last executing test programs:

446.198531ms ago: executing program 2 (id=156):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="020300030f000000000700000000000005000900e000000001d78771b90bd8a3b4914783c58777003d5b9538a9d03e6e9bfdac550000000003000600000000000200000000000000000000000000001c02000100000000000000020d00000000030005000000000002"], 0x78}, 0x1, 0x7}, 0x0)

393.848487ms ago: executing program 2 (id=158):
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r1, &(0x7f00000002c0)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x6, @dev={0xfe, 0x80, '\x00', 0x2b}, 0x5}, 0x1c, &(0x7f0000000480)=[{&(0x7f00000005c0)="8c7f924c", 0x4}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e22, 0x200006, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8}, 0x1c, &(0x7f0000000a40)=[{&(0x7f0000000500)='\x00', 0x1}], 0x1}}], 0x2, 0x4048010)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x41, 0x3, 0x258, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x1c0, 0x1f0, 0x1f0, 0x1c0, 0x1f0, 0x3, 0x0, {[{{@ip={@local, @loopback, 0x0, 0x0, 'wlan1\x00', 'veth1_to_hsr\x00'}, 0x0, 0xd0, 0xf0, 0x0, {0x0, 0xffffffffa0028000}, [@common=@unspec=@connbytes={{0x38}, {[{}, {0x10000}], 0x0, 0x3}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, 0x0, 0xa2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2b8)

333.374946ms ago: executing program 2 (id=159):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x14, 0x33, 0x1, 0x70bd2b, 0x25dbdbfe, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x50}, 0x4000000)
sendmsg$nl_route(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="300000204a0001e9000a199246421757e8d508ec73e6fcbcdc8cff6a6eb9d22c728fd1e73e5e706abc20114c27d03532920ed8a048796bf5abbd84875e95378cc2db4e2e7aa07207680ef3b9f822f89e01fbb08a51698e38aebae1b8d90d60989e59579c8db54ec12af27943402f1dfacfdf48b3b95af3f0a6e585fe37da934b2a2d78f09307fefe5a19eb232b4e9bb98986a8f54c61f2a42ec476049ed3ead6ba07d6bfeb2800000000000000"], 0x30}}, 0x4040090)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x268, 0x0, 0x25, 0x148, 0xb8, 0x60, 0x1d0, 0x2a8, 0x2a8, 0x1d0, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xff, 0xff, 'xfrm0\x00', 'ipvlan1\x00', {0xff}, {0xff}, 0xc, 0x3, 0x2a}, 0x0, 0x70, 0xb8, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz0\x00'}}}, {{@ip={@broadcast, @multicast1, 0x0, 0xffffffff, 'veth1_to_bond\x00', 'veth0\x00', {0xff}, {0xff}}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@unspec=@cgroup0={{0x28}, {0x4}}, @common=@unspec=@statistic={{0x38}, {0x100}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x168, 0x5, 0x0, '\x00', {0x1fb}}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x2c8)

332.645004ms ago: executing program 0 (id=161):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000980)={&(0x7f0000000840)=ANY=[@ANYBLOB="9feb0100180000000000000054000000540000000a000000000000000000000b0300000005000000000000020300000000000000000000030000000004000000020000000e000000000000000300000d00000000070000000000000003000000000000000a000000020000009b820000000000000000"], &(0x7f0000000940)=""/53, 0x76, 0x35}, 0x28)

284.179659ms ago: executing program 0 (id=162):
r0 = socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$inet6_udp(0xa, 0x2, 0x0) (async)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x14, 0x1, 0x4, 0x401, 0x0, 0x0, {0x2, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x40055}, 0x40000) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) (async)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000002c000000000000001800000000000000000000000002000000000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00'}, 0x90)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r3, 0xe0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10, &(0x7f0000001380)}}, 0x10) (async)
r4 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)="9902000012006b9c9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d24460bc24eab556a705251e6182949a36c2151fef08d8cdbf9367b41ad206000000f408000300040100000800050000000000", 0x5c}, {&(0x7f0000000700)="d557fc16674b56c0a96a733c232d6790c63ca969a688b06e3da58f3c4568bf0a77bdff6f41d7890e18defe94ef1a392dc00dea94a1bee64982de7cf1c91e1103cc1840210cbb57222bc2bfa30369992a6bc5156c00aeadd359a7991ad1de01feec401dba6d7694a14785839d3c2d67188cd07827c934897de4676743c192c4a4b24f7f8747141a1325d29da89694574c32eba56e5bbc8f80376f3325dd89937e990089294183a4829e21849004c538378d41066cb7de399450b3544067", 0xbd}, {&(0x7f0000000500)="5e191aea3468a5eab1c3d6024b43dece099475c81c53aa9244d866f68b8e31e93b41b432fb0454234620a25706bfb6f01ce01093b7ff634785d8b345ef8f7a928034820bbd37467d1049ac7a724c153c358d6f7efd919bb918734e846598b03733a6f4bbce06471d3a440e14dae67170cbfea76bc33481c28ec2cfad1f3d83ddece3006d5bb30dc4288dd40bd476cc7f94d143c56e54ed4d84b9c1ecc87fc035c7c992767edcfe2218bc6542a6a3a9b879e8aa6d652d277ee640cc15d2e9efe30584ed57ab208ca4db6cf63381804a5ee5", 0xd1}, {&(0x7f00000008c0)="fd7617adb877574c4a4489fcaccde0c97bdb2d9d89dba8ab9fc9ebbdcedc770661e1971989a787890de32eebe4008ac8bfafa034add91f6ea4acc741521abecc6cbb4fcfeb61d7d08a8911e59550055d00897194afc1ffd04c18c2506d41bec374a6e5b1ed5fd07db55483fef2dc9ad8ae7c6044b08a303f256ff7e7dd720c72fc0d513110468d44e31a8fcd833d521b95c3b04378ca1c67b4faca350009045628c7f7196510f14ebdc68ba7", 0xac}, {&(0x7f0000001880)="1439ea", 0x3}], 0x5, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
writev(r4, &(0x7f0000000000), 0x0)

283.509312ms ago: executing program 2 (id=163):
r0 = socket$kcm(0x2b, 0x1, 0x0)
sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc)
shutdown(r0, 0x1)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
ioctl$TUNGETVNETLE(r2, 0x400454de, &(0x7f0000001140))
sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x18207, 0x11}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x6}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @loopback}, @IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e24}, @IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}, @IFLA_LINK={0x8}]}, 0x58}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000000)={'bond0\x00'})

234.062246ms ago: executing program 1 (id=164):
r0 = accept(0xffffffffffffffff, &(0x7f00000000c0)=@in6={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000000)=0x80)
r1 = accept4$vsock_stream(r0, &(0x7f0000000180)={0x28, 0x0, 0x2710, @local}, 0x10, 0x800)
pipe(&(0x7f0000000500)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0)
r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'ip6tnl0\x00'})
sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002b00010000000000ffdbdf2502"], 0x114}], 0x1}, 0x0)
bind(r4, &(0x7f0000000240)=@hci={0x1f, 0xffffffffffffffff, 0x3}, 0x80)
setsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="df01000008000800010000000800"], 0xe)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYRES32=r1, @ANYRES16=r2], 0x54}}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

232.395016ms ago: executing program 0 (id=165):
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
socket$inet6_tcp(0xa, 0x1, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
socket$inet(0x2, 0x2, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0))
socket$packet(0x11, 0x3, 0x300)
socket$netlink(0x10, 0x3, 0x10)
socket$inet6_udp(0xa, 0x2, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r2], 0xc4}}, 0x0)
unshare(0x24020400)
unshare(0x400)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000001c0)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x40}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x6}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x60}}, 0x80)
r4 = socket$unix(0x1, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f00000000c0)=0x41d9, 0x4)
setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000280)=0x43f1, 0x4)
tee(r1, r0, 0xa000000000000000, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071115e00000000008510000002000000850000004800000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70)

231.647885ms ago: executing program 0 (id=166):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="020300030f000000000700000000000005000900e000000001d78771b90bd8a3b4914783c58777003d5b9538a9d03e6e9bfdac550000000003000600000000000200000000000000000000000000002002000100000000000000020d00000000030005000000000002"], 0x78}, 0x1, 0x7}, 0x0)

229.343944ms ago: executing program 1 (id=167):
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'macvtap0\x00', <r0=>0x0})
r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'hsr0\x00', <r3=>0x0})
r4 = socket$packet(0x11, 0x3, 0x300) (async)
r5 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x5, 0x8, 0x9}, 0x50)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r6, &(0x7f0000000240), &(0x7f00000000c0)=@udp6=r5}, 0x20) (async)
sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) (async)
pselect6(0x40, &(0x7f0000000100), &(0x7f0000000000)={0x1f}, 0x0, 0x0, 0x0) (async)
setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) (async)
sendto$packet(r4, &(0x7f0000000180)="0b032212e0ff25000200475400f6a13bb1000000080086dd4803", 0x9e91, 0x0, &(0x7f0000000000)={0x11, 0x1a, r3}, 0x14) (async)
bind$llc(r1, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x54}, 0x10) (async)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0)
write$cgroup_int(r7, &(0x7f0000000000), 0xffffff6a)
sendfile(r1, r7, 0x0, 0xffffffff000) (async)
r8 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x4, 0xa927, 0x9, 0x1000, 0x1, 0x0, '\x00', r0, r7, 0x0, 0x1, 0x4, 0xb}, 0x50)
socket$phonet(0x23, 0x2, 0x1) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x3}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r8}, @generic={0x66}, @initr0, @exit, @alu={0x4, 0x0, 0x6, 0x3}]}, &(0x7f0000000000)='GPL\x00'}, 0x94)

171.578328ms ago: executing program 2 (id=168):
r0 = socket(0x11, 0x3, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000140)=0x1de, 0x4)
close(r0)
socket$inet_icmp_raw(0x2, 0x3, 0x1) (async)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5)
getsockopt$bt_hci(r1, 0x0, 0x1, &(0x7f0000000640)=""/132, 0x0)
close(0x4) (async)
syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00')
unshare(0x6a040000) (async)
socket(0x3, 0xf, 0x0) (async)
r2 = socket(0x2, 0x2, 0x0) (async)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003"], 0x7c}, 0x1, 0x0, 0x0, 0x4000084}, 0x0) (async)
sendmsg$NFT_BATCH(r3, 0x0, 0x0) (async)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) (async)
pipe(&(0x7f0000000380)={0xffffffffffffffff, <r5=>0xffffffffffffffff}) (async)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r6, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) (async)
setsockopt$inet_tcp_int(r6, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4)
shutdown(r6, 0x0) (async)
r7 = socket(0x840000000002, 0x3, 0xfa)
connect$inet(r7, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) (async)
sendmmsg$inet(r7, &(0x7f0000005240), 0x4000095, 0x0)
setsockopt$inet_mreqn(r7, 0x0, 0x20, 0x0, 0xa) (async)
sendto$inet(r6, &(0x7f0000000200)="e1", 0xfea8, 0x0, 0x0, 0x0)
splice(r6, 0x0, r5, 0x0, 0x10fea7, 0xa)
setsockopt$TIPC_GROUP_LEAVE(r7, 0x10f, 0x88) (async)
r8 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x12, 0x7d, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000740)={r8, 0x0, &(0x7f0000000200)=@tcp6=r2}, 0x20)

170.985184ms ago: executing program 1 (id=169):
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x17, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071110200000000001000000200000085000000bb00000095003300000000009500a5050000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xa4}, 0x70)

168.673963ms ago: executing program 1 (id=170):
bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xa, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000073116800000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0)
close(r3)
r4 = socket$kcm(0x25, 0x1, 0x0)
recvmsg(r4, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x40010040)
r5 = socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r10, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000008c0)=ANY=[@ANYBLOB="628f852acedb82306b67e3084bc37457cee89dfe84a7450553ef2909ff5e01ce85255095a39737ec2883b1ec162bfca8275d0a3ed95d305cd3bb59c89d57e1625722f791fff74c845f959ab77393956e6360b7d1b7df07f05723f875c4e48cda2f6cd077320f4cdf97457d2245b6299d3b92bce6d01fe5bfb3b5408d17dc91df675627c84be9b1e44b6ca1a67d1a5f101150d6674146efdab91b127283ef6eb5c5064880a40986bb0c6bfea0699e9bdbdc8301f67f6eac6515312cd63737e8321c42ddccf92f4895e2277dd9f8d4d1ac21e169eaefc0b9e375497004413efd691103c93c8c240a21fdc47f3e916ea11c0f18880ab5f60d229921c1e80fc2f64b4201", @ANYRES16=r9, @ANYBLOB="010026bd70000400000005000000080009000200000008000c00a50a000008000b00000000000600010007000000"], 0x34}}, 0x20)
connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e)
sendmsg$inet(r5, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x1)
r11 = socket$caif_stream(0x25, 0x1, 0x0)
setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000000140)={0x3, 0x9, 0x0, 0x1}, 0x8)
ioctl$SIOCSIFHWADDR(r3, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="0100ffffffff"})
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1d, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bb000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000003100000095"], &(0x7f0000000040)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41100, 0x60, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94)
sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0], 0x38}}, 0x0)
sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="c70000e6", @ANYRES16=r0, @ANYBLOB="0300000000000000640089800b0001006970366772650000540002525892f6800800150061db0a00", @ANYRES64=r11, @ANYBLOB="14000700fe8000000000000000000000000000aa08000d005fe1ffff060010004e22000008000500200c000014000600fc"], 0x94}, 0x1, 0x0, 0x0, 0x895}, 0x8000)
sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002780)=ANY=[@ANYBLOB="140000001000010000000000000000400300000a20000000000a05000000000000000000030000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a300000000038000000060a010400000000000000000100000008000b4000000000100004800c00018008000100636d70000c0006400000000000000005140000001100010000000000000000000000000a"], 0xac}, 0x1, 0x0, 0x0, 0x1880}, 0x0)

164.225673ms ago: executing program 0 (id=171):
r0 = socket(0x1e, 0x4, 0x0)
r1 = socket(0x1e, 0x4, 0x307)
setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0xfffffffc}, 0x10)
setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000)
recvmmsg(r1, &(0x7f0000002840)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000480)=""/4071, 0xfffffffffffffd5f}], 0x1}, 0xbe58}], 0x1, 0x7ffeedc0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0902000000000000000001000000050002000a00000014000700ff00000000000000000000000000000108000b00", @ANYRESOCT], 0x38}}, 0x0)
r4 = socket(0x1e, 0x4, 0x0)
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), r5)
ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000700)={'wpan0\x00', <r8=>0x0})
sendmsg$NL802154_CMD_DEL_SEC_DEV(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000740)={0x2c, r7, 0x3, 0x70bd27, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x2e, 0x0, 0x1, {0xc}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x200000c0)
setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
socket$tipc(0x1e, 0x5, 0x0)
close(r4)
r9 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000400)="d800000019008111e00212ba0d8105040a603f00ff0f040b067c55a1bc000900080006990300000015000500fe8081780d000500030001400200000901ac040000d67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300"/216, 0xd8}], 0x1}, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f00000000c0)=ANY=[@ANYRES32=r9, @ANYRESDEC, @ANYRES8=r9, @ANYRESHEX=r9, @ANYRES16=r9], &(0x7f0000000040)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94)

83.069896ms ago: executing program 0 (id=172):
r0 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57)
recvmmsg(r0, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x10c4}], 0x1}}], 0x4000210, 0x2, 0x0) (async)
sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}}, 0x0) (async)
r1 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'syz_tun\x00', <r2=>0x0})
bind$packet(r1, &(0x7f0000000380)={0x11, 0x15, r2, 0x1, 0x0, 0x6, @multicast}, 0x29) (async, rerun: 32)
r3 = socket$packet(0x11, 0x3, 0x300) (rerun: 32)
bind$packet(r3, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x10, 0x6, @link_local}, 0x14) (async, rerun: 32)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (rerun: 32)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async)
r5 = socket(0x2a, 0x3, 0x0) (async)
r6 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) (async)
r8 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0}) (async)
r10 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001640)=@deltfilter={0x24, 0x2d, 0x1, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0xb, 0x19}, {0x9, 0xfff1}, {0xe, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0)
r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r12 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r11}, 0x10)
r13 = socket$packet(0x11, 0x3, 0x300) (async)
setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000180)={@empty, @remote, r2}, 0xc) (async)
socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64)
ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f00000002c0)={'pim6reg\x00', <r14=>0x0}) (async, rerun: 64)
r15 = socket$nl_route(0x10, 0x3, 0x0)
sendto$packet(r13, &(0x7f0000000140)="33aaf14f564b1bf220cb1137d54b", 0xe, 0x40, &(0x7f0000000200)={0x11, 0x0, r14, 0x1, 0x8, 0x6, @multicast}, 0x14) (async)
sendmsg$nl_route_sched(r15, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r14, {}, {}, {0x13}}}, 0x24}}, 0x0)
unshare(0x62040200)

82.880521ms ago: executing program 1 (id=173):
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32=0x0, @ANYBLOB="090001"], 0x38}}, 0x40000)
write$tun(r1, &(0x7f0000000000)=ANY=[], 0x38)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0)
accept4$alg(r1, 0x0, 0x0, 0x400)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000740)=@filter={'filter\x00', 0x42, 0x4, 0x328, 0xffffffff, 0x198, 0x198, 0x198, 0xffffffff, 0xffffffff, 0x290, 0x290, 0x290, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0xb0, 0x0, {0x100000000000000}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x9}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@inet=@socket3={{0x28, 'socket\x00', 0x2}}, @common=@unspec=@addrtype1={{0x28}}]}, @REJECT={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'wlan1\x00', 'pim6reg1\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@statistic={{0x38}, {0x0, 0x2000}}, @common=@ttl={{0x28}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x388)

1.830149ms ago: executing program 2 (id=174):
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000340), 0xffffffffffffffff) (async)
socket$kcm(0x2, 0xa, 0x73) (async)
r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
socket$kcm(0x2, 0xa, 0x73) (async)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async)
sendmsg$DEVLINK_CMD_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000006c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010027bd7000fcdbdf25010000000e0001006e657464657673696d0000000f0002106e657464657673696d300000b00460e83b59ad5c23d48211903c244f8c69b6"], 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000000)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000280)=0x2, 0x4) (async)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x16c}}, 0x24)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="11000000040000000400000005"], 0x50) (async)
r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000640)=ANY=[@ANYBLOB="140000001400010000470000df8759550000000004000080a7e17aefbf271a09c28042883dd5334d13cc24897ff0a1d1f562a7f0068a6e7e65316d14c7daebaf5e59b3eef1b80400578672d2ce206182d41a6e5a4009d2c8bfc550343a832cf0d64b6e357ba2737f1c5b2b5b055f34be41299ce16a02236f"], 0x14}], 0x1}, 0x0) (async)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x8, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], <r5=>0x0, 0xf4, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000340), &(0x7f0000000380), 0x8, 0x57, 0x8, 0x8, &(0x7f00000003c0)}}, 0x10)
ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000540)={r3, 0x40, 0x9, 0x1}) (async)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x6, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRESOCT=r3, @ANYBLOB="0000000000000000b7080000000000157b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240)={r6, 0xffffffffffffffff, 0x500}, 0x57)

0s ago: executing program 1 (id=175):
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0xb2}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) (async)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0) (async)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0)
close(r0)
ioctl$SIOCSIFHWADDR(r0, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="060000000010"}) (async)
ioctl$SIOCSIFHWADDR(r0, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="060000000010"})
bind$alg(r0, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha512\x00'}, 0x58)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, 0x0, 0x4008040)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) (async)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2)
r4 = socket$inet_sctp(0x2, 0x1, 0x84)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000380)={'wlan1\x00', <r5=>0x0})
sendmsg$NL80211_CMD_DEL_MPATH(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r3, 0x1, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x8000)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async)
r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r7=>0x0})
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_TDLS_OPER(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)={0x30, r8, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000004}, 0xc000)
sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000429bd702999f69c71ed0ad60d8a3e00fddbdf258900000008000300", @ANYRES32=r7, @ANYBLOB="0c009900090000005400000028001d80240000800c000300440b663e0000000005000800cc000000050006000100000004000400"], 0x50}, 0x1, 0x0, 0x0, 0x4000014}, 0x20008841)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0)
ioctl(0xffffffffffffffff, 0x1, &(0x7f00000001c0)="0feb79dba4d547dbfc1dd208eaa30956048fec8af59ac89db5fa9990264676e2986faafd3ea5dae7bc92a1bc24e351e85f1d5bd5ddeaca8f55b490bd77a9bdc487a1216409507ef4a44e804db9321ed9a0d3b0d49a")
r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
connect$netrom(r9, &(0x7f0000000140)={{0x6, @rose}, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) (async)
connect$netrom(r9, &(0x7f0000000140)={{0x6, @rose}, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48)
socket$inet6_sctp(0xa, 0x801, 0x84) (async)
r10 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r10, &(0x7f0000000e40)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000180)='`', 0x1}], 0x1}}, {{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @private2, 0x540}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000340)="b4", 0x1}], 0x1}}], 0x2, 0x0)
shutdown(r10, 0x1)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r10, 0x84, 0x71, &(0x7f0000000040), &(0x7f00000000c0)=0x8)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async)
r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_inet_SIOCSIFFLAGS(r11, 0x8914, &(0x7f0000000100)={'lo\x00', 0x2})

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:55714' (ED25519) to the list of known hosts.
syzkaller login: [   41.979774][ T5754] cgroup: Unknown subsys name 'net'
[   42.068449][ T5754] cgroup: Unknown subsys name 'cpuset'
[   42.073885][ T5754] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   43.647978][ T5754] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   47.360060][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   47.363507][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   47.368910][   T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   47.372077][   T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   47.375935][   T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   47.432370][ T5218] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   47.436399][ T5218] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   47.440238][ T5218] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   47.444549][ T5218] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   47.448122][ T5218] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   47.563156][ T5826] chnl_net:caif_netlink_parms(): no params data found
[   47.572885][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   47.577866][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   47.581233][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   47.585278][   T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   47.588901][   T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   47.707221][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state
[   47.710858][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state
[   47.714573][ T5826] bridge_slave_0: entered allmulticast mode
[   47.718499][ T5826] bridge_slave_0: entered promiscuous mode
[   47.733451][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state
[   47.737325][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state
[   47.740396][ T5826] bridge_slave_1: entered allmulticast mode
[   47.744498][ T5826] bridge_slave_1: entered promiscuous mode
[   47.801022][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   47.821954][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   47.869956][ T5826] team0: Port device team_slave_0 added
[   47.875508][ T5826] team0: Port device team_slave_1 added
[   47.907298][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0
[   47.910228][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   47.920696][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   47.929858][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1
[   47.932722][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   47.943517][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   47.962229][ T5830] chnl_net:caif_netlink_parms(): no params data found
[   48.041841][ T5826] hsr_slave_0: entered promiscuous mode
[   48.045205][ T5826] hsr_slave_1: entered promiscuous mode
[   48.124950][ T5837] chnl_net:caif_netlink_parms(): no params data found
[   48.143887][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[   48.146874][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state
[   48.149355][ T5830] bridge_slave_0: entered allmulticast mode
[   48.152130][ T5830] bridge_slave_0: entered promiscuous mode
[   48.156718][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[   48.159273][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state
[   48.161936][ T5830] bridge_slave_1: entered allmulticast mode
[   48.165655][ T5830] bridge_slave_1: entered promiscuous mode
[   48.231253][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   48.267114][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   48.270885][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state
[   48.273889][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state
[   48.277117][ T5837] bridge_slave_0: entered allmulticast mode
[   48.280953][ T5837] bridge_slave_0: entered promiscuous mode
[   48.309072][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state
[   48.311416][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state
[   48.314348][ T5837] bridge_slave_1: entered allmulticast mode
[   48.318051][ T5837] bridge_slave_1: entered promiscuous mode
[   48.335709][ T5830] team0: Port device team_slave_0 added
[   48.352607][ T5830] team0: Port device team_slave_1 added
[   48.368076][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   48.390007][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   48.399829][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0
[   48.402823][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.414501][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   48.421376][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1
[   48.424567][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.435504][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   48.471559][ T5837] team0: Port device team_slave_0 added
[   48.482073][ T5837] team0: Port device team_slave_1 added
[   48.531495][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0
[   48.535183][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.545781][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   48.553469][ T5830] hsr_slave_0: entered promiscuous mode
[   48.556545][ T5830] hsr_slave_1: entered promiscuous mode
[   48.558665][ T5830] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   48.561176][ T5830] Cannot create hsr debugfs directory
[   48.567624][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1
[   48.570529][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   48.582612][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   48.613533][ T5826] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   48.620409][ T5826] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   48.625954][ T5826] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   48.649938][ T5826] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   48.690824][ T5837] hsr_slave_0: entered promiscuous mode
[   48.695574][ T5837] hsr_slave_1: entered promiscuous mode
[   48.698480][ T5837] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   48.701641][ T5837] Cannot create hsr debugfs directory
[   48.937847][ T5830] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   48.954251][ T5830] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   48.964005][ T5830] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   48.989388][ T5830] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   49.039548][ T5837] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   49.052168][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0
[   49.057366][ T5837] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   49.070544][ T5837] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   49.090396][ T5837] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   49.100894][ T5826] 8021q: adding VLAN 0 to HW filter on device team0
[   49.123563][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.126094][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   49.141262][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.143563][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.248409][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0
[   49.263166][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0
[   49.276368][ T5830] 8021q: adding VLAN 0 to HW filter on device team0
[   49.287155][ T5837] 8021q: adding VLAN 0 to HW filter on device team0
[   49.290670][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.293047][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   49.306464][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.308841][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   49.312445][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.314869][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.328291][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.330597][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.352805][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0
[   49.400947][ T5830] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   49.438683][ T5826] veth0_vlan: entered promiscuous mode
[   49.444145][ T5826] veth1_vlan: entered promiscuous mode
[   49.446963][ T5218] Bluetooth: hci0: command tx timeout
[   49.483598][ T5826] veth0_macvtap: entered promiscuous mode
[   49.497254][ T5826] veth1_macvtap: entered promiscuous mode
[   49.520985][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0
[   49.535434][ T5218] Bluetooth: hci1: command tx timeout
[   49.540706][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1
[   49.546916][ T5826] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   49.549736][ T5826] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   49.552462][ T5826] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   49.557007][ T5826] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   49.611989][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0
[   49.615092][ T5218] Bluetooth: hci2: command tx timeout
[   49.620827][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0
[   49.638850][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.642119][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.673526][ T3720] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   49.677179][ T3720] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   49.697970][ T5837] veth0_vlan: entered promiscuous mode
[   49.716356][ T5837] veth1_vlan: entered promiscuous mode
[   49.736949][ T5826] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   49.749826][ T5830] veth0_vlan: entered promiscuous mode
[   49.771348][ T5830] veth1_vlan: entered promiscuous mode
[   49.776547][ T5837] veth0_macvtap: entered promiscuous mode
[   49.796125][ T5837] veth1_macvtap: entered promiscuous mode
[   49.825754][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0
[   49.835972][ T5830] veth0_macvtap: entered promiscuous mode
[   49.845267][ T5830] veth1_macvtap: entered promiscuous mode
[   49.852816][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1
[   49.862547][ T5837] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   49.871399][ T5837] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   49.877827][ T5837] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   49.881519][ T5837] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   49.896273][ T5892] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   49.949056][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0
[   49.952858][ T5892] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4'.
[   49.961939][ T5892] bridge_slave_1: left allmulticast mode
[   49.965477][ T5892] bridge_slave_1: left promiscuous mode
[   49.968286][ T5892] bridge0: port 2(bridge_slave_1) entered disabled state
[   49.974959][ T5892] bridge_slave_0: left allmulticast mode
[   49.977142][ T5892] bridge_slave_0: left promiscuous mode
[   49.979578][ T5892] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.080598][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1
[   50.137041][ T5830] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   50.141112][ T5830] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   50.148395][ T5830] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   50.152165][ T5830] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   50.170261][   T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.179423][   T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   50.222218][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.227265][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   50.283911][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.303256][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   50.341341][   T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.346006][ T5897] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3'.
[   50.346961][   T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   50.352939][ T5897] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3'.
[   50.364924][   T13] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   50.368699][   T13] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   50.387416][ T5897] veth3: entered promiscuous mode
[   50.394642][ T5862] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   50.420715][ T5897] syz.2.3 uses obsolete (PF_INET,SOCK_PACKET)
[   50.486556][ T5899] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   50.535242][ T5862] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01)
[   50.538257][ T5862] wlan1: send auth to 08:02:11:00:00:00 (try 1/3)
[   50.549616][ T5902] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   50.554538][ T3720] wlan1: authenticated
[   50.559245][ T5901] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.5'.
[   50.565106][   T29] wlan1: associate with 08:02:11:00:00:00 (try 1/3)
[   50.617761][ T1595] wlan1: RX AssocResp from 08:02:11:00:00:00 (capab=0x1 status=0 aid=1)
[   50.623145][ T5899] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   50.627762][ T1595] wlan1: associated
[   50.643429][ T5899] bridge_slave_0: left allmulticast mode
[   50.647340][ T5899] bridge_slave_0: left promiscuous mode
[   50.649194][ T5899] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.655936][ T5899] bridge_slave_1: left allmulticast mode
[   50.658534][ T5899] bridge_slave_1: left promiscuous mode
[   50.661081][ T5899] bridge0: port 2(bridge_slave_1) entered disabled state
[   50.677136][ T5899] bond0: (slave bond_slave_0): Releasing backup interface
[   50.687334][ T5899] bond0: (slave bond_slave_1): Releasing backup interface
[   50.702267][ T5899] team0: Failed to send options change via netlink (err -105)
[   50.706962][ T5899] team0: Failed to send port change of device team_slave_0 via netlink (err -105)
[   50.711416][ T5899] team0: Port device team_slave_0 removed
[   50.733288][ T5899] team0: Failed to send options change via netlink (err -105)
[   50.750933][ T5899] team0: Failed to send port change of device team_slave_1 via netlink (err -105)
[   50.765511][ T5899] team0: Port device team_slave_1 removed
[   50.774532][ T5899] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   50.777618][ T5899] batman_adv: batadv0: Removing interface: batadv_slave_0
[   50.782486][ T5899] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   50.786412][ T5899] batman_adv: batadv0: Removing interface: batadv_slave_1
[   50.934672][  T790] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   51.157766][ T5919] warning: `syz.2.11' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   51.364857][ T5862] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   51.511755][ T5929] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.14'.
[   51.524822][ T5218] Bluetooth: hci0: command tx timeout
[   51.605195][ T5218] Bluetooth: hci1: command tx timeout
[   51.684506][ T5218] Bluetooth: hci2: command tx timeout
[   52.017584][ T5950] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   52.041569][ T5952] netlink: 8 bytes leftover after parsing attributes in process `syz.0.21'.
[   52.046954][ T5952] netlink: 16 bytes leftover after parsing attributes in process `syz.0.21'.
[   52.055292][   T12] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   52.061388][   T12] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   52.072346][ T5950] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   52.084707][ T5895] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   52.097223][ T5952] veth3: entered promiscuous mode
[   52.103948][ T5954] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.23'.
[   52.141497][ T5955] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   52.159650][ T5950] bridge_slave_0: left allmulticast mode
[   52.161727][ T5950] bridge_slave_0: left promiscuous mode
[   52.163992][ T5950] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.174424][ T5895] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   52.187730][ T5950] bridge_slave_1: left allmulticast mode
[   52.190099][ T5950] bridge_slave_1: left promiscuous mode
[   52.192508][ T5950] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.230476][ T5950] bond0: (slave bond_slave_0): Releasing backup interface
[   52.237059][ T5950] bond0: (slave bond_slave_1): Releasing backup interface
[   52.249769][ T5950] team0: Failed to send options change via netlink (err -105)
[   52.253204][ T5950] team0: Failed to send port change of device team_slave_0 via netlink (err -105)
[   52.258240][ T5950] team0: Port device team_slave_0 removed
[   52.270801][ T5950] team0: Failed to send options change via netlink (err -105)
[   52.274983][ T5950] team0: Failed to send port change of device team_slave_1 via netlink (err -105)
[   52.279305][ T5950] team0: Port device team_slave_1 removed
[   52.282360][ T5950] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   52.286193][ T5950] batman_adv: batadv0: Removing interface: batadv_slave_0
[   52.290969][ T5950] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   52.299347][ T5950] batman_adv: batadv0: Removing interface: batadv_slave_1
[   52.344869][ T5876] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   52.391156][ T5962] netlink: 4 bytes leftover after parsing attributes in process `syz.0.26'.
[   52.475850][ T5966] netlink: 52 bytes leftover after parsing attributes in process `syz.1.28'.
[   52.478923][ T5966] netlink: 'syz.1.28': attribute type 1 has an invalid length.
[   52.847464][ T5987] Zero length message leads to an empty skb
[   53.111750][ T6002] trusted_key: syz.1.38 sent an empty control message without MSG_MORE.
[   53.273245][ T6021] netlink: zone id is out of range
[   53.291708][ T6021] netlink: zone id is out of range
[   53.293955][ T6021] netlink: zone id is out of range
[   53.305183][ T6021] netlink: zone id is out of range
[   53.309920][ T6021] netlink: zone id is out of range
[   53.312165][ T6021] netlink: zone id is out of range
[   53.322446][ T6021] netlink: zone id is out of range
[   53.329906][ T6021] netlink: zone id is out of range
[   53.332203][ T6021] netlink: zone id is out of range
[   53.338941][ T6021] netlink: zone id is out of range
[   53.501427][ T6033] tipc: Enabling of bearer <udp:sy> rejected, failed to enable media
[   53.615838][ T5218] Bluetooth: hci0: command tx timeout
[   53.684748][ T5218] Bluetooth: hci1: command tx timeout
[   53.727526][ T6048] netlink: 'syz.2.49': attribute type 12 has an invalid length.
[   53.762290][ T6052] netlink: 'syz.0.52': attribute type 1 has an invalid length.
[   53.767281][ T5218] Bluetooth: hci2: command tx timeout
[   54.203664][ T6076] netlink: 'syz.1.54': attribute type 83 has an invalid length.
[   54.579668][ T6094] xt_socket: unknown flags 0xfc
[   54.706741][ T6105] netlink: 'syz.2.63': attribute type 5 has an invalid length.
[   54.810862][ T6117] xt_CT: You must specify a L4 protocol and not use inversions on it
[   55.131438][ T6142] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on
[   55.684483][ T5218] Bluetooth: hci0: command tx timeout
[   55.764320][ T5218] Bluetooth: hci1: command tx timeout
[   55.845627][ T5218] Bluetooth: hci2: command tx timeout
[   55.910331][ T6158] kthread_run failed with err -4
[   56.051242][ T5863] IPVS: starting estimator thread 0...
[   56.154477][ T6174] IPVS: using max 79 ests per chain, 189600 per kthread
[   56.244414][    C0] ip6_tnl_xmit_ctl: 3 callbacks suppressed
[   56.244427][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   56.289897][ T6201] __nla_validate_parse: 7 callbacks suppressed
[   56.289911][ T6201] netlink: 16 bytes leftover after parsing attributes in process `syz.0.88'.
[   56.434637][ T6216] netdevsim netdevsim0 netdevsim0: entered allmulticast mode
[   56.482370][ T6214] syz.1.90 (6214) used greatest stack depth: 19000 bytes left
[   56.537373][ T6223] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   56.548687][ T6223] xt_time: invalid argument - start or stop time greater than 23:59:59
[   56.618770][ T6234] netlink: 4 bytes leftover after parsing attributes in process `syz.0.99'.
[   56.623682][ T6234] netlink: 4 bytes leftover after parsing attributes in process `syz.0.99'.
[   56.678887][ T6242] netlink: 'syz.0.102': attribute type 142 has an invalid length.
[   56.686160][ T6244] netlink: 'syz.0.102': attribute type 142 has an invalid length.
[   56.743107][ T6248] netlink: 84 bytes leftover after parsing attributes in process `syz.0.103'.
[   56.754265][ T6248] netem: invalid attributes len -16
[   56.756265][ T6248] netem: change failed
[   57.136782][ T6283] netlink: 'syz.0.115': attribute type 1 has an invalid length.
[   57.140100][ T6283] netlink: 224 bytes leftover after parsing attributes in process `syz.0.115'.
[   57.188356][ T6286] netlink: 32 bytes leftover after parsing attributes in process `syz.0.116'.
[   57.192650][ T6286] netlink: 32 bytes leftover after parsing attributes in process `syz.0.116'.
[   57.289598][ T6293] netlink: 12 bytes leftover after parsing attributes in process `syz.0.118'.
[   58.042316][ T6307] netlink: 'syz.1.123': attribute type 10 has an invalid length.
[   58.042321][ T6305] netlink: 'syz.1.123': attribute type 17 has an invalid length.
[   58.042334][ T6307] netlink: 40 bytes leftover after parsing attributes in process `syz.1.123'.
[   58.052651][ T6307] dummy0: entered promiscuous mode
[   58.056596][ T6307] netlink: 'syz.1.123': attribute type 10 has an invalid length.
[   58.057153][ T6305] netlink: 2 bytes leftover after parsing attributes in process `syz.1.123'.
[   58.065573][ T6305] netlink: 'syz.1.123': attribute type 17 has an invalid length.
[   58.069305][ T6305] netlink: 'syz.1.123': attribute type 17 has an invalid length.
[   58.072625][ T6305] netlink: 'syz.1.123': attribute type 17 has an invalid length.
[   58.077289][ T6307] netlink: 'syz.1.123': attribute type 10 has an invalid length.
[   58.081009][ T6307] netlink: 'syz.1.123': attribute type 10 has an invalid length.
[   58.088266][ T6307] netlink: 'syz.1.123': attribute type 10 has an invalid length.
[   58.092144][ T6307] netlink: 'syz.1.123': attribute type 10 has an invalid length.
[   58.221340][ T6320] Cannot find add_set index 2 as target
[   58.317021][ T6331] sctp: [Deprecated]: syz.1.132 (pid 6331) Use of int in max_burst socket option.
[   58.317021][ T6331] Use struct sctp_assoc_value instead
[   58.472364][ T6346] tipc: Started in network mode
[   58.474027][ T6346] tipc: Node identity d285421116ed, cluster identity 4711
[   58.485653][ T6346] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   58.489435][ T6346] tipc: Resetting bearer <eth:syzkaller0>
[   58.495392][ T6345] tipc: Disabling bearer <eth:syzkaller0>
[   58.627204][ T6365] xt_limit: Overflow, try lower: 262144/524288
[   58.631292][ T6364] xt_limit: Overflow, try lower: 262144/524288
[   58.814840][ T6377] net veth1_virt_wifi virt_wifi0: entered allmulticast mode
[   58.919583][ T6386] x_tables: duplicate underflow at hook 2
[   59.106417][ T6426] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   59.109775][ T6426] IPv6: NLM_F_CREATE should be set when creating new route
[   59.779011][ T6488] vcan0: tx drop: invalid da for name 0x0000000000000003
[   63.211423][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   65.124329][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   70.890510][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[   70.893000][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[   80.488069][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[   81.127843][   T52] cfg80211: failed to load regulatory.db
[   83.044315][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  113.764654][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  117.604550][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  132.326604][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  132.328758][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[  170.244643][ T5829] Bluetooth: hci1: command 0x0406 tx timeout
[  170.247732][ T5829] Bluetooth: hci0: command 0x0406 tx timeout
[  180.484371][ T5218] Bluetooth: hci2: command 0x0406 tx timeout
[  183.526157][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  188.646862][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  193.769414][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  193.772047][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[  255.208035][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  255.210720][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[  316.644347][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  316.650978][    C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  316.651480][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  316.659044][ T1360] ieee802154 phy1 wpan1: encryption failed: -22

VM DIAGNOSIS:
16:17:52  Registers:
info registers vcpu 0

CPU#0
RAX=1e3c23bf19785100 RBX=ffffffff81976c78 RCX=1e3c23bf19785100 RDX=0000000000000001
RSI=ffffffff8d998b14 RDI=ffffffff8be29dc0 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f5b R9 =1ffff110096065eb R10=dffffc0000000000 R11=ffffed10096065ec
R12=ffffffff8fa1f3f0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6f34d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00005558f4fe7600 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=000000040000005a 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000ff0000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000001001 0000000000000014
XMM06=ff00000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffff0000 ffffffffffffff00 XMM09=00316e6170772f74 656e2f317968702f
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=b14c7af64cfecf00 RBX=ffffffff81976c78 RCX=b14c7af64cfecf00 RDX=0000000000000001
RSI=ffffffff8d998b14 RDI=ffffffff8be29dc0 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f5b R9 =1ffff11026cc65eb R10=dffffc0000000000 R11=ffffed1026cc65ec
R12=ffffffff8fa1f3f0 R13=0000000000000001 R14=0000000000000001 R15=1ffff110200d2000
RIP=ffffffff8b6f34d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00005558f4fe8680 CR3=00000000293f2000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 00000000000001a4 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
