000)
sendmsg$NFT_BATCH(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000100)={&(0x7f000000c300)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2000000}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}], {0x14}}, 0x64}}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff}}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x9, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r5}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f00000022c0)=ANY=[@ANYBLOB="61158c000000000061134c0000000000bfa00000000000001705000008004ef02d3501000000000095003200000000006916000000000000bf67000000000000350605000fff07206706000002000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b540dcfc7ad0500c4063b3b8754c0686cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d39d25991b085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e5671c888fb126a163f16f920ae2fb494059bba8e3b680324a188090eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb40000000000000000000000000040007abf9c20d89cbc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eb29000000000000003cc3aa39ee4b1386bab561cda886fa64ffffff7f473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59801fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e17417a249a2cd8ff62aa6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d00000000d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38c7f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf73400000000000000cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61d1f5b2a443faa9bda0577383dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea90000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8a10300004d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a122822bb031bbee6d23cef7074f6d718b06ca80b57aa183dd0c39e9d8547c666b6764a3c7dd62a94eee45881441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a365b5b11df7216652b5703f31e078ecdefe8e6bfc45a9980a7a8de863e3477dd47d0f11611ca92d89641a183c8f629f17cfc28fde209a793d9c0cdde3bb3f82670d33396982988b9f5207a732908fdf1506f307ccae47a69319ee2242272e4f7ceb7a40e49a21ce6405af3ecb3381bf0668749c81fc6c2d97e68a693e3e622af52e572f4fa7b20d5c72cf5ff8016461130a46803de45029489921a48bd7688dd593e4a3e9803263ecbd8ae8570293508ebe5fabc1842cbc01ae8fabbf41820c31b7bb83a3439d4540f839ed5c23828a33d7645baa1ec32bb7aa8a786bb0997ccf6bba0a2cf6ef2157a63974d5e525a3f3f7f993ea9e82732ccc2e12c6310121ecb9029e7f835420f8f27a7e563684a225dee6ca5f5ff18a89ac6c627ff0e0e4769b6fbcfc847b20960704a4b13e962333bddb966de8bcade6f6bd3915a580ddec2e1bd88fbfdb749789cdc946822212f1cbacb03ba8d3e51e48ccdae20a43bf79ca0131b830620a97877242989e78dfec1d6df5f97ca5cddece50d0cae5d6eabbc1913aa3660e0b00000000000000000000000000bc12b71cb118d93461aa2914d6e454ef05c41beab7382787ba46b68c8d8b35349fb58b259b4447b59c667ddcac0bb2d066eb0579be84bdca8ed5d693411b7e5b21efaceddacef03daa9772f2715b5613ae0d88f8d109e36f8b8871b646d9ebbcc25d527ad3f828c92cb6597f82ed4d496a511007781be0c7cac07fc508a585f415ef81a887475286df80fb6ff9c6524d0e22d50f88ca15545bc688063b04eb8e0248aca60b9983dd5966216499ccfc0551f6e0323859ae64f55e4d496a695f8e6382aa714b92f95dcfd0b456d9ce7a24f736e4009ef64230e8f83f8283a4cc5f178d4698b94ccd8d0e0e3e2e35e1a7ac0cb3ee52013e8c2802d2f89b3f708fb53c17c3e4fbe0326ee510c4317b5f5f1eb34ca8441c23755acfc469909b16fba134de01d484c1b380622d3743a0be77b64961753faba6131c136fb14b1963960f2f7f118bc451a18b216bf26c3cec2575a059da60baede629711a5f11c347fcbca73440d27b1147b44fb15106c00669da23964fd9de079d1a9077848100f6e75d29b2d60016abc6ef1542bd3062f599676bb04e64decb6c843a407f"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
syz_emit_ethernet(0x70, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff3711e0ee8bb1080045030062ffff0000002f90780000f0ffdf000001248022eb000000000000000010000800ffff000086dda999cea4080088be00000000100000000100000000000000080022eb00000000200000000200000000000000000000000800655800000000"], 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:21165' (ED25519) to the list of known hosts.
syzkaller login: [   40.809199][ T5754] cgroup: Unknown subsys name 'net'
[   40.913391][ T5754] cgroup: Unknown subsys name 'cpuset'
[   40.917258][ T5754] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   42.527533][ T5754] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   47.270216][ T5217] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   47.273944][ T5217] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   47.275039][ T5831] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   47.280105][ T5834] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   47.283312][ T5834] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   47.286225][ T5836] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   47.287333][ T5838] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   47.288922][ T5836] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   47.290863][ T5838] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   47.293553][ T5836] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   47.297683][ T5831] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   47.300108][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   47.303787][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   47.306107][ T5838] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   47.311446][ T5836] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   47.557758][ T5827] chnl_net:caif_netlink_parms(): no params data found
[   47.622781][ T5829] chnl_net:caif_netlink_parms(): no params data found
[   47.638110][ T5826] chnl_net:caif_netlink_parms(): no params data found
[   47.702997][ T5827] bridge0: port 1(bridge_slave_0) entered blocking state
[   47.705367][ T5827] bridge0: port 1(bridge_slave_0) entered disabled state
[   47.707809][ T5827] bridge_slave_0: entered allmulticast mode
[   47.710554][ T5827] bridge_slave_0: entered promiscuous mode
[   47.730058][ T5827] bridge0: port 2(bridge_slave_1) entered blocking state
[   47.732631][ T5827] bridge0: port 2(bridge_slave_1) entered disabled state
[   47.734816][ T5827] bridge_slave_1: entered allmulticast mode
[   47.737611][ T5827] bridge_slave_1: entered promiscuous mode
[   47.748897][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   47.751368][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state
[   47.753481][ T5829] bridge_slave_0: entered allmulticast mode
[   47.756014][ T5829] bridge_slave_0: entered promiscuous mode
[   47.795533][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   47.797680][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state
[   47.799752][ T5829] bridge_slave_1: entered allmulticast mode
[   47.802754][ T5829] bridge_slave_1: entered promiscuous mode
[   47.807813][ T5827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   47.811242][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state
[   47.813414][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state
[   47.815518][ T5826] bridge_slave_0: entered allmulticast mode
[   47.818072][ T5826] bridge_slave_0: entered promiscuous mode
[   47.832278][ T5827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   47.835098][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state
[   47.837229][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state
[   47.839370][ T5826] bridge_slave_1: entered allmulticast mode
[   47.842102][ T5826] bridge_slave_1: entered promiscuous mode
[   47.877730][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   47.882080][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   47.895101][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   47.899127][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   47.912860][ T5827] team0: Port device team_slave_0 added
[   47.939573][ T5827] team0: Port device team_slave_1 added
[   47.945070][ T5829] team0: Port device team_slave_0 added
[   47.949303][ T5826] team0: Port device team_slave_0 added
[   47.973351][ T5829] team0: Port device team_slave_1 added
[   47.976299][ T5826] team0: Port device team_slave_1 added
[   47.996656][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_0
[   47.998786][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.006693][ T5827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   48.026728][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_1
[   48.028823][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.036307][ T5827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   48.040127][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0
[   48.043467][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.051550][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   48.055352][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0
[   48.057580][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.066033][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   48.075608][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1
[   48.077615][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.085175][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   48.088940][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1
[   48.091722][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.099523][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   48.175662][ T5827] hsr_slave_0: entered promiscuous mode
[   48.180084][ T5827] hsr_slave_1: entered promiscuous mode
[   48.189391][ T5826] hsr_slave_0: entered promiscuous mode
[   48.194379][ T5826] hsr_slave_1: entered promiscuous mode
[   48.197464][ T5826] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   48.200960][ T5826] Cannot create hsr debugfs directory
[   48.206682][ T5829] hsr_slave_0: entered promiscuous mode
[   48.208849][ T5829] hsr_slave_1: entered promiscuous mode
[   48.211090][ T5829] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   48.213292][ T5829] Cannot create hsr debugfs directory
[   48.488870][ T5827] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   48.496194][ T5827] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   48.501879][ T5827] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   48.513933][ T5827] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   48.562904][ T5829] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   48.568635][ T5829] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   48.574464][ T5829] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   48.578942][ T5829] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   48.649657][ T5826] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   48.655739][ T5826] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   48.660357][ T5826] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   48.668477][ T5826] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   48.742547][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0
[   48.753088][ T5827] 8021q: adding VLAN 0 to HW filter on device bond0
[   48.769836][ T5829] 8021q: adding VLAN 0 to HW filter on device team0
[   48.776039][ T5827] 8021q: adding VLAN 0 to HW filter on device team0
[   48.786156][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   48.788686][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   48.802919][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   48.805115][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   48.808351][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   48.810494][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   48.825915][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   48.828188][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   48.834718][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0
[   48.876727][ T5826] 8021q: adding VLAN 0 to HW filter on device team0
[   48.887443][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   48.889708][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   48.903078][ T5829] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   48.909448][ T1149] bridge0: port 2(bridge_slave_1) entered blocking state
[   48.911727][ T1149] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.047769][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0
[   49.084526][ T5827] 8021q: adding VLAN 0 to HW filter on device batadv0
[   49.105680][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0
[   49.124069][ T5829] veth0_vlan: entered promiscuous mode
[   49.138030][ T5829] veth1_vlan: entered promiscuous mode
[   49.166469][ T5826] veth0_vlan: entered promiscuous mode
[   49.170239][ T5827] veth0_vlan: entered promiscuous mode
[   49.186136][ T5826] veth1_vlan: entered promiscuous mode
[   49.192377][ T5827] veth1_vlan: entered promiscuous mode
[   49.208856][ T5829] veth0_macvtap: entered promiscuous mode
[   49.217306][ T5829] veth1_macvtap: entered promiscuous mode
[   49.233111][ T5826] veth0_macvtap: entered promiscuous mode
[   49.240118][ T5826] veth1_macvtap: entered promiscuous mode
[   49.248352][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0
[   49.261668][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1
[   49.264403][ T5827] veth0_macvtap: entered promiscuous mode
[   49.268609][ T5829] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   49.273167][ T5829] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   49.275844][ T5829] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   49.278507][ T5829] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   49.293593][ T5827] veth1_macvtap: entered promiscuous mode
[   49.304031][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0
[   49.333116][   T54] Bluetooth: hci0: command tx timeout
[   49.333772][ T5830] Bluetooth: hci2: command tx timeout
[   49.335780][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_0
[   49.340340][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1
[   49.364013][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_1
[   49.367897][ T5826] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   49.372408][ T5826] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   49.374984][ T5826] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   49.377489][ T5826] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   49.391678][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.396260][ T5827] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   49.398858][ T5827] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   49.401605][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.403415][ T5827] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   49.407544][ T5827] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   49.411672][ T5830] Bluetooth: hci1: command tx timeout
[   49.470586][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.473967][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.515323][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.516276][ T5829] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   49.517694][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.589339][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.596241][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.617111][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.619474][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.651574][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.655410][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.949268][ T5916] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   50.448487][ T5959] netlink: 'syz.0.30': attribute type 3 has an invalid length.
[   50.875681][    C0] vxcan0: j1939_tp_rxtimer: 0xffff888026e31800: rx timeout, send abort
[   51.007516][ T5997] netlink: 28 bytes leftover after parsing attributes in process `syz.1.48'.
[   51.364660][ T6012] netlink: 12 bytes leftover after parsing attributes in process `syz.1.54'.
[   51.367890][ T6012] netlink: 20 bytes leftover after parsing attributes in process `syz.1.54'.
[   51.376016][    C0] vxcan0: j1939_tp_rxtimer: 0xffff888026e31c00: rx timeout, send abort
[   51.378985][    C0] vxcan0: j1939_tp_rxtimer: 0xffff888026e31800: abort rx timeout. Force session deactivation
[   51.411640][ T5830] Bluetooth: hci2: command tx timeout
[   51.413319][ T5830] Bluetooth: hci0: command tx timeout
[   51.491421][ T5830] Bluetooth: hci1: command tx timeout
[   51.599746][ T6027] Driver unsupported XDP return value 0 on prog  (id 16) dev N/A, expect packet loss!
[   51.702087][ T6032] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   51.879434][    C0] vxcan0: j1939_tp_rxtimer: 0xffff888026e31c00: abort rx timeout. Force session deactivation
[   52.523508][ T6064] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   53.492832][ T5830] Bluetooth: hci0: command tx timeout
[   53.494474][ T5830] Bluetooth: hci2: command tx timeout
[   53.537733][ T6133] netlink: 28 bytes leftover after parsing attributes in process `syz.1.107'.
[   53.540756][ T6133] netlink: 28 bytes leftover after parsing attributes in process `syz.1.107'.
[   53.543382][ T6133] netlink: 'syz.1.107': attribute type 4 has an invalid length.
[   53.572457][   T54] Bluetooth: hci1: command tx timeout
[   54.038147][ T6165] syz.2.121 uses obsolete (PF_INET,SOCK_PACKET)
[   54.175403][ T6173] netlink: 84 bytes leftover after parsing attributes in process `syz.1.126'.
[   54.202535][ T6176] erspan0: entered promiscuous mode
[   54.401652][ T6191] macvtap1: entered allmulticast mode
[   54.403298][ T6191] veth0_macvtap: entered allmulticast mode
[   54.976305][ T6248] netlink: del zone limit has 4 unknown bytes
[   55.009814][ T6252] Bluetooth: MGMT ver 1.23
[   55.125654][ T6263] netlink: 36 bytes leftover after parsing attributes in process `syz.2.164'.
[   55.128469][ T6263] netlink: 16 bytes leftover after parsing attributes in process `syz.2.164'.
[   55.131153][ T6263] netlink: 36 bytes leftover after parsing attributes in process `syz.2.164'.
[   55.133711][ T6263] netlink: 36 bytes leftover after parsing attributes in process `syz.2.164'.
[   55.472683][ T6283] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 0, id = 0
[   55.571227][   T54] Bluetooth: hci2: command tx timeout
[   55.573570][ T5830] Bluetooth: hci0: command tx timeout
[   55.652437][   T54] Bluetooth: hci1: command tx timeout
[   56.469208][ T6370] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   56.700556][ T6397] Zero length message leads to an empty skb
[   56.741742][ T6403] netlink: 'syz.0.222': attribute type 11 has an invalid length.
[   57.120236][ T6433] pimreg: entered allmulticast mode
[   58.002793][ T6473] syz_tun: entered promiscuous mode
[   58.004599][ T6473] macsec1: entered allmulticast mode
[   58.006191][ T6473] syz_tun: entered allmulticast mode
[   58.011808][ T6473] syz_tun: left allmulticast mode
[   58.021280][ T6473] syz_tun: left promiscuous mode
[   58.075607][ T6478] __nla_validate_parse: 2 callbacks suppressed
[   58.075618][ T6478] netlink: 27 bytes leftover after parsing attributes in process `syz.1.255'.
[   58.198766][ T5276] udevd[5276]: worker [5839] terminated by signal 33 (Unknown signal 33)
[   58.207667][ T5276] udevd[5276]: worker [5839] failed while handling '/devices/virtual/block/loop1'
[   58.304465][ T6496] netlink: 4 bytes leftover after parsing attributes in process `syz.2.264'.
[   58.374661][ T6504] netlink: 68 bytes leftover after parsing attributes in process `syz.1.268'.
[   59.003895][ T6551] netlink: 'syz.1.289': attribute type 8 has an invalid length.
[   59.310477][ T6572] netlink: 'syz.1.300': attribute type 3 has an invalid length.
[   59.472622][ T6596] netlink: 4 bytes leftover after parsing attributes in process `syz.1.310'.
[   60.393911][ T6620] netlink: 'syz.0.320': attribute type 1 has an invalid length.
[   60.556078][ T6641] netlink: 12 bytes leftover after parsing attributes in process `syz.0.330'.
[   60.561360][ T6641] netlink: 12 bytes leftover after parsing attributes in process `syz.0.330'.
[   60.964393][ T6674] infiniband syz0: set down
[   60.966901][ T6674] infiniband syz0: added ipvlan1
[   60.995516][ T6674] RDS/IB: syz0: added
[   60.998454][ T6674] smc: adding ib device syz0 with port count 1
[   61.000488][ T6674] smc:    ib device syz0 port 1 has pnetid 
[   61.336129][ T6674] syz.1.346 (6674) used greatest stack depth: 19560 bytes left
[   61.564364][ T6699] netlink: 12 bytes leftover after parsing attributes in process `syz.1.354'.
[   61.765434][ T6716] ieee802154 phy0 wpan0: encryption failed: -22
[   62.466550][ T6733] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   63.003266][ T6790] netlink: 8 bytes leftover after parsing attributes in process `syz.0.395'.
[   63.049746][ T6794] netlink: 28 bytes leftover after parsing attributes in process `syz.2.398'.
[   63.053662][ T6794] netlink: 16 bytes leftover after parsing attributes in process `syz.2.398'.
[   64.932123][ T6941] netlink: 'syz.1.468': attribute type 3 has an invalid length.
[   65.208103][ T6968] trusted_key: syz.1.480 sent an empty control message without MSG_MORE.
[   65.632530][ T7005] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   65.676588][ T7007] netlink: 10 bytes leftover after parsing attributes in process `syz.0.499'.
[   65.874321][ T7020] netlink: 40 bytes leftover after parsing attributes in process `syz.1.505'.
[   66.452332][ T7086] openvswitch: netlink: Missing key (keys=40, expected=200000)
[   66.788560][ T7112] syz.1.548 (7112) used obsolete PPPIOCDETACH ioctl
[   67.093874][ T7135] netlink: 4 bytes leftover after parsing attributes in process `syz.1.557'.
[   67.391046][ T7157] netlink: 4 bytes leftover after parsing attributes in process `syz.0.566'.
[   67.442809][ T7158] netlink: 4 bytes leftover after parsing attributes in process `syz.0.566'.
[   67.521473][ T7161] netlink: 'syz.0.567': attribute type 1 has an invalid length.
[   68.016358][  T789] cfg80211: failed to load regulatory.db
[   68.779810][ T7213] netlink: 24 bytes leftover after parsing attributes in process `syz.1.587'.
[   68.938383][ T7221] netlink: 'syz.2.591': attribute type 10 has an invalid length.
[   68.957609][ T5826] cgroup: fork rejected by pids controller in /syz1
[   69.003627][ T7221] veth0_macvtap (unregistering): left allmulticast mode
[   69.198555][ T5859] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.299927][ T5859] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.362086][ T5859] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.421682][ T5859] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.487911][ T5830] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   69.494404][ T5830] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   69.498855][ T5830] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   69.502932][ T5830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   69.505990][ T5830] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   69.575375][ T5859] bridge_slave_1: left allmulticast mode
[   69.598972][ T5859] bridge_slave_1: left promiscuous mode
[   69.602484][ T5859] bridge0: port 2(bridge_slave_1) entered disabled state
[   69.616195][ T5859] bridge_slave_0: left allmulticast mode
[   69.621255][ T5859] bridge_slave_0: left promiscuous mode
[   69.627633][ T5859] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.811195][ T5859] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   70.819942][ T5859] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   70.825341][ T5859] bond0 (unregistering): Released all slaves
[   70.856683][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   70.859154][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   70.940132][ T7255] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[   70.944825][ T7255] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[   71.570020][ T7312] netlink: 60 bytes leftover after parsing attributes in process `syz.0.608'.
[   71.571258][ T5830] Bluetooth: hci0: command tx timeout
[   71.647116][ T7309] netlink: 60 bytes leftover after parsing attributes in process `syz.0.608'.
[   72.103151][ T7232] chnl_net:caif_netlink_parms(): no params data found
[   72.173036][ T5859] hsr_slave_0: left promiscuous mode
[   72.175360][ T5859] hsr_slave_1: left promiscuous mode
[   72.177396][ T5859] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   72.179620][ T5859] batman_adv: batadv0: Removing interface: batadv_slave_0
[   72.184599][ T5859] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   72.186950][ T5859] batman_adv: batadv0: Removing interface: batadv_slave_1
[   72.198537][ T5859] veth1_macvtap: left promiscuous mode
[   72.200424][ T5859] veth0_macvtap: left promiscuous mode
[   72.203359][ T5859] veth1_vlan: left promiscuous mode
[   72.205137][ T5859] veth0_vlan: left promiscuous mode
[   72.225068][ T7382] netlink: 4 bytes leftover after parsing attributes in process `syz.0.613'.
[   72.365746][ T6122] smc: removing ib device syz0
[   72.518144][ T5859] team0 (unregistering): Port device team_slave_1 removed
[   72.538760][ T5859] team0 (unregistering): Port device team_slave_0 removed
[   72.774433][ T7379] geneve2: entered promiscuous mode
[   72.835419][  T789] ==================================================================
[   72.838427][  T789] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x6e/0x190
[   72.841695][  T789] Read of size 8 at addr ffff8881234182e8 by task kworker/1:2/789
[   72.845524][  T789] 
[   72.846481][  T789] CPU: 1 UID: 0 PID: 789 Comm: kworker/1:2 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[   72.846499][  T789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   72.846508][  T789] Workqueue: events smc_ib_port_event_work
[   72.846558][  T789] Call Trace:
[   72.846566][  T789]  <TASK>
[   72.846590][  T789]  dump_stack_lvl+0x189/0x250
[   72.846608][  T789]  ? __virt_addr_valid+0x1c8/0x5c0
[   72.846626][  T789]  ? rcu_is_watching+0x15/0xb0
[   72.846642][  T789]  ? __pfx_dump_stack_lvl+0x10/0x10
[   72.846658][  T789]  ? rcu_is_watching+0x15/0xb0
[   72.846673][  T789]  ? lock_release+0x4b/0x3e0
[   72.846689][  T789]  ? __virt_addr_valid+0x1c8/0x5c0
[   72.846706][  T789]  ? __virt_addr_valid+0x4a5/0x5c0
[   72.846724][  T789]  print_report+0xd2/0x2b0
[   72.846737][  T789]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   72.846756][  T789]  kasan_report+0x118/0x150
[   72.846775][  T789]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   72.846797][  T789]  __ethtool_get_link_ksettings+0x6e/0x190
[   72.846818][  T789]  ib_get_eth_speed+0x15e/0x7b0
[   72.846839][  T789]  ? __pfx_ib_get_eth_speed+0x10/0x10
[   72.846862][  T789]  ? do_raw_spin_unlock+0x4d/0x240
[   72.846885][  T789]  rxe_query_port+0x93/0x3b0
[   72.846903][  T789]  ib_query_port+0x170/0x830
[   72.846925][  T789]  smc_ib_port_event_work+0x15a/0x940
[   72.846949][  T789]  ? _raw_spin_unlock_irq+0x23/0x50
[   72.846968][  T789]  ? process_scheduled_works+0x9ef/0x17b0
[   72.846983][  T789]  ? process_scheduled_works+0x9ef/0x17b0
[   72.846999][  T789]  process_scheduled_works+0xae1/0x17b0
[   72.847025][  T789]  ? __pfx_process_scheduled_works+0x10/0x10
[   72.847047][  T789]  worker_thread+0x8a0/0xda0
[   72.847064][  T789]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   72.847086][  T789]  ? __kthread_parkme+0x7b/0x200
[   72.847106][  T789]  kthread+0x711/0x8a0
[   72.847126][  T789]  ? __pfx_worker_thread+0x10/0x10
[   72.847141][  T789]  ? __pfx_kthread+0x10/0x10
[   72.847159][  T789]  ? _raw_spin_unlock_irq+0x23/0x50
[   72.847177][  T789]  ? lockdep_hardirqs_on+0x9c/0x150
[   72.847189][  T789]  ? __pfx_kthread+0x10/0x10
[   72.847207][  T789]  ret_from_fork+0x3fc/0x770
[   72.847222][  T789]  ? __pfx_ret_from_fork+0x10/0x10
[   72.847238][  T789]  ? __switch_to_asm+0x39/0x70
[   72.847254][  T789]  ? __switch_to_asm+0x33/0x70
[   72.847270][  T789]  ? __pfx_kthread+0x10/0x10
[   72.847288][  T789]  ret_from_fork_asm+0x1a/0x30
[   72.847311][  T789]  </TASK>
[   72.847316][  T789] 
[   72.929812][  T789] Allocated by task 5826:
[   72.931472][  T789]  kasan_save_track+0x3e/0x80
[   72.933226][  T789]  __kasan_kmalloc+0x93/0xb0
[   72.934954][  T789]  __kvmalloc_node_noprof+0x30d/0x5f0
[   72.936948][  T789]  alloc_netdev_mqs+0xa6/0x11e0
[   72.938812][  T789]  rtnl_create_link+0x31f/0xd10
[   72.940679][  T789]  rtnl_newlink_create+0x25c/0xb00
[   72.942256][  T789]  rtnl_newlink+0x16d6/0x1c70
[   72.943805][  T789]  rtnetlink_rcv_msg+0x7cf/0xb70
[   72.945431][  T789]  netlink_rcv_skb+0x208/0x470
[   72.947302][  T789]  netlink_unicast+0x75b/0x8d0
[   72.949123][  T789]  netlink_sendmsg+0x805/0xb30
[   72.950988][  T789]  __sock_sendmsg+0x21c/0x270
[   72.952738][  T789]  __sys_sendto+0x3bd/0x520
[   72.954448][  T789]  __x64_sys_sendto+0xde/0x100
[   72.956183][  T789]  do_syscall_64+0xfa/0x3b0
[   72.957603][  T789]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   72.959676][  T789] 
[   72.960405][  T789] Freed by task 5859:
[   72.961596][  T789]  kasan_save_track+0x3e/0x80
[   72.962995][  T789]  kasan_save_free_info+0x46/0x50
[   72.964468][  T789]  __kasan_slab_free+0x62/0x70
[   72.965868][  T789]  kfree+0x18e/0x440
[   72.967057][  T789]  device_release+0x9c/0x1c0
[   72.968426][  T789]  kobject_put+0x22b/0x480
[   72.969743][  T789]  netdev_run_todo+0xd2e/0xea0
[   72.971165][  T789]  default_device_exit_batch+0x81e/0x890
[   72.972846][  T789]  ops_undo_list+0x525/0x990
[   72.974204][  T789]  cleanup_net+0x4c5/0x800
[   72.975536][  T789]  process_scheduled_works+0xae1/0x17b0
[   72.977210][  T789]  worker_thread+0x8a0/0xda0
[   72.978580][  T789]  kthread+0x711/0x8a0
[   72.979825][  T789]  ret_from_fork+0x3fc/0x770
[   72.981189][  T789]  ret_from_fork_asm+0x1a/0x30
[   72.982611][  T789] 
[   72.983336][  T789] The buggy address belongs to the object at ffff888123418000
[   72.983336][  T789]  which belongs to the cache kmalloc-cg-4k of size 4096
[   72.987469][  T789] The buggy address is located 744 bytes inside of
[   72.987469][  T789]  freed 4096-byte region [ffff888123418000, ffff888123419000)
[   72.991493][  T789] 
[   72.992228][  T789] The buggy address belongs to the physical page:
[   72.994108][  T789] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x123418
[   72.996702][  T789] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   72.999155][  T789] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   73.001400][  T789] page_type: f5(slab)
[   73.002602][  T789] raw: 057ff00000000040 ffff88801a44b500 dead000000000122 0000000000000000
[   73.005119][  T789] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[   73.007577][  T789] head: 057ff00000000040 ffff88801a44b500 dead000000000122 0000000000000000
[   73.010063][  T789] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[   73.012504][  T789] head: 057ff00000000003 ffffea00048d0601 00000000ffffffff 00000000ffffffff
[   73.014981][  T789] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   73.017463][  T789] page dumped because: kasan: bad access detected
[   73.019307][  T789] page_owner tracks the page as allocated
[   73.020936][  T789] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5826, tgid 5826 (syz-executor), ts 48291875675, free_ts 0
[   73.027099][  T789]  post_alloc_hook+0x240/0x2a0
[   73.028489][  T789]  get_page_from_freelist+0x21e4/0x22c0
[   73.030122][  T789]  __alloc_frozen_pages_noprof+0x181/0x370
[   73.031797][  T789]  alloc_pages_mpol+0x232/0x4a0
[   73.033206][  T789]  allocate_slab+0x8a/0x3b0
[   73.034536][  T789]  ___slab_alloc+0xbfc/0x1480
[   73.035898][  T789]  __kvmalloc_node_noprof+0x429/0x5f0
[   73.037471][  T789]  alloc_netdev_mqs+0xa6/0x11e0
[   73.038928][  T789]  rtnl_create_link+0x31f/0xd10
[   73.040358][  T789]  rtnl_newlink_create+0x25c/0xb00
[   73.041884][  T789]  rtnl_newlink+0x16d6/0x1c70
[   73.043273][  T789]  rtnetlink_rcv_msg+0x7cf/0xb70
[   73.044726][  T789]  netlink_rcv_skb+0x208/0x470
[   73.046153][  T789]  netlink_unicast+0x75b/0x8d0
[   73.047570][  T789]  netlink_sendmsg+0x805/0xb30
[   73.048999][  T789]  __sock_sendmsg+0x21c/0x270
[   73.050391][  T789] page_owner free stack trace missing
[   73.051948][  T789] 
[   73.052662][  T789] Memory state around the buggy address:
[   73.054266][  T789]  ffff888123418180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   73.056575][  T789]  ffff888123418200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   73.058863][  T789] >ffff888123418280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   73.061206][  T789]                                                           ^
[   73.063346][  T789]  ffff888123418300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   73.065702][  T789]  ffff888123418380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   73.068051][  T789] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   73.110803][  T789] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   73.112979][  T789] CPU: 1 UID: 0 PID: 789 Comm: kworker/1:2 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[   73.116568][  T789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   73.119498][  T789] Workqueue: events smc_ib_port_event_work
[   73.121246][  T789] Call Trace:
[   73.122265][  T789]  <TASK>
[   73.123152][  T789]  dump_stack_lvl+0x99/0x250
[   73.124525][  T789]  ? __asan_memcpy+0x40/0x70
[   73.125882][  T789]  ? __pfx_dump_stack_lvl+0x10/0x10
[   73.127389][  T789]  ? __pfx__printk+0x10/0x10
[   73.128743][  T789]  panic+0x2db/0x790
[   73.129901][  T789]  ? __pfx_panic+0x10/0x10
[   73.131197][  T789]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[   73.132885][  T789]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   73.134683][  T789]  ? print_memory_metadata+0x314/0x400
[   73.136235][  T789]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   73.138076][  T789]  check_panic_on_warn+0x89/0xb0
[   73.139528][  T789]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   73.141305][  T789]  end_report+0x78/0x160
[   73.142567][  T789]  kasan_report+0x129/0x150
[   73.143900][  T789]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   73.145672][  T789]  __ethtool_get_link_ksettings+0x6e/0x190
[   73.147440][  T789]  ib_get_eth_speed+0x15e/0x7b0
[   73.148970][  T789]  ? __pfx_ib_get_eth_speed+0x10/0x10
[   73.150536][  T789]  ? do_raw_spin_unlock+0x4d/0x240
[   73.152064][  T789]  rxe_query_port+0x93/0x3b0
[   73.153430][  T789]  ib_query_port+0x170/0x830
[   73.154777][  T789]  smc_ib_port_event_work+0x15a/0x940
[   73.156359][  T789]  ? _raw_spin_unlock_irq+0x23/0x50
[   73.157885][  T789]  ? process_scheduled_works+0x9ef/0x17b0
[   73.159545][  T789]  ? process_scheduled_works+0x9ef/0x17b0
[   73.161200][  T789]  process_scheduled_works+0xae1/0x17b0
[   73.162813][  T789]  ? __pfx_process_scheduled_works+0x10/0x10
[   73.164535][  T789]  worker_thread+0x8a0/0xda0
[   73.165878][  T789]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   73.167837][  T789]  ? __kthread_parkme+0x7b/0x200
[   73.169325][  T789]  kthread+0x711/0x8a0
[   73.170533][  T789]  ? __pfx_worker_thread+0x10/0x10
[   73.172016][  T789]  ? __pfx_kthread+0x10/0x10
[   73.173380][  T789]  ? _raw_spin_unlock_irq+0x23/0x50
[   73.174934][  T789]  ? lockdep_hardirqs_on+0x9c/0x150
[   73.176553][  T789]  ? __pfx_kthread+0x10/0x10
[   73.177930][  T789]  ret_from_fork+0x3fc/0x770
[   73.179273][  T789]  ? __pfx_ret_from_fork+0x10/0x10
[   73.180785][  T789]  ? __switch_to_asm+0x39/0x70
[   73.182166][  T789]  ? __switch_to_asm+0x33/0x70
[   73.183607][  T789]  ? __pfx_kthread+0x10/0x10
[   73.184975][  T789]  ret_from_fork_asm+0x1a/0x30
[   73.186393][  T789]  </TASK>
[   73.187881][  T789] Kernel Offset: disabled
[   73.189186][  T789] Rebooting in 86400 seconds..

VM DIAGNOSIS:
06:35:50  Registers:
info registers vcpu 0

CPU#0
RAX=22f4838b5064f800 RBX=ffffffff81975d58 RCX=22f4838b5064f800 RDX=0000000000000001
RSI=ffffffff8d996d99 RDI=ffffffff8be28fc0 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f5b R9 =1ffff110096065eb R10=dffffc0000000000 R11=ffffed10096065ec
R12=ffffffff8fa1def0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6ee4a3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055555e29a808 CR3=000000001e4b8000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=ffffffffffffffff ffffffffff000000 XMM01=0101010101010101 0000010100ffffff
XMM02=ffffffffffffffb8 00007f1a0031726e XMM03=0000000000000000 0000000000000000
XMM04=ffff000000000000 ffffffffff000000 XMM05=0100000000000000 00000000000002ff
XMM06=0100000000000000 00000000000002ff XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=000000000000006f RBX=000000000000006f RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90004ecf090
R8 =ffff888108b48237 R9 =1ffff11021169046 R10=dffffc0000000000 R11=ffffffff85475610
R12=dffffc0000000000 R13=ffffffff99af790a R14=ffffffff99dfc760 R15=0000000000000000
RIP=ffffffff8547568c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffe00da2f18 CR3=0000000120028000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=ffff000000000000 00ff0000000000ff XMM03=ffffffffffffffff ffff0000ff000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000211 00006b632f006b00
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffff0000 ffff000000ff00ff XMM09=616e616b3a3a3474 75706e692f347475
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
