last executing test programs:

1.152830481s ago: executing program 0 (id=29):
r0 = socket$kcm(0x2, 0x5, 0x84)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x1, 0x2, 0xa}, {0x2}], 0x10, 0x8}, 0x94)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
close(r2)
recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r3=>0xffffffffffffffff]}}], 0x18}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0x10, &(0x7f0000000000)=r3, 0x8)

1.057791263s ago: executing program 0 (id=32):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7968dd986c6a6700020006aa"], 0xfdef)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48)

800.725637ms ago: executing program 0 (id=36):
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e00e020023200b02d25a80ef8c6394f93e24fc60049d0d", 0x17}], 0x1}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000202070ca00000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = socket$kcm(0x10, 0x2, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33)

799.173983ms ago: executing program 2 (id=38):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x29, &(0x7f0000001500)=[{&(0x7f0000001580)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d815001b003a05142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x0)

774.616749ms ago: executing program 0 (id=40):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x4, 0x5, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xa100, 0x7, 0x8, 0x0, 0x2b66, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x2, [@var={0x2, 0x0, 0x0, 0x11, 0x3, 0xffffffff}, @const={0x0, 0x0, 0x0, 0x2, 0x3}]}}, 0x0, 0x36, 0x0, 0x0, 0x800}, 0x28)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b000000000000"], 0xcfa4)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

710.70756ms ago: executing program 2 (id=42):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000680)={r0, &(0x7f00000002c0), 0x0}, 0x20)

642.087508ms ago: executing program 2 (id=43):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080006007c09e8fe55a10a0015800a00142603600e1208000f0000000406a80005c0080003400400027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1}, 0x0)

641.770081ms ago: executing program 2 (id=44):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b400000000000000791028000000000069000c00000000009500740000000000", @ANYRESDEC], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/164, 0x0, 0x25, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff8f}, 0x48)

561.898073ms ago: executing program 2 (id=45):
r0 = socket$kcm(0xa, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x3, @remote, 0x5, 0x3}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000080)='n', 0x1}], 0x1}, 0x2600c055)

511.737117ms ago: executing program 2 (id=46):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, 0x0, 0x0, 0x8, 0xc3, &(0x7f00000003c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94)
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r1=>0xffffffffffffffff})
recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@rights={{0x14, 0x1, 0x1, [<r2=>0xffffffffffffffff]}}], 0x18}, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0x10, 0x0, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x1b, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r3)
r4 = socket$kcm(0x2, 0x1000000000000002, 0x0)
r5 = gettid()
perf_event_open(0x0, r5, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
syz_open_procfs$namespace(r5, &(0x7f0000000180)='ns/uts\x00')
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r7 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0)
setsockopt$sock_attach_bpf(r4, 0x88, 0x67, &(0x7f00000002c0), 0x4)
sendmsg$inet(r4, &(0x7f0000000380)={&(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000100)="00446916ab", 0x5}], 0x1, &(0x7f0000000000)}, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000310081044e81f782db44b904021d080005000000e8fe55a1180015000600142603600e120900210000000401a8001600a40001", 0x37}], 0x1}, 0x0)

319.206904ms ago: executing program 0 (id=47):
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000000)={'veth0_vlan\x00', @remote})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000180), &(0x7f00000001c0)=r2}, 0x20)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10)
openat$tun(0xffffff9c, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'veth0_vlan\x00', @random="0106002010ff"})

319.020165ms ago: executing program 1 (id=48):
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x3, 0x1, 0x0, {0xa, 0x4e23, 0x9, @loopback, 0x97}}}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x2000f765)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

136.766721ms ago: executing program 1 (id=49):
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x800c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x9, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0)
bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0)
socketpair(0x1, 0x2, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x541b, &(0x7f0000000080))
socket$kcm(0x2c, 0x3, 0x0)
socket$kcm(0x2c, 0x3, 0x0)
openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x24, &(0x7f00000000c0), 0x4)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x4, 0xffffffff}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000780)="f4000900062b2c25fe80000000000000dc8b850f238466cc00007a000000ad6e911b51818462b400", 0x28}], 0x1}, 0x0)
r0 = socket$kcm(0x22, 0x2, 0x21)
r1 = socket$kcm(0x2, 0x2, 0x0)
setsockopt$sock_attach_bpf(r1, 0x1, 0x45, &(0x7f0000000640), 0x4)
recvmsg$kcm(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x4001a050)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@ifindex, 0x6, 0x0, 0xa, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000100)=[0x0], 0x0, &(0x7f0000000200)=[0x0]}, 0x40)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xa, 0x10, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

133.126395ms ago: executing program 1 (id=50):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x74, &(0x7f0000000040)=[{&(0x7f0000000000)="2000000020008107090f9becdb4cb96b02000020fd0000010064000000000000", 0x20}], 0x1, 0x0, 0x0, 0x81000000}, 0x0)

50.619985ms ago: executing program 1 (id=51):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x36}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80)

9.345604ms ago: executing program 1 (id=52):
perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}, 0x0, 0xc8}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(r1)
recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r2=>0xffffffffffffffff]}}], 0x18}, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="8fedcb791f6f9875f37538e486dd6317ce81ea038800fe08000e40000200875a65969ff57b00ff02"], 0xfdef)

3.65216ms ago: executing program 0 (id=53):
bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xb, 0x5, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x11}, @call={0x85, 0x0, 0x0, 0x2a}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48)

0s ago: executing program 1 (id=54):
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
socket$kcm(0x10, 0x400000002, 0x0)
socket$kcm(0x2, 0x922000000001, 0x106)
socket$kcm(0xa, 0x5, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfe33)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r2 = openat$cgroup_procs(r1, &(0x7f0000000100)='tasks\x00', 0x2, 0x0)
write$cgroup_pid(r2, &(0x7f00000001c0), 0x12)
r3 = openat$cgroup_freezer_state(r1, &(0x7f0000000080), 0x2, 0x0)
write$cgroup_freezer_state(r3, &(0x7f00000000c0)='THAWED\x00', 0x7)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2})
bpf$MAP_CREATE(0x0, 0x0, 0x0)
ioctl$TUNSETQUEUE(r0, 0x400454d9, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48)
bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x2, 0x0, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:2680' (ED25519) to the list of known hosts.
syzkaller login: [   40.963664][ T5767] cgroup: Unknown subsys name 'net'
[   41.070516][ T5767] cgroup: Unknown subsys name 'cpuset'
[   41.074852][ T5767] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   42.349409][ T5767] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   45.398856][ T5828] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   45.401995][ T5828] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   45.404914][ T5828] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   45.407935][ T5828] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   45.412545][   T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   45.415111][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   45.436963][ T5217] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   45.440690][ T5217] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   45.451691][ T5217] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   45.454674][ T5217] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   45.503118][ T5828] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   45.506031][ T5828] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   45.508889][ T5828] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   45.511703][ T5828] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   45.514470][ T5828] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   45.660236][ T5825] chnl_net:caif_netlink_parms(): no params data found
[   45.711096][ T5829] chnl_net:caif_netlink_parms(): no params data found
[   45.729026][ T5834] chnl_net:caif_netlink_parms(): no params data found
[   45.781436][ T5825] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.784321][ T5825] bridge0: port 1(bridge_slave_0) entered disabled state
[   45.786976][ T5825] bridge_slave_0: entered allmulticast mode
[   45.790268][ T5825] bridge_slave_0: entered promiscuous mode
[   45.804520][ T5825] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.807064][ T5825] bridge0: port 2(bridge_slave_1) entered disabled state
[   45.809908][ T5825] bridge_slave_1: entered allmulticast mode
[   45.812725][ T5825] bridge_slave_1: entered promiscuous mode
[   45.849123][ T5825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   45.859963][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.862483][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state
[   45.865057][ T5829] bridge_slave_0: entered allmulticast mode
[   45.867841][ T5829] bridge_slave_0: entered promiscuous mode
[   45.880151][ T5825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   45.890826][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.893275][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state
[   45.895731][ T5829] bridge_slave_1: entered allmulticast mode
[   45.899134][ T5829] bridge_slave_1: entered promiscuous mode
[   45.901845][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state
[   45.904371][ T5834] bridge0: port 1(bridge_slave_0) entered disabled state
[   45.906877][ T5834] bridge_slave_0: entered allmulticast mode
[   45.910106][ T5834] bridge_slave_0: entered promiscuous mode
[   45.913458][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state
[   45.915888][ T5834] bridge0: port 2(bridge_slave_1) entered disabled state
[   45.918823][ T5834] bridge_slave_1: entered allmulticast mode
[   45.921684][ T5834] bridge_slave_1: entered promiscuous mode
[   45.935101][ T5825] team0: Port device team_slave_0 added
[   45.939065][ T5825] team0: Port device team_slave_1 added
[   45.977048][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   45.989122][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_0
[   45.991527][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.001199][ T5825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   46.006973][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   46.011940][ T5834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   46.021699][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_1
[   46.024027][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.032549][ T5825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   46.037621][ T5834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   46.067942][ T5829] team0: Port device team_slave_0 added
[   46.071467][ T5829] team0: Port device team_slave_1 added
[   46.096676][ T5834] team0: Port device team_slave_0 added
[   46.107536][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0
[   46.110146][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.119283][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   46.125831][ T5825] hsr_slave_0: entered promiscuous mode
[   46.128860][ T5825] hsr_slave_1: entered promiscuous mode
[   46.132603][ T5834] team0: Port device team_slave_1 added
[   46.135370][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1
[   46.137766][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.146759][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   46.176757][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_0
[   46.180098][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.189060][ T5834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   46.204307][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_1
[   46.206724][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   46.215914][ T5834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   46.242725][ T5829] hsr_slave_0: entered promiscuous mode
[   46.245148][ T5829] hsr_slave_1: entered promiscuous mode
[   46.247349][ T5829] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   46.250147][ T5829] Cannot create hsr debugfs directory
[   46.304539][ T5834] hsr_slave_0: entered promiscuous mode
[   46.306968][ T5834] hsr_slave_1: entered promiscuous mode
[   46.310062][ T5834] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   46.312509][ T5834] Cannot create hsr debugfs directory
[   46.442196][ T5825] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   46.455814][ T5825] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   46.468984][ T5825] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   46.474276][ T5825] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   46.508415][ T5829] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   46.513660][ T5829] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   46.521829][ T5829] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   46.532412][ T5825] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.534975][ T5825] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.537814][ T5825] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.540319][ T5825] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.544372][ T5829] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   46.580281][ T5834] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   46.592094][ T5834] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   46.597139][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.599922][ T5829] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.602611][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.605025][ T5829] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.611721][ T5834] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   46.617609][ T5834] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   46.656260][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.658800][ T5834] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.661308][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.663749][ T5834] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.672521][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.682473][   T26] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.686284][   T26] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.691118][   T26] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.694483][   T26] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.700443][   T26] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.704185][   T26] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.731031][ T5825] 8021q: adding VLAN 0 to HW filter on device team0
[   46.739666][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.742688][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.751904][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.754918][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.770982][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.794866][ T5829] 8021q: adding VLAN 0 to HW filter on device team0
[   46.803983][ T5825] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   46.809446][ T5825] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   46.821202][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.824200][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.832841][ T5834] 8021q: adding VLAN 0 to HW filter on device bond0
[   46.840813][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.843254][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.861825][ T5834] 8021q: adding VLAN 0 to HW filter on device team0
[   46.877268][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.879787][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   46.884730][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.887180][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   46.965055][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0
[   47.014958][ T5825] veth0_vlan: entered promiscuous mode
[   47.023757][ T5825] veth1_vlan: entered promiscuous mode
[   47.041343][ T5834] 8021q: adding VLAN 0 to HW filter on device batadv0
[   47.063166][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0
[   47.077286][ T5825] veth0_macvtap: entered promiscuous mode
[   47.092367][ T5825] veth1_macvtap: entered promiscuous mode
[   47.097720][ T5834] veth0_vlan: entered promiscuous mode
[   47.112268][ T5834] veth1_vlan: entered promiscuous mode
[   47.117997][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0
[   47.130679][ T5829] veth0_vlan: entered promiscuous mode
[   47.134496][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1
[   47.142021][ T5829] veth1_vlan: entered promiscuous mode
[   47.146128][ T5825] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   47.150244][ T5825] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   47.153146][ T5825] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   47.156067][ T5825] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   47.182661][ T5834] veth0_macvtap: entered promiscuous mode
[   47.201327][ T5834] veth1_macvtap: entered promiscuous mode
[   47.210264][ T5829] veth0_macvtap: entered promiscuous mode
[   47.223563][ T5829] veth1_macvtap: entered promiscuous mode
[   47.232558][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_0
[   47.240933][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.243710][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.248241][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_1
[   47.261378][ T5834] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   47.265018][ T5834] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   47.270753][ T5834] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   47.274321][ T5834] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   47.286434][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0
[   47.296503][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1
[   47.305155][ T5829] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   47.308060][ T5829] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   47.311651][ T5829] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   47.314591][ T5829] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   47.319290][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.322152][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.382685][ T5825] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   47.400103][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.403391][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.443637][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.457428][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.461302][   T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.464076][   T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.479271][ T5828] Bluetooth: hci0: command tx timeout
[   47.486513][ T5828] Bluetooth: hci0: unexpected event 0x33 length: 15 > 10
[   47.489344][ T5828] Bluetooth: hci1: command tx timeout
[   47.496687][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   47.501698][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   47.558633][ T5828] Bluetooth: hci2: command tx timeout
[   47.570687][ T5898] netlink: 'syz.2.5': attribute type 4 has an invalid length.
[   47.573371][ T5898] netlink: 14345 bytes leftover after parsing attributes in process `syz.2.5'.
[   47.665039][ T5909] netlink: 'syz.2.10': attribute type 10 has an invalid length.
[   47.667803][ T5909] netlink: 'syz.2.10': attribute type 19 has an invalid length.
[   47.673126][ T5909] netlink: 14536 bytes leftover after parsing attributes in process `syz.2.10'.
[   47.882341][ T5921] netlink: 'syz.0.16': attribute type 3 has an invalid length.
[   48.021314][ T5925] netlink: 26 bytes leftover after parsing attributes in process `syz.1.18'.
[   48.147347][ T5932] netlink: 'syz.0.21': attribute type 1 has an invalid length.
[   48.153531][ T5932] netlink: 168864 bytes leftover after parsing attributes in process `syz.0.21'.
[   48.296254][ T5938] netlink: 1010 bytes leftover after parsing attributes in process `syz.1.24'.
[   48.306423][ T5938] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported
[   48.316195][ T5940] warning: `syz.0.25' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   48.577557][ T5948] sctp: [Deprecated]: syz.0.29 (pid 5948) Use of struct sctp_assoc_value in delayed_ack socket option.
[   48.577557][ T5948] Use struct sctp_sack_info instead
[   48.677922][ T5954] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   48.885855][ T5960] netlink: 'syz.2.35': attribute type 13 has an invalid length.
[   48.888842][ T5960] netlink: 24859 bytes leftover after parsing attributes in process `syz.2.35'.
[   48.917876][ T5962] netlink: 'syz.0.36': attribute type 13 has an invalid length.
[   48.921547][ T5962] netlink: 24859 bytes leftover after parsing attributes in process `syz.0.36'.
[   48.921784][ T5964] netlink: 'syz.1.37': attribute type 4 has an invalid length.
[   48.965810][ T5968] netlink: 'syz.2.38': attribute type 27 has an invalid length.
[   48.979261][ T5968] netlink: 'syz.2.38': attribute type 3 has an invalid length.
[   48.981833][ T5968] netlink: 132 bytes leftover after parsing attributes in process `syz.2.38'.
[   49.385497][ T5987] veth0_vlan: entered allmulticast mode
[   49.406341][ T5983] Zero length message leads to an empty skb
[   49.444963][    C0] hrtimer: interrupt took 31309 ns
[   49.545391][ T5993] veth0_vlan: left promiscuous mode
[   49.548624][ T5993] veth0_vlan: entered promiscuous mode
[   49.569536][ T5217] Bluetooth: hci0: command tx timeout
[   49.571469][ T5828] Bluetooth: hci1: command tx timeout
[   49.574283][ T5991] delete_channel: no stack
[   49.620000][ T5995] netlink: 4 bytes leftover after parsing attributes in process `syz.1.50'.
[   49.640870][ T5828] Bluetooth: hci2: command tx timeout
[   49.762640][ T6002] 
[   49.763610][ T6002] =============================
[   49.765269][ T6002] WARNING: suspicious RCU usage
[   49.766944][ T6002] 6.16.0-rc6-syzkaller-00434-gcd7c97f4584a-dirty #0 Not tainted
[   49.770603][ T6002] -----------------------------
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   49.772372][ T6002] net/core/netclassid_cgroup.c:24 suspicious rcu_dereference_check() usage!
[   49.775438][ T6002] 
[   49.775438][ T6002] other info that might help us debug this:
[   49.775438][ T6002] 
[   49.779090][ T6002] 
[   49.779090][ T6002] rcu_scheduler_active = 2, debug_locks = 1
[   49.781784][ T6002] 1 lock held by syz.0.53/6002:
[   49.783471][ T6002]  #0: ffffffff8e13f280 (rcu_read_lock_trace){....}-{0:0}, at: rcu_read_lock_trace+0x38/0x80
[   49.787062][ T6002] 
[   49.787062][ T6002] stack backtrace:
[   49.789363][ T6002] CPU: 0 UID: 0 PID: 6002 Comm: syz.0.53 Not tainted 6.16.0-rc6-syzkaller-00434-gcd7c97f4584a-dirty #0 PREEMPT(full) 
[   49.789375][ T6002] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   49.789381][ T6002] Call Trace:
[   49.789384][ T6002]  <TASK>
[   49.789389][ T6002]  dump_stack_lvl+0x189/0x250
[   49.789404][ T6002]  ? __pfx_dump_stack_lvl+0x10/0x10
[   49.789415][ T6002]  ? __pfx__printk+0x10/0x10
[   49.789429][ T6002]  ? print_lock_name+0xde/0x100
[   49.789443][ T6002]  lockdep_rcu_suspicious+0x140/0x1d0
[   49.789454][ T6002]  task_cls_state+0x1a5/0x1d0
[   49.789467][ T6002]  bpf_get_cgroup_classid_curr+0x18/0x60
[   49.789482][ T6002]  bpf_prog_c755d30b5e918e33+0x1b/0x26
[   49.789490][ T6002]  bpf_prog_run_pin_on_cpu+0x6a/0x150
[   49.789502][ T6002]  bpf_prog_test_run_syscall+0x312/0x4b0
[   49.789511][ T6002]  ? __pfx_bpf_prog_test_run_syscall+0x10/0x10
[   49.789519][ T6002]  ? __fget_files+0x2a/0x420
[   49.789530][ T6002]  ? __pfx_bpf_prog_test_run_syscall+0x10/0x10
[   49.789538][ T6002]  bpf_prog_test_run+0x2c7/0x340
[   49.789548][ T6002]  __sys_bpf+0x581/0x870
[   49.789555][ T6002]  ? __pfx___sys_bpf+0x10/0x10
[   49.789589][ T6002]  ? rcu_is_watching+0x15/0xb0
[   49.789603][ T6002]  __x64_sys_bpf+0x7c/0x90
[   49.789614][ T6002]  do_syscall_64+0xfa/0x3b0
[   49.789624][ T6002]  ? lockdep_hardirqs_on+0x9c/0x150
[   49.789635][ T6002]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   49.789643][ T6002]  ? exc_page_fault+0x9f/0xf0
[   49.789654][ T6002]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   49.789663][ T6002] RIP: 0033:0x7ff700f8eb69
[   49.789672][ T6002] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   49.789679][ T6002] RSP: 002b:00007ff701ddd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[   49.789687][ T6002] RAX: ffffffffffffffda RBX: 00007ff7011b5fa0 RCX: 00007ff700f8eb69
[   49.789693][ T6002] RDX: 0000000000000048 RSI: 0000200000000340 RDI: 000000000000000a
[   49.789697][ T6002] RBP: 00007ff701011df1 R08: 0000000000000000 R09: 0000000000000000
[   49.789701][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   49.789706][ T6002] R13: 0000000000000000 R14: 00007ff7011b5fa0 R15: 00007ffe0eb2d6f8
[   49.789716][ T6002]  </TASK>
[   51.224397][ T5698] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   51.305926][ T5698] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   51.365697][ T5698] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   51.427381][ T5698] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   51.507515][ T5698] bridge_slave_1: left allmulticast mode
[   51.510668][ T5698] bridge_slave_1: left promiscuous mode
[   51.513114][ T5698] bridge0: port 2(bridge_slave_1) entered disabled state
[   51.522329][ T5698] bridge_slave_0: left allmulticast mode
[   51.524308][ T5698] bridge_slave_0: left promiscuous mode
[   51.526640][ T5698] bridge0: port 1(bridge_slave_0) entered disabled state
[   51.729388][ T5698] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   51.734796][ T5698] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   51.740106][ T5698] bond0 (unregistering): Released all slaves
[   51.954381][ T5698] hsr_slave_0: left promiscuous mode
[   51.956672][ T5698] hsr_slave_1: left promiscuous mode
[   51.960051][ T5698] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   51.962632][ T5698] batman_adv: batadv0: Removing interface: batadv_slave_0
[   51.967138][ T5698] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   51.970178][ T5698] batman_adv: batadv0: Removing interface: batadv_slave_1
[   51.980894][ T5698] veth1_macvtap: left promiscuous mode
[   51.982938][ T5698] veth0_macvtap: left promiscuous mode
[   51.984871][ T5698] veth1_vlan: left promiscuous mode
[   51.986636][ T5698] veth0_vlan: left promiscuous mode
[   52.185839][ T5698] team0 (unregistering): Port device team_slave_1 removed
[   52.204814][ T5698] team0 (unregistering): Port device team_slave_0 removed
[   52.656201][ T5698] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   52.702191][ T5698] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   52.747458][ T5698] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   52.803552][ T5698] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   52.926093][ T5698] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   52.977519][ T5698] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   53.019057][ T5698] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   53.159275][ T5698] bridge_slave_1: left allmulticast mode
[   53.161286][ T5698] bridge_slave_1: left promiscuous mode
[   53.163324][ T5698] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.168968][ T5698] bridge_slave_0: left allmulticast mode
[   53.170913][ T5698] bridge_slave_0: left promiscuous mode
[   53.172999][ T5698] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.177666][ T5698] bridge_slave_1: left allmulticast mode
[   53.180915][ T5698] bridge_slave_1: left promiscuous mode
[   53.182934][ T5698] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.186801][ T5698] bridge_slave_0: left allmulticast mode
[   53.189142][ T5698] bridge_slave_0: left promiscuous mode
[   53.191116][ T5698] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.420185][ T5698] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   53.424514][ T5698] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   53.430992][ T5698] bond0 (unregistering): Released all slaves
[   53.589289][ T5698] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   53.593328][ T5698] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   53.596990][ T5698] bond0 (unregistering): Released all slaves
[   53.965049][ T5698] hsr_slave_0: left promiscuous mode
[   53.967314][ T5698] hsr_slave_1: left promiscuous mode
[   53.969549][ T5698] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   53.972003][ T5698] batman_adv: batadv0: Removing interface: batadv_slave_0
[   53.974848][ T5698] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   53.977337][ T5698] batman_adv: batadv0: Removing interface: batadv_slave_1
[   53.983196][ T5698] hsr_slave_0: left promiscuous mode
[   53.986407][ T5698] hsr_slave_1: left promiscuous mode
[   53.992168][ T5698] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   53.994711][ T5698] batman_adv: batadv0: Removing interface: batadv_slave_0
[   53.997514][ T5698] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   54.000082][ T5698] batman_adv: batadv0: Removing interface: batadv_slave_1
[   54.014361][ T5698] veth1_macvtap: left promiscuous mode
[   54.016292][ T5698] veth0_macvtap: left promiscuous mode
[   54.018607][ T5698] veth1_vlan: left promiscuous mode
[   54.020434][ T5698] veth0_vlan: left promiscuous mode
[   54.023037][ T5698] veth1_macvtap: left promiscuous mode
[   54.024933][ T5698] veth0_macvtap: left promiscuous mode
[   54.027220][ T5698] veth1_vlan: left promiscuous mode
[   54.029170][ T5698] veth0_vlan: left promiscuous mode
[   54.273458][ T5698] team0 (unregistering): Port device team_slave_1 removed
[   54.288966][ T5698] team0 (unregistering): Port device team_slave_0 removed
[   54.599862][ T5698] team0 (unregistering): Port device team_slave_1 removed
[   54.615591][ T5698] team0 (unregistering): Port device team_slave_0 removed

VM DIAGNOSIS:
13:11:45  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000072 RBX=0000000000000072 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000f1f RDI=0000000000000f20 RBP=00000000000003f8 RSP=ffffc900043ef550
R8 =ffff8881068f8237 R9 =1ffff11020d1f046 R10=dffffc0000000000 R11=ffffffff85471fa0
R12=dffffc0000000000 R13=ffffffff99af589f R14=ffffffff99dfa1e0 R15=0000000000000000
RIP=ffffffff8547201c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007ff701ddd6c0 ffffffff 00c00000
GS =0000 ffff8880b861f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c2c1385 CR3=0000000038a0e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007ff701187498 00007ff701187470 XMM03=00007ff7011874a8 00007ff7011874a0
XMM04=00007ff701ced100 00007ff701187460 XMM05=00007ff701187478 00007ff7011874c0
XMM06=00007ff7011874b8 00007ff7011874b0 XMM07=00007ff7011874a8 00007ff7011874a0
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007ff701012f89
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff81b4b390 RBX=ffff88813663b200 RCX=ffff88802169b980 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc900030bf700 RSP=ffffc900030bf5a0
R8 =ffffffff8fa1e8f7 R9 =1ffffffff1f43d1e R10=dffffc0000000000 R11=fffffbfff1f43d1f
R12=1ffff1100960838d R13=dffffc0000000000 R14=0000000000000000 R15=ffff88804b041c68
RIP=ffffffff81b4b379 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f2785ce7d60 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00007f27851876c3 00007f27851876c3 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 00ff000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=000055556110fcf9 000055556110f630
XMM06=0000000000000000 0000000000000000 XMM07=de0008001ca00300 08001c9803000800
XMM08=1c90030fffffffff ffff041c80030fff XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
