last executing test programs:

1.147598079s ago: executing program 1 (id=142):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x25, &(0x7f0000001500)={0x0, @in={{0x2, 0x4e22, @empty}}}, 0x90)

1.091151812s ago: executing program 1 (id=145):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfffffffb}]}, &(0x7f0000000140)=0x10)
getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x34ce}, &(0x7f0000000080)=0x8)

469.883518ms ago: executing program 0 (id=166):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000068000000060a010400000000000000000100000008000b40000000000900010073797a3000000000400004803c0001800a0001006c696d69740000002c0002800c000240000000008000000108000540000000000c0001400000000000000008080005400003"], 0xf0}}, 0x0)

469.720808ms ago: executing program 2 (id=167):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0)
setsockopt$sock_attach_bpf(r0, 0x1, 0x2a, &(0x7f0000000100)=r2, 0x4)
sendmsg$unix(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)="c3", 0x1}], 0x1, 0x0, 0x0, 0x40000}, 0x20004011)
recvmsg$unix(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002)
sendmsg$inet(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x2404c140)
write$cgroup_subtree(r1, &(0x7f0000000280)={[{0x2b, 'pids'}]}, 0x6)

398.965062ms ago: executing program 0 (id=168):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x100, 0x100, 0x1, 0x1, 0x1}, 0x50)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@bloom_filter={0x1e, 0x2, 0x792, 0xff, 0x808, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x5, 0xa}, 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000780), 0xcff5, r0}, 0x38)

398.773826ms ago: executing program 0 (id=169):
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000f00)={'veth1_macvtap\x00', &(0x7f00000003c0)=@ethtool_perm_addr={0x4b, 0x46, "4b721b782a17a7b6a00d963e3f7fdafda2073830fb8cfb34eb7cbd173ed6f04cba5a1e6a6f0ef6c61346d54f61bd850519514421d1f3050000f99b355dcb6ab9ed36e7e24582"}})

377.282389ms ago: executing program 2 (id=170):
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f00000006c0)=ANY=[@ANYBLOB="b40800000000000073112000000000008510000002000000b7000000000000009500c2000000000095000012000000000e09b9445761db3ed82f7be4b9f1628b"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000080)}], 0x1}}], 0x1, 0x4000)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404cf"], 0xfc}, 0x1, 0x0, 0x0, 0x8040}, 0x8000)

319.724861ms ago: executing program 0 (id=171):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_netfilter(0x10, 0x3, 0xc)
close(0x3)
r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r1, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48)
r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
bind$netrom(r2, &(0x7f00000004c0)={{0x6, @rose, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48)
listen(r2, 0x80)
accept$netrom(r2, 0x0, 0x0)
writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1)

319.481168ms ago: executing program 2 (id=172):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5, 0x1000}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10)

249.158857ms ago: executing program 2 (id=173):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000015c0)=@newtfilter={0x480, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {}, {0xa, 0xa}}, [@TCA_RATE={0x6, 0x5, {0xff, 0x5}}, @filter_kind_options=@f_flow={{0x9}, {0x448, 0x2, [@TCA_FLOW_POLICE={0x444, 0xa, 0x0, 0x1, [@TCA_POLICE_TBF={0x3c, 0x1, {0xa, 0x7, 0x7, 0x7, 0x5, {0x15, 0x2, 0x200, 0x9, 0x7, 0x6}, {0x8, 0x1, 0x7fff, 0x5465, 0x4}, 0x3, 0x8001, 0x81}}, @TCA_POLICE_RATE={0x404, 0x2, [0x7, 0xe4, 0x1ff, 0x5, 0x8, 0x0, 0x6, 0x0, 0x7, 0x0, 0x8, 0xb3, 0x4, 0x7, 0x2, 0x8, 0x8, 0x3, 0x100, 0x4, 0xd5500, 0xca, 0x331, 0x8, 0x0, 0xec52, 0xb091, 0x0, 0x7fff, 0x5, 0x0, 0xe00, 0x11, 0x1000, 0x2, 0xe, 0x4, 0x8, 0x7fff, 0x6, 0x8, 0x7fffffff, 0x81, 0x6, 0x7, 0x3, 0x4, 0x8, 0x8, 0x1, 0x5bd, 0x3, 0x6, 0x1, 0x7, 0x2, 0x4, 0x3, 0x2, 0x2, 0x3, 0x4, 0x4, 0x33e774c4, 0x40000000, 0x0, 0x0, 0xcb5, 0x12, 0x3, 0x10000, 0x80000000, 0x0, 0x2, 0x7, 0x9, 0x3, 0xffffffdb, 0x4, 0x7, 0x5, 0x6, 0xffffffff, 0x1, 0x9, 0x81, 0x7b58, 0x9, 0x2, 0x1, 0x81, 0xfffffffe, 0xa, 0x0, 0xffffffff, 0x0, 0x9, 0x8b, 0x9, 0x4, 0x7bf, 0x5, 0x5, 0x3, 0x80, 0x9, 0x7fffffff, 0x2, 0x6, 0x4, 0x800, 0xa9a, 0x1, 0x1, 0x79ce, 0x3ff, 0x7ff, 0xffff, 0x1, 0x400, 0x1ff, 0x0, 0x0, 0x7, 0x9, 0x0, 0x8, 0xad, 0x7, 0x1ff, 0x9, 0x808, 0x5, 0x1, 0x8, 0x3, 0x1ff, 0x4, 0xb, 0x8, 0x7, 0x9, 0x6, 0x80, 0x1, 0xd0000000, 0x5, 0x6, 0x7, 0x6, 0x1, 0x4, 0x3, 0x9, 0x6, 0x5, 0x8, 0x80000001, 0x1ff16624, 0x6, 0x0, 0x1, 0x8, 0x3, 0x5, 0xdd3e, 0x3, 0x401, 0x9, 0x9, 0xff, 0x9, 0x609624be, 0x3, 0xa, 0xfffffffe, 0x7ff, 0x42d8, 0x200, 0x2, 0x200, 0x100, 0x5, 0x9, 0xd1f, 0x6, 0x5, 0x9, 0x8000, 0x8000, 0xffffffff, 0x7, 0x3, 0x1, 0x2, 0x203, 0x1, 0x55, 0x2de, 0xc2bb, 0x3, 0x5, 0x4, 0xc1ad, 0x3ff, 0x4, 0x8, 0x105, 0xa0a6, 0xa, 0x8000, 0xffff, 0x8, 0x8, 0x9, 0x2, 0x8, 0x6, 0x858c, 0xb247, 0x6, 0x10002, 0x0, 0x4, 0x2, 0xf96, 0x2, 0x9, 0xd, 0x9, 0x1, 0xffffffff, 0x200, 0x3, 0x1, 0x3, 0x8, 0x4, 0xba44, 0x23, 0xe, 0x17, 0x73, 0x1, 0x7, 0xd, 0x9b, 0x8, 0x53e6, 0x80000001, 0x2, 0xffffffff, 0x6, 0x7, 0x1c, 0x5]}]}]}}]}, 0x480}}, 0x20048000)

170.67406ms ago: executing program 1 (id=174):
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22041000f3fe80000000000000110880febb0007aafe8000000000000027bfa7b09303960e2b80"], 0xfdef)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

170.345504ms ago: executing program 2 (id=175):
socket$inet_smc(0x2b, 0x1, 0x0)
socket(0x10, 0x803, 0x0)
r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
socket$inet6_mptcp(0xa, 0x1, 0x106)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, 0x0, 0x0}, 0x94)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0)
unshare(0x22020400)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000340)={0xffffffffffffffff, 0x0, 0x0}, 0x20)

80.715407ms ago: executing program 2 (id=176):
r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r0, &(0x7f0000000380)={{0x6, @default, 0xa}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48)
r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r1, &(0x7f0000000300)={{0x6, @rose, 0xfffbffff}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x48)
listen(r0, 0x1ad72f7)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x10)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4)
r3 = socket$kcm(0x10, 0x2, 0x0)
r4 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_IPV6_RTHDR(r4, 0x29, 0x39, &(0x7f0000000140)=ANY=[@ANYBLOB="3b02000000000000000000"], 0x18)
r5 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0)
sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0)
socket$key(0xf, 0x3, 0x2)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000300)={'wlan0\x00', <r8=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r8, @ANYBLOB="08002600851600000a00180000000000000000001c005a80180001801400"], 0x4c}}, 0x0)

80.451009ms ago: executing program 1 (id=177):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000005c0), r0)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002ab97000ffdbdf25040000000800020005000000080007007f0000e0070008"], 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x24004854)

80.114778ms ago: executing program 1 (id=178):
r0 = socket$inet(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000002700)=@raw={'raw\x00', 0x8, 0x3, 0x2a0, 0xc8, 0x8, 0xfa04, 0xc8, 0x6c02, 0x208, 0x194, 0x194, 0x208, 0x194, 0x3, 0x0, {[{{@ip={@empty=0x1e00, @broadcast, 0x0, 0x0, 'veth0_to_hsr\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0xa0, 0xc8, 0x0, {0x0, 0x74020000}, [@common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x7a}}]}, @common=@inet=@TCPMSS={0x28}}, {{@ip={@multicast2, @dev, 0x0, 0x0, '\x00', 'tunl0\x00'}, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@connlimit={{0x40}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x300)

341.895µs ago: executing program 0 (id=179):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x18, 0x1412, 0x1, 0x70bd28, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x18}}, 0x20000000)

93.951µs ago: executing program 1 (id=180):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x4e23, 0x0, 0xa}, {0xa, 0x80, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe, 0x3ff, 0x0, 0xffffffffffffffff}, {0x3bb, 0x2000000000, 0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in=@broadcast, 0x0, 0x32}, 0x5, @in=@multicast1, 0x0, 0x1, 0x0, 0x99, 0x1}}, 0xe8)

0s ago: executing program 0 (id=181):
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmmsg$inet6(r0, &(0x7f0000006480)=[{{&(0x7f0000002000)={0xa, 0x4e20, 0xf1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x800}, 0x1c, 0x0, 0x0, &(0x7f00000021c0)=[@flowinfo={{0x14, 0x29, 0xb, 0xaba0}}, @flowinfo={{0x14, 0x29, 0xb, 0x7}}], 0x30}}], 0x1, 0x4000)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:45475' (ED25519) to the list of known hosts.
syzkaller login: [   48.941871][ T5753] cgroup: Unknown subsys name 'net'
[   49.091925][ T5753] cgroup: Unknown subsys name 'cpuset'
[   49.099048][ T5753] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   51.667434][ T5753] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   56.716446][ T5219] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   56.720095][ T5219] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   56.722829][ T5219] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   56.726224][ T5219] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   56.729413][ T5219] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   56.749652][   T54] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   56.753516][   T54] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   56.756535][   T54] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   56.762019][   T54] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   56.765038][   T54] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   56.838885][ T5219] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   56.842714][ T5219] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   56.846206][ T5219] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   56.850068][ T5219] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   56.853567][ T5219] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   57.049506][ T5821] chnl_net:caif_netlink_parms(): no params data found
[   57.074791][ T5825] chnl_net:caif_netlink_parms(): no params data found
[   57.256394][ T5821] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.259524][ T5821] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.261966][ T5821] bridge_slave_0: entered allmulticast mode
[   57.265331][ T5821] bridge_slave_0: entered promiscuous mode
[   57.278397][ T5825] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.281142][ T5825] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.284411][ T5825] bridge_slave_0: entered allmulticast mode
[   57.287463][ T5825] bridge_slave_0: entered promiscuous mode
[   57.297208][ T5821] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.300133][ T5821] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.302993][ T5821] bridge_slave_1: entered allmulticast mode
[   57.307483][ T5821] bridge_slave_1: entered promiscuous mode
[   57.327201][ T5829] chnl_net:caif_netlink_parms(): no params data found
[   57.343287][ T5825] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.345813][ T5825] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.348230][ T5825] bridge_slave_1: entered allmulticast mode
[   57.351242][ T5825] bridge_slave_1: entered promiscuous mode
[   57.404466][ T5821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   57.411352][ T5825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   57.425125][ T5821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   57.438163][ T5825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   57.506305][ T5821] team0: Port device team_slave_0 added
[   57.521734][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.525616][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.528880][ T5829] bridge_slave_0: entered allmulticast mode
[   57.532684][ T5829] bridge_slave_0: entered promiscuous mode
[   57.538033][ T5821] team0: Port device team_slave_1 added
[   57.542173][ T5825] team0: Port device team_slave_0 added
[   57.544649][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.547000][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.549560][ T5829] bridge_slave_1: entered allmulticast mode
[   57.552957][ T5829] bridge_slave_1: entered promiscuous mode
[   57.576200][ T5825] team0: Port device team_slave_1 added
[   57.612876][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_0
[   57.616035][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.625024][ T5821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   57.632114][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   57.647382][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_1
[   57.649610][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.660059][ T5821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   57.666826][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   57.669955][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_0
[   57.672126][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.681444][ T5825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   57.708596][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_1
[   57.710989][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.720411][ T5825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   57.731988][ T5829] team0: Port device team_slave_0 added
[   57.736448][ T5829] team0: Port device team_slave_1 added
[   57.781165][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0
[   57.783652][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.791371][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   57.796377][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1
[   57.798694][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   57.808396][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   57.817737][ T5825] hsr_slave_0: entered promiscuous mode
[   57.820265][ T5825] hsr_slave_1: entered promiscuous mode
[   57.846392][ T5821] hsr_slave_0: entered promiscuous mode
[   57.849560][ T5821] hsr_slave_1: entered promiscuous mode
[   57.852372][ T5821] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   57.855828][ T5821] Cannot create hsr debugfs directory
[   57.950248][ T5829] hsr_slave_0: entered promiscuous mode
[   57.954616][ T5829] hsr_slave_1: entered promiscuous mode
[   57.956825][ T5829] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   57.959166][ T5829] Cannot create hsr debugfs directory
[   58.277486][ T5825] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   58.286748][ T5825] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   58.310927][ T5825] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   58.326451][ T5825] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   58.366791][ T5821] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   58.390910][ T5821] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   58.407574][ T5821] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   58.414972][ T5821] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   58.471023][ T5829] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   58.480520][ T5829] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   58.487671][ T5829] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   58.514515][ T5829] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   58.562651][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.600630][ T5825] 8021q: adding VLAN 0 to HW filter on device team0
[   58.616670][  T661] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.619029][  T661] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.629391][ T5821] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.635034][  T661] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.637257][  T661] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.656346][ T5821] 8021q: adding VLAN 0 to HW filter on device team0
[   58.677082][  T661] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.679355][  T661] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.691688][  T661] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.694706][  T661] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.709195][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0
[   58.752599][ T5829] 8021q: adding VLAN 0 to HW filter on device team0
[   58.775262][   T54] Bluetooth: hci1: command tx timeout
[   58.777777][   T54] Bluetooth: hci0: command tx timeout
[   58.801761][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   58.804133][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   58.817170][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   58.819424][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   58.878815][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0
[   58.916738][ T5825] veth0_vlan: entered promiscuous mode
[   58.934713][ T5219] Bluetooth: hci2: command tx timeout
[   58.941720][ T5825] veth1_vlan: entered promiscuous mode
[   58.969562][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0
[   59.008023][ T5825] veth0_macvtap: entered promiscuous mode
[   59.025414][ T5825] veth1_macvtap: entered promiscuous mode
[   59.048199][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0
[   59.052696][ T5821] veth0_vlan: entered promiscuous mode
[   59.062628][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0
[   59.076308][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1
[   59.081796][ T5821] veth1_vlan: entered promiscuous mode
[   59.094590][ T5825] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.102893][ T5825] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.106570][ T5825] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.109298][ T5825] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.154138][ T5821] veth0_macvtap: entered promiscuous mode
[   59.167598][ T5821] veth1_macvtap: entered promiscuous mode
[   59.185073][ T5829] veth0_vlan: entered promiscuous mode
[   59.219582][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0
[   59.222324][ T5829] veth1_vlan: entered promiscuous mode
[   59.255853][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1
[   59.269704][  T661] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.272340][  T661] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.276853][ T5821] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.279698][ T5821] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.282527][ T5821] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.289579][ T5821] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.315960][ T5829] veth0_macvtap: entered promiscuous mode
[   59.330975][ T5829] veth1_macvtap: entered promiscuous mode
[   59.344277][ T1192] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.347972][ T1192] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.393711][  T458] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.396255][  T458] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.411447][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0
[   59.426539][ T5825] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   59.435141][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1
[   59.438552][  T661] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.441863][  T661] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.454776][ T5829] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   59.457686][ T5829] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   59.460520][ T5829] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   59.469854][ T5829] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   59.588563][  T661] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.591123][  T661] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   59.637411][  T661] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   59.640820][  T661] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   60.027363][ T5925] netlink: 56 bytes leftover after parsing attributes in process `syz.2.18'.
[   60.053621][ T5925] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18'.
[   60.254911][ T5947] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.29'.
[   60.700130][ T5973] netlink: 4 bytes leftover after parsing attributes in process `syz.1.43'.
[   60.859122][   T54] Bluetooth: hci0: command tx timeout
[   60.861476][ T5219] Bluetooth: hci1: command tx timeout
[   60.961812][ T5994] netlink: 'syz.2.51': attribute type 4 has an invalid length.
[   60.974822][ T5994] netlink: 'syz.2.51': attribute type 4 has an invalid length.
[   61.023488][   T54] Bluetooth: hci2: command tx timeout
[   61.079736][ T6000] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms
[   61.085014][ T6000] (unnamed net_device) (uninitialized): option use_carrier: invalid value (5)
[   61.345710][ T6016] netlink: 12 bytes leftover after parsing attributes in process `syz.2.62'.
[   61.917490][ T6061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.78'.
[   62.161265][ T6081] netlink: 'syz.1.89': attribute type 9 has an invalid length.
[   62.337653][ T6094] netlink: 'syz.2.92': attribute type 21 has an invalid length.
[   62.340175][ T6094] netlink: 'syz.2.92': attribute type 6 has an invalid length.
[   62.342445][ T6094] netlink: 64 bytes leftover after parsing attributes in process `syz.2.92'.
[   62.346226][ T6096] warning: `syz.1.94' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   62.401677][ T6100] netlink: 'syz.2.95': attribute type 1 has an invalid length.
[   62.408508][ T6102] netlink: 4 bytes leftover after parsing attributes in process `syz.1.97'.
[   62.467939][ T6100] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link
[   62.479686][   T13] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[   62.481049][ T6100] 8021q: adding VLAN 0 to HW filter on device bond1
[   62.523831][ T6100] veth3: entered promiscuous mode
[   62.527666][ T6100] bond1: (slave veth3): Enslaving as a backup interface with a down link
[   62.598092][   T13] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[   62.672808][ T6116] netlink: 12 bytes leftover after parsing attributes in process `syz.1.103'.
[   62.782243][ T6126] netlink: 12 bytes leftover after parsing attributes in process `syz.2.110'.
[   62.785410][ T6126] netlink: 'syz.2.110': attribute type 1 has an invalid length.
[   62.844855][ T6126] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0
[   62.934002][   T54] Bluetooth: hci0: command tx timeout
[   62.935681][   T54] Bluetooth: hci1: command tx timeout
[   63.094562][ T5219] Bluetooth: hci2: command tx timeout
[   63.228096][ T6161] tipc: Started in network mode
[   63.229784][ T6161] tipc: Node identity , cluster identity 4711
[   63.231706][ T6161] tipc: Failed to obtain node identity
[   63.233468][ T6161] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[   63.473762][ T6177] delete_channel: no stack
[   63.640186][ T6187] netlink: 'syz.1.136': attribute type 4 has an invalid length.
[   63.776089][ T6199] nftables ruleset with unbound chain
[   64.445771][ T6252] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   64.907804][ T6283] xt_CT: You must specify a L4 protocol and not use inversions on it
[   64.954140][ T6286] netlink: 'syz.2.176': attribute type 10 has an invalid length.
[   64.985948][ T6286] team0: Port device dummy0 added
[   64.989760][ T6286] netlink: 'syz.2.176': attribute type 10 has an invalid length.
[   64.992487][ T6286] 
[   64.993443][ T6286] ======================================================
[   64.995575][ T6286] WARNING: possible circular locking dependency detected
[   64.997628][ T6286] 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 Not tainted
[   65.000731][ T6286] ------------------------------------------------------
[   65.002765][ T6286] syz.2.176/6286 is trying to acquire lock:
[   65.004513][ T6286] ffff8880202e4e00 (team->team_lock_key#3){+.+.}-{4:4}, at: team_device_event+0x182/0xa20
[   65.007357][ T6286] 
[   65.007357][ T6286] but task is already holding lock:
[   65.009502][ T6286] ffff88802f152d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: do_setlink+0x388/0x41c0
[   65.012337][ T6286] 
[   65.012337][ T6286] which lock already depends on the new lock.
[   65.012337][ T6286] 
[   65.015407][ T6286] 
[   65.015407][ T6286] the existing dependency chain (in reverse order) is:
[   65.018073][ T6286] 
[   65.018073][ T6286] -> #1 (&dev_instance_lock_key#3){+.+.}-{4:4}:
[   65.020511][ T6286]        lock_acquire+0x120/0x360
[   65.022037][ T6286]        __mutex_lock+0x182/0xe80
[   65.023536][ T6286]        dev_set_mtu+0x10e/0x260
[   65.024975][ T6286]        team_add_slave+0x8b8/0x2840
[   65.026560][ T6286]        do_set_master+0x533/0x6d0
[   65.028041][ T6286]        do_setlink+0xcf0/0x41c0
[   65.029556][ T6286]        rtnl_newlink+0x160b/0x1c70
[   65.031175][ T6286]        rtnetlink_rcv_msg+0x7cf/0xb70
[   65.032867][ T6286]        netlink_rcv_skb+0x208/0x470
[   65.034530][ T6286]        netlink_unicast+0x75b/0x8d0
[   65.036185][ T6286]        netlink_sendmsg+0x805/0xb30
[   65.037769][ T6286]        __sock_sendmsg+0x21c/0x270
[   65.039320][ T6286]        ____sys_sendmsg+0x505/0x830
[   65.040879][ T6286]        ___sys_sendmsg+0x21f/0x2a0
[   65.042457][ T6286]        __x64_sys_sendmsg+0x19b/0x260
[   65.044136][ T6286]        do_syscall_64+0xfa/0x3b0
[   65.045713][ T6286]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.047697][ T6286] 
[   65.047697][ T6286] -> #0 (team->team_lock_key#3){+.+.}-{4:4}:
[   65.050212][ T6286]        validate_chain+0xb9b/0x2140
[   65.051801][ T6286]        __lock_acquire+0xab9/0xd20
[   65.053342][ T6286]        lock_acquire+0x120/0x360
[   65.054910][ T6286]        __mutex_lock+0x182/0xe80
[   65.056444][ T6286]        team_device_event+0x182/0xa20
[   65.058049][ T6286]        notifier_call_chain+0x1b6/0x3e0
[   65.059688][ T6286]        __dev_notify_flags+0x18d/0x2e0
[   65.061337][ T6286]        netif_change_flags+0xe8/0x1a0
[   65.062947][ T6286]        do_setlink+0xc55/0x41c0
[   65.064531][ T6286]        rtnl_newlink+0x160b/0x1c70
[   65.066147][ T6286]        rtnetlink_rcv_msg+0x7cf/0xb70
[   65.067832][ T6286]        netlink_rcv_skb+0x208/0x470
[   65.069740][ T6286]        netlink_unicast+0x75b/0x8d0
[   65.071357][ T6286]        netlink_sendmsg+0x805/0xb30
[   65.072953][ T6286]        __sock_sendmsg+0x21c/0x270
[   65.074558][ T6286]        ____sys_sendmsg+0x505/0x830
[   65.076321][ T6286]        ___sys_sendmsg+0x21f/0x2a0
[   65.077932][ T6286]        __x64_sys_sendmsg+0x19b/0x260
[   65.079626][ T6286]        do_syscall_64+0xfa/0x3b0
[   65.081165][ T6286]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.083108][ T6286] 
[   65.083108][ T6286] other info that might help us debug this:
[   65.083108][ T6286] 
[   65.086203][ T6286]  Possible unsafe locking scenario:
[   65.086203][ T6286] 
[   65.088366][ T6286]        CPU0                    CPU1
[   65.089999][ T6286]        ----                    ----
[   65.091564][ T6286]   lock(&dev_instance_lock_key#3);
[   65.093142][ T6286]                                lock(team->team_lock_key#3);
[   65.095427][ T6286]                                lock(&dev_instance_lock_key#3);
[   65.097697][ T6286]   lock(team->team_lock_key#3);
[   65.099228][ T6286] 
[   65.099228][ T6286]  *** DEADLOCK ***
[   65.099228][ T6286] 
[   65.101581][ T6286] 2 locks held by syz.2.176/6286:
[   65.103099][ T6286]  #0: ffffffff8f51c988 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70
[   65.105794][ T6286]  #1: ffff88802f152d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: do_setlink+0x388/0x41c0
[   65.108887][ T6286] 
[   65.108887][ T6286] stack backtrace:
[   65.110819][ T6286] CPU: 1 UID: 0 PID: 6286 Comm: syz.2.176 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[   65.110831][ T6286] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   65.110839][ T6286] Call Trace:
[   65.110845][ T6286]  <TASK>
[   65.110870][ T6286]  dump_stack_lvl+0x189/0x250
[   65.110886][ T6286]  ? __pfx_dump_stack_lvl+0x10/0x10
[   65.110897][ T6286]  ? __pfx__printk+0x10/0x10
[   65.110910][ T6286]  ? print_lock_name+0xde/0x100
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   65.110922][ T6286]  print_circular_bug+0x2ee/0x310
[   65.110935][ T6286]  check_noncircular+0x134/0x160
[   65.110947][ T6286]  validate_chain+0xb9b/0x2140
[   65.110958][ T6286]  ? __lock_acquire+0xab9/0xd20
[   65.110969][ T6286]  __lock_acquire+0xab9/0xd20
[   65.110977][ T6286]  ? team_device_event+0x182/0xa20
[   65.111001][ T6286]  lock_acquire+0x120/0x360
[   65.111009][ T6286]  ? team_device_event+0x182/0xa20
[   65.111023][ T6286]  ? _raw_spin_unlock_irqrestore+0x85/0x110
[   65.111039][ T6286]  __mutex_lock+0x182/0xe80
[   65.111048][ T6286]  ? team_device_event+0x182/0xa20
[   65.111060][ T6286]  ? __try_to_del_timer_sync+0x34a/0x3a0
[   65.111073][ T6286]  ? team_device_event+0x182/0xa20
[   65.111085][ T6286]  ? __pfx___mutex_lock+0x10/0x10
[   65.111092][ T6286]  ? __timer_delete_sync+0x218/0x2d0
[   65.111106][ T6286]  team_device_event+0x182/0xa20
[   65.111117][ T6286]  notifier_call_chain+0x1b6/0x3e0
[   65.111130][ T6286]  __dev_notify_flags+0x18d/0x2e0
[   65.111141][ T6286]  ? __pfx___dev_notify_flags+0x10/0x10
[   65.111150][ T6286]  ? __dev_change_flags+0x4cc/0x6d0
[   65.111160][ T6286]  ? __pfx___dev_change_flags+0x10/0x10
[   65.111169][ T6286]  ? __pfx_console_unlock+0x10/0x10
[   65.111179][ T6286]  ? irq_work_queue+0xc3/0x140
[   65.111187][ T6286]  netif_change_flags+0xe8/0x1a0
[   65.111198][ T6286]  do_setlink+0xc55/0x41c0
[   65.111210][ T6286]  ? __pfx_do_setlink+0x10/0x10
[   65.111219][ T6286]  ? _printk+0xcf/0x120
[   65.111229][ T6286]  ? __pfx____ratelimit+0x10/0x10
[   65.111243][ T6286]  ? __lock_acquire+0xab9/0xd20
[   65.111251][ T6286]  ? __mutex_trylock_common+0x153/0x260
[   65.111261][ T6286]  ? __pfx___mutex_trylock_common+0x10/0x10
[   65.111272][ T6286]  ? rcu_is_watching+0x15/0xb0
[   65.111281][ T6286]  ? trace_contention_end+0x39/0x120
[   65.111291][ T6286]  ? __mutex_lock+0x330/0xe80
[   65.111298][ T6286]  ? __pfx_aa_get_newest_label+0x10/0x10
[   65.111311][ T6286]  ? rtnl_newlink+0x8db/0x1c70
[   65.111319][ T6286]  ? rcu_is_watching+0x15/0xb0
[   65.111327][ T6286]  ? __pfx___mutex_lock+0x10/0x10
[   65.111336][ T6286]  ? ns_capable+0x8a/0xf0
[   65.111344][ T6286]  ? rtnl_link_get_net_capable+0x16a/0x350
[   65.111354][ T6286]  rtnl_newlink+0x160b/0x1c70
[   65.111362][ T6286]  ? netlink_sendmsg+0x805/0xb30
[   65.111404][ T6286]  ? __pfx_rtnl_newlink+0x10/0x10
[   65.111417][ T6286]  ? kasan_quarantine_put+0xdd/0x220
[   65.111428][ T6286]  ? lockdep_hardirqs_on+0x9c/0x150
[   65.111439][ T6286]  ? nlmon_xmit+0xb0/0x100
[   65.111449][ T6286]  ? kmem_cache_free+0x18f/0x400
[   65.111462][ T6286]  ? __local_bh_enable_ip+0x12d/0x1c0
[   65.111471][ T6286]  ? lockdep_hardirqs_on+0x9c/0x150
[   65.111478][ T6286]  ? __local_bh_enable_ip+0x12d/0x1c0
[   65.111486][ T6286]  ? __pfx___local_bh_enable_ip+0x10/0x10
[   65.111495][ T6286]  ? __dev_queue_xmit+0x27e/0x3a70
[   65.111508][ T6286]  ? __lock_acquire+0xab9/0xd20
[   65.111519][ T6286]  ? __pfx_rtnl_newlink+0x10/0x10
[   65.111527][ T6286]  rtnetlink_rcv_msg+0x7cf/0xb70
[   65.111536][ T6286]  ? rtnetlink_rcv_msg+0x1ab/0xb70
[   65.111543][ T6286]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   65.111551][ T6286]  ? ref_tracker_free+0x63a/0x7d0
[   65.111558][ T6286]  ? __copy_skb_header+0xa7/0x550
[   65.111569][ T6286]  ? __pfx_ref_tracker_free+0x10/0x10
[   65.111576][ T6286]  ? __skb_clone+0x63/0x7a0
[   65.111587][ T6286]  netlink_rcv_skb+0x208/0x470
[   65.111596][ T6286]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   65.111605][ T6286]  ? __pfx_netlink_rcv_skb+0x10/0x10
[   65.111615][ T6286]  ? netlink_deliver_tap+0x2e/0x1b0
[   65.111624][ T6286]  ? netlink_deliver_tap+0x2e/0x1b0
[   65.111634][ T6286]  netlink_unicast+0x75b/0x8d0
[   65.111644][ T6286]  netlink_sendmsg+0x805/0xb30
[   65.111655][ T6286]  ? __pfx_netlink_sendmsg+0x10/0x10
[   65.111664][ T6286]  ? aa_sock_msg_perm+0x94/0x160
[   65.111676][ T6286]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   65.111684][ T6286]  ? __pfx_netlink_sendmsg+0x10/0x10
[   65.111693][ T6286]  __sock_sendmsg+0x21c/0x270
[   65.111702][ T6286]  ____sys_sendmsg+0x505/0x830
[   65.111713][ T6286]  ? __pfx_____sys_sendmsg+0x10/0x10
[   65.111724][ T6286]  ? import_iovec+0x74/0xa0
[   65.111734][ T6286]  ___sys_sendmsg+0x21f/0x2a0
[   65.111744][ T6286]  ? __pfx____sys_sendmsg+0x10/0x10
[   65.111760][ T6286]  ? __fget_files+0x2a/0x420
[   65.111770][ T6286]  ? __fget_files+0x3a0/0x420
[   65.111782][ T6286]  __x64_sys_sendmsg+0x19b/0x260
[   65.111792][ T6286]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   65.111803][ T6286]  ? rcu_is_watching+0x15/0xb0
[   65.111813][ T6286]  ? do_syscall_64+0xbe/0x3b0
[   65.111822][ T6286]  do_syscall_64+0xfa/0x3b0
[   65.111829][ T6286]  ? lockdep_hardirqs_on+0x9c/0x150
[   65.111836][ T6286]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.111844][ T6286]  ? exc_page_fault+0x9f/0xf0
[   65.111855][ T6286]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.111863][ T6286] RIP: 0033:0x7fdf2778e929
[   65.111873][ T6286] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   65.111880][ T6286] RSP: 002b:00007fdf28657038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   65.111891][ T6286] RAX: ffffffffffffffda RBX: 00007fdf279b6080 RCX: 00007fdf2778e929
[   65.111898][ T6286] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000007
[   65.111903][ T6286] RBP: 00007fdf27810b39 R08: 0000000000000000 R09: 0000000000000000
[   65.111908][ T6286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   65.111913][ T6286] R13: 0000000000000000 R14: 00007fdf279b6080 R15: 00007ffcaf300528
[   65.111923][ T6286]  </TASK>
[   65.112422][ T5219] Bluetooth: hci1: command tx timeout
[   65.120447][   T54] Bluetooth: hci0: command tx timeout
[   65.183162][ T5219] Bluetooth: hci2: command tx timeout
[   65.300178][ T6286] team0: Port device dummy0 removed
[   65.303809][ T6286] bond0: (slave dummy0): Enslaving as an active interface with an up link
[   65.467924][ T5833] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.567532][ T5833] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.650761][ T5833] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.698152][ T5833] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   65.780817][ T5833] bridge_slave_1: left allmulticast mode
[   65.782561][ T5833] bridge_slave_1: left promiscuous mode
[   65.784506][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.787574][ T5833] bridge_slave_0: left allmulticast mode
[   65.789245][ T5833] bridge_slave_0: left promiscuous mode
[   65.791000][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.906493][ T5833] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   65.910393][ T5833] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   65.913715][ T5833] bond0 (unregistering): Released all slaves
[   66.109933][ T5833] hsr_slave_0: left promiscuous mode
[   66.113492][ T5833] hsr_slave_1: left promiscuous mode
[   66.116571][ T5833] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   66.118885][ T5833] batman_adv: batadv0: Removing interface: batadv_slave_0
[   66.121735][ T5833] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   66.124983][ T5833] batman_adv: batadv0: Removing interface: batadv_slave_1
[   66.129221][ T5833] veth1_macvtap: left promiscuous mode
[   66.130877][ T5833] veth0_macvtap: left promiscuous mode
[   66.132541][ T5833] veth1_vlan: left promiscuous mode
[   66.134268][ T5833] veth0_vlan: left promiscuous mode
[   66.227913][ T5833] team0 (unregistering): Port device team_slave_1 removed
[   66.240479][ T5833] team0 (unregistering): Port device team_slave_0 removed
[   66.569561][ T5833] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   66.619965][ T5833] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   66.670444][ T5833] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   66.706235][ T5833] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   66.755380][ T5833] bridge_slave_1: left allmulticast mode
[   66.757111][ T5833] bridge_slave_1: left promiscuous mode
[   66.759485][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state
[   66.762841][ T5833] bridge_slave_0: left allmulticast mode
[   66.764874][ T5833] bridge_slave_0: left promiscuous mode
[   66.766638][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state
[   66.809486][ T5833] bond1 (unregistering): (slave ip6gretap1): Removing an active aggregator
[   66.812665][ T5833] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface
[   66.817653][ T5833] bond1 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 5e:95:0a:da:a8:68 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[   66.891239][ T5833] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   66.895457][ T5833] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   66.900204][ T5833] bond0 (unregistering): (slave dummy0): Releasing backup interface
[   66.904531][ T5833] bond0 (unregistering): Released all slaves
[   66.911410][ T5833] bond1 (unregistering): (slave veth3): Releasing backup interface
[   66.914996][ T5833] bond1 (unregistering): Released all slaves
[   67.090987][ T5833] hsr_slave_0: left promiscuous mode
[   67.092946][ T5833] hsr_slave_1: left promiscuous mode
[   67.095135][ T5833] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   67.097501][ T5833] batman_adv: batadv0: Removing interface: batadv_slave_0
[   67.100061][ T5833] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   67.103459][ T5833] batman_adv: batadv0: Removing interface: batadv_slave_1
[   67.108537][ T5833] veth1_macvtap: left promiscuous mode
[   67.110301][ T5833] veth0_macvtap: left promiscuous mode
[   67.112082][ T5833] veth1_vlan: left promiscuous mode
[   67.115105][ T5833] veth0_vlan: left promiscuous mode
[   67.224176][ T5833] team0 (unregistering): Port device team_slave_1 removed
[   67.233907][ T5833] team0 (unregistering): Port device team_slave_0 removed
[   71.095319][ T1362] ieee802154 phy1 wpan1: encryption failed: -22

VM DIAGNOSIS:
02:10:00  Registers:
info registers vcpu 0

CPU#0
RAX=ffffffff820cfaff RBX=ffffea0001392100 RCX=ffff88810ae11cc0 RDX=0000000000000000
RSI=ffffea0001392100 RDI=ffff88810faf2000 RBP=ffffc9000351f630 RSP=ffffc9000351f380
R8 =ffffea0001392137 R9 =1ffffd4000272426 R10=dffffc0000000000 R11=fffff94000272427
R12=dffffc0000000000 R13=ffffea0001392100 R14=ffff88810faf2000 R15=ffffea0001392100
RIP=ffffffff81c05e78 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555589e4c500 ffffffff 00c00000
GS =0000 ffff8880b861d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f8cb4ae56c0 CR3=00000001214f6000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f8cb3e11c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000064 RBX=0000000000000064 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000002f3c RDI=0000000000002f3d RBP=00000000000003f8 RSP=ffffc90007185f10
R8 =ffff888106460237 R9 =1ffff11020c8c046 R10=dffffc0000000000 R11=ffffffff85475610
R12=dffffc0000000000 R13=ffffffff99af7914 R14=ffffffff99dfc760 R15=0000000000000000
RIP=ffffffff8547568c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fdf286576c0 ffffffff 00c00000
GS =0000 ffff8881a3c1d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c353dfe CR3=0000000122f24000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fdf27985478 00007fdf27985450 XMM03=00007fdf27985488 00007fdf27985480
XMM04=00007fdf284ed100 00007fdf27985440 XMM05=00007fdf27985458 00007fdf279854a0
XMM06=00007fdf27985498 00007fdf27985490 XMM07=00007fdf27985488 00007fdf27985480
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007fdf27811c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
