last executing test programs:

17.152486401s ago: executing program 1 (id=69):
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0)
r0 = bpf$ITER_CREATE(0x21, 0x0, 0x0)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, 0x0, 0x0)
bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, 0x0, 0x0}, 0x94)
socket$kcm(0xa, 0x3, 0x73)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0)
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='fib6_table_lookup\x00', r2}, 0x10)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x2, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x40082406, &(0x7f00000001c0)='cpu~00\t&&')
socket$kcm(0xa, 0x5, 0x0)

17.151086792s ago: executing program 0 (id=70):
ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x541b, 0x0)
perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8020, 0x90000, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x2, 0x6}, 0x8224, 0x2, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000024c0), &(0x7f0000001280), 0x2}, 0x90)

17.10438937s ago: executing program 0 (id=71):
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x3000c041)
r1 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08061cdc030ec080000000060000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f2130809d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff000000000000000000", 0x89}], 0x1}, 0x0)

17.104171096s ago: executing program 0 (id=72):
socketpair$unix(0x1, 0x5, 0x0, 0x0)
r0 = socket$kcm(0xa, 0x5, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x8)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={0xffffffffffffffff, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x2000, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
setsockopt$sock_attach_bpf(r0, 0x29, 0x1a, &(0x7f0000000140), 0x4)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x78, 0x0, 0x0)
sendmsg$kcm(r0, &(0x7f00000003c0)={&(0x7f0000000040)=@in6={0xa, 0x4e23, 0xd, @local, 0x7}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000000)="f1", 0x1}], 0x1}, 0x40040)

17.024656587s ago: executing program 1 (id=73):
r0 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="89000000120081ae08060cdc030000007f1be3f74001000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014006040400000400009bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0)

16.969499018s ago: executing program 1 (id=74):
r0 = socket$kcm(0xf, 0x3, 0x2)
sendmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000003c0)="a67139e977f06b8606b6d054d9bf2b52", 0x10}, {0x0}], 0x2}, 0x0)

16.969352162s ago: executing program 1 (id=75):
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x5, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x23}, [@ldst={0x1, 0x0, 0x3, 0x1, 0x1, 0x8}, @call={0x85, 0x0, 0x0, 0xc6}]}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x6f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffc0}, 0x94)

16.92846165s ago: executing program 0 (id=76):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="11000000040000000400000001"], 0x48)
r1 = socket$kcm(0x2c, 0x3, 0x0)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f00000001c0)=r1}, 0x20)
close(r1)

16.85388316s ago: executing program 1 (id=78):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xb, 0x4f, 0x200cc, 0x6, 0x5}, 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240), 0x4af, r0}, 0x38)
syz_clone(0xa49a4080, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc)

16.853557155s ago: executing program 2 (id=79):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x7, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x9d}}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

16.853301685s ago: executing program 0 (id=80):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xc, 0xd, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000015000000850000000700000095"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000080)="0000090000980500000000000800", 0x0, 0x7fffffff, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50)

16.784180516s ago: executing program 2 (id=81):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff)
r0 = socket$kcm(0xa, 0x2, 0x73)
close(r0)

15.912913016s ago: executing program 0 (id=82):
bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x50)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_config_ext={0xffffffffffffffff, 0x8001}, 0x0, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0xa4706, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x320, 0x0, 0x0, 0x2}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r0}, 0x8)
close(0xffffffffffffffff)
r2 = socket$kcm(0x2, 0x5, 0x84)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x9, 0x3, 0x4c}, 0x48)
close(0xffffffffffffffff)
recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r3=>0xffffffffffffffff]}}], 0x18}, 0x0)
setsockopt$sock_attach_bpf(r2, 0x84, 0xd, &(0x7f0000000000)=r3, 0x8)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
r4 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$sock_attach_bpf(r4, 0x29, 0x4b, 0x0, 0x0)
socketpair(0x1, 0x1, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0xfeffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), 0x0, 0x3}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002d40)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x10000000}, 0x8}, 0x94)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_clone(0x600, 0x0, 0x0, 0x0, 0x0, 0x0)
close(0xffffffffffffffff)

15.912673961s ago: executing program 2 (id=83):
r0 = socket$kcm(0xa, 0x1, 0x106)
setsockopt$sock_attach_bpf(r0, 0x29, 0x4a, 0x0, 0x0)

15.912403851s ago: executing program 1 (id=84):
bpf$PROG_BIND_MAP(0x23, 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000c00)="d8000000180081054e81f782db4cb904021d080006407c09e8fe55a10a0015000500142603600e1208000f0000000401a8000900080008400400027c8c000461c1d67f6f95001600cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d96f54f6f7848b66ea00a24843d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d", 0xa2}], 0x1}, 0x84)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000400), 0x4)
perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d2f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socketpair$tipc(0x1e, 0x2, 0x0, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0)
close(r1)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff7)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x50)
ioctl$TUNGETVNETLE(r1, 0x40047451, &(0x7f0000000180))
socket$kcm(0x10, 0x2, 0x0)
close(r1)
socketpair(0x1d, 0x2, 0x6, &(0x7f0000000300))
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r2 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x3)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0)
bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8913, &(0x7f0000000cc0)='lo:\x96o8\x14d\xa1\xba\xda\xd1\xa0J\x12tQ\xb16\xe3\xd7\\b\x8b\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00l \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x02\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xeb\xe1\xde\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xfc\xfa 6(%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc5<J\x1f\xba\xfc\x90(\x985\x93\xa8\xd4\xf0\xbdTy\x18\xc8\xa0\xbb\x99\x8c\xe0Q\xffCl\xbdX~3\xa1\xa2\xf4\xd9\xf7\xc7\xfb\xce\x959x\xfeW\r\xf0{\xcaT\xecp)=\x9d\xdfG8\xa1\xe3=\xa6\x00\x98\xc1\xb3\x91-\xab\'W\x8al?d<JN\xcb\xd4H\xb0_jO\xf3\x90\xe8/l\xdfg)\x8d#\xfdo\xa9L\xdeA*\xec\xa1\x14,\xe8\x8d^\xb9r=\xc0\x18\xd4\x11dU[Ry\xed\xd6\x97\x8a\xe8\xca\x99\x10\x8e\xc8P\xa3\xae/\xdaof\x06\x7f\xf7\x80$f\b\x92\xae\xeb\xdd\"\x89\xb8\xf0\xc3\b\x00\x00\x00\x00\a\xf6\xfc\x1d\xd4\x893\xeb)\xc1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00O!\xd2q\xda}\xe2\xa2\xfe\xfd)\\\xdf\x9aN\\\xaeyc\xe4g\xc0\x8a\n\v{\xa9H\\\xd1\x9d')
syz_clone(0xf0000200, &(0x7f0000000000)="4f5512125dd5d70997899ec7665aa2105df84f16d04387cacfae3bfeb595f8e060b1283eeff1a40bb7af87f48039fce4abbe", 0x32, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)="2272da5fde0d22d286260ee9fabead5c1a426818f21bc5579cd54abc546f19f8faac535395045e4e04c3e611ce1519d5d52617fb577388b7ee88785c609eccf2a39a45af2630ad90c0984e5732030a81f3c8aed756de1bbf2d68919b32378c703658e02dbb92a29b8ba3a4ed7cb6e95ea435a9fde5023ac291")

15.750153048s ago: executing program 2 (id=85):
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000740)={{r0}, &(0x7f00000008c0), &(0x7f0000000780)='%+9llu \x00'}, 0x20)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x10, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000004000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x2f08, 0x10, 0x10, &(0x7f00000006c0)="0000000000000005", &(0x7f0000000700)=""/8, 0x447, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c)

15.746936691s ago: executing program 2 (id=86):
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61123000000000006113100000000000bf2000000000000016000200071b48013d030100000000009500000000000000bc26000000000000bf67000000000000070200000fff0700670200001f000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)

15.743543773s ago: executing program 2 (id=87):
r0 = socket$kcm(0x11, 0x3, 0x0)
sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x2c}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000000)='s', 0x1}], 0x1}, 0x480c0)

313.207662ms ago: executing program 32 (id=82):
bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x50)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_config_ext={0xffffffffffffffff, 0x8001}, 0x0, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0xa4706, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x320, 0x0, 0x0, 0x2}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r0}, 0x8)
close(0xffffffffffffffff)
r2 = socket$kcm(0x2, 0x5, 0x84)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x9, 0x3, 0x4c}, 0x48)
close(0xffffffffffffffff)
recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r3=>0xffffffffffffffff]}}], 0x18}, 0x0)
setsockopt$sock_attach_bpf(r2, 0x84, 0xd, &(0x7f0000000000)=r3, 0x8)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
r4 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$sock_attach_bpf(r4, 0x29, 0x4b, 0x0, 0x0)
socketpair(0x1, 0x1, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0xfeffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), 0x0, 0x3}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002d40)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x10000000}, 0x8}, 0x94)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_clone(0x600, 0x0, 0x0, 0x0, 0x0, 0x0)
close(0xffffffffffffffff)

156.953788ms ago: executing program 33 (id=84):
bpf$PROG_BIND_MAP(0x23, 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000c00)="d8000000180081054e81f782db4cb904021d080006407c09e8fe55a10a0015000500142603600e1208000f0000000401a8000900080008400400027c8c000461c1d67f6f95001600cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d96f54f6f7848b66ea00a24843d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d", 0xa2}], 0x1}, 0x84)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000400), 0x4)
perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d2f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socketpair$tipc(0x1e, 0x2, 0x0, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0)
close(r1)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff7)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x50)
ioctl$TUNGETVNETLE(r1, 0x40047451, &(0x7f0000000180))
socket$kcm(0x10, 0x2, 0x0)
close(r1)
socketpair(0x1d, 0x2, 0x6, &(0x7f0000000300))
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r2 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x3)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0)
bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8913, &(0x7f0000000cc0)='lo:\x96o8\x14d\xa1\xba\xda\xd1\xa0J\x12tQ\xb16\xe3\xd7\\b\x8b\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00l \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x02\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xeb\xe1\xde\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xfc\xfa 6(%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc5<J\x1f\xba\xfc\x90(\x985\x93\xa8\xd4\xf0\xbdTy\x18\xc8\xa0\xbb\x99\x8c\xe0Q\xffCl\xbdX~3\xa1\xa2\xf4\xd9\xf7\xc7\xfb\xce\x959x\xfeW\r\xf0{\xcaT\xecp)=\x9d\xdfG8\xa1\xe3=\xa6\x00\x98\xc1\xb3\x91-\xab\'W\x8al?d<JN\xcb\xd4H\xb0_jO\xf3\x90\xe8/l\xdfg)\x8d#\xfdo\xa9L\xdeA*\xec\xa1\x14,\xe8\x8d^\xb9r=\xc0\x18\xd4\x11dU[Ry\xed\xd6\x97\x8a\xe8\xca\x99\x10\x8e\xc8P\xa3\xae/\xdaof\x06\x7f\xf7\x80$f\b\x92\xae\xeb\xdd\"\x89\xb8\xf0\xc3\b\x00\x00\x00\x00\a\xf6\xfc\x1d\xd4\x893\xeb)\xc1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00O!\xd2q\xda}\xe2\xa2\xfe\xfd)\\\xdf\x9aN\\\xaeyc\xe4g\xc0\x8a\n\v{\xa9H\\\xd1\x9d')
syz_clone(0xf0000200, &(0x7f0000000000)="4f5512125dd5d70997899ec7665aa2105df84f16d04387cacfae3bfeb595f8e060b1283eeff1a40bb7af87f48039fce4abbe", 0x32, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)="2272da5fde0d22d286260ee9fabead5c1a426818f21bc5579cd54abc546f19f8faac535395045e4e04c3e611ce1519d5d52617fb577388b7ee88785c609eccf2a39a45af2630ad90c0984e5732030a81f3c8aed756de1bbf2d68919b32378c703658e02dbb92a29b8ba3a4ed7cb6e95ea435a9fde5023ac291")

0s ago: executing program 34 (id=87):
r0 = socket$kcm(0x11, 0x3, 0x0)
sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x2c}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000000)='s', 0x1}], 0x1}, 0x480c0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:18797' (ED25519) to the list of known hosts.
syzkaller login: [   40.817473][ T5754] cgroup: Unknown subsys name 'net'
[   40.959605][ T5754] cgroup: Unknown subsys name 'cpuset'
[   40.966963][ T5754] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   42.312140][ T5754] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   45.494507][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   45.497782][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   45.500384][   T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   45.503452][   T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   45.506616][ T5829] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   45.509315][ T5829] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   45.515382][ T5833] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   45.530972][ T5833] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   45.533427][ T5833] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   45.536756][ T5833] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   45.546155][ T5219] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   45.553340][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   45.557917][ T5219] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   45.563197][ T5219] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   45.570628][ T5219] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   45.731000][ T5826] chnl_net:caif_netlink_parms(): no params data found
[   45.794567][ T5830] chnl_net:caif_netlink_parms(): no params data found
[   45.828416][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.830867][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state
[   45.833311][ T5826] bridge_slave_0: entered allmulticast mode
[   45.836661][ T5826] bridge_slave_0: entered promiscuous mode
[   45.851200][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.853478][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state
[   45.856678][ T5826] bridge_slave_1: entered allmulticast mode
[   45.859374][ T5826] bridge_slave_1: entered promiscuous mode
[   45.877866][ T5834] chnl_net:caif_netlink_parms(): no params data found
[   45.905733][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   45.913508][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   45.916992][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.919345][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state
[   45.922119][ T5830] bridge_slave_0: entered allmulticast mode
[   45.924768][ T5830] bridge_slave_0: entered promiscuous mode
[   45.943006][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.946035][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state
[   45.948394][ T5830] bridge_slave_1: entered allmulticast mode
[   45.951089][ T5830] bridge_slave_1: entered promiscuous mode
[   45.988721][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   45.996660][ T5826] team0: Port device team_slave_0 added
[   45.999968][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   46.013965][ T5826] team0: Port device team_slave_1 added
[   46.043342][ T5830] team0: Port device team_slave_0 added
[   46.045894][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.048174][ T5834] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.050473][ T5834] bridge_slave_0: entered allmulticast mode
[   46.053095][ T5834] bridge_slave_0: entered promiscuous mode
[   46.063339][ T5830] team0: Port device team_slave_1 added
[   46.065990][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.068269][ T5834] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.070558][ T5834] bridge_slave_1: entered allmulticast mode
[   46.073178][ T5834] bridge_slave_1: entered promiscuous mode
[   46.076062][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0
[   46.078336][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.087002][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   46.111190][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1
[   46.113480][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.122154][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   46.129719][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0
[   46.131945][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.140070][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   46.152572][ T5834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   46.156053][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1
[   46.158282][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.166610][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   46.171723][ T5834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   46.216986][ T5826] hsr_slave_0: entered promiscuous mode
[   46.219377][ T5826] hsr_slave_1: entered promiscuous mode
[   46.229723][ T5834] team0: Port device team_slave_0 added
[   46.234295][ T5830] hsr_slave_0: entered promiscuous mode
[   46.237138][ T5830] hsr_slave_1: entered promiscuous mode
[   46.239269][ T5830] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   46.241828][ T5830] Cannot create hsr debugfs directory
[   46.252150][ T5834] team0: Port device team_slave_1 added
[   46.300774][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_0
[   46.303091][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.312241][ T5834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   46.325894][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_1
[   46.328149][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.336319][ T5834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   46.421162][ T5834] hsr_slave_0: entered promiscuous mode
[   46.423693][ T5834] hsr_slave_1: entered promiscuous mode
[   46.426506][ T5834] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   46.429015][ T5834] Cannot create hsr debugfs directory
[   46.488187][ T5830] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   46.493826][ T5830] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   46.510773][ T5830] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   46.525563][ T5830] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   46.564367][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.567029][ T5830] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.569745][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.572038][ T5830] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.576415][ T5826] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   46.582581][ T5826] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   46.594810][ T5826] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   46.608594][ T5826] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   46.640680][ T5834] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   46.645140][ T5834] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   46.651884][ T5834] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   46.657045][ T5834] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   46.662134][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.664950][ T5826] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.667600][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.669988][ T5826] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.691568][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.702219][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.704584][ T5834] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.707149][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.709508][ T5834] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.724520][   T29] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.728096][   T29] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.732490][   T29] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.736361][   T29] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.740874][   T29] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.744461][   T29] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.754784][ T5830] 8021q: adding VLAN 0 to HW filter on device team0
[   46.771189][   T29] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.773461][   T29] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.783120][   T29] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.786110][   T29] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.796218][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.816570][ T5826] 8021q: adding VLAN 0 to HW filter on device team0
[   46.832362][ T2895] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.834729][ T2895] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.842415][ T5834] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.847755][ T2895] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.850105][ T2895] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.870144][ T5834] 8021q: adding VLAN 0 to HW filter on device team0
[   46.893975][ T2895] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.896642][ T2895] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.911715][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.914008][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.954728][ T5834] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   47.000034][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0
[   47.011104][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0
[   47.049649][ T5830] veth0_vlan: entered promiscuous mode
[   47.053590][ T5826] veth0_vlan: entered promiscuous mode
[   47.062700][ T5830] veth1_vlan: entered promiscuous mode
[   47.065235][ T5826] veth1_vlan: entered promiscuous mode
[   47.072251][ T5834] 8021q: adding VLAN 0 to HW filter on device batadv0
[   47.096829][ T5826] veth0_macvtap: entered promiscuous mode
[   47.100174][ T5830] veth0_macvtap: entered promiscuous mode
[   47.107853][ T5826] veth1_macvtap: entered promiscuous mode
[   47.113126][ T5830] veth1_macvtap: entered promiscuous mode
[   47.131201][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0
[   47.134954][ T5834] veth0_vlan: entered promiscuous mode
[   47.140369][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0
[   47.146282][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1
[   47.150787][ T5834] veth1_vlan: entered promiscuous mode
[   47.158299][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1
[   47.162591][ T5826] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   47.165886][ T5826] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   47.168645][ T5826] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   47.171424][ T5826] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   47.177818][ T5830] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   47.180727][ T5830] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   47.183578][ T5830] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   47.188354][ T5830] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   47.222225][ T5834] veth0_macvtap: entered promiscuous mode
[   47.238275][ T5834] veth1_macvtap: entered promiscuous mode
[   47.250706][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_0
[   47.272247][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_1
[   47.283071][ T3052] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.283111][ T5834] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   47.288931][ T3052] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.290040][ T5834] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   47.294143][ T5834] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   47.298107][ T5834] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   47.315501][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.318214][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.336509][ T2895] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.339033][ T2895] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.347534][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.351281][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.374652][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.380421][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.397875][ T5830] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   47.403657][   T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.412048][   T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.509813][    C0] hrtimer: interrupt took 95000 ns
[   47.607611][ T5219] Bluetooth: hci2: command tx timeout
[   47.609619][   T54] Bluetooth: hci0: command tx timeout
[   47.611705][ T5833] Bluetooth: hci1: command tx timeout
[   47.949623][ T5937] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   48.037127][ T5943] netlink: 'syz.1.24': attribute type 21 has an invalid length.
[   48.039741][ T5943] netlink: 128 bytes leftover after parsing attributes in process `syz.1.24'.
[   48.042663][ T5943] netlink: 'syz.1.24': attribute type 6 has an invalid length.
[   48.045178][ T5943] netlink: 3 bytes leftover after parsing attributes in process `syz.1.24'.
[   48.217474][ T5949] netlink: 13435 bytes leftover after parsing attributes in process `syz.2.27'.
[   48.222525][ T5949] Zero length message leads to an empty skb
[   49.555202][ T6004] netlink: 132 bytes leftover after parsing attributes in process `syz.1.52'.
[   49.685400][ T5833] Bluetooth: hci1: command tx timeout
[   49.687927][ T5833] Bluetooth: hci2: command tx timeout
[   49.689739][ T5833] Bluetooth: hci0: command tx timeout
[   49.786449][ T6026] netlink: 'syz.2.63': attribute type 1 has an invalid length.
[   49.791074][ T6026] netlink: 16150 bytes leftover after parsing attributes in process `syz.2.63'.
[   50.019798][ T6038] netlink: 'syz.1.68': attribute type 4 has an invalid length.
[   50.022928][ T6038] netlink: 'syz.1.68': attribute type 3 has an invalid length.
[   50.028103][ T6036] netlink: 132 bytes leftover after parsing attributes in process `syz.2.66'.
[   50.033186][ T6038] netlink: 199820 bytes leftover after parsing attributes in process `syz.1.68'.
[   50.039015][ T5219] Bluetooth: hci2: ISO packet for unknown connection handle 3327
[   50.054920][ T5219] Bluetooth: hci2: unexpected subevent 0x01 length: 150 > 18
[   50.301925][ T6048] syz.0.72 (6048) used greatest stack depth: 20160 bytes left
[   67.206231][ T5219] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   67.209618][ T5219] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   67.215487][ T5219] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   67.218594][ T5219] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   67.221530][ T5219] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   67.295623][ T5219] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   67.301032][ T5219] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   67.303611][ T5219] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   67.307779][ T5219] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   67.310257][ T5219] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   67.482654][ T5219] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   67.486349][ T5219] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   67.489032][ T5219] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   67.491709][ T5219] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   67.494236][ T5219] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   69.285454][ T5219] Bluetooth: hci3: command tx timeout
[   69.366031][ T5219] Bluetooth: hci4: command tx timeout
[   69.525505][ T5219] Bluetooth: hci5: command tx timeout
[   71.365688][ T5219] Bluetooth: hci3: command tx timeout
[   71.445504][ T5219] Bluetooth: hci4: command tx timeout
[   71.605580][ T5219] Bluetooth: hci5: command tx timeout
[   73.445471][ T5219] Bluetooth: hci3: command tx timeout
[   73.525389][ T5219] Bluetooth: hci4: command tx timeout
[   73.685478][ T5219] Bluetooth: hci5: command tx timeout
[   75.525527][ T5219] Bluetooth: hci3: command tx timeout
[   75.615629][ T5219] Bluetooth: hci4: command tx timeout
[   75.765425][ T5219] Bluetooth: hci5: command tx timeout
[   81.061615][   T52] cfg80211: failed to load regulatory.db
[  128.346864][ T5832] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  128.350582][ T5832] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  128.353121][ T5832] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  128.356601][ T5832] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  128.359418][ T5832] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  128.370854][ T5832] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  128.373759][ T5832] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  128.377824][ T5832] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  128.380716][ T5832] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  128.383496][ T5832] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  128.395460][ T5832] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1
[  128.398197][ T5832] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9
[  128.400787][ T5832] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9
[  128.403490][ T5832] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4
[  128.408382][ T5832] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2
[  130.405466][   T54] Bluetooth: hci6: command tx timeout
[  130.408110][ T5829] Bluetooth: hci7: command tx timeout
[  130.485533][ T5829] Bluetooth: hci8: command tx timeout
[  132.485444][   T54] Bluetooth: hci6: command tx timeout
[  132.487763][ T5829] Bluetooth: hci7: command tx timeout
[  132.565525][ T5829] Bluetooth: hci8: command tx timeout
[  134.565445][ T5829] Bluetooth: hci7: command tx timeout
[  134.567262][ T5829] Bluetooth: hci6: command tx timeout
[  134.645547][   T54] Bluetooth: hci8: command tx timeout
[  136.655563][ T5829] Bluetooth: hci7: command tx timeout
[  136.657365][   T54] Bluetooth: hci6: command tx timeout
[  136.725529][   T54] Bluetooth: hci8: command tx timeout
[  156.345252][    C0] rcu: INFO: rcu_preempt self-detected stall on CPU
[  156.347489][    C0] rcu: 	0-....: (10499 ticks this GP) idle=3c44/1/0x4000000000000000 softirq=14671/14674 fqs=4522
[  156.352218][    C0] rcu: 	         hardirqs   softirqs   csw/system
[  156.354355][    C0] rcu: 	 number:  1033214          0            0
[  156.356415][    C0] rcu: 	cputime:    25293      27195           92   ==> 52490(ms)
SYZFAIL: failed to recv rpc
[  156.358879][    C0] rcu: 	(t=10500 jiffies g=5961 q=3295 ncpus=2)
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  156.361137][    C0] CPU: 0 UID: 0 PID: 6069 Comm: syz.0.82 Not tainted 6.16.0-rc6-syzkaller-00434-gcd7c97f4584a-dirty #0 PREEMPT(full) 
[  156.361146][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  156.361151][    C0] RIP: 0010:rcu_read_unlock_special+0x87/0x4c0
[  156.361169][    C0] Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 92 37 f8 10 41 f7 c6 00 00 f0 00 74 49 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
[  156.361175][    C0] RSP: 0018:ffffc90000007600 EFLAGS: 00000206
[  156.361182][    C0] RAX: 4e971bcfa019ab00 RBX: 1ffff92000000ec8 RCX: 4e971bcfa019ab00
[  156.361187][    C0] RDX: 0000000000000003 RSI: ffffffff8d998701 RDI: ffffffff8be29f80
[  156.361192][    C0] RBP: ffffc900000076f8 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  156.361196][    C0] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: ffffffff8e144400
[  156.361201][    C0] R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000001
[  156.361206][    C0] FS:  00007fc5ae5836c0(0000) GS:ffff8880b861f000(0000) knlGS:0000000000000000
[  156.361211][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  156.361215][    C0] CR2: 0000001b30114ff8 CR3: 0000000121730000 CR4: 00000000000006f0
[  156.361240][    C0] Call Trace:
[  156.361246][    C0]  <IRQ>
[  156.361248][    C0]  ? __lock_acquire+0xab9/0xd20
[  156.361261][    C0]  ? __pfx_rcu_read_unlock_special+0x10/0x10
[  156.361278][    C0]  ? unwind_next_frame+0xa5/0x2390
[  156.361290][    C0]  __rcu_read_unlock+0x84/0xe0
[  156.361301][    C0]  ? unwind_next_frame+0xa5/0x2390
[  156.361307][    C0]  unwind_next_frame+0x19ae/0x2390
[  156.361317][    C0]  ? unwind_next_frame+0xa5/0x2390
[  156.361325][    C0]  ? irq_exit_rcu+0x9/0x30
[  156.361335][    C0]  ? rcu_core+0xc34/0x1710
[  156.361341][    C0]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  156.361351][    C0]  arch_stack_walk+0x11c/0x150
[  156.361363][    C0]  ? sysvec_apic_timer_interrupt+0xa6/0xc0
[  156.361375][    C0]  stack_trace_save+0x9c/0xe0
[  156.361384][    C0]  ? __pfx_stack_trace_save+0x10/0x10
[  156.361393][    C0]  ? __irq_exit_rcu+0xd8/0x1f0
[  156.361400][    C0]  ? __pfx___irq_exit_rcu+0x10/0x10
[  156.361409][    C0]  kasan_save_track+0x3e/0x80
[  156.361420][    C0]  ? kasan_save_track+0x3e/0x80
[  156.361429][    C0]  ? kasan_save_free_info+0x46/0x50
[  156.361437][    C0]  ? __kasan_slab_free+0x62/0x70
[  156.361442][    C0]  ? slab_free_after_rcu_debug+0x129/0x2a0
[  156.361452][    C0]  ? rcu_core+0xca8/0x1710
[  156.361458][    C0]  ? handle_softirqs+0x286/0x870
[  156.361464][    C0]  ? __irq_exit_rcu+0xca/0x1f0
[  156.361470][    C0]  ? irq_exit_rcu+0x9/0x30
[  156.361497][    C0]  kasan_save_free_info+0x46/0x50
[  156.361505][    C0]  __kasan_slab_free+0x62/0x70
[  156.361512][    C0]  slab_free_after_rcu_debug+0x129/0x2a0
[  156.361521][    C0]  ? __pfx_slab_free_after_rcu_debug+0x10/0x10
[  156.361529][    C0]  ? rcu_core+0xc34/0x1710
[  156.361535][    C0]  rcu_core+0xca8/0x1710
[  156.361550][    C0]  ? __pfx_rcu_core+0x10/0x10
[  156.361561][    C0]  ? __pfx_tmigr_handle_remote+0x10/0x10
[  156.361569][    C0]  ? seqcount_lockdep_reader_access+0x15f/0x1c0
[  156.361587][    C0]  handle_softirqs+0x286/0x870
[  156.361597][    C0]  ? __irq_exit_rcu+0xca/0x1f0
[  156.361606][    C0]  ? __pfx_handle_softirqs+0x10/0x10
[  156.361616][    C0]  ? irqtime_account_irq+0xb6/0x1c0
[  156.361628][    C0]  __irq_exit_rcu+0xca/0x1f0
[  156.361636][    C0]  ? __pfx___irq_exit_rcu+0x10/0x10
[  156.361647][    C0]  irq_exit_rcu+0x9/0x30
[  156.361654][    C0]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  156.361661][    C0]  </IRQ>
[  156.361663][    C0]  <TASK>
[  156.361666][    C0]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  156.361674][    C0] RIP: 0010:preempt_schedule_irq+0xb0/0x150
[  156.361683][    C0] Code: 24 20 f6 44 24 21 02 74 0c 90 0f 0b 48 f7 03 08 00 00 00 74 64 bf 01 00 00 00 e8 5b 22 21 f6 e8 96 f5 57 f6 fb bf 01 00 00 00 <e8> 1b ab ff ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24
[  156.361688][    C0] RSP: 0018:ffffc900049775a0 EFLAGS: 00000286
[  156.361694][    C0] RAX: 4e971bcfa019ab00 RBX: 0000000000000000 RCX: 4e971bcfa019ab00
[  156.361698][    C0] RDX: 0000000000000007 RSI: ffffffff8d998701 RDI: 0000000000000001
[  156.361702][    C0] RBP: ffffc90004977650 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  156.361706][    C0] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: 0000000000000000
[  156.361710][    C0] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff9200092eeb4
[  156.361723][    C0]  ? __pfx_preempt_schedule_irq+0x10/0x10
[  156.361735][    C0]  ? rcu_irq_exit_check_preempt+0xdf/0x210
[  156.361744][    C0]  irqentry_exit+0x6f/0x90
[  156.361751][    C0]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  156.361757][    C0] RIP: 0010:__raw_spin_lock_init+0x5/0x100
[  156.361767][    C0] Code: a2 8f e8 7e 6f 84 00 eb 90 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 54 53 89 cd 49 89 d6 49 89 f7 48 89 fb 49 bc 00 00
[  156.361771][    C0] RSP: 0018:ffffc90004977710 EFLAGS: 00000246
[  156.361776][    C0] RAX: 1ffff1100395294e RBX: ffff88801ca948a8 RCX: 0000000000000003
[  156.361780][    C0] RDX: ffffffff92a6b400 RSI: ffffffff8b8aa0e0 RDI: ffff88801ca948a8
[  156.361785][    C0] RBP: ffffc900049778f0 R08: ffff88801ca9452f R09: 0000000000000000
[  156.361789][    C0] R10: ffff88801ca94520 R11: ffffed10039528a6 R12: dffffc0000000000
[  156.361793][    C0] R13: dffffc0000000000 R14: ffffffff99b07880 R15: ffffffff8b93fa40
[  156.361805][    C0]  __init_waitqueue_head+0x3a/0x150
[  156.361818][    C0]  perf_event_alloc+0x4c9/0x2bb0
[  156.361828][    C0]  ? irqentry_exit+0x74/0x90
[  156.361839][    C0]  ? inherit_event+0xe8/0xa20
[  156.361853][    C0]  ? __pfx_perf_event_alloc+0x10/0x10
[  156.361864][    C0]  ? alloc_perf_context+0x4e/0x220
[  156.361876][    C0]  inherit_event+0x15d/0xa20
[  156.361886][    C0]  ? inherit_event+0xe8/0xa20
[  156.361897][    C0]  inherit_task_group+0x1a1/0x530
[  156.361909][    C0]  perf_event_init_task+0x292/0x4b0
[  156.361922][    C0]  ? copy_process+0x978/0x3b80
[  156.361930][    C0]  copy_process+0x1412/0x3b80
[  156.361942][    C0]  ? copy_process+0x978/0x3b80
[  156.361990][    C0]  ? __pfx_copy_process+0x10/0x10
[  156.362001][    C0]  ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[  156.362016][    C0]  kernel_clone+0x21e/0x870
[  156.362027][    C0]  ? __pfx_kernel_clone+0x10/0x10
[  156.362044][    C0]  __x64_sys_clone+0x18b/0x1e0
[  156.362055][    C0]  ? __pfx___x64_sys_clone+0x10/0x10
[  156.362069][    C0]  ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[  156.362079][    C0]  ? rcu_is_watching+0x15/0xb0
[  156.362089][    C0]  ? do_syscall_64+0xbe/0x3b0
[  156.362100][    C0]  do_syscall_64+0xfa/0x3b0
[  156.362110][    C0]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  156.362116][    C0]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  156.362124][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  156.362130][    C0] RIP: 0033:0x7fc5ad78eb69
[  156.362139][    C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  156.362144][    C0] RSP: 002b:00007fc5ae582fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
[  156.362151][    C0] RAX: ffffffffffffffda RBX: 00007fc5ad9b5fa0 RCX: 00007fc5ad78eb69
[  156.362155][    C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000600
[  156.362158][    C0] RBP: 00007fc5ad811df1 R08: 0000000000000000 R09: 0000000000000000
[  156.362162][    C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
[  156.362166][    C0] R13: 0000000000000000 R14: 00007fc5ad9b5fa0 R15: 00007fff49ace5a8
[  156.362177][    C0]  </TASK>
[  156.591839][    C0] sched: DL replenish lagged too much
[  156.598647][    C0] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 105363313426 wd_nsec: 105363315627
[  156.619738][   T54] Bluetooth: hci0: command tx timeout
[  156.622107][   T54] Bluetooth: hci2: command tx timeout
[  156.624444][   T54] Bluetooth: hci1: command tx timeout
[  158.645560][ T5829] Bluetooth: hci1: command tx timeout
[  158.647432][ T5829] Bluetooth: hci2: command tx timeout
[  158.649499][ T5829] Bluetooth: hci0: command tx timeout

VM DIAGNOSIS:
21:49:53  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000073 RBX=0000000000000073 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90000006930
R8 =ffff888021bf0237 R9 =1ffff1100437e046 R10=dffffc0000000000 R11=ffffffff85471fa0
R12=dffffc0000000000 R13=ffffffff99af58b1 R14=ffffffff99dfa1e0 R15=0000000000000000
RIP=ffffffff8547201c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fc5ae5836c0 ffffffff 00c00000
GS =0000 ffff8880b861f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b30114ff8 CR3=0000000121730000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fc5ad987498 00007fc5ad987470 XMM03=00007fc5ad9874a8 00007fc5ad9874a0
XMM04=00007fc5ae4ed100 00007fc5ad987460 XMM05=00007fc5ad987478 00007fc5ad9874c0
XMM06=00007fc5ad9874b8 00007fc5ad9874b0 XMM07=00007fc5ad9874a8 00007fc5ad9874a0
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007fc5ad812f89
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000001 RBX=ffffffff8e144440 RCX=ffffffff8b71260c RDX=0000000000000000
RSI=0000000000000004 RDI=ffffffff8e144440 RBP=ffffc90004e5ef18 RSP=ffffc90004e5ee20
R8 =ffffffff8e144443 R9 =1ffffffff1c28888 R10=dffffc0000000000 R11=fffffbfff1c28889
R12=1ffff920009cbdcc R13=0000000000000001 R14=ffffc90004e5ee80 R15=1ffffffff1c28888
RIP=ffffffff8b7125ff RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f1610aa5800 ffffffff 00c00000
GS =0000 ffff8881a3c1f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f0f0aa70e3b CR3=0000000108c46000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
