last executing test programs:

38.500247881s ago: executing program 0 (id=1448):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x110, 0x65, 0x2, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x2, 0xa}, {0xfff2, 0x1}, {0xa, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0xdc, 0x2, [@TCA_BPF_FLAGS={0x8}, @TCA_BPF_ACT={0xb4, 0x1, [@m_ctinfo={0xb0, 0x1b, 0x0, 0x0, {{0xb}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x401}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x92}, @TCA_CTINFO_ACT={0x18, 0x3, {0x8, 0x8, 0x5, 0x0, 0x9}}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x400}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0xffffffb4}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x800}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3b}]}, {0x3a, 0x6, "38e8a0f6c59bf5d03ba18c2489af3e84e20074eda7eeb2de98621c98969968a3b3cb087cd9693dd7f9664da29546efca3e545e5bdfa2"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8}, @TCA_BPF_FD={0x8}]}}]}, 0x110}, 0x1, 0x0, 0x0, 0x81}, 0x20000080)
r0 = socket(0x10, 0x803, 0x0)
sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0x8848}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400})

32.312869481s ago: executing program 0 (id=1448):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x110, 0x65, 0x2, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x2, 0xa}, {0xfff2, 0x1}, {0xa, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0xdc, 0x2, [@TCA_BPF_FLAGS={0x8}, @TCA_BPF_ACT={0xb4, 0x1, [@m_ctinfo={0xb0, 0x1b, 0x0, 0x0, {{0xb}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x401}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x92}, @TCA_CTINFO_ACT={0x18, 0x3, {0x8, 0x8, 0x5, 0x0, 0x9}}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x400}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0xffffffb4}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x800}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3b}]}, {0x3a, 0x6, "38e8a0f6c59bf5d03ba18c2489af3e84e20074eda7eeb2de98621c98969968a3b3cb087cd9693dd7f9664da29546efca3e545e5bdfa2"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8}, @TCA_BPF_FD={0x8}]}}]}, 0x110}, 0x1, 0x0, 0x0, 0x81}, 0x20000080)
r0 = socket(0x10, 0x803, 0x0)
sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0x8848}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400})

29.271115939s ago: executing program 1 (id=1895):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
listen(r0, 0xfffffffc)
connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r2, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0)
setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000180)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f00000001c0)=0x399c, 0x4)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'macvtap0\x00', <r4=>0x0})
sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x11, 0xf7, r4, 0x1, 0x20, 0x6, @local}, 0x14)
r5 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0)
openat$cgroup_ro(r5, &(0x7f00000000c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
socket(0x11, 0x3, 0x7)
r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
getsockopt$WPAN_SECURITY_LEVEL(r6, 0x0, 0x2, &(0x7f00000001c0), &(0x7f0000000200)=0x4)
sendmmsg$sock(0xffffffffffffffff, &(0x7f00000010c0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000001200)="9f", 0x1}], 0x1}}], 0x1, 0xc0)
bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="070100000000000000010000f9ffffff240000001100f0074165acafae5750453cd9bd8a04afbc72e486ac5f886caf52983598f8a8156dc156689838de1821b04680ac3651baf86938746636c99e91", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)

28.446309096s ago: executing program 1 (id=1900):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="7a0a00ff00000000711065000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94)
r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8)
write$tun(r0, &(0x7f0000000180)={@val={0x0, 0x200}, @void, @ipv4=@igmp={{0x12, 0x4, 0x3, 0x6, 0xca, 0x66, 0x0, 0xb, 0x2, 0x0, @empty, @broadcast, {[@ra={0x94, 0x4}, @ssrr={0x89, 0x7, 0x88, [@empty]}, @timestamp={0x44, 0x10, 0x5b, 0x0, 0x5, [0x2, 0x1, 0x5]}, @lsrr={0x83, 0x17, 0x5b, [@rand_addr=0x64010100, @empty, @multicast1, @local, @remote]}]}}, {0x16, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}, "4e53f77df69519fd83af8c77d0ec81e8c516bc50a6776a50c7970f000da62d0a866b95fa48a10163e3bf59e14a66a78d4e1657a089ebdb8be93ccc5dfca9bc26609b584204768cf73629ba36de4a919df30a694f575c269149f018317a6833373a19c1f677653c481bf0f547f0050713bd6f7740c96e44f08985"}}}, 0xce)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010400004000fedbdf2501f80000", @ANYRES32=0x0, @ANYBLOB="01020400000000002800128008000100736974001c00028008000200c6120001060008001900000005000a00fd000000080004000100010008000a00fa"], 0x58}}, 0x20040000)

25.705486849s ago: executing program 0 (id=1448):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x110, 0x65, 0x2, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x2, 0xa}, {0xfff2, 0x1}, {0xa, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0xdc, 0x2, [@TCA_BPF_FLAGS={0x8}, @TCA_BPF_ACT={0xb4, 0x1, [@m_ctinfo={0xb0, 0x1b, 0x0, 0x0, {{0xb}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x401}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x92}, @TCA_CTINFO_ACT={0x18, 0x3, {0x8, 0x8, 0x5, 0x0, 0x9}}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x400}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0xffffffb4}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x800}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3b}]}, {0x3a, 0x6, "38e8a0f6c59bf5d03ba18c2489af3e84e20074eda7eeb2de98621c98969968a3b3cb087cd9693dd7f9664da29546efca3e545e5bdfa2"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8}, @TCA_BPF_FD={0x8}]}}]}, 0x110}, 0x1, 0x0, 0x0, 0x81}, 0x20000080)
r0 = socket(0x10, 0x803, 0x0)
sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0x8848}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400})

24.627726581s ago: executing program 1 (id=1900):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="7a0a00ff00000000711065000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94)
r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8)
write$tun(r0, &(0x7f0000000180)={@val={0x0, 0x200}, @void, @ipv4=@igmp={{0x12, 0x4, 0x3, 0x6, 0xca, 0x66, 0x0, 0xb, 0x2, 0x0, @empty, @broadcast, {[@ra={0x94, 0x4}, @ssrr={0x89, 0x7, 0x88, [@empty]}, @timestamp={0x44, 0x10, 0x5b, 0x0, 0x5, [0x2, 0x1, 0x5]}, @lsrr={0x83, 0x17, 0x5b, [@rand_addr=0x64010100, @empty, @multicast1, @local, @remote]}]}}, {0x16, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}, "4e53f77df69519fd83af8c77d0ec81e8c516bc50a6776a50c7970f000da62d0a866b95fa48a10163e3bf59e14a66a78d4e1657a089ebdb8be93ccc5dfca9bc26609b584204768cf73629ba36de4a919df30a694f575c269149f018317a6833373a19c1f677653c481bf0f547f0050713bd6f7740c96e44f08985"}}}, 0xce)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010400004000fedbdf2501f80000", @ANYRES32=0x0, @ANYBLOB="01020400000000002800128008000100736974001c00028008000200c6120001060008001900000005000a00fd000000080004000100010008000a00fa"], 0x58}}, 0x20040000)

18.146155975s ago: executing program 1 (id=1900):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="7a0a00ff00000000711065000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94)
r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8)
write$tun(r0, &(0x7f0000000180)={@val={0x0, 0x200}, @void, @ipv4=@igmp={{0x12, 0x4, 0x3, 0x6, 0xca, 0x66, 0x0, 0xb, 0x2, 0x0, @empty, @broadcast, {[@ra={0x94, 0x4}, @ssrr={0x89, 0x7, 0x88, [@empty]}, @timestamp={0x44, 0x10, 0x5b, 0x0, 0x5, [0x2, 0x1, 0x5]}, @lsrr={0x83, 0x17, 0x5b, [@rand_addr=0x64010100, @empty, @multicast1, @local, @remote]}]}}, {0x16, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}, "4e53f77df69519fd83af8c77d0ec81e8c516bc50a6776a50c7970f000da62d0a866b95fa48a10163e3bf59e14a66a78d4e1657a089ebdb8be93ccc5dfca9bc26609b584204768cf73629ba36de4a919df30a694f575c269149f018317a6833373a19c1f677653c481bf0f547f0050713bd6f7740c96e44f08985"}}}, 0xce)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010400004000fedbdf2501f80000", @ANYRES32=0x0, @ANYBLOB="01020400000000002800128008000100736974001c00028008000200c6120001060008001900000005000a00fd000000080004000100010008000a00fa"], 0x58}}, 0x20040000)

17.90699529s ago: executing program 0 (id=1448):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x110, 0x65, 0x2, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x2, 0xa}, {0xfff2, 0x1}, {0xa, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0xdc, 0x2, [@TCA_BPF_FLAGS={0x8}, @TCA_BPF_ACT={0xb4, 0x1, [@m_ctinfo={0xb0, 0x1b, 0x0, 0x0, {{0xb}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x401}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x92}, @TCA_CTINFO_ACT={0x18, 0x3, {0x8, 0x8, 0x5, 0x0, 0x9}}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x400}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0xffffffb4}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x800}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3b}]}, {0x3a, 0x6, "38e8a0f6c59bf5d03ba18c2489af3e84e20074eda7eeb2de98621c98969968a3b3cb087cd9693dd7f9664da29546efca3e545e5bdfa2"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8}, @TCA_BPF_FD={0x8}]}}]}, 0x110}, 0x1, 0x0, 0x0, 0x81}, 0x20000080)
r0 = socket(0x10, 0x803, 0x0)
sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0x8848}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400})

11.988521809s ago: executing program 1 (id=1900):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="7a0a00ff00000000711065000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94)
r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8)
write$tun(r0, &(0x7f0000000180)={@val={0x0, 0x200}, @void, @ipv4=@igmp={{0x12, 0x4, 0x3, 0x6, 0xca, 0x66, 0x0, 0xb, 0x2, 0x0, @empty, @broadcast, {[@ra={0x94, 0x4}, @ssrr={0x89, 0x7, 0x88, [@empty]}, @timestamp={0x44, 0x10, 0x5b, 0x0, 0x5, [0x2, 0x1, 0x5]}, @lsrr={0x83, 0x17, 0x5b, [@rand_addr=0x64010100, @empty, @multicast1, @local, @remote]}]}}, {0x16, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}, "4e53f77df69519fd83af8c77d0ec81e8c516bc50a6776a50c7970f000da62d0a866b95fa48a10163e3bf59e14a66a78d4e1657a089ebdb8be93ccc5dfca9bc26609b584204768cf73629ba36de4a919df30a694f575c269149f018317a6833373a19c1f677653c481bf0f547f0050713bd6f7740c96e44f08985"}}}, 0xce)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010400004000fedbdf2501f80000", @ANYRES32=0x0, @ANYBLOB="01020400000000002800128008000100736974001c00028008000200c6120001060008001900000005000a00fd000000080004000100010008000a00fa"], 0x58}}, 0x20040000)

11.490768734s ago: executing program 0 (id=1448):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x110, 0x65, 0x2, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x2, 0xa}, {0xfff2, 0x1}, {0xa, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0xdc, 0x2, [@TCA_BPF_FLAGS={0x8}, @TCA_BPF_ACT={0xb4, 0x1, [@m_ctinfo={0xb0, 0x1b, 0x0, 0x0, {{0xb}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x401}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x92}, @TCA_CTINFO_ACT={0x18, 0x3, {0x8, 0x8, 0x5, 0x0, 0x9}}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x400}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0xffffffb4}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x800}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3b}]}, {0x3a, 0x6, "38e8a0f6c59bf5d03ba18c2489af3e84e20074eda7eeb2de98621c98969968a3b3cb087cd9693dd7f9664da29546efca3e545e5bdfa2"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8}, @TCA_BPF_FD={0x8}]}}]}, 0x110}, 0x1, 0x0, 0x0, 0x81}, 0x20000080)
r0 = socket(0x10, 0x803, 0x0)
sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0x8848}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400})

5.269881714s ago: executing program 1 (id=1900):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="7a0a00ff00000000711065000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94)
r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8)
write$tun(r0, &(0x7f0000000180)={@val={0x0, 0x200}, @void, @ipv4=@igmp={{0x12, 0x4, 0x3, 0x6, 0xca, 0x66, 0x0, 0xb, 0x2, 0x0, @empty, @broadcast, {[@ra={0x94, 0x4}, @ssrr={0x89, 0x7, 0x88, [@empty]}, @timestamp={0x44, 0x10, 0x5b, 0x0, 0x5, [0x2, 0x1, 0x5]}, @lsrr={0x83, 0x17, 0x5b, [@rand_addr=0x64010100, @empty, @multicast1, @local, @remote]}]}}, {0x16, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}, "4e53f77df69519fd83af8c77d0ec81e8c516bc50a6776a50c7970f000da62d0a866b95fa48a10163e3bf59e14a66a78d4e1657a089ebdb8be93ccc5dfca9bc26609b584204768cf73629ba36de4a919df30a694f575c269149f018317a6833373a19c1f677653c481bf0f547f0050713bd6f7740c96e44f08985"}}}, 0xce)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010400004000fedbdf2501f80000", @ANYRES32=0x0, @ANYBLOB="01020400000000002800128008000100736974001c00028008000200c6120001060008001900000005000a00fd000000080004000100010008000a00fa"], 0x58}}, 0x20040000)

4.65476775s ago: executing program 0 (id=1448):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x110, 0x65, 0x2, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x2, 0xa}, {0xfff2, 0x1}, {0xa, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0xdc, 0x2, [@TCA_BPF_FLAGS={0x8}, @TCA_BPF_ACT={0xb4, 0x1, [@m_ctinfo={0xb0, 0x1b, 0x0, 0x0, {{0xb}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x401}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x92}, @TCA_CTINFO_ACT={0x18, 0x3, {0x8, 0x8, 0x5, 0x0, 0x9}}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x400}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0xffffffb4}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x800}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3b}]}, {0x3a, 0x6, "38e8a0f6c59bf5d03ba18c2489af3e84e20074eda7eeb2de98621c98969968a3b3cb087cd9693dd7f9664da29546efca3e545e5bdfa2"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8}, @TCA_BPF_FD={0x8}]}}]}, 0x110}, 0x1, 0x0, 0x0, 0x81}, 0x20000080)
r0 = socket(0x10, 0x803, 0x0)
sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0x8848}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400})

3.368376883s ago: executing program 2 (id=2017):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="180100002e00010000000000fcdbdf2507"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async, rerun: 32)
r1 = socket$packet(0x11, 0x2, 0x300) (rerun: 32)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'dummy0\x00', <r2=>0x0})
close(r1)
r3 = socket$nl_route(0x10, 0x3, 0x0) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r5, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) (async)
setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10)
r6 = accept4(r5, 0x0, 0x0, 0x0)
sendmsg$alg(r6, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x40010}, 0x14000012) (async, rerun: 64)
recvmsg$can_raw(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)=""/34, 0x22}], 0x1}, 0x40010042) (async, rerun: 64)
recvfrom$unix(r6, &(0x7f0000000500)=""/16, 0x10, 0x102, &(0x7f0000000540)=@abs={0x0, 0x0, 0x4e22}, 0x6e) (async)
r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$NL80211_CMD_GET_MPATH(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010027bd70000000000067db000008000334", @ANYRES32=0x0, @ANYBLOB='\f'], 0x34}}, 0x8080) (async)
sendmsg$NL80211_CMD_ASSOCIATE(r4, &(0x7f00000001c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x100600}, 0xc, &(0x7f0000000180)={&(0x7f0000000480)={0x2c, r8, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xf, 0x7a}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="57218d5407ba"}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8c0}, 0x200080c4)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x12, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bb000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000ba00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x66, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcc86}, 0x94)
r9 = socket$inet6_udp(0xa, 0x2, 0x0) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32)
getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000240)=<r10=>0x0, &(0x7f0000000280)=0x4) (rerun: 32)
r11 = accept4$inet6(r9, &(0x7f00000002c0)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000400)=0x1c, 0x80800)
ioctl$ifreq_SIOCGIFINDEX_team(r11, 0x8933, &(0x7f0000000440)) (async, rerun: 64)
sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@bridge_newneigh={0x54, 0x1c, 0x200, 0x70bd27, 0x25dfdbfe, {0xa, 0x0, 0x0, r10, 0x8cc6c85ead026713, 0x22, 0x6}, [@NDA_IFINDEX={0x8, 0x8, r2}, @NDA_PROBES={0x8, 0x4, 0x3}, @NDA_VLAN={0x6}, @NDA_NH_ID={0x8, 0xd, 0x3}, @NDA_PORT={0x6, 0x6, 0x4e24}, @NDA_LINK_NETNSID={0x8, 0xa, 0xffff0000}, @NDA_SRC_VNI={0x8, 0xb, 0x5}]}, 0x54}}, 0x49) (async, rerun: 64)
syz_emit_ethernet(0x38, &(0x7f00000021c0)={@empty, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, @val={@val={0x88a8, 0x4, 0x0, 0x3}, {0x8100, 0x4, 0x1}}, {@generic={0x88f7, "4baa4b53f9ae7cfe12232cc787593dc404353086ab921dd1498ad6792ecb9b94c95c"}}}, 0x0)

2.989855373s ago: executing program 2 (id=2018):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b28, &(0x7f0000000000)={'wlan1\x00', @random="e300"})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a6c52d922ba2a05"], 0xfdef)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2, 0x31}, 0x48)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000002fc0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a00010000000000000000000a000000000000000010000005fd8f0007"], 0x24}}, 0x4000884)
sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="a03700002d00010026bd7000fcdbdf250400000005000b00", @ANYRES32=r0, @ANYBLOB="81120c"], 0x37a0}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000)

2.514043027s ago: executing program 2 (id=2019):
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000440)={0x0, 0x9}, 0x8)
bind$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r3=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newtfilter={0x5c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0xf}, {0x0, 0x2}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x30, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0x1, 0x1, 0x3, 0x1, 0x4, 0x2, 0x6, 0x7ffffffa, [{0x0, 0x53, 0xa9, 0x1}]}}, @TCA_U32_LINK={0x8}]}}]}, 0x5c}}, 0x24040084)
r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x7, [@type_tag={0x8, 0x0, 0x0, 0x12, 0x2}, @union={0x10, 0x1, 0x0, 0x5, 0x1, 0x2, [{0xb, 0x2, 0x8}]}]}, {0x0, [0x2e, 0x61, 0x61, 0x30, 0x0]}}, &(0x7f0000000900)=""/78, 0x43, 0x4e, 0x0, 0x3a0cd7e9, 0x10000}, 0x28)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000f40)=ANY=[@ANYBLOB="0900000005000000000200004000000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000790800000000000000000004000000002d62d37e37841e980977197a6d38bfb4b18b039a2efe03aa2d36bfb4b0772ad45899de020bf2e7fd5d570c92ebe7573eb419f658b42f0a3400acec45b822540f2a59100c4ddf41b05aa30a91216a40b3c23eec0b85670d8091bcff1787d3633fd8456c78e5e94940b3bb295aaeeae959d3b8ed7b65494b2c08d8321484dd874f21b220ff65162ee35e799cea91d4f5e16f49bdc8fd517d3d705a7eead43303d3f7b1"], 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000003c0), 0x7fff, r5}, 0x38)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f00000001c0)={r5, &(0x7f0000000080), &(0x7f0000000180)=""/29}, 0x20)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000a00)={0x1, <r6=>0xffffffffffffffff}, 0x4)
r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000a40)={0xffffffffffffffff, 0x400, 0x8}, 0xc)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000bc0)={{0x1, <r8=>0xffffffffffffffff}, &(0x7f0000000b40), &(0x7f0000000b80)}, 0x20)
r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=@base={0x1, 0x10, 0x3, 0x8, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x1}, 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d40)={0x11, 0x5, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3}, [@map_fd={0x18, 0x9}]}, &(0x7f0000000600)='syzkaller\x00', 0x323, 0xdc, &(0x7f00000007c0)=""/220, 0x40f00, 0x21, '\x00', r3, 0x0, r4, 0x8, &(0x7f0000000980)={0x4, 0x5}, 0x8, 0x10, &(0x7f00000009c0)={0x4, 0x4, 0x4, 0x6}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000000c80)=[r5, r0, r6, r7, 0xffffffffffffffff, r8, r9], &(0x7f0000000cc0)=[{0x1, 0x2, 0xb, 0x9}, {0x1, 0x4, 0x3, 0x2}, {0x2, 0x3, 0xe, 0x2}, {0x5, 0x5, 0x7, 0xa}, {0x0, 0x4, 0x4, 0x1}, {0x3, 0x2, 0x5, 0x9}, {0x5, 0x2, 0xc, 0x7}, {0x3, 0x4, 0xd}], 0x10, 0xf}, 0x94)
sendmmsg$inet6(r2, &(0x7f0000001500)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback}, 0x1c, &(0x7f0000000580)=[{&(0x7f00000003c0)='\t', 0x1}], 0x1}}], 0x1, 0x0)
setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f00000008c0), 0x4)
r10 = socket$pppoe(0x18, 0x1, 0x0)
r11 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r11)
getsockopt$sock_buf(r10, 0x1, 0x1c, &(0x7f0000000ec0)=""/59, &(0x7f0000000f00)=0x3b)
sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0)
r12 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r12, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8)
r13 = socket$key(0xf, 0x3, 0x2)
setsockopt$sock_int(r13, 0x1, 0x8, &(0x7f00000001c0), 0x4)
sendmsg$key(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0)

1.003963626s ago: executing program 2 (id=2020):
pipe(&(0x7f0000001540)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
r4 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}]}, &(0x7f0000000180)=0x10)
r5 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={<r6=>0x0}, &(0x7f0000000200)=0x8)
getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000140)={r6, 0x7fffffff, 0xe, 0x8, 0x7, 0x1, 0x6, 0x6, {0x0, @in={{0x2, 0x4e20, @rand_addr=0x64010102}}, 0x1, 0x7, 0x1, 0x0, 0x3347}}, &(0x7f0000000200)=0xb0)
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000ac0)={0x6, 0xb, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1005, 0x0, 0x0, 0x0, 0xa8000}, [@printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x80000}, {0x85, 0x0, 0x0, 0xc8}}]}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8}, 0x94)
r8 = socket$inet(0x2, 0x3, 0x1)
setsockopt$sock_int(r8, 0x1, 0x5, &(0x7f00000000c0)=0xabb3, 0x4)
sendmsg$inet(r8, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x60000000}, 0x4000000)
r9 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x5411, &(0x7f00000007c0))
r10 = socket$inet6(0xa, 0x1, 0x84)
setsockopt$sock_linger(r10, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xfffffffd}, 0x8)
close(r10)
listen(r7, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00', <r11=>0x0})
sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x7c, r2, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x2, 0x11}}}}, [@NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "8e00f5a7e15fb92e0f6bb6a378"}, @NL80211_ATTR_KEY_SEQ={0xd, 0xa, "d8e5a86b56f768d7c7"}, @NL80211_ATTR_KEY_IDX={0x5}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x8, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "aca4f46cd3"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "c068b5a9c772f283660861eccd"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x1)
splice(r7, 0x0, r1, 0x0, 0x406f413, 0x0)

84.177637ms ago: executing program 2 (id=2021):
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0)
ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000180)={0x0, 0x2, 0x8, 0xe7})
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0)
ioctl$SIOCRSSL2CALL(r3, 0x89e2, &(0x7f0000000240)=@bcast)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x1d, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x6}, {}, {}, [@alu={0x7, 0x0, 0x2, 0x0, 0x7, 0x30, 0x1}, @call={0x85, 0x0, 0x0, 0x3e}, @map_val={0x18, 0x4, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @map_fd, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_fd={0x18, 0x6, 0x1, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='syzkaller\x00', 0x8, 0x46, &(0x7f0000000080)=""/70, 0x41000, 0x4, '\x00', r1, @xdp=0x25, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000200)={0x2, 0xd, 0x3, 0x8}, 0x10, 0x0, 0xffffffffffffffff, 0x9, 0x0, &(0x7f00000002c0)=[{0x2, 0x3, 0x9, 0x8}, {0x3, 0x1, 0x3, 0x8}, {0x2, 0x1, 0xc, 0x5}, {0x1, 0x4, 0x7, 0x3}, {0x3, 0x1, 0xe, 0x7}, {0x2, 0x1, 0x7, 0x4}, {0x3, 0x1, 0x4, 0x6}, {0x3, 0x2, 0x3}, {0x5, 0x2, 0xe, 0x8}], 0x10, 0x7}, 0x94)
r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="b400000000000000791090000000000063000000000000009500000000000000cb5239a01b5b902367fd5ec1a64e367acb74c7e00c2f2bd72b3a0be2ea96caa37fb3469e8505342e47fc8929a6a015"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x22, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r4}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)="fd", 0x0}, 0x50)
bind$unix(r3, &(0x7f0000000900)=@abs={0x1, 0x0, 0x4e23}, 0x6e)
r6 = syz_genetlink_get_family_id$SEG6(&(0x7f00000007c0), r3)
sendmsg$SEG6_CMD_GET_TUNSRC(r3, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x58, r6, 0x705644287de68131, 0x70bd28, 0x25dfdbff, {}, [@SEG6_ATTR_DST={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x5, 0x6, 0x1ff, 0x3, 0x3]}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x9}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x7, 0x2, 0x8]}]}, 0x58}}, 0x11)
getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000680)={<r7=>0x0, 0x6}, &(0x7f00000006c0)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000700)={r7, 0x8, 0x30, 0xfffffffffffffffa, 0x58ec}, &(0x7f0000000740)=0x18)
sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x40, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r1, 0x800, 0x55007}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @remote}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) (async)
socket$nl_route(0x10, 0x3, 0x0) (async)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) (async)
ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000180)={0x0, 0x2, 0x8, 0xe7}) (async)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0) (async)
ioctl$SIOCRSSL2CALL(r3, 0x89e2, &(0x7f0000000240)=@bcast) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x1d, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x6}, {}, {}, [@alu={0x7, 0x0, 0x2, 0x0, 0x7, 0x30, 0x1}, @call={0x85, 0x0, 0x0, 0x3e}, @map_val={0x18, 0x4, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @map_fd, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_fd={0x18, 0x6, 0x1, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='syzkaller\x00', 0x8, 0x46, &(0x7f0000000080)=""/70, 0x41000, 0x4, '\x00', r1, @xdp=0x25, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000200)={0x2, 0xd, 0x3, 0x8}, 0x10, 0x0, 0xffffffffffffffff, 0x9, 0x0, &(0x7f00000002c0)=[{0x2, 0x3, 0x9, 0x8}, {0x3, 0x1, 0x3, 0x8}, {0x2, 0x1, 0xc, 0x5}, {0x1, 0x4, 0x7, 0x3}, {0x3, 0x1, 0xe, 0x7}, {0x2, 0x1, 0x7, 0x4}, {0x3, 0x1, 0x4, 0x6}, {0x3, 0x2, 0x3}, {0x5, 0x2, 0xe, 0x8}], 0x10, 0x7}, 0x94) (async)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="b400000000000000791090000000000063000000000000009500000000000000cb5239a01b5b902367fd5ec1a64e367acb74c7e00c2f2bd72b3a0be2ea96caa37fb3469e8505342e47fc8929a6a015"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x22, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r4}, 0x94) (async)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)="fd", 0x0}, 0x50) (async)
bind$unix(r3, &(0x7f0000000900)=@abs={0x1, 0x0, 0x4e23}, 0x6e) (async)
syz_genetlink_get_family_id$SEG6(&(0x7f00000007c0), r3) (async)
sendmsg$SEG6_CMD_GET_TUNSRC(r3, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x58, r6, 0x705644287de68131, 0x70bd28, 0x25dfdbff, {}, [@SEG6_ATTR_DST={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x5, 0x6, 0x1ff, 0x3, 0x3]}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x9}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x7, 0x2, 0x8]}]}, 0x58}}, 0x11) (async)
getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000680)={0x0, 0x6}, &(0x7f00000006c0)=0x8) (async)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000700)={r7, 0x8, 0x30, 0xfffffffffffffffa, 0x58ec}, &(0x7f0000000740)=0x18) (async)
sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x40, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r1, 0x800, 0x55007}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @remote}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async)

0s ago: executing program 2 (id=2022):
r0 = socket$inet(0x2, 0x3, 0x2)
setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000540)={'filter\x00', 0x7, 0x4, 0x408, 0x210, 0x0, 0x0, 0x320, 0x320, 0x320, 0x4, 0x0, {[{{@arp={@empty, @dev={0xac, 0x14, 0x14, 0x31}, 0xff000000, 0xffffffff, 0x7, 0x9, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0xff, 0x6b88d4ec8dad2b11, 0x0, 0xff, 0x0, 0xff]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}, {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}, 0x100, 0x34da, 0x8, 0x6, 0xa4, 0x401, 'gre0\x00', 'hsr0\x00', {}, {0xff}, 0x0, 0x80}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}, @empty, @empty, @remote, 0x9, 0xffffffff}}}, {{@arp={@empty, @local, 0xffffff00, 0xff000000, 0x7, 0x2, {@empty, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x10, 0x5, 0x8, 0x200, 0x1, 0x1, 'virt_wifi0\x00', 'team0\x00', {}, {}, 0x0, 0x1}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "711e379779394213806194c4cfa86944c5f735162dff836faaa40a29acdf"}}, {{@arp={@remote, @multicast2, 0xffffffff, 0x0, 0xa, 0xa, {@mac=@broadcast, {[0x0, 0x0, 0xff]}}, {@empty, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x9, 0xc, 0x995, 0x800, 0x1, 0x9, 'pimreg0\x00', 'erspan0\x00', {}, {}, 0x0, 0x40}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}, @rand_addr=0x64010101, @empty, 0x4, 0xffffffff}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x458)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000280)=0x14)
r2 = socket(0x2a, 0x2, 0x0)
getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1a3, 0x655c, 0x4, 0x40, 0x7fffffff, 0x7fffffff, 0x80, 0xffffffff, 0x1}}}}]}, 0x58}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0x8, 0x9}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x100}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4000)
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r6, {0x0, 0x5}, {0x8}, {0x7}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x14, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}]}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x4800)
r7 = socket(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', <r9=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r9, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}}, 0x44080)
sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x30, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r9, {}, {0x9, 0xa}, {0xa, 0x10}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x20048045}, 0x4000)
r10 = socket$nl_route(0x10, 0x3, 0x0)
r11 = socket$packet(0x11, 0x3, 0x300)
ioctl$ifreq_SIOCGIFINDEX_wireguard(r11, 0x8933, &(0x7f00000001c0)={'wg1\x00', <r12=>0x0})
sendmsg$nl_route(r10, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000002b00)=@newlink={0x44, 0x10, 0x1, 0x4, 0x0, {0x0, 0x0, 0x0, r12}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @remote}]}]}, @IFLA_MTU={0x8}]}, 0x44}}, 0x0)
r13 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000040)={'tunl0\x00', <r14=>0x0})
sendmsg$nl_route_sched(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r14, {}, {0xffff, 0xffff}, {0x1, 0x8}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0x9}, @TCA_FQ_RATE_ENABLE={0x8, 0x5, 0x1}]}}]}, 0x40}}, 0x0)
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000380)={'gretap0\x00', &(0x7f00000002c0)={'gre0\x00', 0x0, 0x700, 0x10, 0x7f, 0x5, {{0x19, 0x4, 0x2, 0x2, 0x64, 0x65, 0x0, 0xdd, 0x4, 0x0, @loopback, @rand_addr=0x64010102, {[@rr={0x7, 0x1b, 0x6b, [@empty, @multicast1, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @private=0xa010101]}, @noop, @timestamp_prespec={0x44, 0x34, 0xc4, 0x3, 0x1, [{@dev={0xac, 0x14, 0x14, 0x20}, 0x7}, {@empty, 0xc87d}, {@local}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x5}, {@broadcast, 0xf9f}, {@private=0xa010100, 0x80}]}]}}}}})
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000400)={'syztnl1\x00', &(0x7f00000003c0)={'syztnl1\x00', <r15=>0x0, 0x40, 0x7, 0x4, 0x0, {{0x7, 0x4, 0x3, 0x4, 0x1c, 0x65, 0x0, 0xca, 0x29, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x13}, {[@ra={0x94, 0x4}, @end]}}}}})
r16 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r16, 0x8933, &(0x7f0000000080)={'bridge0\x00', <r17=>0x0})
sendmsg$nl_route(r16, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0xbf4}, [@IFLA_MASTER={0x8, 0xa, r17}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000020}, 0x0)
sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000440)={&(0x7f00000009c0)={0x378, 0x0, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@HEADER={0x88, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}]}, @HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x90, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0xffffffffffffff11, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4eb6b51718fd6c61}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}]}, @HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}, @ETHTOOL_A_HEADER_FLAGS={0x0, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r17}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x378}}, 0x0)

kernel console output (not intermixed with test programs):

an invalid length.
[  160.453451][T10739] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1688'.
[  160.529824][ T5828] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  160.537342][T10742] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1690'.
[  160.537670][ T5828] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  160.547803][ T5828] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  160.551932][ T5828] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  160.559182][ T5828] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  160.572146][T10742] IPv6: sit1: Disabled Multicast RS
[  160.579928][T10746] IPVS: Unknown mcast interface: pim6reg
[  160.595468][T10742] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1690'.
[  160.616408][T10746] batadv0: entered promiscuous mode
[  160.618337][T10746] macsec2: entered promiscuous mode
[  160.781526][T10758] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  160.790314][T10758] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  160.795819][T10758] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  160.804602][T10754] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  160.807689][T10754] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  160.846377][T10743] chnl_net:caif_netlink_parms(): no params data found
[  161.195355][T10743] bridge0: port 1(bridge_slave_0) entered blocking state
[  161.197710][T10743] bridge0: port 1(bridge_slave_0) entered disabled state
[  161.200037][T10743] bridge_slave_0: entered allmulticast mode
[  161.217601][T10743] bridge_slave_0: entered promiscuous mode
[  161.222247][T10743] bridge0: port 2(bridge_slave_1) entered blocking state
[  161.227188][T10743] bridge0: port 2(bridge_slave_1) entered disabled state
[  161.230341][T10743] bridge_slave_1: entered allmulticast mode
[  161.234994][T10743] bridge_slave_1: entered promiscuous mode
[  161.298011][T10743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  161.322162][T10743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  161.373185][ T5848] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  161.442498][T10783] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  161.451612][T10743] team0: Port device team_slave_0 added
[  161.476380][ T5848] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  161.482738][T10743] team0: Port device team_slave_1 added
[  161.547810][T10743] batman_adv: batadv0: Adding interface: batadv_slave_0
[  161.550360][T10743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  161.560889][T10743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  161.578688][ T5848] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  161.591363][T10743] batman_adv: batadv0: Adding interface: batadv_slave_1
[  161.593876][T10743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  161.605704][T10743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  161.635916][T10792] Illegal XDP return value 4294967274 on prog  (id 375) dev N/A, expect packet loss!
[  161.661000][T10743] hsr_slave_0: entered promiscuous mode
[  161.663732][T10743] hsr_slave_1: entered promiscuous mode
[  161.667705][T10743] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  161.671312][T10743] Cannot create hsr debugfs directory
[  161.876956][ T5848] bridge_slave_1: left allmulticast mode
[  161.878879][ T5848] bridge_slave_1: left promiscuous mode
[  161.880810][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[  161.892405][ T5848] bridge_slave_0: left allmulticast mode
[  161.897924][ T5848] bridge_slave_0: left promiscuous mode
[  161.899786][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[  162.151769][ T5848] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  162.156632][ T5848] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  162.160173][ T5848] bond0 (unregistering): Released all slaves
[  162.244276][T10810] syzkaller0: entered promiscuous mode
[  162.246707][T10810] syzkaller0: entered allmulticast mode
[  162.294658][T10808] __nla_validate_parse: 2 callbacks suppressed
[  162.294670][T10808] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1713'.
[  162.325044][T10808] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1713'.
[  162.365713][T10808] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1713'.
[  162.385459][T10815] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1714'.
[  162.517281][ T5848] hsr_slave_0: left promiscuous mode
[  162.531006][ T5848] hsr_slave_1: left promiscuous mode
[  162.533076][ T5848] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  162.540053][ T5848] batman_adv: batadv0: Removing interface: batadv_slave_0
[  162.542817][ T5848] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  162.550793][ T5848] batman_adv: batadv0: Removing interface: batadv_slave_1
[  162.563388][ T5848] veth1_macvtap: left promiscuous mode
[  162.569201][ T5848] veth0_macvtap: left promiscuous mode
[  162.569299][T10825] netlink: 'syz.1.1717': attribute type 21 has an invalid length.
[  162.571441][ T5848] veth1_vlan: left promiscuous mode
[  162.578050][ T5848] veth0_vlan: left promiscuous mode
[  162.588957][T10825] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1717'.
[  162.607409][ T5822] Bluetooth: hci0: command tx timeout
[  162.962860][ T5848] team0 (unregistering): Port device team_slave_1 removed
[  162.990175][ T5848] team0 (unregistering): Port device team_slave_0 removed
[  163.475547][T10840] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  163.485408][T10840] CPU: 1 UID: 0 PID: 10840 Comm: syz.1.1721 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  163.485425][T10840] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  163.485431][T10840] Call Trace:
[  163.485435][T10840]  <TASK>
[  163.485440][T10840]  dump_stack_lvl+0x189/0x250
[  163.485461][T10840]  ? __pfx_dump_stack_lvl+0x10/0x10
[  163.485474][T10840]  ? __pfx__printk+0x10/0x10
[  163.485486][T10840]  ? kernfs_path_from_node+0x2c/0x260
[  163.485496][T10840]  ? kernfs_path_from_node+0x2c/0x260
[  163.485505][T10840]  ? kernfs_path_from_node+0x2c/0x260
[  163.485515][T10840]  ? kernfs_path_from_node+0x22c/0x260
[  163.485525][T10840]  ? kernfs_path_from_node+0x2c/0x260
[  163.485535][T10840]  sysfs_warn_dup+0x8e/0xa0
[  163.485546][T10840]  sysfs_do_create_link_sd+0xc0/0x110
[  163.485556][T10840]  device_add_class_symlinks+0x1cf/0x240
[  163.485566][T10840]  device_add+0x475/0xb50
[  163.485575][T10840]  wiphy_register+0x199a/0x26b0
[  163.485593][T10840]  ? __pfx_wiphy_register+0x10/0x10
[  163.485601][T10840]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  163.485612][T10840]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  163.485623][T10840]  ieee80211_register_hw+0x33e1/0x4120
[  163.485642][T10840]  ? ieee80211_register_hw+0x14b1/0x4120
[  163.485656][T10840]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  163.485669][T10840]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  163.485686][T10840]  ? __hrtimer_setup+0x187/0x210
[  163.485697][T10840]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  163.485707][T10840]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  163.485731][T10840]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  163.485742][T10840]  ? trace_kmalloc+0x1f/0xd0
[  163.485748][T10840]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  163.485755][T10840]  ? kstrndup+0xbf/0x160
[  163.485770][T10840]  hwsim_new_radio_nl+0xea4/0x1b10
[  163.485779][T10840]  ? __pfx___nla_validate_parse+0x10/0x10
[  163.485796][T10840]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  163.485805][T10840]  ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0
[  163.485819][T10840]  ? __nla_parse+0x40/0x60
[  163.485831][T10840]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  163.485845][T10840]  genl_family_rcv_msg_doit+0x215/0x300
[  163.485858][T10840]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  163.485874][T10840]  ? bpf_lsm_capable+0x9/0x20
[  163.485881][T10840]  ? security_capable+0x7e/0x2e0
[  163.485893][T10840]  genl_rcv_msg+0x60e/0x790
[  163.485906][T10840]  ? __pfx_genl_rcv_msg+0x10/0x10
[  163.485915][T10840]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  163.485929][T10840]  netlink_rcv_skb+0x208/0x470
[  163.485937][T10840]  ? __pfx_genl_rcv_msg+0x10/0x10
[  163.485948][T10840]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  163.485963][T10840]  ? down_read+0x1ad/0x2e0
[  163.485971][T10840]  genl_rcv+0x28/0x40
[  163.485981][T10840]  netlink_unicast+0x75b/0x8d0
[  163.485993][T10840]  netlink_sendmsg+0x805/0xb30
[  163.486005][T10840]  ? __pfx_netlink_sendmsg+0x10/0x10
[  163.486015][T10840]  ? aa_sock_msg_perm+0x94/0x160
[  163.486025][T10840]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  163.486034][T10840]  ? __pfx_netlink_sendmsg+0x10/0x10
[  163.486042][T10840]  __sock_sendmsg+0x21c/0x270
[  163.486055][T10840]  ____sys_sendmsg+0x505/0x830
[  163.486066][T10840]  ? __pfx_____sys_sendmsg+0x10/0x10
[  163.486079][T10840]  ? ___sys_sendmsg+0x1fb/0x2a0
[  163.486090][T10840]  ___sys_sendmsg+0x21f/0x2a0
[  163.486100][T10840]  ? __pfx____sys_sendmsg+0x10/0x10
[  163.486124][T10840]  ? __fget_files+0x2a/0x420
[  163.486132][T10840]  ? __fget_files+0x3a0/0x420
[  163.486145][T10840]  __x64_sys_sendmsg+0x19b/0x260
[  163.486155][T10840]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  163.486168][T10840]  ? rcu_is_watching+0x15/0xb0
[  163.486188][T10840]  ? do_syscall_64+0xbe/0x3b0
[  163.486197][T10840]  do_syscall_64+0xfa/0x3b0
[  163.486203][T10840]  ? lockdep_hardirqs_on+0x9c/0x150
[  163.486215][T10840]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  163.486252][T10840]  ? exc_page_fault+0x9f/0xf0
[  163.486264][T10840]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  163.486273][T10840] RIP: 0033:0x7fcb4c18e929
[  163.486282][T10840] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  163.486290][T10840] RSP: 002b:00007fcb49ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  163.486300][T10840] RAX: ffffffffffffffda RBX: 00007fcb4c3b5fa0 RCX: 00007fcb4c18e929
[  163.486307][T10840] RDX: 000000002000c800 RSI: 0000200000000040 RDI: 0000000000000004
[  163.486312][T10840] RBP: 00007fcb4c210b39 R08: 0000000000000000 R09: 0000000000000000
[  163.486318][T10840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  163.486323][T10840] R13: 0000000000000000 R14: 00007fcb4c3b5fa0 R15: 00007ffeb99c92c8
[  163.486336][T10840]  </TASK>
[  163.704738][T10743] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  163.728083][T10743] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  163.737402][T10743] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  163.782617][T10743] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  163.849084][T10857] netlink: 'syz.2.1726': attribute type 21 has an invalid length.
[  163.851729][T10857] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1726'.
[  164.029342][T10743] 8021q: adding VLAN 0 to HW filter on device bond0
[  164.089178][T10743] 8021q: adding VLAN 0 to HW filter on device team0
[  164.101542][ T8854] bridge0: port 1(bridge_slave_0) entered blocking state
[  164.104025][ T8854] bridge0: port 1(bridge_slave_0) entered forwarding state
[  164.141373][ T8854] bridge0: port 2(bridge_slave_1) entered blocking state
[  164.143705][ T8854] bridge0: port 2(bridge_slave_1) entered forwarding state
[  164.195445][T10876] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1734'.
[  164.199108][T10876] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1734'.
[  164.231437][T10881] netlink: 'syz.1.1735': attribute type 21 has an invalid length.
[  164.238456][T10881] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1735'.
[  164.377758][T10743] 8021q: adding VLAN 0 to HW filter on device batadv0
[  164.432738][T10743] veth0_vlan: entered promiscuous mode
[  164.447406][T10743] veth1_vlan: entered promiscuous mode
[  164.480906][T10743] veth0_macvtap: entered promiscuous mode
[  164.493262][T10743] veth1_macvtap: entered promiscuous mode
[  164.513024][T10743] batman_adv: batadv0: Interface activated: batadv_slave_0
[  164.540808][T10743] batman_adv: batadv0: Interface activated: batadv_slave_1
[  164.551169][T10892] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  164.553848][T10892] CPU: 0 UID: 0 PID: 10892 Comm: syz.1.1738 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  164.553862][T10892] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  164.553867][T10892] Call Trace:
[  164.553872][T10892]  <TASK>
[  164.553878][T10892]  dump_stack_lvl+0x189/0x250
[  164.553926][T10892]  ? __pfx_dump_stack_lvl+0x10/0x10
[  164.553950][T10892]  ? __pfx__printk+0x10/0x10
[  164.553968][T10892]  ? kernfs_path_from_node+0x2c/0x260
[  164.553986][T10892]  ? kernfs_path_from_node+0x2c/0x260
[  164.554001][T10892]  ? kernfs_path_from_node+0x2c/0x260
[  164.554014][T10892]  ? kernfs_path_from_node+0x22c/0x260
[  164.554022][T10892]  ? kernfs_path_from_node+0x2c/0x260
[  164.554031][T10892]  sysfs_warn_dup+0x8e/0xa0
[  164.554041][T10892]  sysfs_do_create_link_sd+0xc0/0x110
[  164.554050][T10892]  device_add_class_symlinks+0x1cf/0x240
[  164.554061][T10892]  device_add+0x475/0xb50
[  164.554070][T10892]  wiphy_register+0x199a/0x26b0
[  164.554087][T10892]  ? __pfx_wiphy_register+0x10/0x10
[  164.554096][T10892]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  164.554109][T10892]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  164.554121][T10892]  ieee80211_register_hw+0x33e1/0x4120
[  164.554141][T10892]  ? ieee80211_register_hw+0x14b1/0x4120
[  164.554155][T10892]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  164.554168][T10892]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  164.554185][T10892]  ? __hrtimer_setup+0x187/0x210
[  164.554197][T10892]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  164.554207][T10892]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  164.554260][T10892]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  164.554274][T10892]  ? trace_kmalloc+0x1f/0xd0
[  164.554281][T10892]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  164.554290][T10892]  ? kstrndup+0xbf/0x160
[  164.554306][T10892]  hwsim_new_radio_nl+0xea4/0x1b10
[  164.554316][T10892]  ? __pfx___nla_validate_parse+0x10/0x10
[  164.554337][T10892]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  164.554351][T10892]  ? __nla_parse+0x40/0x60
[  164.554365][T10892]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  164.554383][T10892]  genl_family_rcv_msg_doit+0x215/0x300
[  164.554397][T10892]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  164.554413][T10892]  ? bpf_lsm_capable+0x9/0x20
[  164.554422][T10892]  ? security_capable+0x7e/0x2e0
[  164.554435][T10892]  genl_rcv_msg+0x60e/0x790
[  164.554450][T10892]  ? __pfx_genl_rcv_msg+0x10/0x10
[  164.554460][T10892]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  164.554473][T10892]  netlink_rcv_skb+0x208/0x470
[  164.554482][T10892]  ? __pfx_genl_rcv_msg+0x10/0x10
[  164.554493][T10892]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  164.554510][T10892]  ? down_read+0x1ad/0x2e0
[  164.554519][T10892]  genl_rcv+0x28/0x40
[  164.554529][T10892]  netlink_unicast+0x75b/0x8d0
[  164.554541][T10892]  netlink_sendmsg+0x805/0xb30
[  164.554554][T10892]  ? __pfx_netlink_sendmsg+0x10/0x10
[  164.554563][T10892]  ? aa_sock_msg_perm+0x94/0x160
[  164.554574][T10892]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  164.554584][T10892]  ? __pfx_netlink_sendmsg+0x10/0x10
[  164.554592][T10892]  __sock_sendmsg+0x21c/0x270
[  164.554605][T10892]  ____sys_sendmsg+0x505/0x830
[  164.554617][T10892]  ? __pfx_____sys_sendmsg+0x10/0x10
[  164.554629][T10892]  ? import_iovec+0x74/0xa0
[  164.554639][T10892]  ___sys_sendmsg+0x21f/0x2a0
[  164.554649][T10892]  ? __pfx____sys_sendmsg+0x10/0x10
[  164.554673][T10892]  ? __fget_files+0x2a/0x420
[  164.554682][T10892]  ? __fget_files+0x3a0/0x420
[  164.554694][T10892]  __x64_sys_sendmsg+0x19b/0x260
[  164.554704][T10892]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  164.554718][T10892]  ? rcu_is_watching+0x15/0xb0
[  164.554731][T10892]  ? do_syscall_64+0xbe/0x3b0
[  164.554740][T10892]  do_syscall_64+0xfa/0x3b0
[  164.554745][T10892]  ? lockdep_hardirqs_on+0x9c/0x150
[  164.554755][T10892]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  164.554763][T10892]  ? exc_page_fault+0x9f/0xf0
[  164.554774][T10892]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  164.554781][T10892] RIP: 0033:0x7fcb4c18e929
[  164.554790][T10892] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  164.554797][T10892] RSP: 002b:00007fcb49ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  164.554806][T10892] RAX: ffffffffffffffda RBX: 00007fcb4c3b5fa0 RCX: 00007fcb4c18e929
[  164.554811][T10892] RDX: 000000002000c800 RSI: 0000200000000040 RDI: 0000000000000004
[  164.554816][T10892] RBP: 00007fcb4c210b39 R08: 0000000000000000 R09: 0000000000000000
[  164.554821][T10892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  164.554825][T10892] R13: 0000000000000000 R14: 00007fcb4c3b5fa0 R15: 00007ffeb99c92c8
[  164.554837][T10892]  </TASK>
[  164.684012][ T5822] Bluetooth: hci0: command tx timeout
[  164.713757][T10743] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  164.718247][T10743] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  164.721209][T10743] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  164.724357][T10743] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  164.786205][ T8864] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  164.789240][ T8864] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  164.791704][ T8864] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  164.794360][ T8864] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  165.316276][T10911] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  165.318848][T10911] CPU: 1 UID: 0 PID: 10911 Comm: syz.2.1745 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  165.318859][T10911] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  165.318865][T10911] Call Trace:
[  165.318869][T10911]  <TASK>
[  165.318872][T10911]  dump_stack_lvl+0x189/0x250
[  165.318891][T10911]  ? __pfx_dump_stack_lvl+0x10/0x10
[  165.318903][T10911]  ? __pfx__printk+0x10/0x10
[  165.318913][T10911]  ? kernfs_path_from_node+0x2c/0x260
[  165.318924][T10911]  ? kernfs_path_from_node+0x2c/0x260
[  165.318932][T10911]  ? kernfs_path_from_node+0x2c/0x260
[  165.318941][T10911]  ? kernfs_path_from_node+0x22c/0x260
[  165.318949][T10911]  ? kernfs_path_from_node+0x2c/0x260
[  165.318960][T10911]  sysfs_warn_dup+0x8e/0xa0
[  165.318969][T10911]  sysfs_do_create_link_sd+0xc0/0x110
[  165.318980][T10911]  device_add_class_symlinks+0x1cf/0x240
[  165.318990][T10911]  device_add+0x475/0xb50
[  165.318999][T10911]  wiphy_register+0x199a/0x26b0
[  165.319016][T10911]  ? __pfx_wiphy_register+0x10/0x10
[  165.319024][T10911]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  165.319038][T10911]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  165.319048][T10911]  ieee80211_register_hw+0x33e1/0x4120
[  165.319065][T10911]  ? ieee80211_register_hw+0x14b1/0x4120
[  165.319078][T10911]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  165.319090][T10911]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  165.319105][T10911]  ? __hrtimer_setup+0x187/0x210
[  165.319117][T10911]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  165.319127][T10911]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  165.319152][T10911]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  165.319162][T10911]  ? trace_kmalloc+0x1f/0xd0
[  165.319168][T10911]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  165.319181][T10911]  ? kstrndup+0xbf/0x160
[  165.319194][T10911]  hwsim_new_radio_nl+0xea4/0x1b10
[  165.319202][T10911]  ? __pfx___nla_validate_parse+0x10/0x10
[  165.319240][T10911]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  165.319254][T10911]  ? __nla_parse+0x40/0x60
[  165.319266][T10911]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  165.319280][T10911]  genl_family_rcv_msg_doit+0x215/0x300
[  165.319295][T10911]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  165.319312][T10911]  ? bpf_lsm_capable+0x9/0x20
[  165.319320][T10911]  ? security_capable+0x7e/0x2e0
[  165.319333][T10911]  genl_rcv_msg+0x60e/0x790
[  165.319346][T10911]  ? __pfx_genl_rcv_msg+0x10/0x10
[  165.319357][T10911]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  165.319371][T10911]  netlink_rcv_skb+0x208/0x470
[  165.319380][T10911]  ? __pfx_genl_rcv_msg+0x10/0x10
[  165.319391][T10911]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  165.319406][T10911]  ? down_read+0x1ad/0x2e0
[  165.319414][T10911]  genl_rcv+0x28/0x40
[  165.319423][T10911]  netlink_unicast+0x75b/0x8d0
[  165.319434][T10911]  netlink_sendmsg+0x805/0xb30
[  165.319447][T10911]  ? __pfx_netlink_sendmsg+0x10/0x10
[  165.319456][T10911]  ? aa_sock_msg_perm+0x94/0x160
[  165.319466][T10911]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  165.319475][T10911]  ? __pfx_netlink_sendmsg+0x10/0x10
[  165.319484][T10911]  __sock_sendmsg+0x21c/0x270
[  165.319496][T10911]  ____sys_sendmsg+0x505/0x830
[  165.319507][T10911]  ? __pfx_____sys_sendmsg+0x10/0x10
[  165.319519][T10911]  ? import_iovec+0x74/0xa0
[  165.319528][T10911]  ___sys_sendmsg+0x21f/0x2a0
[  165.319538][T10911]  ? __pfx____sys_sendmsg+0x10/0x10
[  165.319562][T10911]  ? __fget_files+0x2a/0x420
[  165.319570][T10911]  ? __fget_files+0x3a0/0x420
[  165.319582][T10911]  __x64_sys_sendmsg+0x19b/0x260
[  165.319592][T10911]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  165.319605][T10911]  ? rcu_is_watching+0x15/0xb0
[  165.319618][T10911]  ? do_syscall_64+0xbe/0x3b0
[  165.319627][T10911]  do_syscall_64+0xfa/0x3b0
[  165.319632][T10911]  ? lockdep_hardirqs_on+0x9c/0x150
[  165.319643][T10911]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  165.319650][T10911]  ? exc_page_fault+0x9f/0xf0
[  165.319661][T10911]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  165.319668][T10911] RIP: 0033:0x7f32f978e929
[  165.319676][T10911] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  165.319683][T10911] RSP: 002b:00007f32fa673038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  165.319692][T10911] RAX: ffffffffffffffda RBX: 00007f32f99b5fa0 RCX: 00007f32f978e929
[  165.319697][T10911] RDX: 000000002000c800 RSI: 0000200000000040 RDI: 0000000000000004
[  165.319702][T10911] RBP: 00007f32f9810b39 R08: 0000000000000000 R09: 0000000000000000
[  165.319706][T10911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  165.319711][T10911] R13: 0000000000000000 R14: 00007f32f99b5fa0 R15: 00007fff5a432648
[  165.319722][T10911]  </TASK>
[  165.365573][T10915] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1747'.
[  166.061012][T10951] net_ratelimit: 6 callbacks suppressed
[  166.061024][T10951] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  166.084150][T10951] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  166.087393][T10951] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  166.101282][T10950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  166.108417][T10950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  166.269085][T10959] xt_connbytes: Forcing CT accounting to be enabled
[  166.271409][T10959] x_tables: ip6_tables: SNPT target: used from hooks OUTPUT, but only usable from INPUT/POSTROUTING
[  166.633789][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  167.314689][T10994] __nla_validate_parse: 4 callbacks suppressed
[  167.314708][T10994] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1779'.
[  167.356715][T10994] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1779'.
[  167.444771][T10998] xt_TPROXY: Can be used only with -p tcp or -p udp
[  167.456734][ T5828] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  167.460800][ T5828] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  167.463613][ T5828] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  167.468080][ T5828] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  167.470683][ T5828] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  167.577407][T11010] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  167.579880][T11010] CPU: 0 UID: 0 PID: 11010 Comm: syz.2.1784 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  167.579891][T11010] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  167.579897][T11010] Call Trace:
[  167.579901][T11010]  <TASK>
[  167.579905][T11010]  dump_stack_lvl+0x189/0x250
[  167.579924][T11010]  ? __pfx_dump_stack_lvl+0x10/0x10
[  167.579937][T11010]  ? __pfx__printk+0x10/0x10
[  167.579946][T11010]  ? kernfs_path_from_node+0x2c/0x260
[  167.579957][T11010]  ? kernfs_path_from_node+0x2c/0x260
[  167.579965][T11010]  ? kernfs_path_from_node+0x2c/0x260
[  167.579975][T11010]  ? kernfs_path_from_node+0x22c/0x260
[  167.579984][T11010]  ? kernfs_path_from_node+0x2c/0x260
[  167.579993][T11010]  sysfs_warn_dup+0x8e/0xa0
[  167.580002][T11010]  sysfs_do_create_link_sd+0xc0/0x110
[  167.580011][T11010]  device_add_class_symlinks+0x1cf/0x240
[  167.580022][T11010]  device_add+0x475/0xb50
[  167.580032][T11010]  wiphy_register+0x199a/0x26b0
[  167.580049][T11010]  ? __pfx_wiphy_register+0x10/0x10
[  167.580057][T11010]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  167.580069][T11010]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  167.580080][T11010]  ieee80211_register_hw+0x33e1/0x4120
[  167.580097][T11010]  ? ieee80211_register_hw+0x14b1/0x4120
[  167.580110][T11010]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  167.580123][T11010]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  167.580137][T11010]  ? __hrtimer_setup+0x187/0x210
[  167.580148][T11010]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  167.580159][T11010]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  167.580182][T11010]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  167.580192][T11010]  ? trace_kmalloc+0x1f/0xd0
[  167.580198][T11010]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  167.580206][T11010]  ? kstrndup+0xbf/0x160
[  167.580243][T11010]  hwsim_new_radio_nl+0xea4/0x1b10
[  167.580254][T11010]  ? __pfx___nla_validate_parse+0x10/0x10
[  167.580271][T11010]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  167.580285][T11010]  ? __nla_parse+0x40/0x60
[  167.580298][T11010]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  167.580313][T11010]  genl_family_rcv_msg_doit+0x215/0x300
[  167.580327][T11010]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  167.580344][T11010]  ? bpf_lsm_capable+0x9/0x20
[  167.580351][T11010]  ? security_capable+0x7e/0x2e0
[  167.580363][T11010]  genl_rcv_msg+0x60e/0x790
[  167.580376][T11010]  ? __pfx_genl_rcv_msg+0x10/0x10
[  167.580385][T11010]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  167.580398][T11010]  netlink_rcv_skb+0x208/0x470
[  167.580407][T11010]  ? __pfx_genl_rcv_msg+0x10/0x10
[  167.580417][T11010]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  167.580432][T11010]  ? down_read+0x1ad/0x2e0
[  167.580440][T11010]  genl_rcv+0x28/0x40
[  167.580449][T11010]  netlink_unicast+0x75b/0x8d0
[  167.580461][T11010]  netlink_sendmsg+0x805/0xb30
[  167.580473][T11010]  ? __pfx_netlink_sendmsg+0x10/0x10
[  167.580483][T11010]  ? aa_sock_msg_perm+0x94/0x160
[  167.580493][T11010]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  167.580502][T11010]  ? __pfx_netlink_sendmsg+0x10/0x10
[  167.580510][T11010]  __sock_sendmsg+0x21c/0x270
[  167.580522][T11010]  ____sys_sendmsg+0x505/0x830
[  167.580534][T11010]  ? __pfx_____sys_sendmsg+0x10/0x10
[  167.580546][T11010]  ? import_iovec+0x74/0xa0
[  167.580555][T11010]  ___sys_sendmsg+0x21f/0x2a0
[  167.580565][T11010]  ? __pfx____sys_sendmsg+0x10/0x10
[  167.580589][T11010]  ? __fget_files+0x2a/0x420
[  167.580596][T11010]  ? __fget_files+0x3a0/0x420
[  167.580608][T11010]  __x64_sys_sendmsg+0x19b/0x260
[  167.580619][T11010]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  167.580632][T11010]  ? rcu_is_watching+0x15/0xb0
[  167.580645][T11010]  ? do_syscall_64+0xbe/0x3b0
[  167.580654][T11010]  do_syscall_64+0xfa/0x3b0
[  167.580659][T11010]  ? lockdep_hardirqs_on+0x9c/0x150
[  167.580669][T11010]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  167.580677][T11010]  ? exc_page_fault+0x9f/0xf0
[  167.580688][T11010]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  167.580695][T11010] RIP: 0033:0x7f32f978e929
[  167.580703][T11010] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  167.580710][T11010] RSP: 002b:00007f32fa673038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  167.580719][T11010] RAX: ffffffffffffffda RBX: 00007f32f99b5fa0 RCX: 00007f32f978e929
[  167.580725][T11010] RDX: 000000002000c800 RSI: 0000200000000040 RDI: 0000000000000004
[  167.580729][T11010] RBP: 00007f32f9810b39 R08: 0000000000000000 R09: 0000000000000000
[  167.580734][T11010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  167.580738][T11010] R13: 0000000000000000 R14: 00007f32f99b5fa0 R15: 00007fff5a432648
[  167.580750][T11010]  </TASK>
[  167.593790][T11013] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1785'.
[  167.654315][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  167.715929][T11013] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1785'.
[  167.718114][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  167.756965][T11013] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1785'.
[  167.761290][T11013] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1785'.
[  167.787687][T11001] chnl_net:caif_netlink_parms(): no params data found
[  167.975293][T11001] bridge0: port 1(bridge_slave_0) entered blocking state
[  167.982109][T11001] bridge0: port 1(bridge_slave_0) entered disabled state
[  167.987404][T11001] bridge_slave_0: entered allmulticast mode
[  167.990708][T11001] bridge_slave_0: entered promiscuous mode
[  167.998149][T11001] bridge0: port 2(bridge_slave_1) entered blocking state
[  168.000409][T11001] bridge0: port 2(bridge_slave_1) entered disabled state
[  168.002646][T11001] bridge_slave_1: entered allmulticast mode
[  168.032832][T11001] bridge_slave_1: entered promiscuous mode
[  168.044763][T11036] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1792'.
[  168.067924][T11036] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1792'.
[  168.111046][T11001] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  168.126668][T11001] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  168.171438][T11001] team0: Port device team_slave_0 added
[  168.189834][T11001] team0: Port device team_slave_1 added
[  168.273846][T11048] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1796'.
[  168.303154][T11001] batman_adv: batadv0: Adding interface: batadv_slave_0
[  168.306204][T11001] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  168.323178][T11001] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  168.330729][T11001] batman_adv: batadv0: Adding interface: batadv_slave_1
[  168.332999][T11001] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  168.341675][T11001] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  168.387667][T11052] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  168.391215][T11052] CPU: 1 UID: 0 PID: 11052 Comm: syz.2.1798 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  168.391255][T11052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  168.391262][T11052] Call Trace:
[  168.391270][T11052]  <TASK>
[  168.391276][T11052]  dump_stack_lvl+0x189/0x250
[  168.391302][T11052]  ? __pfx_dump_stack_lvl+0x10/0x10
[  168.391318][T11052]  ? __pfx__printk+0x10/0x10
[  168.391336][T11052]  ? kernfs_path_from_node+0x2c/0x260
[  168.391348][T11052]  ? kernfs_path_from_node+0x2c/0x260
[  168.391358][T11052]  ? kernfs_path_from_node+0x2c/0x260
[  168.391370][T11052]  ? kernfs_path_from_node+0x22c/0x260
[  168.391380][T11052]  ? kernfs_path_from_node+0x2c/0x260
[  168.391393][T11052]  sysfs_warn_dup+0x8e/0xa0
[  168.391405][T11052]  sysfs_do_create_link_sd+0xc0/0x110
[  168.391418][T11052]  device_add_class_symlinks+0x1cf/0x240
[  168.391433][T11052]  device_add+0x475/0xb50
[  168.391448][T11052]  wiphy_register+0x199a/0x26b0
[  168.391472][T11052]  ? __pfx_wiphy_register+0x10/0x10
[  168.391483][T11052]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  168.391501][T11052]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  168.391518][T11052]  ieee80211_register_hw+0x33e1/0x4120
[  168.391545][T11052]  ? ieee80211_register_hw+0x14b1/0x4120
[  168.391563][T11052]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  168.391578][T11052]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  168.391596][T11052]  ? __hrtimer_setup+0x187/0x210
[  168.391610][T11052]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  168.391625][T11052]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  168.391658][T11052]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  168.391673][T11052]  ? trace_kmalloc+0x1f/0xd0
[  168.391682][T11052]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  168.391691][T11052]  ? kstrndup+0xbf/0x160
[  168.391709][T11052]  hwsim_new_radio_nl+0xea4/0x1b10
[  168.391721][T11052]  ? __pfx___nla_validate_parse+0x10/0x10
[  168.391744][T11052]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  168.391761][T11052]  ? __nla_parse+0x40/0x60
[  168.391776][T11052]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  168.391796][T11052]  genl_family_rcv_msg_doit+0x215/0x300
[  168.391815][T11052]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  168.391837][T11052]  ? bpf_lsm_capable+0x9/0x20
[  168.391846][T11052]  ? security_capable+0x7e/0x2e0
[  168.391862][T11052]  genl_rcv_msg+0x60e/0x790
[  168.391880][T11052]  ? __pfx_genl_rcv_msg+0x10/0x10
[  168.391892][T11052]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  168.391909][T11052]  netlink_rcv_skb+0x208/0x470
[  168.391921][T11052]  ? __pfx_genl_rcv_msg+0x10/0x10
[  168.391935][T11052]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  168.391956][T11052]  ? down_read+0x1ad/0x2e0
[  168.391967][T11052]  genl_rcv+0x28/0x40
[  168.391979][T11052]  netlink_unicast+0x75b/0x8d0
[  168.391996][T11052]  netlink_sendmsg+0x805/0xb30
[  168.392012][T11052]  ? __pfx_netlink_sendmsg+0x10/0x10
[  168.392026][T11052]  ? aa_sock_msg_perm+0x94/0x160
[  168.392043][T11052]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  168.392055][T11052]  ? __pfx_netlink_sendmsg+0x10/0x10
[  168.392067][T11052]  __sock_sendmsg+0x21c/0x270
[  168.392086][T11052]  ____sys_sendmsg+0x505/0x830
[  168.392101][T11052]  ? __pfx_____sys_sendmsg+0x10/0x10
[  168.392118][T11052]  ? import_iovec+0x74/0xa0
[  168.392130][T11052]  ___sys_sendmsg+0x21f/0x2a0
[  168.392143][T11052]  ? __pfx____sys_sendmsg+0x10/0x10
[  168.392188][T11052]  ? __fget_files+0x2a/0x420
[  168.392200][T11052]  ? __fget_files+0x3a0/0x420
[  168.392250][T11052]  __x64_sys_sendmsg+0x19b/0x260
[  168.392268][T11052]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  168.392293][T11052]  ? do_syscall_64+0xbe/0x3b0
[  168.392307][T11052]  do_syscall_64+0xfa/0x3b0
[  168.392314][T11052]  ? lockdep_hardirqs_on+0x9c/0x150
[  168.392332][T11052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  168.392343][T11052]  ? exc_page_fault+0x9f/0xf0
[  168.392357][T11052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  168.392367][T11052] RIP: 0033:0x7f32f978e929
[  168.392379][T11052] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  168.392389][T11052] RSP: 002b:00007f32fa673038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  168.392402][T11052] RAX: ffffffffffffffda RBX: 00007f32f99b5fa0 RCX: 00007f32f978e929
[  168.392410][T11052] RDX: 000000002000c800 RSI: 0000200000000040 RDI: 0000000000000004
[  168.392416][T11052] RBP: 00007f32f9810b39 R08: 0000000000000000 R09: 0000000000000000
[  168.392421][T11052] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  168.392427][T11052] R13: 0000000000000000 R14: 00007f32f99b5fa0 R15: 00007fff5a432648
[  168.392445][T11052]  </TASK>
[  168.397958][T11001] hsr_slave_0: entered promiscuous mode
[  168.553359][T11001] hsr_slave_1: entered promiscuous mode
[  168.555952][T11001] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  168.558416][T11001] Cannot create hsr debugfs directory
[  168.577297][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  168.648544][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  168.724651][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  168.840116][   T13] bridge_slave_1: left allmulticast mode
[  168.841960][   T13] bridge_slave_1: left promiscuous mode
[  168.843822][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  168.861131][   T13] bridge_slave_0: left allmulticast mode
[  168.862942][   T13] bridge_slave_0: left promiscuous mode
[  168.869455][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  169.056349][T11074] netlink: 'syz.1.1806': attribute type 6 has an invalid length.
[  169.092387][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  169.097580][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  169.101385][   T13] bond0 (unregistering): Released all slaves
[  169.138913][T11071] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1806'.
[  169.484098][ T5828] Bluetooth: hci0: command tx timeout
[  169.517151][   T13] hsr_slave_0: left promiscuous mode
[  169.519407][   T13] hsr_slave_1: left promiscuous mode
[  169.521806][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  169.530292][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  169.533482][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  169.535984][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  169.548639][   T13] veth1_macvtap: left promiscuous mode
[  169.550768][   T13] veth0_macvtap: left promiscuous mode
[  169.552671][   T13] veth1_vlan: left promiscuous mode
[  169.555089][   T13] veth0_vlan: left promiscuous mode
[  169.830091][   T13] team0 (unregistering): Port device team_slave_1 removed
[  169.863026][   T13] team0 (unregistering): Port device team_slave_0 removed
[  170.227586][T11001] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  170.236768][T11001] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  170.241595][T11001] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  170.249373][T11001] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  170.397991][T11110] x_tables: duplicate underflow at hook 3
[  170.464430][T11001] 8021q: adding VLAN 0 to HW filter on device bond0
[  170.479789][T11001] 8021q: adding VLAN 0 to HW filter on device team0
[  170.518636][ T8854] bridge0: port 1(bridge_slave_0) entered blocking state
[  170.521063][ T8854] bridge0: port 1(bridge_slave_0) entered forwarding state
[  170.545047][ T8854] bridge0: port 2(bridge_slave_1) entered blocking state
[  170.547390][ T8854] bridge0: port 2(bridge_slave_1) entered forwarding state
[  170.777059][T11001] 8021q: adding VLAN 0 to HW filter on device batadv0
[  170.810305][T11093] netlink: zone id is out of range
[  170.812031][T11093] netlink: zone id is out of range
[  170.813725][T11093] netlink: zone id is out of range
[  170.844827][T11001] veth0_vlan: entered promiscuous mode
[  170.853135][T11001] veth1_vlan: entered promiscuous mode
[  170.885534][T11001] veth0_macvtap: entered promiscuous mode
[  170.899519][T11001] veth1_macvtap: entered promiscuous mode
[  170.919703][T11001] batman_adv: batadv0: Interface activated: batadv_slave_0
[  170.934486][T11001] batman_adv: batadv0: Interface activated: batadv_slave_1
[  170.952803][T11001] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  170.964449][T11001] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  170.975406][T11001] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  170.978331][T11001] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  171.183071][ T8865] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  171.188969][ T8865] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  171.236144][ T8854] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  171.239284][ T8854] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  171.248208][T11137] net_ratelimit: 11 callbacks suppressed
[  171.248245][T11137] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes.
[  171.258512][T11137] netlink: 'syz.2.1827': attribute type 1 has an invalid length.
[  172.398384][T11198] __nla_validate_parse: 9 callbacks suppressed
[  172.398397][T11198] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1849'.
[  172.504670][T11206] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1852'.
[  172.580584][T11216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1857'.
[  172.588259][T11216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1857'.
[  172.899795][ T5848] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  173.654147][T11233] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1863'.
[  173.686145][T11233] x_tables: duplicate underflow at hook 2
[  173.706180][T11233] netlink: 'syz.2.1863': attribute type 4 has an invalid length.
[  173.812510][T11238] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  173.831521][T11238] CPU: 0 UID: 0 PID: 11238 Comm: syz.2.1865 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  173.831547][T11238] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  173.831555][T11238] Call Trace:
[  173.831561][T11238]  <TASK>
[  173.831568][T11238]  dump_stack_lvl+0x189/0x250
[  173.831600][T11238]  ? __pfx_dump_stack_lvl+0x10/0x10
[  173.831619][T11238]  ? __pfx__printk+0x10/0x10
[  173.831635][T11238]  ? kernfs_path_from_node+0x2c/0x260
[  173.831651][T11238]  ? kernfs_path_from_node+0x2c/0x260
[  173.831664][T11238]  ? kernfs_path_from_node+0x2c/0x260
[  173.831680][T11238]  ? kernfs_path_from_node+0x22c/0x260
[  173.831692][T11238]  ? kernfs_path_from_node+0x2c/0x260
[  173.831708][T11238]  sysfs_warn_dup+0x8e/0xa0
[  173.831724][T11238]  sysfs_do_create_link_sd+0xc0/0x110
[  173.831740][T11238]  device_add_class_symlinks+0x1cf/0x240
[  173.831758][T11238]  device_add+0x475/0xb50
[  173.831775][T11238]  wiphy_register+0x199a/0x26b0
[  173.831802][T11238]  ? __pfx_wiphy_register+0x10/0x10
[  173.831815][T11238]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  173.831836][T11238]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  173.831856][T11238]  ieee80211_register_hw+0x33e1/0x4120
[  173.831886][T11238]  ? ieee80211_register_hw+0x14b1/0x4120
[  173.831908][T11238]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  173.831928][T11238]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  173.831952][T11238]  ? __hrtimer_setup+0x187/0x210
[  173.831970][T11238]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  173.831989][T11238]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  173.832034][T11238]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  173.832053][T11238]  ? trace_kmalloc+0x1f/0xd0
[  173.832064][T11238]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  173.832078][T11238]  ? kstrndup+0xbf/0x160
[  173.832103][T11238]  hwsim_new_radio_nl+0xea4/0x1b10
[  173.832119][T11238]  ? __pfx___nla_validate_parse+0x10/0x10
[  173.832146][T11238]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  173.832170][T11238]  ? __nla_parse+0x40/0x60
[  173.832190][T11238]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  173.832253][T11238]  genl_family_rcv_msg_doit+0x215/0x300
[  173.832280][T11238]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  173.832310][T11238]  ? bpf_lsm_capable+0x9/0x20
[  173.832322][T11238]  ? security_capable+0x7e/0x2e0
[  173.832343][T11238]  genl_rcv_msg+0x60e/0x790
[  173.832365][T11238]  ? __pfx_genl_rcv_msg+0x10/0x10
[  173.832381][T11238]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  173.832406][T11238]  netlink_rcv_skb+0x208/0x470
[  173.832421][T11238]  ? __pfx_genl_rcv_msg+0x10/0x10
[  173.832439][T11238]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  173.832466][T11238]  ? down_read+0x1ad/0x2e0
[  173.832481][T11238]  genl_rcv+0x28/0x40
[  173.832496][T11238]  netlink_unicast+0x75b/0x8d0
[  173.832518][T11238]  netlink_sendmsg+0x805/0xb30
[  173.832541][T11238]  ? __pfx_netlink_sendmsg+0x10/0x10
[  173.832558][T11238]  ? aa_sock_msg_perm+0x94/0x160
[  173.832575][T11238]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  173.832590][T11238]  ? __pfx_netlink_sendmsg+0x10/0x10
[  173.832605][T11238]  __sock_sendmsg+0x21c/0x270
[  173.832628][T11238]  ____sys_sendmsg+0x505/0x830
[  173.832648][T11238]  ? __pfx_____sys_sendmsg+0x10/0x10
[  173.832670][T11238]  ? import_iovec+0x74/0xa0
[  173.832686][T11238]  ___sys_sendmsg+0x21f/0x2a0
[  173.832701][T11238]  ? __pfx____sys_sendmsg+0x10/0x10
[  173.832745][T11238]  ? __fget_files+0x2a/0x420
[  173.832759][T11238]  ? __fget_files+0x3a0/0x420
[  173.832780][T11238]  __x64_sys_sendmsg+0x19b/0x260
[  173.832797][T11238]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  173.832821][T11238]  ? rcu_is_watching+0x15/0xb0
[  173.832842][T11238]  ? do_syscall_64+0xbe/0x3b0
[  173.832858][T11238]  do_syscall_64+0xfa/0x3b0
[  173.832868][T11238]  ? lockdep_hardirqs_on+0x9c/0x150
[  173.832883][T11238]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  173.832895][T11238]  ? exc_page_fault+0x9f/0xf0
[  173.832914][T11238]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  173.832927][T11238] RIP: 0033:0x7f32f978e929
[  173.832942][T11238] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  173.832953][T11238] RSP: 002b:00007f32fa673038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  173.832968][T11238] RAX: ffffffffffffffda RBX: 00007f32f99b5fa0 RCX: 00007f32f978e929
[  173.832978][T11238] RDX: 000000002000c800 RSI: 0000200000000040 RDI: 0000000000000004
[  173.832987][T11238] RBP: 00007f32f9810b39 R08: 0000000000000000 R09: 0000000000000000
[  173.832994][T11238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  173.833002][T11238] R13: 0000000000000000 R14: 00007f32f99b5fa0 R15: 00007fff5a432648
[  173.833025][T11238]  </TASK>
[  174.128756][ T5822] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  174.136596][ T5822] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  174.140775][ T5822] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  174.177110][ T5822] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  174.180795][ T5822] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  174.189605][T11249] openvswitch: netlink: IPv4 tun info is not correct
[  174.262038][T11252] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies.
[  174.295098][T11255] netlink: 'syz.2.1871': attribute type 3 has an invalid length.
[  174.301177][T11255] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1871'.
[  174.424121][T11264] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1874'.
[  174.439833][T11264] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1874'.
[  174.444492][T11264] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1874'.
[  174.495954][ T5848] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  174.517985][T11243] chnl_net:caif_netlink_parms(): no params data found
[  174.679280][T11243] bridge0: port 1(bridge_slave_0) entered blocking state
[  174.681763][T11243] bridge0: port 1(bridge_slave_0) entered disabled state
[  174.686885][T11243] bridge_slave_0: entered allmulticast mode
[  174.689797][T11243] bridge_slave_0: entered promiscuous mode
[  174.695815][T11243] bridge0: port 2(bridge_slave_1) entered blocking state
[  174.699525][T11243] bridge0: port 2(bridge_slave_1) entered disabled state
[  174.702634][T11243] bridge_slave_1: entered allmulticast mode
[  174.711455][T11243] bridge_slave_1: entered promiscuous mode
[  174.748279][ T5848] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  174.783469][T11243] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  174.819370][ T5848] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  174.841860][T11243] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  174.918190][T11243] team0: Port device team_slave_0 added
[  174.921524][T11243] team0: Port device team_slave_1 added
[  174.927708][T11285] netlink: 196 bytes leftover after parsing attributes in process `syz.2.1879'.
[  174.948741][T11243] batman_adv: batadv0: Adding interface: batadv_slave_0
[  174.950986][T11243] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  174.961753][T11243] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  174.970555][T11243] batman_adv: batadv0: Adding interface: batadv_slave_1
[  174.973209][T11243] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  174.981848][T11243] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  175.097144][T11243] hsr_slave_0: entered promiscuous mode
[  175.105050][T11243] hsr_slave_1: entered promiscuous mode
[  175.107189][T11243] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  175.112938][T11243] Cannot create hsr debugfs directory
[  175.115382][ T5848] bridge_slave_1: left allmulticast mode
[  175.117161][ T5848] bridge_slave_1: left promiscuous mode
[  175.117527][T11294] openvswitch: netlink: Tunnel attr 16359 out of range max 16
[  175.119019][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[  175.136108][ T5848] bridge_slave_0: left allmulticast mode
[  175.138118][ T5848] bridge_slave_0: left promiscuous mode
[  175.145445][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[  175.373464][ T5848] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  175.378045][ T5848] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  175.381728][ T5848] bond0 (unregistering): Released all slaves
[  175.490406][T11304] netlink: 'syz.2.1885': attribute type 5 has an invalid length.
[  175.677506][T11319] netlink: 'syz.2.1891': attribute type 3 has an invalid length.
[  175.710466][T11321] openvswitch: netlink: Tunnel attr 16359 out of range max 16
[  175.767132][ T5848] hsr_slave_0: left promiscuous mode
[  175.770558][ T5848] hsr_slave_1: left promiscuous mode
[  175.772752][ T5848] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  175.788510][ T5848] batman_adv: batadv0: Removing interface: batadv_slave_0
[  175.804238][ T5848] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  175.806700][ T5848] batman_adv: batadv0: Removing interface: batadv_slave_1
[  175.831398][ T5848] veth1_macvtap: left promiscuous mode
[  175.833288][ T5848] veth0_macvtap: left promiscuous mode
[  175.837184][ T5848] veth1_vlan: left promiscuous mode
[  175.838963][ T5848] veth0_vlan: left promiscuous mode
[  175.942082][T11332] ip6t_REJECT: TCP_RESET illegal for non-tcp
[  176.161471][ T5848] team0 (unregistering): Port device team_slave_1 removed
[  176.185801][ T5848] team0 (unregistering): Port device team_slave_0 removed
[  176.207633][ T5822] Bluetooth: hci0: command tx timeout
[  176.589814][T11336] openvswitch: netlink: Tunnel attr 16359 out of range max 16
[  176.735885][T11243] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  176.740517][T11243] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  176.758147][T11243] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  176.769122][T11243] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  176.856776][T11348] xt_l2tp: missing protocol rule (udp|l2tpip)
[  176.866797][T11243] 8021q: adding VLAN 0 to HW filter on device bond0
[  176.886680][T11243] 8021q: adding VLAN 0 to HW filter on device team0
[  176.895782][ T6742] bridge0: port 1(bridge_slave_0) entered blocking state
[  176.898430][ T6742] bridge0: port 1(bridge_slave_0) entered forwarding state
[  176.919991][ T5828] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  176.922626][ T6742] bridge0: port 2(bridge_slave_1) entered blocking state
[  176.923614][ T5828] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  176.925036][ T6742] bridge0: port 2(bridge_slave_1) entered forwarding state
[  176.927921][ T5828] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  176.933002][ T5828] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  176.940642][ T5828] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  177.128643][T11243] 8021q: adding VLAN 0 to HW filter on device batadv0
[  177.140098][T11349] chnl_net:caif_netlink_parms(): no params data found
[  177.218212][T11349] bridge0: port 1(bridge_slave_0) entered blocking state
[  177.220757][T11349] bridge0: port 1(bridge_slave_0) entered disabled state
[  177.223364][T11349] bridge_slave_0: entered allmulticast mode
[  177.228344][T11349] bridge_slave_0: entered promiscuous mode
[  177.233139][T11349] bridge0: port 2(bridge_slave_1) entered blocking state
[  177.235908][T11349] bridge0: port 2(bridge_slave_1) entered disabled state
[  177.238517][T11349] bridge_slave_1: entered allmulticast mode
[  177.241799][T11349] bridge_slave_1: entered promiscuous mode
[  177.268745][T11349] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  177.280104][T11349] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  177.308393][T11349] team0: Port device team_slave_0 added
[  177.312528][T11349] team0: Port device team_slave_1 added
[  177.344763][T11349] batman_adv: batadv0: Adding interface: batadv_slave_0
[  177.347194][T11349] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  177.357462][T11349] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  177.362801][T11349] batman_adv: batadv0: Adding interface: batadv_slave_1
[  177.365565][T11349] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  177.373714][T11349] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  177.396281][T11243] veth0_vlan: entered promiscuous mode
[  177.427833][T11349] hsr_slave_0: entered promiscuous mode
[  177.430261][T11349] hsr_slave_1: entered promiscuous mode
[  177.432509][T11349] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  177.435408][T11349] Cannot create hsr debugfs directory
[  177.453966][T11243] veth1_vlan: entered promiscuous mode
[  177.581789][T11349] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  177.593748][T11243] veth0_macvtap: entered promiscuous mode
[  177.598529][T11243] veth1_macvtap: entered promiscuous mode
[  177.632542][T11349] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  177.649454][T11243] batman_adv: batadv0: Interface activated: batadv_slave_0
[  177.656822][T11243] batman_adv: batadv0: Interface activated: batadv_slave_1
[  177.666481][T11243] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  177.669430][T11243] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  177.672364][T11243] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  177.675655][T11243] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  177.720655][T11349] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  177.798653][T11349] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  177.815594][ T6728] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  177.818172][ T6728] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  177.855539][ T6728] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  177.858632][ T6728] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  177.998443][T11349] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  178.003151][T11349] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  178.011269][T11349] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  178.015739][T11366] __nla_validate_parse: 6 callbacks suppressed
[  178.015749][T11366] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1905'.
[  178.016602][T11349] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  178.075456][T11374] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1906'.
[  178.078804][T11374] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1906'.
[  178.081748][T11374] netlink: 7 bytes leftover after parsing attributes in process `syz.2.1906'.
[  178.089700][T11374] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1906'.
[  178.105333][T11349] 8021q: adding VLAN 0 to HW filter on device bond0
[  178.119326][T11349] 8021q: adding VLAN 0 to HW filter on device team0
[  178.138567][ T8865] bridge0: port 1(bridge_slave_0) entered blocking state
[  178.140840][ T8865] bridge0: port 1(bridge_slave_0) entered forwarding state
[  178.152331][ T8865] bridge0: port 2(bridge_slave_1) entered blocking state
[  178.154634][ T8865] bridge0: port 2(bridge_slave_1) entered forwarding state
[  178.192372][T11349] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  178.205739][T11349] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  178.350569][T11349] 8021q: adding VLAN 0 to HW filter on device batadv0
[  178.407624][T11349] veth0_vlan: entered promiscuous mode
[  178.413289][T11349] veth1_vlan: entered promiscuous mode
[  178.428904][T11392] netlink: 'syz.2.1912': attribute type 3 has an invalid length.
[  178.433195][T11349] veth0_macvtap: entered promiscuous mode
[  178.439280][T11349] veth1_macvtap: entered promiscuous mode
[  178.466972][T11349] batman_adv: batadv0: Interface activated: batadv_slave_0
[  178.476419][T11349] batman_adv: batadv0: Interface activated: batadv_slave_1
[  178.485388][T11349] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  178.488478][T11349] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  178.491527][T11349] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  178.496759][T11349] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  178.561168][ T8854] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  178.569707][ T8854] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  178.593579][ T8865] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  178.598114][ T8865] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  179.476377][   T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  180.303762][T11404] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  180.311825][T11404] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  180.322004][T11404] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  180.326538][T11403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  180.329535][T11403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  180.421726][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  180.430387][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  180.433857][   T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  180.440267][   T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  180.443144][   T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  180.607539][   T54] Bluetooth: hci1: command 0x0406 tx timeout
[  180.792418][T11407] chnl_net:caif_netlink_parms(): no params data found
[  180.925294][T11407] bridge0: port 1(bridge_slave_0) entered blocking state
[  180.927642][T11407] bridge0: port 1(bridge_slave_0) entered disabled state
[  180.929934][T11407] bridge_slave_0: entered allmulticast mode
[  180.945417][T11407] bridge_slave_0: entered promiscuous mode
[  180.948620][T11407] bridge0: port 2(bridge_slave_1) entered blocking state
[  180.950858][T11407] bridge0: port 2(bridge_slave_1) entered disabled state
[  180.953131][T11407] bridge_slave_1: entered allmulticast mode
[  180.964902][T11407] bridge_slave_1: entered promiscuous mode
[  180.982117][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  180.985939][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  180.988799][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  180.992159][   T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  180.995373][   T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  181.025497][T11407] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  181.047524][T11407] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  181.078833][T11439] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  181.081369][T11439] CPU: 0 UID: 0 PID: 11439 Comm: syz.2.1923 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  181.081382][T11439] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  181.081388][T11439] Call Trace:
[  181.081392][T11439]  <TASK>
[  181.081396][T11439]  dump_stack_lvl+0x189/0x250
[  181.081416][T11439]  ? __pfx_dump_stack_lvl+0x10/0x10
[  181.081428][T11439]  ? __pfx__printk+0x10/0x10
[  181.081438][T11439]  ? kernfs_path_from_node+0x2c/0x260
[  181.081448][T11439]  ? kernfs_path_from_node+0x2c/0x260
[  181.081456][T11439]  ? kernfs_path_from_node+0x2c/0x260
[  181.081465][T11439]  ? kernfs_path_from_node+0x22c/0x260
[  181.081475][T11439]  ? kernfs_path_from_node+0x2c/0x260
[  181.081484][T11439]  sysfs_warn_dup+0x8e/0xa0
[  181.081495][T11439]  sysfs_do_create_link_sd+0xc0/0x110
[  181.081509][T11439]  device_add_class_symlinks+0x1cf/0x240
[  181.081519][T11439]  device_add+0x475/0xb50
[  181.081528][T11439]  wiphy_register+0x199a/0x26b0
[  181.081545][T11439]  ? __pfx_wiphy_register+0x10/0x10
[  181.081553][T11439]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  181.081565][T11439]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  181.081578][T11439]  ieee80211_register_hw+0x33e1/0x4120
[  181.081596][T11439]  ? ieee80211_register_hw+0x14b1/0x4120
[  181.081609][T11439]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  181.081621][T11439]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  181.081637][T11439]  ? __hrtimer_setup+0x187/0x210
[  181.081648][T11439]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  181.081659][T11439]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  181.081683][T11439]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  181.081693][T11439]  ? trace_kmalloc+0x1f/0xd0
[  181.081700][T11439]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  181.081707][T11439]  ? kstrndup+0xbf/0x160
[  181.081720][T11439]  hwsim_new_radio_nl+0xea4/0x1b10
[  181.081729][T11439]  ? __pfx___nla_validate_parse+0x10/0x10
[  181.081746][T11439]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  181.081758][T11439]  ? __nla_parse+0x40/0x60
[  181.081769][T11439]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  181.081784][T11439]  genl_family_rcv_msg_doit+0x215/0x300
[  181.081797][T11439]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  181.081813][T11439]  ? bpf_lsm_capable+0x9/0x20
[  181.081820][T11439]  ? security_capable+0x7e/0x2e0
[  181.081833][T11439]  genl_rcv_msg+0x60e/0x790
[  181.081845][T11439]  ? __pfx_genl_rcv_msg+0x10/0x10
[  181.081855][T11439]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  181.081868][T11439]  netlink_rcv_skb+0x208/0x470
[  181.081876][T11439]  ? __pfx_genl_rcv_msg+0x10/0x10
[  181.081887][T11439]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  181.081902][T11439]  ? down_read+0x1ad/0x2e0
[  181.081910][T11439]  genl_rcv+0x28/0x40
[  181.081919][T11439]  netlink_unicast+0x75b/0x8d0
[  181.081931][T11439]  netlink_sendmsg+0x805/0xb30
[  181.081943][T11439]  ? __pfx_netlink_sendmsg+0x10/0x10
[  181.081953][T11439]  ? aa_sock_msg_perm+0x94/0x160
[  181.081963][T11439]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  181.081972][T11439]  ? __pfx_netlink_sendmsg+0x10/0x10
[  181.081980][T11439]  __sock_sendmsg+0x21c/0x270
[  181.081993][T11439]  ____sys_sendmsg+0x505/0x830
[  181.082004][T11439]  ? __pfx_____sys_sendmsg+0x10/0x10
[  181.082017][T11439]  ? import_iovec+0x74/0xa0
[  181.082026][T11439]  ___sys_sendmsg+0x21f/0x2a0
[  181.082036][T11439]  ? __pfx____sys_sendmsg+0x10/0x10
[  181.082060][T11439]  ? __fget_files+0x2a/0x420
[  181.082068][T11439]  ? __fget_files+0x3a0/0x420
[  181.082080][T11439]  __x64_sys_sendmsg+0x19b/0x260
[  181.082090][T11439]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  181.082103][T11439]  ? rcu_is_watching+0x15/0xb0
[  181.082117][T11439]  ? do_syscall_64+0xbe/0x3b0
[  181.082125][T11439]  do_syscall_64+0xfa/0x3b0
[  181.082131][T11439]  ? lockdep_hardirqs_on+0x9c/0x150
[  181.082141][T11439]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  181.082148][T11439]  ? exc_page_fault+0x9f/0xf0
[  181.082160][T11439]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  181.082167][T11439] RIP: 0033:0x7f32f978e929
[  181.082176][T11439] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  181.082183][T11439] RSP: 002b:00007f32fa673038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  181.082192][T11439] RAX: ffffffffffffffda RBX: 00007f32f99b5fa0 RCX: 00007f32f978e929
[  181.082198][T11439] RDX: 000000002000c800 RSI: 0000200000000040 RDI: 0000000000000004
[  181.082202][T11439] RBP: 00007f32f9810b39 R08: 0000000000000000 R09: 0000000000000000
[  181.082207][T11439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  181.082211][T11439] R13: 0000000000000000 R14: 00007f32f99b5fa0 R15: 00007fff5a432648
[  181.082251][T11439]  </TASK>
[  181.289391][   T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  181.302800][T11407] team0: Port device team_slave_0 added
[  181.311000][T11407] team0: Port device team_slave_1 added
[  181.345581][T11407] batman_adv: batadv0: Adding interface: batadv_slave_0
[  181.348116][T11407] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  181.359898][T11407] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  181.360172][T11442] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.366545][T11442] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.369316][T11442] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.372325][T11442] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.392318][   T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  181.399723][T11407] batman_adv: batadv0: Adding interface: batadv_slave_1
[  181.401943][T11407] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  181.410138][T11407] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  181.506617][   T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  181.558397][T11407] hsr_slave_0: entered promiscuous mode
[  181.560807][T11407] hsr_slave_1: entered promiscuous mode
[  181.562950][T11407] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  181.566549][T11407] Cannot create hsr debugfs directory
[  181.665268][T11436] chnl_net:caif_netlink_parms(): no params data found
[  181.669889][T11450] net_ratelimit: 4 callbacks suppressed
[  181.669901][T11450] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.676783][T11450] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.679569][T11450] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.682554][T11449] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.687266][T11449] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.756379][T11452] openvswitch: netlink: Tunnel attr 16359 out of range max 16
[  181.865729][T11436] bridge0: port 1(bridge_slave_0) entered blocking state
[  181.868023][T11436] bridge0: port 1(bridge_slave_0) entered disabled state
[  181.870631][T11436] bridge_slave_0: entered allmulticast mode
[  181.873356][T11436] bridge_slave_0: entered promiscuous mode
[  181.888987][T11457] pimreg: entered allmulticast mode
[  181.899166][T11436] bridge0: port 2(bridge_slave_1) entered blocking state
[  181.901507][T11436] bridge0: port 2(bridge_slave_1) entered disabled state
[  181.903727][T11436] bridge_slave_1: entered allmulticast mode
[  181.906913][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.909624][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.913282][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.917927][T11456] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  181.936141][T11436] bridge_slave_1: entered promiscuous mode
[  181.988912][T11436] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  181.994137][   T12] bridge_slave_1: left allmulticast mode
[  181.995941][   T12] bridge_slave_1: left promiscuous mode
[  181.997814][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  182.015197][   T12] bridge_slave_0: left allmulticast mode
[  182.017062][   T12] bridge_slave_0: left promiscuous mode
[  182.018910][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  182.256369][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  182.260608][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  182.264488][   T12] bond0 (unregistering): Released all slaves
[  182.272567][T11436] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  182.341157][T11436] team0: Port device team_slave_0 added
[  182.351657][T11436] team0: Port device team_slave_1 added
[  182.354889][T11468] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  182.363381][T11468] CPU: 1 UID: 0 PID: 11468 Comm: syz.2.1930 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  182.363397][T11468] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  182.363402][T11468] Call Trace:
[  182.363407][T11468]  <TASK>
[  182.363412][T11468]  dump_stack_lvl+0x189/0x250
[  182.363431][T11468]  ? __pfx_dump_stack_lvl+0x10/0x10
[  182.363444][T11468]  ? __pfx__printk+0x10/0x10
[  182.363473][T11468]  ? kernfs_path_from_node+0x2c/0x260
[  182.363484][T11468]  ? kernfs_path_from_node+0x2c/0x260
[  182.363493][T11468]  ? kernfs_path_from_node+0x2c/0x260
[  182.363503][T11468]  ? kernfs_path_from_node+0x22c/0x260
[  182.363510][T11468]  ? kernfs_path_from_node+0x2c/0x260
[  182.363520][T11468]  sysfs_warn_dup+0x8e/0xa0
[  182.363529][T11468]  sysfs_do_create_link_sd+0xc0/0x110
[  182.363539][T11468]  device_add_class_symlinks+0x1cf/0x240
[  182.363550][T11468]  device_add+0x475/0xb50
[  182.363560][T11468]  wiphy_register+0x199a/0x26b0
[  182.363577][T11468]  ? __pfx_wiphy_register+0x10/0x10
[  182.363584][T11468]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  182.363597][T11468]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  182.363609][T11468]  ieee80211_register_hw+0x33e1/0x4120
[  182.363628][T11468]  ? ieee80211_register_hw+0x14b1/0x4120
[  182.363641][T11468]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  182.363653][T11468]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  182.363667][T11468]  ? __hrtimer_setup+0x187/0x210
[  182.363678][T11468]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  182.363689][T11468]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  182.363713][T11468]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  182.363724][T11468]  ? trace_kmalloc+0x1f/0xd0
[  182.363730][T11468]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  182.363737][T11468]  ? kstrndup+0xbf/0x160
[  182.363750][T11468]  hwsim_new_radio_nl+0xea4/0x1b10
[  182.363759][T11468]  ? __pfx___nla_validate_parse+0x10/0x10
[  182.363777][T11468]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  182.363791][T11468]  ? __nla_parse+0x40/0x60
[  182.363803][T11468]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  182.363818][T11468]  genl_family_rcv_msg_doit+0x215/0x300
[  182.363831][T11468]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  182.363847][T11468]  ? bpf_lsm_capable+0x9/0x20
[  182.363854][T11468]  ? security_capable+0x7e/0x2e0
[  182.363866][T11468]  genl_rcv_msg+0x60e/0x790
[  182.363879][T11468]  ? __pfx_genl_rcv_msg+0x10/0x10
[  182.363889][T11468]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  182.363902][T11468]  netlink_rcv_skb+0x208/0x470
[  182.363928][T11468]  ? __pfx_genl_rcv_msg+0x10/0x10
[  182.363939][T11468]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  182.363954][T11468]  ? down_read+0x1ad/0x2e0
[  182.363963][T11468]  genl_rcv+0x28/0x40
[  182.363972][T11468]  netlink_unicast+0x75b/0x8d0
[  182.363984][T11468]  netlink_sendmsg+0x805/0xb30
[  182.363996][T11468]  ? __pfx_netlink_sendmsg+0x10/0x10
[  182.364006][T11468]  ? aa_sock_msg_perm+0x94/0x160
[  182.364017][T11468]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  182.364025][T11468]  ? __pfx_netlink_sendmsg+0x10/0x10
[  182.364034][T11468]  __sock_sendmsg+0x21c/0x270
[  182.364048][T11468]  ____sys_sendmsg+0x505/0x830
[  182.364059][T11468]  ? __pfx_____sys_sendmsg+0x10/0x10
[  182.364072][T11468]  ? import_iovec+0x74/0xa0
[  182.364081][T11468]  ___sys_sendmsg+0x21f/0x2a0
[  182.364090][T11468]  ? __pfx____sys_sendmsg+0x10/0x10
[  182.364115][T11468]  ? __fget_files+0x2a/0x420
[  182.364123][T11468]  ? __fget_files+0x3a0/0x420
[  182.364135][T11468]  __x64_sys_sendmsg+0x19b/0x260
[  182.364145][T11468]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  182.364158][T11468]  ? rcu_is_watching+0x15/0xb0
[  182.364172][T11468]  ? do_syscall_64+0xbe/0x3b0
[  182.364181][T11468]  do_syscall_64+0xfa/0x3b0
[  182.364186][T11468]  ? lockdep_hardirqs_on+0x9c/0x150
[  182.364202][T11468]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  182.364209][T11468]  ? exc_page_fault+0x9f/0xf0
[  182.364242][T11468]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  182.364252][T11468] RIP: 0033:0x7f32f978e929
[  182.364262][T11468] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  182.364269][T11468] RSP: 002b:00007f32fa673038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  182.364279][T11468] RAX: ffffffffffffffda RBX: 00007f32f99b5fa0 RCX: 00007f32f978e929
[  182.364285][T11468] RDX: 000000002000c800 RSI: 0000200000000040 RDI: 0000000000000004
[  182.364290][T11468] RBP: 00007f32f9810b39 R08: 0000000000000000 R09: 0000000000000000
[  182.364295][T11468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  182.364300][T11468] R13: 0000000000000000 R14: 00007f32f99b5fa0 R15: 00007fff5a432648
[  182.364312][T11468]  </TASK>
[  182.528700][ T5828] Bluetooth: hci0: command tx timeout
[  182.712485][T11436] batman_adv: batadv0: Adding interface: batadv_slave_0
[  182.717781][T11436] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  182.727976][T11436] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  182.732908][T11436] batman_adv: batadv0: Adding interface: batadv_slave_1
[  182.738097][T11436] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  182.749700][T11436] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  182.753725][T11470] wg1: Master is either lo or non-ether device
[  182.860666][T11436] hsr_slave_0: entered promiscuous mode
[  182.863600][T11436] hsr_slave_1: entered promiscuous mode
[  182.868929][T11436] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  182.871662][T11436] Cannot create hsr debugfs directory
[  182.895294][   T12] hsr_slave_0: left promiscuous mode
[  182.897469][   T12] hsr_slave_1: left promiscuous mode
[  182.899759][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  182.902617][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[  182.908730][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  182.911338][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[  182.923156][   T12] veth1_macvtap: left promiscuous mode
[  182.928796][   T12] veth0_macvtap: left promiscuous mode
[  182.930802][   T12] veth1_vlan: left promiscuous mode
[  182.932607][   T12] veth0_vlan: left promiscuous mode
[  183.008680][   T54] Bluetooth: hci2: command tx timeout
[  183.014183][T11472] block nbd1: server does not support multiple connections per device.
[  183.016961][T11472] block nbd1: shutting down sockets
[  183.238329][   T12] team0 (unregistering): Port device team_slave_1 removed
[  183.269041][   T12] team0 (unregistering): Port device team_slave_0 removed
[  183.613715][T11407] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  183.627840][T11407] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  183.632852][T11407] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  183.653656][T11407] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  183.729181][T11436] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  183.801395][T11407] 8021q: adding VLAN 0 to HW filter on device bond0
[  183.820516][T11486] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1935'.
[  183.821424][T11436] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  183.837688][T11486] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1935'.
[  183.849245][T11407] 8021q: adding VLAN 0 to HW filter on device team0
[  183.856027][ T8856] bridge0: port 1(bridge_slave_0) entered blocking state
[  183.858288][ T8856] bridge0: port 1(bridge_slave_0) entered forwarding state
[  183.871634][ T8856] bridge0: port 2(bridge_slave_1) entered blocking state
[  183.874020][ T8856] bridge0: port 2(bridge_slave_1) entered forwarding state
[  183.911174][T11436] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  183.998421][T11436] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  184.019674][T11494] syzkaller0: left promiscuous mode
[  184.021396][T11494] syzkaller0: left allmulticast mode
[  184.029185][T11494] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  184.032995][T11494] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1938'.
[  184.093479][T11407] 8021q: adding VLAN 0 to HW filter on device batadv0
[  184.110587][   T13] bridge_slave_1: left allmulticast mode
[  184.112526][   T13] bridge_slave_1: left promiscuous mode
[  184.124196][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  184.136399][   T13] bridge_slave_0: left allmulticast mode
[  184.138263][   T13] bridge_slave_0: left promiscuous mode
[  184.140061][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  184.407490][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  184.411894][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  184.415913][   T13] bond0 (unregistering): Released all slaves
[  184.502704][T11407] veth0_vlan: entered promiscuous mode
[  184.524568][ T8864] wlan0: Trigger new scan to find an IBSS to join
[  184.541277][T11407] veth1_vlan: entered promiscuous mode
[  184.549446][T11436] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  184.565271][T11436] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  184.572975][T11436] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  184.586384][T11407] veth0_macvtap: entered promiscuous mode
[  184.599080][T11436] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  184.618601][   T54] Bluetooth: hci0: command tx timeout
[  184.642773][T11407] veth1_macvtap: entered promiscuous mode
[  184.699605][T11407] batman_adv: batadv0: Interface activated: batadv_slave_0
[  184.727531][T11407] batman_adv: batadv0: Interface activated: batadv_slave_1
[  184.731678][T11407] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  184.737707][T11407] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  184.740507][T11407] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  184.743245][T11407] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  184.757564][   T13] hsr_slave_0: left promiscuous mode
[  184.764442][   T13] hsr_slave_1: left promiscuous mode
[  184.766589][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  184.769024][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  184.771917][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  184.776415][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  184.799887][   T13] veth1_macvtap: left promiscuous mode
[  184.801886][   T13] veth0_macvtap: left promiscuous mode
[  184.803896][   T13] veth1_vlan: left promiscuous mode
[  184.806346][   T13] veth0_vlan: left promiscuous mode
[  185.096867][   T54] Bluetooth: hci2: command tx timeout
[  185.152905][   T13] team0 (unregistering): Port device team_slave_1 removed
[  185.172150][   T13] team0 (unregistering): Port device team_slave_0 removed
[  185.460615][T11436] 8021q: adding VLAN 0 to HW filter on device bond0
[  185.518519][T11436] 8021q: adding VLAN 0 to HW filter on device team0
[  185.523986][ T8854] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  185.526542][ T8854] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  185.586797][ T8856] bridge0: port 1(bridge_slave_0) entered blocking state
[  185.589797][ T8856] bridge0: port 1(bridge_slave_0) entered forwarding state
[  185.616041][ T8864] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  185.622108][ T8856] bridge0: port 2(bridge_slave_1) entered blocking state
[  185.624621][ T8856] bridge0: port 2(bridge_slave_1) entered forwarding state
[  185.629451][ T8864] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  185.697669][T11436] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  185.700988][T11436] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  185.878107][T11436] 8021q: adding VLAN 0 to HW filter on device batadv0
[  185.926650][T11436] veth0_vlan: entered promiscuous mode
[  185.931548][T11436] veth1_vlan: entered promiscuous mode
[  185.966052][T11436] veth0_macvtap: entered promiscuous mode
[  185.969818][T11436] veth1_macvtap: entered promiscuous mode
[  185.995162][T11436] batman_adv: batadv0: Interface activated: batadv_slave_0
[  186.001785][T11436] batman_adv: batadv0: Interface activated: batadv_slave_1
[  186.019251][T11436] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  186.022074][T11436] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  186.030107][T11436] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  186.033005][T11436] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  186.128942][ T8856] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  186.131617][ T8856] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  186.177529][ T8864] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  186.180042][ T8864] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  186.700627][T11571] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1964'.
[  186.726598][T11571] syzkaller1: entered promiscuous mode
[  186.728436][T11571] syzkaller1: entered allmulticast mode
[  186.734065][T11571] PF_CAN: dropped non conform CAN skbuff: dev type 779, len 324
[  187.034529][   T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  187.250095][T11590] netlink: 'syz.2.1967': attribute type 10 has an invalid length.
[  187.330831][   T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  187.334921][ T5828] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  187.338059][ T5828] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  187.341183][ T5828] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  187.344319][ T5828] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  187.347346][ T5828] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  187.485379][ T8864] wlan0: Trigger new scan to find an IBSS to join
[  187.514083][T11593] chnl_net:caif_netlink_parms(): no params data found
[  187.561928][T11593] bridge0: port 1(bridge_slave_0) entered blocking state
[  187.565177][T11593] bridge0: port 1(bridge_slave_0) entered disabled state
[  187.567547][T11593] bridge_slave_0: entered allmulticast mode
[  187.570188][T11593] bridge_slave_0: entered promiscuous mode
[  187.573691][T11593] bridge0: port 2(bridge_slave_1) entered blocking state
[  187.576013][T11593] bridge0: port 2(bridge_slave_1) entered disabled state
[  187.578277][T11593] bridge_slave_1: entered allmulticast mode
[  187.580901][T11593] bridge_slave_1: entered promiscuous mode
[  187.610496][T11593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  187.617982][T11593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  187.659827][T11593] team0: Port device team_slave_0 added
[  187.670024][T11593] team0: Port device team_slave_1 added
[  187.691824][   T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  187.722046][T11593] batman_adv: batadv0: Adding interface: batadv_slave_0
[  187.727592][T11593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  187.736624][T11593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  187.742834][T11593] batman_adv: batadv0: Adding interface: batadv_slave_1
[  187.747279][T11593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  187.755571][T11593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  187.782833][T11593] hsr_slave_0: entered promiscuous mode
[  187.787444][T11593] hsr_slave_1: entered promiscuous mode
[  187.789553][T11593] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  187.791935][T11593] Cannot create hsr debugfs directory
[  188.371560][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  188.378376][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  188.381693][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  188.384711][   T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  188.387279][   T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  188.434327][ T8856] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  188.469151][   T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  188.578924][T11624] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1970'.
[  188.591359][T11624] net_ratelimit: 7 callbacks suppressed
[  188.591369][T11624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  188.596051][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  188.617576][T11612] chnl_net:caif_netlink_parms(): no params data found
[  188.687004][   T13] bridge_slave_1: left allmulticast mode
[  188.689435][   T13] bridge_slave_1: left promiscuous mode
[  188.691300][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  188.696525][T11628] netlink: 'syz.2.1971': attribute type 3 has an invalid length.
[  188.700034][   T13] bridge_slave_0: left allmulticast mode
[  188.701895][   T13] bridge_slave_0: left promiscuous mode
[  188.703739][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  188.704032][T11628] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1971'.
[  188.959055][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  188.964472][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  188.968213][   T13] bond0 (unregistering): Released all slaves
[  189.068591][T11612] bridge0: port 1(bridge_slave_0) entered blocking state
[  189.071037][T11612] bridge0: port 1(bridge_slave_0) entered disabled state
[  189.073516][T11612] bridge_slave_0: entered allmulticast mode
[  189.084989][T11612] bridge_slave_0: entered promiscuous mode
[  189.118299][T11612] bridge0: port 2(bridge_slave_1) entered blocking state
[  189.121547][T11612] bridge0: port 2(bridge_slave_1) entered disabled state
[  189.125079][T11612] bridge_slave_1: entered allmulticast mode
[  189.129440][T11612] bridge_slave_1: entered promiscuous mode
[  189.136859][T11633] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes.
[  189.177971][T11612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  189.188392][T11612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  189.259105][T11612] team0: Port device team_slave_0 added
[  189.270951][T11612] team0: Port device team_slave_1 added
[  189.308443][T11612] batman_adv: batadv0: Adding interface: batadv_slave_0
[  189.310681][T11612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  189.334031][T11612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  189.342183][   T13] hsr_slave_0: left promiscuous mode
[  189.346569][   T13] hsr_slave_1: left promiscuous mode
[  189.348685][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  189.351051][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  189.364248][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  189.366570][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  189.379313][   T13] veth1_macvtap: left promiscuous mode
[  189.381113][   T13] veth0_macvtap: left promiscuous mode
[  189.383043][   T13] veth1_vlan: left promiscuous mode
[  189.384940][   T13] veth0_vlan: left promiscuous mode
[  189.417161][   T54] Bluetooth: hci0: command tx timeout
[  189.682273][   T13] team0 (unregistering): Port device team_slave_1 removed
[  189.703456][   T13] team0 (unregistering): Port device team_slave_0 removed
[  189.744190][T11642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  189.747069][T11642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  189.749890][T11642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  189.764173][T11642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  189.816196][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  189.956324][T11612] batman_adv: batadv0: Adding interface: batadv_slave_1
[  189.958999][T11612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  189.968349][T11612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  190.070972][T11593] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  190.092840][T11612] hsr_slave_0: entered promiscuous mode
[  190.096006][T11612] hsr_slave_1: entered promiscuous mode
[  190.098244][T11612] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  190.100804][T11612] Cannot create hsr debugfs directory
[  190.103742][T11593] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  190.128380][T11593] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  190.144188][T11593] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  190.288968][T11612] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  190.322675][T11593] 8021q: adding VLAN 0 to HW filter on device bond0
[  190.363567][T11612] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  190.367208][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  190.367387][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  190.379475][T11593] 8021q: adding VLAN 0 to HW filter on device team0
[  190.390506][ T8856] bridge0: port 1(bridge_slave_0) entered blocking state
[  190.392884][ T8856] bridge0: port 1(bridge_slave_0) entered forwarding state
[  190.408180][ T8856] bridge0: port 2(bridge_slave_1) entered blocking state
[  190.410536][ T8856] bridge0: port 2(bridge_slave_1) entered forwarding state
[  190.433386][T11612] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  190.455782][   T54] Bluetooth: hci2: command tx timeout
[  190.492921][T11612] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  190.576000][   T13] bridge_slave_1: left allmulticast mode
[  190.577935][   T13] bridge_slave_1: left promiscuous mode
[  190.580530][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  190.588706][   T13] bridge_slave_0: left allmulticast mode
[  190.590596][   T13] bridge_slave_0: left promiscuous mode
[  190.592565][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  190.801961][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  190.808468][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  190.811945][   T13] bond0 (unregistering): Released all slaves
[  190.880789][T11593] 8021q: adding VLAN 0 to HW filter on device batadv0
[  190.886519][T11612] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  190.895460][T11612] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  190.911717][T11612] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  190.917633][T11612] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  191.041266][T11593] veth0_vlan: entered promiscuous mode
[  191.071753][T11593] veth1_vlan: entered promiscuous mode
[  191.113727][   T13] hsr_slave_0: left promiscuous mode
[  191.120532][   T13] hsr_slave_1: left promiscuous mode
[  191.123012][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  191.130797][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  191.145567][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  191.147926][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  191.160656][   T13] veth1_macvtap: left promiscuous mode
[  191.162506][   T13] veth0_macvtap: left promiscuous mode
[  191.166714][   T13] veth1_vlan: left promiscuous mode
[  191.168692][   T13] veth0_vlan: left promiscuous mode
[  191.451008][   T13] team0 (unregistering): Port device team_slave_1 removed
[  191.473142][   T13] team0 (unregistering): Port device team_slave_0 removed
[  191.496475][   T54] Bluetooth: hci0: command tx timeout
[  191.721786][T11593] veth0_macvtap: entered promiscuous mode
[  191.735187][T11593] veth1_macvtap: entered promiscuous mode
[  191.772036][T11593] batman_adv: batadv0: Interface activated: batadv_slave_0
[  191.781007][T11593] batman_adv: batadv0: Interface activated: batadv_slave_1
[  191.800674][T11593] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  191.803538][T11593] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  191.814029][T11593] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  191.818647][T11593] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  191.845115][T11612] 8021q: adding VLAN 0 to HW filter on device bond0
[  191.902540][T11612] 8021q: adding VLAN 0 to HW filter on device team0
[  191.920454][ T8856] bridge0: port 1(bridge_slave_0) entered blocking state
[  191.922781][ T8856] bridge0: port 1(bridge_slave_0) entered forwarding state
[  191.938414][ T8865] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  191.940901][ T8865] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  191.955084][ T8856] bridge0: port 2(bridge_slave_1) entered blocking state
[  191.957399][ T8856] bridge0: port 2(bridge_slave_1) entered forwarding state
[  191.993087][ T8856] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  191.996299][ T8856] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  192.125181][T11612] 8021q: adding VLAN 0 to HW filter on device batadv0
[  192.179897][T11612] veth0_vlan: entered promiscuous mode
[  192.193532][T11612] veth1_vlan: entered promiscuous mode
[  192.227609][T11612] veth0_macvtap: entered promiscuous mode
[  192.232083][T11612] veth1_macvtap: entered promiscuous mode
[  192.241855][T11612] batman_adv: batadv0: Interface activated: batadv_slave_0
[  192.250372][T11612] batman_adv: batadv0: Interface activated: batadv_slave_1
[  192.256312][T11612] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  192.259378][T11612] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  192.262639][T11612] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  192.266520][T11612] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  192.315046][ T8865] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  192.317600][ T8865] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  192.340351][ T8865] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  192.343546][ T8865] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  192.399725][    C1] vcan0: j1939_tp_rxtimer: 0xffff888049d34000: rx timeout, send abort
[  192.402498][    C1] vcan0: j1939_tp_rxtimer: 0xffff888049d36800: rx timeout, send abort
[  192.902381][    C1] vcan0: j1939_tp_rxtimer: 0xffff888049d34000: abort rx timeout. Force session deactivation
[  192.906010][    C1] vcan0: j1939_tp_rxtimer: 0xffff888049d36800: abort rx timeout. Force session deactivation
[  192.969447][T11688] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1982'.
[  193.133621][   T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  193.490852][   T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  193.686346][   T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  193.767008][   T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  193.825493][ T5828] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  193.829357][ T5828] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  193.832296][ T5828] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  193.836327][ T5828] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  193.844581][ T5828] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  193.884068][    C1] net_ratelimit: 1 callbacks suppressed
[  193.884079][    C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  193.888340][    C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  193.891129][    C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  193.894207][    C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  193.954273][   T13] bridge_slave_1: left allmulticast mode
[  193.956463][   T13] bridge_slave_1: left promiscuous mode
[  193.958328][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  193.963636][   T13] bridge_slave_0: left allmulticast mode
[  193.966482][   T13] bridge_slave_0: left promiscuous mode
[  193.968401][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  194.183036][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  194.189766][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  194.193336][   T13] bond0 (unregistering): Released all slaves
[  194.319147][T11696] chnl_net:caif_netlink_parms(): no params data found
[  194.408808][T11696] bridge0: port 1(bridge_slave_0) entered blocking state
[  194.411266][T11696] bridge0: port 1(bridge_slave_0) entered disabled state
[  194.413506][T11696] bridge_slave_0: entered allmulticast mode
[  194.417800][T11696] bridge_slave_0: entered promiscuous mode
[  194.423421][T11696] bridge0: port 2(bridge_slave_1) entered blocking state
[  194.433513][T11696] bridge0: port 2(bridge_slave_1) entered disabled state
[  194.436803][T11696] bridge_slave_1: entered allmulticast mode
[  194.439481][T11696] bridge_slave_1: entered promiscuous mode
[  194.451292][   T13] hsr_slave_0: left promiscuous mode
[  194.453397][   T13] hsr_slave_1: left promiscuous mode
[  194.459281][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  194.461594][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  194.464402][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  194.466696][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  194.479203][   T13] veth1_macvtap: left promiscuous mode
[  194.480997][   T13] veth0_macvtap: left promiscuous mode
[  194.482849][   T13] veth1_vlan: left promiscuous mode
[  194.484684][   T13] veth0_vlan: left promiscuous mode
[  194.732000][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  194.741813][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  194.745123][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  194.749123][   T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  194.752619][   T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  194.961541][   T13] team0 (unregistering): Port device team_slave_1 removed
[  194.985845][   T13] team0 (unregistering): Port device team_slave_0 removed
[  195.248923][T11696] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  195.295299][T11696] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  195.378378][T11696] team0: Port device team_slave_0 added
[  195.381770][T11696] team0: Port device team_slave_1 added
[  195.449278][T11696] batman_adv: batadv0: Adding interface: batadv_slave_0
[  195.451879][T11696] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  195.462172][T11696] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  195.500674][T11696] batman_adv: batadv0: Adding interface: batadv_slave_1
[  195.502967][T11696] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  195.513333][T11696] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  195.598655][T11696] hsr_slave_0: entered promiscuous mode
[  195.601030][T11696] hsr_slave_1: entered promiscuous mode
[  195.603096][T11696] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  195.607652][T11696] Cannot create hsr debugfs directory
[  195.658555][T11707] chnl_net:caif_netlink_parms(): no params data found
[  195.803332][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  195.887566][ T5828] Bluetooth: hci0: command tx timeout
[  195.891139][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  195.897138][T11707] bridge0: port 1(bridge_slave_0) entered blocking state
[  195.900366][T11707] bridge0: port 1(bridge_slave_0) entered disabled state
[  195.903106][T11707] bridge_slave_0: entered allmulticast mode
[  195.910264][T11707] bridge_slave_0: entered promiscuous mode
[  195.913527][T11707] bridge0: port 2(bridge_slave_1) entered blocking state
[  195.916647][T11707] bridge0: port 2(bridge_slave_1) entered disabled state
[  195.919364][T11707] bridge_slave_1: entered allmulticast mode
[  195.922001][T11707] bridge_slave_1: entered promiscuous mode
[  195.951728][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  195.979850][T11707] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  195.984740][T11707] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  196.019375][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  196.046357][T11707] team0: Port device team_slave_0 added
[  196.050450][T11707] team0: Port device team_slave_1 added
[  196.068289][T11707] batman_adv: batadv0: Adding interface: batadv_slave_0
[  196.070664][T11707] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  196.084073][T11707] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  196.090789][T11707] batman_adv: batadv0: Adding interface: batadv_slave_1
[  196.095563][T11707] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  196.103786][T11707] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  196.158756][T11707] hsr_slave_0: entered promiscuous mode
[  196.161195][T11707] hsr_slave_1: entered promiscuous mode
[  196.163325][T11707] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  196.167775][T11707] Cannot create hsr debugfs directory
[  196.220786][   T13] bridge_slave_1: left allmulticast mode
[  196.223010][   T13] bridge_slave_1: left promiscuous mode
[  196.226823][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  196.230619][   T13] bridge_slave_0: left allmulticast mode
[  196.232478][   T13] bridge_slave_0: left promiscuous mode
[  196.235327][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  196.476634][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  196.481069][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  196.486865][   T13] bond0 (unregistering): Released all slaves
[  196.660995][T11696] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  196.680569][T11696] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  196.696490][T11696] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  196.708394][T11696] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  196.775836][ T5828] Bluetooth: hci2: command tx timeout
[  196.789342][   T13] hsr_slave_0: left promiscuous mode
[  196.792410][   T13] hsr_slave_1: left promiscuous mode
[  196.796804][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  196.799550][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  196.807154][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  196.809920][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  196.838136][   T13] veth1_macvtap: left promiscuous mode
[  196.839970][   T13] veth0_macvtap: left promiscuous mode
[  196.842295][   T13] veth1_vlan: left promiscuous mode
[  196.845919][   T13] veth0_vlan: left promiscuous mode
[  197.176177][   T13] team0 (unregistering): Port device team_slave_1 removed
[  197.197620][   T13] team0 (unregistering): Port device team_slave_0 removed
[  197.431324][T11746] syzkaller1: entered promiscuous mode
[  197.433080][T11746] syzkaller1: entered allmulticast mode
[  197.537003][T11696] 8021q: adding VLAN 0 to HW filter on device bond0
[  197.572255][T11696] 8021q: adding VLAN 0 to HW filter on device team0
[  197.593281][ T8865] bridge0: port 1(bridge_slave_0) entered blocking state
[  197.595669][ T8865] bridge0: port 1(bridge_slave_0) entered forwarding state
[  197.625906][ T8865] bridge0: port 2(bridge_slave_1) entered blocking state
[  197.628466][ T8865] bridge0: port 2(bridge_slave_1) entered forwarding state
[  197.641168][T11696] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  197.651740][T11696] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  197.737951][T11707] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  197.754702][T11707] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  197.770261][T11707] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  197.786786][T11707] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  197.821923][T11696] 8021q: adding VLAN 0 to HW filter on device batadv0
[  197.918270][T11696] veth0_vlan: entered promiscuous mode
[  197.935357][T11707] 8021q: adding VLAN 0 to HW filter on device bond0
[  197.944373][T11696] veth1_vlan: entered promiscuous mode
[  197.962816][T11707] 8021q: adding VLAN 0 to HW filter on device team0
[  197.964814][ T5828] Bluetooth: hci0: command tx timeout
[  197.990161][ T8854] bridge0: port 1(bridge_slave_0) entered blocking state
[  197.992755][ T8854] bridge0: port 1(bridge_slave_0) entered forwarding state
[  197.996702][T11777] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1999'.
[  198.006413][ T8854] bridge0: port 2(bridge_slave_1) entered blocking state
[  198.009030][ T8854] bridge0: port 2(bridge_slave_1) entered forwarding state
[  198.029783][T11696] veth0_macvtap: entered promiscuous mode
[  198.047942][T11696] veth1_macvtap: entered promiscuous mode
[  198.060254][T11707] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  198.063824][T11707] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  198.090383][T11696] batman_adv: batadv0: Interface activated: batadv_slave_0
[  198.100822][T11696] batman_adv: batadv0: Interface activated: batadv_slave_1
[  198.116380][T11696] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  198.119131][T11696] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  198.121891][T11696] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  198.144311][T11696] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  198.208669][ T6734] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  198.211202][ T6734] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  198.238973][ T8864] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  198.248307][ T8864] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  198.269292][T11707] 8021q: adding VLAN 0 to HW filter on device batadv0
[  198.309516][T11707] veth0_vlan: entered promiscuous mode
[  198.347617][T11707] veth1_vlan: entered promiscuous mode
[  198.373058][T11707] veth0_macvtap: entered promiscuous mode
[  198.384947][T11707] veth1_macvtap: entered promiscuous mode
[  198.401203][T11707] batman_adv: batadv0: Interface activated: batadv_slave_0
[  198.411572][T11707] batman_adv: batadv0: Interface activated: batadv_slave_1
[  198.421452][T11707] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  198.425611][T11707] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  198.428422][T11707] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  198.431199][T11707] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  198.489760][ T8864] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  198.494874][ T8864] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  198.511657][ T8864] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  198.517149][ T8864] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  199.317017][T11801] netlink: 'syz.2.2006': attribute type 1 has an invalid length.
[  199.370067][T11801] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2006'.
[  199.481606][T11811] wg1: Master is either lo or non-ether device
[  199.533352][T11813] vxcan0: entered promiscuous mode
[  199.758016][T11820] netlink: 'syz.2.2013': attribute type 3 has an invalid length.
[  199.760531][T11820] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2013'.
[  199.877432][ T5847] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  200.650501][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  200.656213][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  200.659092][   T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  200.662458][   T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  200.665744][   T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  200.783863][T11825] chnl_net:caif_netlink_parms(): no params data found
[  200.857155][T11825] bridge0: port 1(bridge_slave_0) entered blocking state
[  200.859689][T11825] bridge0: port 1(bridge_slave_0) entered disabled state
[  200.862197][T11825] bridge_slave_0: entered allmulticast mode
[  200.865613][T11825] bridge_slave_0: entered promiscuous mode
[  200.869633][T11825] bridge0: port 2(bridge_slave_1) entered blocking state
[  200.871975][T11825] bridge0: port 2(bridge_slave_1) entered disabled state
[  200.876385][T11825] bridge_slave_1: entered allmulticast mode
[  200.879211][T11825] bridge_slave_1: entered promiscuous mode
[  200.899070][T11825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  200.906542][T11825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  200.930253][T11825] team0: Port device team_slave_0 added
[  200.935754][T11825] team0: Port device team_slave_1 added
[  200.956371][T11825] batman_adv: batadv0: Adding interface: batadv_slave_0
[  200.958658][T11825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  200.967026][T11825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  200.971816][T11825] batman_adv: batadv0: Adding interface: batadv_slave_1
[  200.974897][T11825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  200.983312][T11825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  201.010154][T11825] hsr_slave_0: entered promiscuous mode
[  201.012504][T11825] hsr_slave_1: entered promiscuous mode
[  201.015172][T11825] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  201.017577][T11825] Cannot create hsr debugfs directory
[  201.410069][ T5847] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  201.481329][ T5847] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  201.561980][ T5847] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  201.584210][T11835] openvswitch: netlink: Tunnel attr 16359 out of range max 16
[  201.721460][T11840] netlink: 260 bytes leftover after parsing attributes in process `syz.2.2017'.
[  201.734129][T11840] netlink: 260 bytes leftover after parsing attributes in process `syz.2.2017'.
[  201.737754][T11840] netlink: 260 bytes leftover after parsing attributes in process `syz.2.2017'.
[  201.754884][ T5847] bridge_slave_1: left allmulticast mode
[  201.756703][ T5847] bridge_slave_1: left promiscuous mode
[  201.758638][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state
[  201.768479][ T5847] bridge_slave_0: left allmulticast mode
[  201.770606][ T5847] bridge_slave_0: left promiscuous mode
[  201.772485][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state
[  201.775212][T11840] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2017'.
[  201.804714][ T5828] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  201.808708][ T5828] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  201.811863][ T5828] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  201.815105][ T5828] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  201.817865][ T5828] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  202.020592][ T5847] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  202.025749][ T5847] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  202.029903][ T5847] bond0 (unregistering): Released all slaves
[  202.129680][T11847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  202.132306][T11847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  202.134968][T11847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  202.137557][T11847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  202.140245][T11847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  202.142845][T11847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  202.145573][T11847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  202.148261][T11847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  202.150818][T11847] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  202.175253][T11848] netlink: 'syz.2.2018': attribute type 12 has an invalid length.
[  202.178446][T11848] netlink: 9472 bytes leftover after parsing attributes in process `syz.2.2018'.
[  202.602277][T11851] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  202.689738][   T54] Bluetooth: hci0: command tx timeout
[  202.722973][T11851] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  202.737497][T11843] chnl_net:caif_netlink_parms(): no params data found
[  202.778861][ T5847] hsr_slave_0: left promiscuous mode
[  202.781309][ T5847] hsr_slave_1: left promiscuous mode
[  202.783589][ T5847] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  202.786400][ T5847] batman_adv: batadv0: Removing interface: batadv_slave_0
[  202.790163][ T5847] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  202.792947][ T5847] batman_adv: batadv0: Removing interface: batadv_slave_1
[  202.808459][ T5847] veth1_macvtap: left promiscuous mode
[  202.810674][ T5847] veth0_macvtap: left promiscuous mode
[  202.812977][ T5847] veth1_vlan: left promiscuous mode
[  202.817096][ T5847] veth0_vlan: left promiscuous mode
[  203.227075][ T5847] team0 (unregistering): Port device team_slave_1 removed
[  203.257383][ T5847] team0 (unregistering): Port device team_slave_0 removed
[  203.583085][T11851] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  203.706022][T11843] bridge0: port 1(bridge_slave_0) entered blocking state
[  203.709008][T11843] bridge0: port 1(bridge_slave_0) entered disabled state
[  203.711947][T11843] bridge_slave_0: entered allmulticast mode
[  203.725510][T11843] bridge_slave_0: entered promiscuous mode
[  203.740205][T11851] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  203.746549][T11825] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  203.753108][T11843] bridge0: port 2(bridge_slave_1) entered blocking state
[  203.760592][T11843] bridge0: port 2(bridge_slave_1) entered disabled state
[  203.763532][T11843] bridge_slave_1: entered allmulticast mode
[  203.775581][T11843] bridge_slave_1: entered promiscuous mode
[  203.778804][T11825] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  203.836525][T11825] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  203.849079][T11825] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  203.866842][T11843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  203.891795][   T54] Bluetooth: hci2: command tx timeout
[  203.897609][T11843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  203.937405][T11851] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  203.980015][T11843] team0: Port device team_slave_0 added
[  203.992653][T11851] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  204.011031][T11851] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  204.018343][T11843] team0: Port device team_slave_1 added
[  204.041254][T11851] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  204.067955][T11843] batman_adv: batadv0: Adding interface: batadv_slave_0
[  204.070426][T11843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  204.080706][T11843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  204.119075][T11843] batman_adv: batadv0: Adding interface: batadv_slave_1
[  204.121988][T11843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  204.154329][T11843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  204.219584][T11843] hsr_slave_0: entered promiscuous mode
[  204.221969][T11843] hsr_slave_1: entered promiscuous mode
[  204.234663][T11843] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  204.237101][T11843] Cannot create hsr debugfs directory
[  204.278858][ T5847] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  204.376951][ T5847] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  204.406751][T11825] 8021q: adding VLAN 0 to HW filter on device bond0
[  204.455036][ T5847] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  204.514354][ T5847] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  204.522802][T11825] 8021q: adding VLAN 0 to HW filter on device team0
[  204.530441][ T8854] bridge0: port 1(bridge_slave_0) entered blocking state
[  204.532807][ T8854] bridge0: port 1(bridge_slave_0) entered forwarding state
[  204.542523][ T8854] bridge0: port 2(bridge_slave_1) entered blocking state
[  204.544922][ T8854] bridge0: port 2(bridge_slave_1) entered forwarding state
[  204.655971][ T5847] bridge_slave_1: left allmulticast mode
[  204.660252][ T5847] bridge_slave_1: left promiscuous mode
[  204.664502][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state
[  204.671559][ T5847] bridge_slave_0: left allmulticast mode
[  204.673534][ T5847] bridge_slave_0: left promiscuous mode
[  204.678377][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state
[  204.768711][   T54] Bluetooth: hci0: command tx timeout
[  205.070922][ T5847] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  205.080813][ T5847] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  205.087662][ T5847] bond0 (unregistering): Released all slaves
[  205.130104][T11873] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN PTI
[  205.133927][T11873] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
[  205.136787][T11873] CPU: 1 UID: 0 PID: 11873 Comm: syz.2.2022 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  205.142015][T11873] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  205.145368][T11873] RIP: 0010:qdisc_tree_reduce_backlog+0x223/0x480
[  205.147589][T11873] Code: 89 ef e8 00 80 b3 f8 4d 89 ef 85 db 74 0d e8 34 fc 4f f8 4c 89 f5 e9 88 00 00 00 48 8b 6d 00 48 8d 45 20 48 89 c3 48 c1 eb 03 <42> 80 3c 33 00 48 89 04 24 74 0d 48 8b 3c 24 e8 c9 7f b3 f8 48 8b
[  205.154202][T11873] RSP: 0018:ffffc90002bcf128 EFLAGS: 00010202
[  205.156269][T11873] RAX: 0000000000000020 RBX: 0000000000000004 RCX: 0000000000000002
[  205.158969][T11873] RDX: ffff888107a18000 RSI: 0000000000000000 RDI: 0000000000000000
[  205.161657][T11873] RBP: 0000000000000000 R08: ffff888107a18000 R09: 0000000000000002
[  205.164347][T11873] R10: 00000000ffffffff R11: 0000000000000002 R12: 00000000000a0009
[  205.167088][T11873] R13: ffff88810f819800 R14: dffffc0000000000 R15: ffff88810f819800
[  205.170348][T11873] FS:  00007f32fa6736c0(0000) GS:ffff8881a3c50000(0000) knlGS:0000000000000000
[  205.173376][T11873] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  205.175596][T11873] CR2: 000000110c2aa198 CR3: 000000010d208000 CR4: 00000000000006f0
[  205.178334][T11873] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  205.180976][T11873] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  205.183655][T11873] Call Trace:
[  205.184799][T11873]  <TASK>
[  205.185843][T11873]  ? qdisc_tree_reduce_backlog+0x3c/0x480
[  205.187940][T11873]  hhf_change+0x764/0xad0
[  205.189696][T11873]  ? __pfx_hhf_change+0x10/0x10
[  205.191397][T11873]  ? __pfx_hhf_init+0x10/0x10
[  205.193034][T11873]  hhf_init+0x213/0x950
[  205.194515][T11873]  ? __pfx_hhf_init+0x10/0x10
[  205.196376][T11873]  qdisc_create+0x7ac/0xea0
[  205.197876][T11873]  tc_modify_qdisc+0x1426/0x2010
[  205.199525][T11873]  ? __pfx_tc_modify_qdisc+0x10/0x10
[  205.201256][T11873]  ? __pfx_tc_modify_qdisc+0x10/0x10
[  205.202972][T11873]  rtnetlink_rcv_msg+0x77c/0xb70
[  205.204585][T11873]  ? rtnetlink_rcv_msg+0x1ab/0xb70
[  205.206285][T11873]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  205.208039][T11873]  ? ref_tracker_free+0x63a/0x7d0
[  205.209646][T11873]  ? __copy_skb_header+0xa7/0x550
[  205.211238][T11873]  ? __pfx_ref_tracker_free+0x10/0x10
[  205.212941][T11873]  netlink_rcv_skb+0x208/0x470
[  205.214487][T11873]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  205.216535][T11873]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  205.218313][T11873]  ? netlink_deliver_tap+0x2e/0x1b0
[  205.219961][T11873]  ? netlink_deliver_tap+0x2e/0x1b0
[  205.221680][T11873]  netlink_unicast+0x75b/0x8d0
[  205.223362][T11873]  netlink_sendmsg+0x805/0xb30
[  205.225058][T11873]  ? __pfx_netlink_sendmsg+0x10/0x10
[  205.226853][T11873]  ? aa_sock_msg_perm+0x94/0x160
[  205.228443][T11873]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  205.230121][T11873]  ? __pfx_netlink_sendmsg+0x10/0x10
[  205.231821][T11873]  __sock_sendmsg+0x21c/0x270
[  205.233396][T11873]  ____sys_sendmsg+0x505/0x830
[  205.235052][T11873]  ? __pfx_____sys_sendmsg+0x10/0x10
[  205.237293][T11873]  ? import_iovec+0x74/0xa0
[  205.238863][T11873]  ___sys_sendmsg+0x21f/0x2a0
[  205.240410][T11873]  ? __pfx____sys_sendmsg+0x10/0x10
[  205.242261][T11873]  ? __fget_files+0x2a/0x420
[  205.243948][T11873]  ? __fget_files+0x3a0/0x420
[  205.245547][T11873]  __x64_sys_sendmsg+0x19b/0x260
[  205.247117][T11873]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  205.248853][T11873]  ? rcu_is_watching+0x15/0xb0
[  205.250385][T11873]  ? do_syscall_64+0xbe/0x3b0
[  205.251933][T11873]  do_syscall_64+0xfa/0x3b0
[  205.253434][T11873]  ? lockdep_hardirqs_on+0x9c/0x150
[  205.255317][T11873]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  205.257559][T11873]  ? exc_page_fault+0x9f/0xf0
[  205.259147][T11873]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  205.261130][T11873] RIP: 0033:0x7f32f978e929
[  205.262611][T11873] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  205.269256][T11873] RSP: 002b:00007f32fa673038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  205.271934][T11873] RAX: ffffffffffffffda RBX: 00007f32f99b5fa0 RCX: 00007f32f978e929
[  205.274548][T11873] RDX: 0000000000004000 RSI: 0000200000000280 RDI: 0000000000000007
[  205.277412][T11873] RBP: 00007f32f9810b39 R08: 0000000000000000 R09: 0000000000000000
[  205.279997][T11873] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  205.282596][T11873] R13: 0000000000000000 R14: 00007f32f99b5fa0 R15: 00007fff5a432648
[  205.285207][T11873]  </TASK>
[  205.286372][T11873] Modules linked in:
[  205.288147][T11873] ---[ end trace 0000000000000000 ]---
[  205.290058][T11873] RIP: 0010:qdisc_tree_reduce_backlog+0x223/0x480
[  205.292301][T11873] Code: 89 ef e8 00 80 b3 f8 4d 89 ef 85 db 74 0d e8 34 fc 4f f8 4c 89 f5 e9 88 00 00 00 48 8b 6d 00 48 8d 45 20 48 89 c3 48 c1 eb 03 <42> 80 3c 33 00 48 89 04 24 74 0d 48 8b 3c 24 e8 c9 7f b3 f8 48 8b
[  205.299041][T11873] RSP: 0018:ffffc90002bcf128 EFLAGS: 00010202
[  205.301038][T11873] RAX: 0000000000000020 RBX: 0000000000000004 RCX: 0000000000000002
[  205.304072][T11873] RDX: ffff888107a18000 RSI: 0000000000000000 RDI: 0000000000000000
[  205.306773][T11873] RBP: 0000000000000000 R08: ffff888107a18000 R09: 0000000000000002
[  205.309504][T11873] R10: 00000000ffffffff R11: 0000000000000002 R12: 00000000000a0009
[  205.312139][T11873] R13: ffff88810f819800 R14: dffffc0000000000 R15: ffff88810f819800
[  205.315321][T11873] FS:  00007f32fa6736c0(0000) GS:ffff8881a3c50000(0000) knlGS:0000000000000000
[  205.318863][T11873] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  205.321523][T11873] CR2: 000000110c2aa198 CR3: 000000010d208000 CR4: 00000000000006f0
[  205.324756][T11873] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  205.327286][T11873] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  205.329781][T11873] Kernel panic - not syncing: Fatal exception in interrupt
[  205.332688][T11873] Kernel Offset: disabled
[  205.334380][T11873] Rebooting in 86400 seconds..

VM DIAGNOSIS:
15:25:05  Registers:
info registers vcpu 0

CPU#0
RAX=1ffff11004916730 RBX=ffffffff8f50ffb0 RCX=ffffffff819da768 RDX=0000000000000000
RSI=0000000000000008 RDI=0000000000000001 RBP=1ffffffff1ea1fec RSP=ffffc90009aef848
R8 =ffffffff8f50ff67 R9 =1ffffffff1ea1fec R10=dffffc0000000000 R11=fffffbfff1ea1fed
R12=ffffffff8f50ff60 R13=ffffffff8f50ffb0 R14=dffffc0000000000 R15=ffff888107a18000
RIP=ffffffff819da75b RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8650000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fac4123a440 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=7269642065676e61 68632074276e6163 XMM01=2e36312e3627206f 742079726f746365
XMM02=2d72656c6c616b7a 79732d3363722d30 XMM03=6638383232653332 32672d3935313030
XMM04=2779747269642d38 6234663838323265 XMM05=333232672d393531 30302d72656c6c61
XMM06=6b7a79732d336372 2d302e36312e3627 XMM07=206f742079726f74 6365726964206567
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000031 RBX=0000000000000031 RCX=0000000000000000 RDX=00000000000003f8
RSI=000000000000177e RDI=000000000000177f RBP=00000000000003f8 RSP=ffffc90002bce8b0
R8 =ffff888021028237 R9 =1ffff11004205046 R10=dffffc0000000000 R11=ffffffff85474610
R12=dffffc0000000000 R13=ffffffff99ac48c8 R14=ffffffff99dc9760 R15=0000000000000000
RIP=ffffffff8547468c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f32fa6736c0 ffffffff 00c00000
GS =0000 ffff8881a3c50000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c2aa198 CR3=000000010d208000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f32f9984478 00007f32f9984450 XMM03=00007f32f9984488 00007f32f9984480
XMM04=00007f32fa4ed100 00007f32f9984440 XMM05=00007f32f9984458 00007f32f99844a0
XMM06=00007f32f9984498 00007f32f9984490 XMM07=00007f32f9984488 00007f32f9984480
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f32f9811c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
