last executing test programs:

20.095505897s ago: executing program 1 (id=1100):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000080)={'team0\x00', <r2=>0x0})
r3 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000100000008000100", @ANYRES32=r2, @ANYBLOB="400002803c0001"], 0x5c}, 0x1, 0x0, 0x0, 0x4004}, 0x40000)
r4 = socket(0x2a, 0x2, 0x0)
getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)
sendmsg$alg(r4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)}, 0x14000012)
sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000003a40)=@newchain={0xc, 0x64, 0x100, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xfff1}, {0x2, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x40881)
recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x10000, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x2, 0xc}}]}}]}, 0x3c}}, 0x2000c800)
r6 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0)
r7 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r7, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64\x00'}, 0x58)
accept4(r7, 0x0, 0x0, 0x0)
socket$inet_smc(0x2b, 0x1, 0x0)
r8 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_int(r8, 0x1, 0x3c, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$rose(0xb, 0x5, 0x0)
bind$rose(r4, &(0x7f0000000000)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xfffffffc, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast]}, 0x40)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x6, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xa}, 0x94)
r9 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'bridge0\x00', <r10=>0x0})
sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="0022709570243015716c00000000", @ANYRES32=r10, @ANYRES16=r2], 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x0)
setsockopt$inet_tcp_int(r8, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4)
sendmmsg$inet(r8, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000140)}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2400c042)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x7, 0x0, 0x0, 0x32158f982d0c464a, 0x22, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0x4, 0x1}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000540), 0x10, 0x4}, 0x94)

20.087766003s ago: executing program 1 (id=1102):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_sctp(0x2, 0x5, 0x84)
r1 = syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff)
sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="210400000000040000000100000008000100"], 0x38}}, 0x4)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c)
listen(r2, 0x3)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10)
syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0)
syz_emit_ethernet(0x4a, &(0x7f0000000480)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x10, 0x3, 0x0, 0x0, {[@md5sig={0x13, 0x12, "d242d7728c9386c4a0ac7e05bafbae38"}]}}}}}}}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x19, 0x4, 0x4, 0x20002, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48)
r3 = socket(0x10, 0x3, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x3, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c)
setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7fffffff}, 0x10)
sendmsg$kcm(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e00000022008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000008000000060000000010"], 0x48)
r5 = socket(0x10, 0x80003, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000100000e00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@bloom_filter={0x1e, 0x0, 0xa, 0x89c8, 0x40401, r4, 0x7f, '\x00', r7, 0xffffffffffffffff, 0x4, 0x0, 0x3, 0x2}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xa, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x9a}}, 0x0, 0x7fff, 0x0, 0x0, 0x41000, 0x60, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1ff}, 0x94)
sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="a03700002d00010026bd7000fcdbdf250400200005000b00", @ANYRES32=r0, @ANYBLOB="81120c"], 0x37a0}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000)

19.891917852s ago: executing program 1 (id=1110):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x0, 0x1, 0x0, 0x0, {0x2, 0x2, 0x2}}, 0x14}, 0x1, 0x40030000000000}, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r1, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600)
r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff)
r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r3, <r4=>0xffffffffffffffff}, 0x4)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000400008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b705000008000000850000008800000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x1, 0x0, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x1, 0x2}}}}, 0x30}}, 0x0)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000800)={r5, 0x0, 0x87, 0xa8, &(0x7f0000000580)="b22873ad079b0ca27c71cd606bfdda05096b5a3a8a721847ac219ee8d7d8e11fcdb9a72c543e63543cf42a9218093d2820c7469b9bbe99fb248a20a2ff5eaf2b63f8685e581f6b4292acb43e8b88cd061a64cf1265df1005b9b410cd33066fe22a168585d542fd8a54a5812a51fa5b1f1e59ebae4ffa70cffb972b33eda2b66f472b031ba4d7b9", &(0x7f0000000640)=""/168, 0x7, 0x0, 0x0, 0xc7, &(0x7f00000004c0), &(0x7f0000000700)="27384d0dae7e0d07b492d5e0641afb1d2e46fd92f4016676a8db62998d225610cb4f05581adc4f85079f326d54dc4f88a05de96dad206256fd58a21aa3cc25416b5b57c7c1e550ffa16f5176c4633427514a7b59b0d21f5b843239631eddc11701f10f1acf7313369c529889941b49cac09ff28e193bd7a3815eb7695d015750bb7ef839aab8e6d3ac5a275eabec8a967f0b39e6377880a9907a06b098a6b6ac8fee478a0c080cebcf8053795a5c8a9055c41672fce1ada4281cb99edfe08fe6fe082a3060e777", 0x5}, 0x50)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000001c0)={'vcan0\x00', <r7=>0x0})
r8 = socket(0x2a, 0x2, 0xffffffff)
sendmsg$nl_route_sched(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a80)=@newqdisc={0x24, 0x24, 0x10, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0x1}, {}, {0xb, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x24004001)
getsockname$packet(r8, &(0x7f0000000200)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0xfffffcb7, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r9, {}, {}, {0x2, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x2}, @TCA_U32_DIVISOR={0x8, 0x4, 0x10}]}}]}, 0x40}}, 0x40808c4)
sendmsg$nl_route(r6, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000200)=@ipv4_getnexthop={0x50, 0x6a, 0x300, 0x70bd28, 0x9, {}, [@NHA_MASTER={0x8, 0xa, 0xfffffffe}, @NHA_MASTER={0x8}, @NHA_OIF={0x8, 0x5, r7}, @NHA_ID={0x8, 0x1, 0x2}, @NHA_ID={0x8}, @NHA_OIF={0x8, 0x5, r9}, @NHA_MASTER={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x48840)

19.891328879s ago: executing program 2 (id=1111):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="80010000100001000000000000000000fe880000000000000000000000000001fe80000000000000000000000000000000000000000000000a0020005c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000010000000033000000fc0200000000000000000000000000010000000000000000ffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffffffffffffff0800000000000000000000000000000000000000000000000000000000000000000000000200048000000000000000008d001400736d33000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000802000000000000776c3dac4c123121daa2ff5cd87186c96a82d89c65ea6ba138aa025681856d0f5f5e956336d23906f1a7e9087ab152c391005e5be92b828b1f0eb091afe0a4e2ce000000"], 0x180}, 0x1, 0x0, 0x0, 0x20004001}, 0x0)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x9f11, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x5}, 0x50)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r2)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3)
sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x305200, 0x0)
close(r5)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000400)={'batadv0\x00', <r8=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000006c0)={0x1c, 0x0, 0x1, 0xf0bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4800}, 0x20004804)
sendmsg$nl_generic(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001a00)=ANY=[@ANYBLOB="281000003e00070100000000fcdbdf25047c0000040000001010018004100600986538d8c0a1046273975d7e0ec26812fd41c8d6bd9b7b67625ea471b1ebae6839bf9e2916d30806243b4d6145d7856d3f7d40e0915a4db5a95b9ce57beb52f28dca9ab1e437199bc5e198d793e57c34a32c27d5e2bbeba15caffff79f3a120b5a4e2742be43cedb9eacf51fa4a8e17369c98f5c2ea5dee3ec6551adb15428b9984f14421734135d23170cc8392653ee26257c9f8be7b56d087116c586297d76beeda3e518885d02a1ba62da273824c56c7d48c829c6f8da5aa1fc7d9ab890b698d5c228971beac517edb9b21306c138f9e946ed0ead6df566054fcc6abf55be1305c807bc9a7ddb4ca47f31a1d4a94e3abac8713107c7337d8fe350bbd1e5e591b04b7ff86bc0105ba2ae9a670e120b59d547175cbe7592e29ceb9eba272cd5a763c08355cf073ca76d6b84246ef47ea4527532357fdb1d6043347fd3bd71f1d3b52e920eac533c6a60d9c7b3822ec9a9102467e9f7a142cc1153f780d689f5d5236be94b9e1612c92241fdec78388548b147a0799845ece343857686e58c69eb9ddcff978df3f3a57c0db7a118f237df184458d3a06ae49b9266abb9ea7e069275942b91993a3bb6412ec140382628fa7535f51254fd1a211d6e9bdabd4c904e2efef435b6c2e191fabbe57790541e7247475ea3717d3e86f8adbf0c5ad9d8f1d7c1e0453bdebe2dea3e59865998bd06eeec166ad3b0414dfbbb4b9c34403e4697b23f9c5a84e3d181e0e316cc48c963968bb2f47b95ce8516593747c2be78bf7201b96cc880e827365fa0afa2e32e7b6b3ce85772f1633714256a8be907dad44e9ed60ad5275ca72cd4466814d7b91d7cc9149d5f0f2b98385ad5f7c78cc62fe1e8e508ed5a15da298f61bae8e887369ef92884c70679706e93f2e89be17244e6db5d74819e692731a5ca4e0b52cbe62c7e6d59e5439d4f416188a2f30b80017ac9298fed3c2fc5346af991351f2232ba4b76e67d3b97ebb639cdfc5344817622b8f439e1309cc6163c1344bc30b659de8b2d991399af47e3a76c39a04aec6d87895f93b7cfa05693c0e6e66049fffe6d774cc7faa8e73044afc48303cf56aaa9d4049ec7d652fbafd5e284c0faadbb8e60db059435de85cefe7a9ca782e09f26bf23cede40adbb3fc96c3e08fbb762065f1066dabde6ed7703c95f0460f6344472f982d54d3d07b746c73e343842959cc0cfddd109a5eb8b7d90184ef9686968fcc27f5d706ace47d2c1e40ad3e69b76f844a37e803cb2c6c74989e6bd8febf7224ff88c04ade7dbf2b860dd1986c5ba1810dd4f9efead5bb07987c0fd268114be8c1aad21adfe2808140ad0bdb49025e2b321312f0841182beacf1b2bf5459da39715fd8f04ba2cb3264635d88c32bec2318d7ecd13df4b8dc3f9d0251b5435dd22bb8d063f2c549b48852cd72a05b2df5dfffd9b6b33bc3f79d16466dc75929808e602365f285e05f0fda92bcacce09fe6589ce1f76f6a4bb0a0d15148dcba829592c875c6d940b3760bf0c6f528e68463954c1dc7a569ffd6c717e1ed8f24e6a54c4598ebd12bd08922f7c167e5205addcc33169a38c302e2fc7f727ed947dc5c2a62b5da26cb6f945c60175dfff51bf03e152cf581277e1984a28392589d30650c2366a873116676ec6d1539fb27df79c1eaef3bc20c467ea268b7edd5639122e505ab462b82a2188d5f791aa34a295bec29d9bae658fe00dc9797ed95780beba17b460a31d17ae5d2b8a362933fc6275e1b76ff724e1e9bc128a71d730d1c37b32ce8f4448416dcce4c9c0b47d2a33708fe2a56808ddd3d3c90acd9a5cedb6f4a3b2c619f9eb6d0aff0869896c0097f8521992115622c0143412aa2ed84d5d8c88938a80eac7d906cd087aa2668e81ca82c77bcaa80aced1656dd337cb245181a65ec735a6650e5361016df5a0671ae9ff52cc92f81f0538cf24e6c10b924f9a5a285124a0ea687a3f62d2e0c3923e1f15f413aa825460b3bdf41b784bf19eacf7ec2e8344a93bd22805ae699b8ae973fca0a531f76dac57b4c64497e6e20624e0f28f7f208d385b3daaa4d8a95326ff4eeaa97d1a812ba6687c8e383a00da8b85c94a701b81ae20baf7d32638ebcae6921b7f8d1f91b04cc90488e59b58ebeb462c95dda65067e78daae6dd88c1df986512b9550f5fd9e9dcc721d20055fbde429ac297f89a2e80ef9453cff8782fca07a436e79cb8885ecdae6cc3539571f7c1425534ec98872371cce5d60b0b56257959c18f49c6f766192ebdbe0038ba3aaaf6ba31145c93219ee80e2e55b0f4415b5d0203099279d23098902980b0e57b0d65455273571edfdb8bd1a4db0a07d95869af57c96be4658f43e09e88fceb5a966261a7a5b9b51fc01d4699d0922ae36ec46675234205bd4036de90a805dfadcd8b5db7ff0fffdbd3db3496ad94bed9564a960baf5eacf042558839467f25dd1a9c9d163403d6e1a7ee5c7d99e904bbde55216ce80d29f858e42d5d094f3c9d1d0ca2b0a37700771e2ca44b6382f50a8a49e8b6a21e4a8e630c883d06aae03fe32985618f20d8bfe16e7166849604ce7bde392817d897e7fa5e7dab50a722378e785753ff4b15b3e903c790bfb61b63bf21398a16d644a9bdf39416a7de7698e3f8ae19c0b783ec3fd9d33ae833b93a2d505ec31ee8305c3c6c725b1c1cb5a7f421670bee66a8f12d134834c7c7293784af76ab85337b42f275aaa9f22896806ce2fa8a2fa262b16df9f6571d1ab77e22123d09b2749b2a7da35501ce2213c132360a0cea21a576cebe2c8ef7b2ffcef09a1e55d6f448bf00ca9c4038ed2f08f1b76f46f607c8ec6315465bdb748e4bc13e371f6a94c794d5c356986f28860ca80ce8761623df520df74db8d7e2b3294dc23eaa1e5fdeb53d52c48b2d69b7d5fd09b91933da69783917d531903d9a3f2a8c96aff2aad7413c6fa6ab675f219a87c64e44b9c60942efdd84a6872b8dc4530e0566e5af87eec861e962f9ab915180450eefea8ebdd24494c12cd88766dbbb9d5dbd79aaa150a361abe390d411fbc4efe8475d3d691ff0802c6ad34be6bd5c3b0903c476c566af89d69bca49befa89d9e463440c66ed0fd84bb5a5584e0fea3e62344117188bd02bb7f69fc7455264ec53415645962a028bd1aac2b2736f2e4439039aec464f3597755bbfed2e0d2445fc81bcf5d4144ad27f674a30c67772a11f38a2ea6d582053b3df48c6df24be22d5ecd92fa497a22c5d272a9a0bf4d10e820bb82bd11f88dc87f5cea79070a4ab8a2dba1e2bb29071e9621fec330e2093155877e0daabddb1512ba0c60ab4dbb7a2caa3c99c7f2f88ed30847c1b0fffa9233651e3ce52370d2a8df5b3c8aac105bea8ddf616960b6cad5cf5fea62b9b78fba0fe251d20eeccd1c7c7c8b74a05310edcee425a82cf14c83079a5a29dda0e18002fe525536e6e2b8d1205736525a39ef85eda2aae6a772a9641d5ad6e1bb3640b3988a614d0a3fef3841be13208885832fbd5034855b356a02a48f172a2b3af62398691c28684e6fdc7786a77809540277a33ed73627dcc4d12e924b2acaaf171c52838c699f57c619fd0c1236a6d2b3edb15abcb4216aad0ea00350146eb2c8851644a224b072e1b593e6b4e2adb0b6c3d5d929fddb56b8fb8be76911ab2f15121f2dd2c7d3cb2125f4ef534c59fda1b5040dd4dc1140d2ca03f01cbe312c71d6f7b5e623286115c591a88b30cd82f395a2135cc4984c60270a8ed066d0fafdcf8bcbb43e8dff7dac6adc4932554823f8b679d4648c3fe71f56207d1d6abd10187b59386e265c03f8f9b302a542852c1c639380520f314b2a89fc9d6632b1a7497d6c8e31053da2441e3372da32aa34e99f76afab991d0c77afaf79cdf5645c1dd9d35b6aa0196e7844c44c6629b0afcaf92a69242b2ffba39ae35c6b289a9049e3faa8d0d49099686d1d3ae9c911e358e2c1548aee5ab21b9ede0ab61cca17c45e3a18bf70a1d4a983f6299ed9a3c82ddf79e5cbe2cb1f0dddcad898263eea65873acc82753112b7ce6bbaad71744ae470607180efc93fc531266b1814836c862f906c2840256536635c677e5d4c88cf5cd990d9184e345f37f53bffec8ffa04d1413008e9fbd4be6651f59c18ee3d7552b40cea8d17a84ba012991a1f72d59eb246f4bb5d23217b709bbf5364aad0a2066036b0799efaf37f016d389897684db1434b31fdf9644bb9a9b3fd3775ea4a5948b6f125b810a76613a9adc21d3f87aae7cc45fbda0d022f81ed2a6aecba163b72849c79b69a8803234fccdee332414381ff4db6232109d26da1ec47a9b3ad1d4f614f07e4001cfbd036b7a4181f7eec8de150437ef5b6c243fff61f0ac47ce3430e5fc9dd93f4d9b1fe933ba0f9d51593bf73f4daa478399a2055d8d0c66196fba14e1951a797948442e2ed29b68ea35f70f35f390240491996855d88909d68fdca10d8b6e33dd144920e51103a3a29198db243c55cd462880aaab1b51511487465e17bcbb167a51b33a34ccfb1134f7cb2e840461334330923444a3585f4cb850ec7877f49156bc4e718500560d4afda3d47f04b68fde49cbf9f65096d60039867749312bff6f445da817f2b0b8d5eb50d4f3d86df1a36377a79a7c0edca525f265a44798777de79b442738de4709010d610dc60d5f0a98040b989eefcae9a7cf026a9ba1c1abcd412e47173c616419ea17080530e8a18993769684c619dea7bbee68ee5c214ea351e31a153f363f392efa87cd65542a4527ef3f798bed2a870fd608d6352e83d86014a06879ac08bff20cd7e15f5417bf0f06b7c7e7399884c2f4484f8a1705e8302609640e1735ebd87b86b8ad1811bdcfaafd868d5997441d8fe53176fdfca8c26e34d7ae2f48a2e3f47ac9bd98e327db35ae23734394d1bff271952fde1a0eeb795b9951af5553d05fd91c6447a71d2424464d9d4bdad3fb3559625aba0f31f9bab2f600d3ea134a1516f67d12647e9e1f26fbda15d416a9f9b67e6d1802ccf5299ec7d5e9f11461b847e66f4f7129ecc18ed4330ead1c6c04fafd65455f116b9d850f23baef1e6aeed200d06d5c470d24a5a5cbe1f5ff78fc72891fa759ec146fa86a8d30c84b7c0bac19be7f196d85f891e5b6a2fd5782e685e175f5866f31f5cd72ad90154a8bdb483ae6c2456df7248f3b935b80fec4f28b17e31f111b1a794849cfc5f27699c72c27aaf64b45d7a216a5abdc4b76d1c5196fe7fab32196f364fd23eea2c34b5cdd8f790a87aebe2feb414dc79f02c7c599953336e137460a18498c5d798be0f5e601b9346fb3673141d493282f21f4ddeb3740416be03e093549f13fed63bf1f61af2fa0e28fdc94d61447156b207151d1c20cf76417b8d2ec120d0f0d9f352e0e17a1a058a50139cce71722a251f0ea203c77c60bbf9b61c1e4e17e0c40e0eb19b18d338f1b1b51fe2be523f47595b41ffdf04fa1b9ef1527665e91cd46d47cc4d08ac30ad183aeeba7472256bab1105334812c66a4a1bd21702ccfa3fab890bc9340708d9a7ada94bd3d8747e44ce666ea0c929f969c3e4bcb9d07656b05dd07bc0094a8a491a10e0e539e7dbe5502a58858f9a99d28f1b755ebeb056a6169927eb4123feb10d67ce0da5e65a299442312be0ce2f7b35e9854fd5687911fafb6e8f94ae5e03e0dd1ff7324e24c7029357028bf2cafd970a55ffbc91407ad8b86985f51ff2b9b3b9fc29388740ae39450e8ad2c59b4ee117c74339fc85f24fc1b9f6af01f4f5d67065f65a1e0bd91b6b33de5bbaf341e5cc32e867c7672b1d9f694842ed32fd3e1bf5f30bc51f7864a4d646b808001800e0000001"], 0x1028}}, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x8, &(0x7f0000000240)=@framed={{}, [@tail_call]}, 0x0, 0xf}, 0x94)
syz_emit_ethernet(0x9a, &(0x7f00000002c0)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x64, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x5, 0xa, "a78c000000008080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c40dd3be27df3e34066d42ca0a5c15b37adac15084dbaf636b41e5af1802"}, {}]}}}}}}, 0x0)
r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000009000000000000000000feff9500000000000000"], &(0x7f00000000c0)='syzkaller\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r9}, 0x10)
r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r10, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r11 = socket$vsock_stream(0x28, 0x1, 0x0)
setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r11, 0x28, 0x8, &(0x7f0000000100)=0x147ae147ae147ad, 0x112)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)

19.693345595s ago: executing program 1 (id=1114):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a0000000000006111520000000000850000008900000095"], &(0x7f0000000000)='GPL\x00'}, 0x90)
r1 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, &(0x7f0000000340), 0x4)
bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000090000000800000002"], 0x48)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r3 = socket(0x400000000010, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000015c0)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd2a, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0xfff2}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xfff3, 0xb}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240080d0}, 0x0)
close(0x4)
sendmsg$NL80211_CMD_REGISTER_BEACONS(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x12}, @void, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x20008001)
sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000100001000000000000000000d100000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a31000000004c000000050a19020000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d616376746170000000080001400000000514000000110001"], 0xe8}}, 0x0)

19.692459972s ago: executing program 2 (id=1115):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000140)={0x54, r1, 0x1, 0x0, 0x4, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x35, 0x33, @beacon={{{}, {0x40}}, 0x0, @default, 0x0, @void, @val, @void, @val={0x4, 0x6, {0x0, 0x4, 0x4}}, @void, @void, @void, @val={0x2a, 0x1, {0x1}}, @void, @void, @void, @void, @void}}]}, 0x54}, 0x1, 0x700, 0x0, 0x800}, 0x0)

19.623383262s ago: executing program 2 (id=1116):
sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x0, 0x1, 0x0, 0x0, {0x2, 0x2, 0x2}}, 0x14}, 0x1, 0x40030000000000}, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$inet(r0, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000003c0)='sys_enter\x00', r2}, 0x18)
nanosleep(&(0x7f00000001c0)={0x0, 0x3938700}, &(0x7f0000001280))
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x20)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}}, 0x0)
sendmsg$NFT_BATCH(r3, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a14000000020a497f75241d4e1deb000005000006140000001100010000"], 0x3c}}, 0xc050)
setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x11, 0x90, [0x200000000c40, 0x0, 0x0, 0x200000000c70, 0x200000000ca0], 0x0, 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000f0ff000000000000000000000000000000000000000000000000000000000000e7feffffff11000000"]}, 0x108)
r4 = socket(0x40000000015, 0x5, 0x0)
setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4)
bind$inet(r4, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10)
recvmmsg(r4, &(0x7f0000004b40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x8}], 0x1, 0x60010000, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_int(r6, 0x29, 0xb, 0x0, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="440000002100010025bd7000ecdbdf250a00200104000000270000001400110064756d6d793000000000000000000000140002"], 0x44}, 0x1, 0x0, 0x0, 0x300088c5}, 0x4000000)
sendto$inet(r4, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10)

19.622179229s ago: executing program 1 (id=1118):
syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000100)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36)

19.460344171s ago: executing program 2 (id=1120):
socket$packet(0x11, 0x3, 0x300)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f260006d2688a84c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)
syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x50}}, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000026006bab9a3fe3d86e17aa31106b876c1d0000007ea60864160af36504001a0038001d004231a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb5b64f69853362ac3407173ec", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4080)
recvmsg$kcm(r1, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0)
recvmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x40000100)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
bind$inet6(r2, 0x0, 0x0)
r3 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[], 0x50)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x5, 0x0, 0x1}, 0x50)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r5}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r6}, 0x10)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_kthread_work_queue_work\x00', r7}, 0x10)
socketpair(0x11, 0xa, 0x0, &(0x7f0000001080))
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, 0x0}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000800000000000000000000711033000000000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x2021}}, 0x20}, 0x1, 0x0, 0x0, 0x81}, 0xc048082)

19.303070438s ago: executing program 2 (id=1124):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000800)=ANY=[@ANYBLOB="ac0100001000330600000f0000000000fc000000000000000000000400000000ffffffff00ffffffff00000000ffff0000004000000080010000200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff0200000000000000000000000000010000000032000000e000000200000000000000000000000023030000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000000000000a000200000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00200000004e2200000000ac1414bb0000000000000000000000001c00040002004e2100000000fc00000000000000000000000000000108000c000400000008000b00070000002c0017"], 0x1ac}}, 0x0)

19.302856579s ago: executing program 0 (id=1125):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f00000002c0)={0x28, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_SCAN_SSIDS={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0x6}]}, 0x28}, 0x1, 0x0, 0x0, 0x24004084}, 0x40000)
r3 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r3, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
listen(r3, 0x8)
r4 = accept4(r3, 0x0, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000000)={0x0, 0xc35, 0xff}, &(0x7f0000000040)=0x10)
syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r4)

19.223359869s ago: executing program 0 (id=1126):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYRESHEX], 0x60}, 0x1, 0x0, 0x0, 0x20041004}, 0x0)

19.222307502s ago: executing program 0 (id=1127):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x60, 0x0, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4080}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000014001280090001007663616e000000000400028008000a"], 0x3c}}, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e24, 0x1, @mcast2, 0x5907}], 0x1c)
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00000018"], 0x50}}, 0x4000000)
r3 = openat$cgroup_ro(r0, &(0x7f0000000380)='memory.stat\x00', 0x0, 0x0)
r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000500)=@newsa={0x164, 0x10, 0x1, 0x7fffffc, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@empty, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in=@multicast2, 0x4, 0x6c}, @in6=@remote, {0x200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, {0x5, 0x4, 0xd, 0xa}, {0x0, 0x400}, 0xfffffffc, 0x0, 0xa, 0x1, 0x6}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @lifetime_val={0x24, 0x9, {0x3, 0x10, 0x1, 0x1}}, @etimer_thresh={0x8, 0xc, 0x6}]}, 0x164}}, 0x20000000)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000020900010073797a30000000002c000000030a010200000000030000000100ffff0900010073797a30000000000900030073797a3100000000d4040000060a010400000000000000000100000008000b4000000000ac0404802c000180080001006c6f6700200002800900024073797a300000000008000340000000060800034000000002380401800c000100626974776973650028040280080003400000000808000240000000140800064000000002080006400000000064020580bb0001001d92704a203d5ecc985c4e4280e5378a36a2856959ffa601c237cc270251cf18420d11613ec98e629c7d84c655efcb2b5ecd71666675bf512cadfe09e4d05a4f60f60e007ca1cf70a5185f973cec0f1ab052acf1acf6a2df83dd88facc62c6e94a1b6368d6bda68abcaed2ee48c3d589bf2a814b728efb93401dfa1d1063200c10e56294dba0e7b780ce0f6090bd0de9f5e000c98c4b97cd985c91284c2bca23e4757407bb41fd8de797502a72e122032d4ef3160f9f7b00fd000100854e3cb6d05d310db3d528811da7f7450ebb2d62cddc6981343570b9f4ab17d75de9411dea482f508c0dce42c25c4778ebc56bb303f9f51c489eedffcb1490560ab26ab7507ec029cca3ddfe7c4f4f6d91db07cbc008636bc7bea7f96954d31da9d8a9ca043df7b409ca2864d56fc6b2a70fcc2f1a3579737bf47542dae337d5203869caff9ab95a317c25521ebf848fad8ceb87f4655ace0701dbe961e9dcaeffa37bfa2e9d127d61b8d6edc1437b46f54c061e1c9d68120ac8300e91d19c708aa9589c37de59a9f8df5546855e934599a2f31b6cb847347fc02231fec395b906e60300340d60ebe7a3f23e1aa6eec9e0150a9d16b3c25e590000002400028008000340fffffff8080003400000000908000340684dbc5808000180ffffffff6200010091de8d9ca3503f5a0a8259007bc5088ccfe97cfebb5ebb90e05d4e8a63fcbee6f14ab7eff7469cf243a6ef6e528b811dfd72af1e7e08de8fbdd4849367ea82016412fab2ccc0fb94fa63fac7fd0c6ea48c0e9ac7d1a30ecf3e70e44ed5ff00001c0002800800034080000000080003400000000308000180fffffffc080001400000000d600004804000028008000180fffffffb0d00020073797a3000000000080001802b30a3bc08000180000000000900020073797a31000000002900020073797a31000000001c0002800900020073797a31000000000900020073797a3200000000080002400000000a30010480380002800900020073797a3200000000080003400000000908000180fffffffc0800018000000007080003408000000108000340000000050b0001000bca99f460f4b0002800028008000180fffffffb0900020073797a3000000000080003400000000308000340000001ff04000100bc000100e27404a10a99dbcc4575917adc29373e2cc46e5e8f99d7a36b7c42c92713cce62084d863a11eb9c2e19fde212924e527db981a9be0c2c15f6a04a67e9e20f86e4bebd07665e2d01da200712427a5525403c1c75468f31b91a60def25f7757c9921d08b9a5b0bc6f8953efbd0416091bf2b30d9a37e789198313dd07b7b70cebff25c562434b67e9a6b70708dd84c86135ab9b0ffda2c4b2fb4a139220c101f4c0a3d58eb124346005c82dea6f0f36444b28300758475eb3d34000180090001006d65746100000000240002800800024000000002080003400000000d08000340000000090800034000000001100001800a0001006c696d69740000000900010073797a30"], 0x548}, 0x1, 0x0, 0x0, 0x20004000}, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r8 = openat$cgroup_subtree(r7, &(0x7f0000000200), 0x2, 0x0)
write$cgroup_subtree(r8, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5)
sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="440000000101"], 0x44}}, 0x0)
r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r9, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x4}, 0x6)
write$bt_hci(r9, &(0x7f0000000240)=ANY=[], 0xe)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
r10 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
r11 = openat$cgroup_int(r10, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0)
write$cgroup_int(r11, &(0x7f0000000280)=0xd, 0x12)
write$cgroup_subtree(r8, &(0x7f00000002c0)=ANY=[@ANYBLOB="2d637075204243833d12da78782ff5e09c9d522f5b0126dd6aac3c356df1c1e82ef9362304f15bfdeba96e814c1a9021304b4cd59f35d96c3f4d49ddcc5fbf535cda2a2442cec505ba217032766c949a2a21ebc5375fc6760b1163d4081c167cfbd52546258e47f2bac42bf3bcb9aa2e617774d8c5fe302baad3c1e0cb342acb6274"], 0x5)
readv(r11, &(0x7f0000000700)=[{&(0x7f0000000bc0)=""/4096, 0x1000}], 0x1)
connect$inet(r4, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10)
sendfile(r4, r3, 0x0, 0x800)

19.143479761s ago: executing program 2 (id=1128):
unshare(0x24060400)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, 0x0, 0x0)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000040000000000000000008000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000900000900020073797a31000000000900010073797a3000000000080005400000002160"], 0xe4}, 0x1, 0x0, 0x0, 0x44}, 0x0)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="7961fdffffff000000007e0000000c0099"], 0x20}}, 0x4000054)
sendmsg$IPSET_CMD_RENAME(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000000506010200000000000000000a000001"], 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x800)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r2 = socket$igmp6(0xa, 0x3, 0x2)
r3 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f00000003c0)={0x0, 'syzkaller1\x00', {0x3}})
write$tun(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x3, &(0x7f0000000000)=0x3, 0x4)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f000000a0c0), r4)
sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f000000a180)={0x0, 0x0, &(0x7f000000a140)={&(0x7f000000a100)={0x14, r5, 0x1, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4040000)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRES8], &(0x7f00000001c0)=""/13, 0x6e, 0xd, 0x1}, 0x28)
r6 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$sock_linger(r6, 0x1, 0xd, 0x0, 0xb5)
unshare(0x40020000)

19.135592546s ago: executing program 0 (id=1129):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x7, &(0x7f0000000140)=ANY=[@ANYBLOB="18070000000000000040000000800000851000000200000026000000ffffff859500007b000000e984000000130000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x2}, 0x94)

19.135438115s ago: executing program 0 (id=1130):
r0 = socket$nl_rdma(0x10, 0x3, 0x14) (async)
r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48)
r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000040000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000530000008500000005000000bca90000000000003509020000d44a6be5000d0000000000b702000000000000739af0ff00000000c509040004100000c3aaf0ff00000000bf8600000000000007080000f8ffffffbfa400000000000007060000f0ffffffb70200000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2000000011140100fffffffffdffffff05004a"], 0x20}}, 0x0)

19.073311886s ago: executing program 0 (id=1131):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f00000009c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='signal_generate\x00', r3}, 0x10)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000300)='sys_enter\x00', r5}, 0x10)
syz_open_procfs$namespace(0x0, 0xfffffffffffffffe)
ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000140)={'pim6reg\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6)
sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0)
close(r8)
r9 = socket$unix(0x1, 0x1, 0x0)
r10 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r11=>0x0})
sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x6, 0x1, 0x4, 0x3, 0x3, 0xfffffff9}, {0x6e, 0x2, 0xe, 0x6b5, 0x4}, 0x900000, 0x0, 0x1e8c}}, @TCA_TBF_BURST={0x8, 0x6, 0x1000}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20004091}, 0x8080)
ioctl$SIOCSIFHWADDR(r8, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})

19.072202239s ago: executing program 1 (id=1132):
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
r1 = epoll_create1(0x80000)
epoll_pwait(r1, &(0x7f00000000c0)=[{}, {}, {}], 0x3, 0x81, &(0x7f0000000100)={[0x1]}, 0x8)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000040000000000000001000013fc89000002000000000000000000000000005f00"], 0x0, 0x34, 0x0, 0xa}, 0x28)
setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000001f40)={0x9, {{0xa, 0x0, 0x3, @mcast2}}, {{0xa, 0x2, 0x4, @ipv4={'\x00', '\xff\xff', @local}, 0xfffffff8}}}, 0x108)
setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000180)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108)
setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000300)={0x9, {{0xa, 0x40, 0x3, @mcast2, 0xf3}}}, 0x90)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x18, 0x30, 0x871a15abc695f30d, 0xfffffffc, 0x25dfdbf4, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'tunl0\x00', <r4=>0x0})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r6, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="c026000041000701000000000700"], 0x26c0}}, 0x4010)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x7c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x30000000, 0x40, 0x7, 0xb, 0x40, 0x100, 0x80, 0x9}}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2, 0x1}}, {0x4}}]}]}, 0x7c}}, 0x4000010)
socket$l2tp6(0xa, 0x2, 0x73)
unshare(0x600)
setsockopt$rose(0xffffffffffffffff, 0x104, 0x5, 0x0, 0x1d)
sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff)
sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r7, &(0x7f0000000900)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x20, r8, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x40001}, 0x4000)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x780, 0x1d0, 0x5c8, 0x0, 0x5c8, 0x0, 0x6b0, 0x6b0, 0x6b0, 0x6b0, 0x6b0, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [0xffffff00, 0x0, 0x0, 0x1f9814788dbf7ab2], 'veth1\x00', 'syz_tun\x00'}, 0x11e, 0xa8, 0x1d0, 0x1f000000, {0x0, 0x7}}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@ipv6={@loopback, @dev, [], [], 'batadv_slave_0\x00', 'ip6gretap0\x00', {}, {}, 0x2b}, 0x0, 0x1e0, 0x208, 0x7400, {}, [@common=@rt={{0x138}, {0x0, [0x0, 0x5], 0x0, 0x0, 0x0, [@dev, @private2={0xfc, 0x2, '\x00', 0x1}, @remote, @private2, @private1, @dev, @dev={0xfe, 0x80, '\x00', 0x34}, @mcast2, @local, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0, @loopback, @mcast1, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@ipv6header={{0x28}, {0x81, 0x10, 0x1}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x68}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@inet=@socket3={{0x28}, 0x2}]}, @inet=@TOS={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@mcast2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7e0)

47.923085ms ago: executing program 32 (id=1131):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f00000009c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='signal_generate\x00', r3}, 0x10)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000300)='sys_enter\x00', r5}, 0x10)
syz_open_procfs$namespace(0x0, 0xfffffffffffffffe)
ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000140)={'pim6reg\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6)
sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0)
close(r8)
r9 = socket$unix(0x1, 0x1, 0x0)
r10 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r11=>0x0})
sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x6, 0x1, 0x4, 0x3, 0x3, 0xfffffff9}, {0x6e, 0x2, 0xe, 0x6b5, 0x4}, 0x900000, 0x0, 0x1e8c}}, @TCA_TBF_BURST={0x8, 0x6, 0x1000}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20004091}, 0x8080)
ioctl$SIOCSIFHWADDR(r8, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})

119.727µs ago: executing program 33 (id=1132):
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
r1 = epoll_create1(0x80000)
epoll_pwait(r1, &(0x7f00000000c0)=[{}, {}, {}], 0x3, 0x81, &(0x7f0000000100)={[0x1]}, 0x8)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000040000000000000001000013fc89000002000000000000000000000000005f00"], 0x0, 0x34, 0x0, 0xa}, 0x28)
setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000001f40)={0x9, {{0xa, 0x0, 0x3, @mcast2}}, {{0xa, 0x2, 0x4, @ipv4={'\x00', '\xff\xff', @local}, 0xfffffff8}}}, 0x108)
setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000180)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108)
setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000300)={0x9, {{0xa, 0x40, 0x3, @mcast2, 0xf3}}}, 0x90)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x18, 0x30, 0x871a15abc695f30d, 0xfffffffc, 0x25dfdbf4, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'tunl0\x00', <r4=>0x0})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r6, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="c026000041000701000000000700"], 0x26c0}}, 0x4010)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x7c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x30000000, 0x40, 0x7, 0xb, 0x40, 0x100, 0x80, 0x9}}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2, 0x1}}, {0x4}}]}]}, 0x7c}}, 0x4000010)
socket$l2tp6(0xa, 0x2, 0x73)
unshare(0x600)
setsockopt$rose(0xffffffffffffffff, 0x104, 0x5, 0x0, 0x1d)
sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff)
sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r7, &(0x7f0000000900)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x20, r8, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x40001}, 0x4000)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x780, 0x1d0, 0x5c8, 0x0, 0x5c8, 0x0, 0x6b0, 0x6b0, 0x6b0, 0x6b0, 0x6b0, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [0xffffff00, 0x0, 0x0, 0x1f9814788dbf7ab2], 'veth1\x00', 'syz_tun\x00'}, 0x11e, 0xa8, 0x1d0, 0x1f000000, {0x0, 0x7}}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@ipv6={@loopback, @dev, [], [], 'batadv_slave_0\x00', 'ip6gretap0\x00', {}, {}, 0x2b}, 0x0, 0x1e0, 0x208, 0x7400, {}, [@common=@rt={{0x138}, {0x0, [0x0, 0x5], 0x0, 0x0, 0x0, [@dev, @private2={0xfc, 0x2, '\x00', 0x1}, @remote, @private2, @private1, @dev, @dev={0xfe, 0x80, '\x00', 0x34}, @mcast2, @local, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0, @loopback, @mcast1, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@ipv6header={{0x28}, {0x81, 0x10, 0x1}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x68}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@inet=@socket3={{0x28}, 0x2}]}, @inet=@TOS={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@mcast2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7e0)

0s ago: executing program 34 (id=1128):
unshare(0x24060400)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, 0x0, 0x0)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000040000000000000000008000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000900000900020073797a31000000000900010073797a3000000000080005400000002160"], 0xe4}, 0x1, 0x0, 0x0, 0x44}, 0x0)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="7961fdffffff000000007e0000000c0099"], 0x20}}, 0x4000054)
sendmsg$IPSET_CMD_RENAME(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000000506010200000000000000000a000001"], 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x800)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r2 = socket$igmp6(0xa, 0x3, 0x2)
r3 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f00000003c0)={0x0, 'syzkaller1\x00', {0x3}})
write$tun(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x3, &(0x7f0000000000)=0x3, 0x4)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f000000a0c0), r4)
sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f000000a180)={0x0, 0x0, &(0x7f000000a140)={&(0x7f000000a100)={0x14, r5, 0x1, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4040000)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRES8], &(0x7f00000001c0)=""/13, 0x6e, 0xd, 0x1}, 0x28)
r6 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$sock_linger(r6, 0x1, 0xd, 0x0, 0xb5)
unshare(0x40020000)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:3406' (ED25519) to the list of known hosts.
syzkaller login: [   40.803577][ T5756] cgroup: Unknown subsys name 'net'
[   40.905361][ T5756] cgroup: Unknown subsys name 'cpuset'
[   40.911228][ T5756] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   42.570643][ T5756] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   46.426076][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   46.433730][ T5835] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   46.436591][ T5835] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   46.439438][ T5835] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   46.441751][ T5835] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   46.444464][ T5832] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   46.444909][ T5835] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   46.449143][ T5832] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   46.449475][ T5835] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   46.460779][   T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   46.466026][ T5833] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   46.468666][ T5833] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   46.472371][ T5839] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   46.477349][ T5839] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   46.479928][ T5839] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   46.657641][ T5828] chnl_net:caif_netlink_parms(): no params data found
[   46.764827][ T5829] chnl_net:caif_netlink_parms(): no params data found
[   46.798776][ T5828] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.800929][ T5828] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.803820][ T5828] bridge_slave_0: entered allmulticast mode
[   46.806569][ T5828] bridge_slave_0: entered promiscuous mode
[   46.809981][ T5837] chnl_net:caif_netlink_parms(): no params data found
[   46.828141][ T5828] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.830376][ T5828] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.833681][ T5828] bridge_slave_1: entered allmulticast mode
[   46.836357][ T5828] bridge_slave_1: entered promiscuous mode
[   46.899397][ T5828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   46.910742][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.913085][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.915554][ T5829] bridge_slave_0: entered allmulticast mode
[   46.918219][ T5829] bridge_slave_0: entered promiscuous mode
[   46.930071][ T5828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   46.941338][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.944265][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.946487][ T5829] bridge_slave_1: entered allmulticast mode
[   46.949129][ T5829] bridge_slave_1: entered promiscuous mode
[   46.983405][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state
[   46.985659][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state
[   46.987871][ T5837] bridge_slave_0: entered allmulticast mode
[   46.990665][ T5837] bridge_slave_0: entered promiscuous mode
[   46.994563][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state
[   46.996794][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state
[   46.998995][ T5837] bridge_slave_1: entered allmulticast mode
[   47.001584][ T5837] bridge_slave_1: entered promiscuous mode
[   47.006262][ T5828] team0: Port device team_slave_0 added
[   47.009833][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   47.021636][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   47.025474][ T5828] team0: Port device team_slave_1 added
[   47.063464][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   47.075231][ T5829] team0: Port device team_slave_0 added
[   47.077705][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_0
[   47.079986][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   47.088441][ T5828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   47.094559][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   47.098411][ T5829] team0: Port device team_slave_1 added
[   47.117434][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_1
[   47.119591][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   47.127306][ T5828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   47.151160][ T5837] team0: Port device team_slave_0 added
[   47.154188][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0
[   47.156320][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   47.164761][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   47.169286][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1
[   47.171415][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   47.179610][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   47.184138][ T5837] team0: Port device team_slave_1 added
[   47.225242][ T5828] hsr_slave_0: entered promiscuous mode
[   47.227614][ T5828] hsr_slave_1: entered promiscuous mode
[   47.249229][ T5829] hsr_slave_0: entered promiscuous mode
[   47.251521][ T5829] hsr_slave_1: entered promiscuous mode
[   47.255282][ T5829] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   47.257664][ T5829] Cannot create hsr debugfs directory
[   47.260021][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0
[   47.262705][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   47.270398][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   47.274875][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1
[   47.276978][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   47.285866][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   47.359674][ T5837] hsr_slave_0: entered promiscuous mode
[   47.362362][ T5837] hsr_slave_1: entered promiscuous mode
[   47.364458][ T5837] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   47.366760][ T5837] Cannot create hsr debugfs directory
[   47.535926][ T5829] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   47.543578][ T5829] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   47.557653][ T5829] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   47.567420][ T5829] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   47.593549][ T5828] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   47.599033][ T5828] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   47.607639][ T5828] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   47.613653][ T5828] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   47.625076][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   47.627348][ T5829] bridge0: port 2(bridge_slave_1) entered forwarding state
[   47.630107][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   47.633021][ T5829] bridge0: port 1(bridge_slave_0) entered forwarding state
[   47.653726][ T4960] bridge0: port 1(bridge_slave_0) entered disabled state
[   47.656641][ T4960] bridge0: port 2(bridge_slave_1) entered disabled state
[   47.697521][ T5837] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   47.706307][ T5837] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   47.719384][ T5837] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   47.727955][ T5837] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   47.763483][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0
[   47.778199][ T5829] 8021q: adding VLAN 0 to HW filter on device team0
[   47.793634][ T4960] bridge0: port 1(bridge_slave_0) entered blocking state
[   47.795998][ T4960] bridge0: port 1(bridge_slave_0) entered forwarding state
[   47.813784][ T4960] bridge0: port 2(bridge_slave_1) entered blocking state
[   47.816147][ T4960] bridge0: port 2(bridge_slave_1) entered forwarding state
[   47.844714][ T5828] 8021q: adding VLAN 0 to HW filter on device bond0
[   47.869864][ T5828] 8021q: adding VLAN 0 to HW filter on device team0
[   47.883843][ T4960] bridge0: port 1(bridge_slave_0) entered blocking state
[   47.886011][ T4960] bridge0: port 1(bridge_slave_0) entered forwarding state
[   47.897296][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0
[   47.922575][ T4960] bridge0: port 2(bridge_slave_1) entered blocking state
[   47.924867][ T4960] bridge0: port 2(bridge_slave_1) entered forwarding state
[   47.952498][ T5837] 8021q: adding VLAN 0 to HW filter on device team0
[   47.972760][ T4960] bridge0: port 1(bridge_slave_0) entered blocking state
[   47.975014][ T4960] bridge0: port 1(bridge_slave_0) entered forwarding state
[   47.986234][ T4960] bridge0: port 2(bridge_slave_1) entered blocking state
[   47.988507][ T4960] bridge0: port 2(bridge_slave_1) entered forwarding state
[   48.025895][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0
[   48.093369][ T5829] veth0_vlan: entered promiscuous mode
[   48.103401][ T5829] veth1_vlan: entered promiscuous mode
[   48.121964][ T5829] veth0_macvtap: entered promiscuous mode
[   48.126166][ T5829] veth1_macvtap: entered promiscuous mode
[   48.161151][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0
[   48.166252][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0
[   48.178653][ T5828] 8021q: adding VLAN 0 to HW filter on device batadv0
[   48.184026][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1
[   48.197684][ T5844] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   48.204411][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   48.209788][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   48.223753][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   48.266600][ T5837] veth0_vlan: entered promiscuous mode
[   48.275153][ T5837] veth1_vlan: entered promiscuous mode
[   48.290557][ T5828] veth0_vlan: entered promiscuous mode
[   48.296772][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   48.300641][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   48.306311][ T5828] veth1_vlan: entered promiscuous mode
[   48.334796][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   48.339569][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   48.341109][ T5837] veth0_macvtap: entered promiscuous mode
[   48.348349][ T5837] veth1_macvtap: entered promiscuous mode
[   48.363689][ T5828] veth0_macvtap: entered promiscuous mode
[   48.378475][ T5828] veth1_macvtap: entered promiscuous mode
[   48.384342][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0
[   48.386325][ T5829] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   48.390542][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1
[   48.403454][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   48.406327][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   48.438659][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   48.443220][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   48.449432][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_0
[   48.455062][ T5898] warning: `syz.2.3' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   48.472334][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_1
[   48.487393][ T5895] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   48.500888][ T5895] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   48.505100][ T5895] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   48.507880][ T5895] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   48.522643][ T5839] Bluetooth: hci2: command tx timeout
[   48.532002][   T54] Bluetooth: hci1: command tx timeout
[   48.533901][ T5839] Bluetooth: hci0: command tx timeout
[   48.556593][   T28] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   48.559859][   T28] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   48.587725][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   48.590261][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   48.618726][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   48.621206][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   48.643852][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   48.646289][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   48.716259][ T5904] netlink: 'syz.2.5': attribute type 32 has an invalid length.
[   48.777946][ T5910] tipc: Started in network mode
[   48.779766][ T5910] tipc: Node identity d28335807ec8, cluster identity 4711
[   48.782629][ T5910] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   48.786191][ T5910] syzkaller0: entered promiscuous mode
[   48.788034][ T5910] syzkaller0: entered allmulticast mode
[   48.808798][ T5906] netlink: 'syz.0.1': attribute type 12 has an invalid length.
[   48.811292][ T5906] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.1'.
[   48.938083][ T5926] netlink: 52 bytes leftover after parsing attributes in process `syz.2.8'.
[   48.943258][ T5926] bridge0: port 2(bridge_slave_1) entered disabled state
[   48.946089][ T5926] bridge0: port 1(bridge_slave_0) entered disabled state
[   49.077306][ T5931] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10'.
[   49.093924][ T5931] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10'.
[   49.149230][ T5937] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   49.168048][ T5939] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   49.250364][ T5942] syz_tun: entered allmulticast mode
[   49.258700][ T5941] syz_tun: left allmulticast mode
[   49.586865][ T5950] xt_bpf: check failed: parse error
[   49.596405][ T5909] tipc: Resetting bearer <eth:syzkaller0>
[   49.620101][ T5909] tipc: Disabling bearer <eth:syzkaller0>
[   49.706821][ T5952] netlink: 'syz.0.18': attribute type 12 has an invalid length.
[   49.709215][ T5952] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.18'.
[   49.775202][ T5954] netlink: 16 bytes leftover after parsing attributes in process `syz.0.19'.
[   49.842656][ T5957] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma?
[   49.894173][ T5959] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma?
[   49.924784][ T5962] syz_tun: entered allmulticast mode
[   49.927645][ T5961] syz_tun: left allmulticast mode
[   49.963900][ T5964] netlink: 32 bytes leftover after parsing attributes in process `syz.0.22'.
[   50.199423][ T5984] netlink: 8 bytes leftover after parsing attributes in process `syz.0.29'.
[   50.204577][ T5984] netlink: 4 bytes leftover after parsing attributes in process `syz.0.29'.
[   50.207256][ T5984] netlink: 'syz.0.29': attribute type 1 has an invalid length.
[   50.209445][ T5984] netlink: 10 bytes leftover after parsing attributes in process `syz.0.29'.
[   50.244474][   T56] block nbd0: Receive control failed (result -107)
[   50.304455][ T5982] netlink: 'syz.2.28': attribute type 12 has an invalid length.
[   50.344583][ T5988] macsec0: entered promiscuous mode
[   50.347196][ T5988] macsec1: entered allmulticast mode
[   50.348848][ T5988] macsec0: entered allmulticast mode
[   50.350554][ T5988] veth1_macvtap: entered allmulticast mode
[   50.440422][ T5994] syz_tun: entered allmulticast mode
[   50.443855][ T5993] syz_tun: left allmulticast mode
[   50.476936][ T5999] tipc: Started in network mode
[   50.478533][ T5999] tipc: Node identity 0a65ac3f0e07, cluster identity 4711
[   50.480785][ T5999] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   50.493979][ T5996] netlink: 'syz.0.34': attribute type 12 has an invalid length.
[   50.498071][ T5999] syzkaller0: MTU too low for tipc bearer
[   50.500639][ T5999] tipc: Disabling bearer <eth:syzkaller0>
[   50.574963][ T6002] netlink: 'syz.0.36': attribute type 5 has an invalid length.
[   50.602642][   T54] Bluetooth: hci1: command tx timeout
[   50.604405][   T54] Bluetooth: hci2: command tx timeout
[   50.606619][ T5839] Bluetooth: hci0: command tx timeout
[   50.701137][ T6014] syz_tun: entered allmulticast mode
[   50.706741][ T6013] syz_tun: left allmulticast mode
[   50.755397][ T6017] netlink: 'syz.0.43': attribute type 1 has an invalid length.
[   50.803561][   T56] block nbd1: Receive control failed (result -107)
[   50.840828][ T6019] 8021q: adding VLAN 0 to HW filter on device bond0
[   50.846301][ T6019] bond0: (slave rose0): Enslaving as an active interface with an up link
[   51.064678][ T6043] netlink: 'syz.0.47': attribute type 1 has an invalid length.
[   51.098634][ T6045] syz_tun: entered allmulticast mode
[   51.103858][ T6044] syz_tun: left allmulticast mode
[   51.316644][ T6065] 8021q: adding VLAN 0 to HW filter on device bond1
[   51.326778][ T6066] 8021q: adding VLAN 0 to HW filter on device batadv1
[   51.334606][ T6066] bond1: (slave batadv1): Enslaving as an active interface with an up link
[   51.369604][ T6072] syz_tun: entered allmulticast mode
[   51.376770][ T6071] syz_tun: left allmulticast mode
[   51.515443][ T6074] netlink: 'syz.1.57': attribute type 12 has an invalid length.
[   51.658851][ T6098] syz_tun: entered allmulticast mode
[   51.661627][ T6096] syz_tun: left allmulticast mode
[   52.683746][ T5221] Bluetooth: hci2: command tx timeout
[   52.685473][ T5221] Bluetooth: hci1: command tx timeout
[   52.687194][ T5839] Bluetooth: hci0: command tx timeout
[   52.745758][ T6121] Zero length message leads to an empty skb
[   52.748107][ T6121] syz.0.72 uses obsolete (PF_INET,SOCK_PACKET)
[   53.644830][ T6143] syz_tun: entered allmulticast mode
[   53.647967][ T6142] syz_tun: left allmulticast mode
[   53.876298][ T6155] __nla_validate_parse: 23 callbacks suppressed
[   53.876308][ T6155] netlink: 44 bytes leftover after parsing attributes in process `syz.2.82'.
[   53.957142][ T6159] netlink: 8 bytes leftover after parsing attributes in process `syz.2.84'.
[   53.960097][ T6159] netlink: 8 bytes leftover after parsing attributes in process `syz.2.84'.
[   54.098898][ T6163] validate_nla: 4 callbacks suppressed
[   54.098923][ T6163] netlink: 'syz.2.86': attribute type 12 has an invalid length.
[   54.104833][ T6163] netlink: 9472 bytes leftover after parsing attributes in process `syz.2.86'.
[   54.188569][ T6167] netlink: 8 bytes leftover after parsing attributes in process `syz.2.88'.
[   54.191477][ T6167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.88'.
[   54.195832][ T6167] netlink: 'syz.2.88': attribute type 1 has an invalid length.
[   54.198681][ T6167] netlink: 10 bytes leftover after parsing attributes in process `syz.2.88'.
[   54.234309][   T55] block nbd2: Receive control failed (result -107)
[   54.333721][ T6172] netlink: 56 bytes leftover after parsing attributes in process `syz.2.90'.
[   54.365959][ T6174] netlink: 168 bytes leftover after parsing attributes in process `syz.2.91'.
[   54.500383][ T6185] netlink: 12 bytes leftover after parsing attributes in process `syz.2.93'.
[   54.631122][ T6194] netlink: 'syz.0.97': attribute type 1 has an invalid length.
[   54.673073][   T56] block nbd3: Receive control failed (result -107)
[   54.762614][ T5839] Bluetooth: hci0: command tx timeout
[   54.764275][   T54] Bluetooth: hci1: command tx timeout
[   54.764916][ T5839] Bluetooth: hci2: command tx timeout
[   54.859763][ T6217] pimreg: entered allmulticast mode
[   54.869450][ T6219] netlink: 'syz.0.105': attribute type 12 has an invalid length.
[   54.869840][ T6217] pimreg: left allmulticast mode
[   55.021485][ T6227] syz_tun: entered allmulticast mode
[   55.024720][ T6226] syz_tun: left allmulticast mode
[   55.117846][ T6231] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check.
[   55.139261][ T6231] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[   55.225184][ T6237] Cannot find set identified by id 0 to match
[   55.264698][  T790] IPVS: starting estimator thread 0...
[   55.351958][ T6240] IPVS: using max 64 ests per chain, 153600 per kthread
[   55.566839][ T6259] tipc: Can't bind to reserved service type 0
[   55.737805][ T6273] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   55.933130][ T6289] netlink: 'syz.1.131': attribute type 1 has an invalid length.
[   56.031422][ T6296] netlink: 'syz.0.137': attribute type 1 has an invalid length.
[   56.034596][ T6299] syz_tun: entered allmulticast mode
[   56.037804][ T6298] syz_tun: left allmulticast mode
[   56.103846][   T55] block nbd4: Receive control failed (result -107)
[   70.846292][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   81.089554][   T24] cfg80211: failed to load regulatory.db
[   83.486516][ T6314] syz_tun: entered allmulticast mode
[   83.496387][ T6312] syz_tun: left allmulticast mode
[   83.541458][ T6316] xt_CT: No such helper "snmp_trap"
[   83.548267][ T6319] __nla_validate_parse: 17 callbacks suppressed
[   83.548275][ T6319] netlink: 24 bytes leftover after parsing attributes in process `syz.2.142'.
[   83.574326][ T6319] x_tables: duplicate underflow at hook 2
[   83.697374][ T6329] nbd: must specify a size in bytes for the device
[   83.754750][ T6334] netlink: 68 bytes leftover after parsing attributes in process `syz.0.149'.
[   83.805796][ T6341] netlink: 60 bytes leftover after parsing attributes in process `syz.0.151'.
[   83.809020][ T6341] netlink: 60 bytes leftover after parsing attributes in process `syz.0.151'.
[   83.827856][ T6341] netlink: 'syz.0.151': attribute type 1 has an invalid length.
[   83.965928][ T6355] netlink: 56 bytes leftover after parsing attributes in process `syz.0.156'.
[   84.025668][ T6360] netlink: 'syz.0.158': attribute type 1 has an invalid length.
[   84.070198][ T6360] 8021q: adding VLAN 0 to HW filter on device bond2
[   84.075262][ T6359] syz_tun: entered allmulticast mode
[   84.143976][ T6371] xt_hashlimit: size too large, truncated to 1048576
[   84.147259][ T6371] xt_hashlimit: max too large, truncated to 1048576
[   84.274188][ T6384] syz_tun: entered allmulticast mode
[   84.277060][ T6382] syz_tun: left allmulticast mode
[   84.496785][ T6352] syz_tun: left allmulticast mode
[   84.540609][ T6401] nftables ruleset with unbound chain
[   84.541097][ T6400] netlink: 'syz.2.170': attribute type 3 has an invalid length.
[   84.573990][ T6405] netlink: 156 bytes leftover after parsing attributes in process `syz.2.171'.
[   84.790327][    C0] vcan0: j1939_tp_rxtimer: 0xffff888029b67800: rx timeout, send abort
[   84.948998][ T6419] Bluetooth: MGMT ver 1.23
[   85.070845][ T6427] syz_tun: entered allmulticast mode
[   85.074452][ T6427] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.180'.
[   85.105175][ T6422] syz_tun: left allmulticast mode
[   85.210918][ T6436] netlink: 4 bytes leftover after parsing attributes in process `syz.1.184'.
[   85.289752][ T6440] netlink: 56 bytes leftover after parsing attributes in process `syz.2.185'.
[   85.292622][    C0] vcan0: j1939_tp_rxtimer: 0xffff888029b67c00: rx timeout, send abort
[   85.295267][    C0] vcan0: j1939_tp_rxtimer: 0xffff888029b67800: abort rx timeout. Force session deactivation
[   85.383260][ T6442] netlink: 12 bytes leftover after parsing attributes in process `syz.0.186'.
[   85.529888][ T6451] IPv6: sit1: Disabled Multicast RS
[   85.539782][ T6451] sit1: entered allmulticast mode
[   85.667475][ T6461] netlink: 'syz.1.193': attribute type 1 has an invalid length.
[   85.713575][   T56] block nbd5: Receive control failed (result -107)
[   85.792703][    C0] vcan0: j1939_tp_rxtimer: 0xffff888029b67c00: abort rx timeout. Force session deactivation
[   85.942001][ T6474] tipc: Enabled bearer <eth:ipvlan1>, priority 14
[   86.713107][ T6490] hsr_slave_1 (unregistering): left promiscuous mode
[   86.864985][ T6502] A link change request failed with some changes committed already. Interface veth1_to_batadv may have been left with an inconsistent configuration, please check.
[   87.013983][ T6519] Bluetooth: MGMT ver 1.23
[   87.062608][    T9] tipc: Node number set to 2890610048
[   87.139681][ T6529] syz_tun: entered allmulticast mode
[   87.144785][ T6528] syz_tun: left allmulticast mode
[   87.238385][ T6537] netlink: 'syz.1.214': attribute type 1 has an invalid length.
[   87.274479][   T55] block nbd6: Receive control failed (result -107)
[   87.479774][ T6546] netlink: 'syz.2.218': attribute type 2 has an invalid length.
[   87.674247][ T6562] netdevsim0: mtu less than device minimum
[   87.766959][ T6571] veth1_macvtap: left promiscuous mode
[   87.907032][ T6583] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   87.919565][ T6583] tipc: Disabling bearer <eth:syzkaller0>
[   88.838305][ T6628] lo speed is unknown, defaulting to 1000
[   88.840785][ T6628] lo speed is unknown, defaulting to 1000
[   88.845356][ T6628] lo speed is unknown, defaulting to 1000
[   88.850133][ T6628] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   88.859668][ T6628] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[   88.880419][ T6628] lo speed is unknown, defaulting to 1000
[   88.884159][ T6628] lo speed is unknown, defaulting to 1000
[   88.886783][ T6628] lo speed is unknown, defaulting to 1000
[   89.078424][ T6638] __nla_validate_parse: 25 callbacks suppressed
[   89.078434][ T6638] netlink: 168 bytes leftover after parsing attributes in process `syz.0.249'.
[   89.110796][ T6641] netlink: 44 bytes leftover after parsing attributes in process `syz.0.250'.
[   89.187784][ T5861] nci: nci_ntf_packet: unknown ntf opcode 0x206
[   90.071080][ T6670] netlink: 'syz.2.257': attribute type 83 has an invalid length.
[   90.125033][ T6675] netlink: 16 bytes leftover after parsing attributes in process `syz.0.259'.
[   90.166033][ T6677] syz_tun: entered allmulticast mode
[   90.169783][ T6676] syz_tun: left allmulticast mode
[   90.253886][ T6664] netlink: 68 bytes leftover after parsing attributes in process `syz.2.257'.
[   90.417568][ T6695] netlink: 44 bytes leftover after parsing attributes in process `syz.0.266'.
[   90.421396][ T6695] netlink: 43 bytes leftover after parsing attributes in process `syz.0.266'.
[   90.424644][ T6695] netlink: 'syz.0.266': attribute type 6 has an invalid length.
[   90.427626][ T6695] netlink: 'syz.0.266': attribute type 5 has an invalid length.
[   90.430044][ T6695] netlink: 43 bytes leftover after parsing attributes in process `syz.0.266'.
[   90.464134][ T6697] netlink: 44 bytes leftover after parsing attributes in process `syz.0.267'.
[   90.516658][ T6699] lo speed is unknown, defaulting to 1000
[   90.819742][ T6707] batadv_slave_0: entered promiscuous mode
[   90.827265][ T6706] batadv_slave_0: left promiscuous mode
[   91.649859][ T6744] bridge_slave_0: left allmulticast mode
[   91.652942][ T6744] bridge_slave_0: left promiscuous mode
[   91.655022][ T6744] bridge0: port 1(bridge_slave_0) entered disabled state
[   91.659605][ T6744] bridge_slave_1: left allmulticast mode
[   91.661413][ T6744] bridge_slave_1: left promiscuous mode
[   91.663471][ T6744] bridge0: port 2(bridge_slave_1) entered disabled state
[   91.670663][ T6744] bond0: (slave bond_slave_0): Releasing backup interface
[   91.676285][ T6744] bond0: (slave bond_slave_1): Releasing backup interface
[   91.684342][ T6744] team0: Port device team_slave_0 removed
[   91.691167][ T6744] team0: Port device team_slave_1 removed
[   91.695819][ T6744] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   91.698275][ T6744] batman_adv: batadv0: Removing interface: batadv_slave_0
[   91.701603][ T6744] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   91.702020][ T6745] netlink: 12 bytes leftover after parsing attributes in process `syz.2.285'.
[   91.705114][ T6744] batman_adv: batadv0: Removing interface: batadv_slave_1
[   91.746270][ T6744] syz.2.285 (6744) used greatest stack depth: 19896 bytes left
[   91.749802][ T6747] syz_tun: entered allmulticast mode
[   91.764052][ T6746] syz_tun: left allmulticast mode
[   91.845186][ T6754] netlink: 168 bytes leftover after parsing attributes in process `syz.2.289'.
[   91.880379][ T6759] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   92.064804][ T6780] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   92.155623][ T6790] netlink: 'syz.0.301': attribute type 3 has an invalid length.
[   92.281349][ T6794] syz_tun: entered allmulticast mode
[   92.302940][ T6796] netlink: 'syz.0.303': attribute type 12 has an invalid length.
[   92.578593][ T6810] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes.
[   92.740079][ T6785] syz_tun: left allmulticast mode
[   92.747751][ T6819] netlink: 'syz.1.311': attribute type 1 has an invalid length.
[   92.784646][   T55] block nbd7: Receive control failed (result -107)
[   92.870007][ T6822] netlink: del zone limit has 4 unknown bytes
[   93.047958][ T6847] netlink: 'syz.1.319': attribute type 12 has an invalid length.
[   93.077631][ T6852] syz_tun: entered allmulticast mode
[   93.086133][ T6849] netlink: 'syz.0.322': attribute type 1 has an invalid length.
[   93.116394][ T6852] syz_tun: left allmulticast mode
[   93.226645][ T6863] netlink: 'syz.1.329': attribute type 3 has an invalid length.
[   93.231305][ T6864] netlink: 'syz.0.328': attribute type 1 has an invalid length.
[   93.261540][ T6866] 8021q: VLANs not supported on ip6gre0
[   93.284565][   T56] block nbd8: Receive control failed (result -107)
[   93.456580][ T6885] xt_hashlimit: overflow, try lower: 18446744073709551615/7
[   93.624353][ T6907] xt_addrtype: both incoming and outgoing interface limitation cannot be selected
[   93.640830][ T6907] syz_tun: entered allmulticast mode
[   93.739205][ T6917] syzkaller1: entered promiscuous mode
[   93.741678][ T6917] syzkaller1: entered allmulticast mode
[   93.784036][ T6894] syz_tun: left allmulticast mode
[   94.027804][ T6934] DRBG: could not allocate digest TFM handle: hmac(sha384)
[   94.195490][ T6955] __nla_validate_parse: 29 callbacks suppressed
[   94.195503][ T6955] netlink: 212 bytes leftover after parsing attributes in process `syz.2.359'.
[   94.228413][ T6954] syz_tun: entered allmulticast mode
[   94.234309][ T6952] syz_tun: left allmulticast mode
[   94.308875][ T6964] netlink: 8 bytes leftover after parsing attributes in process `syz.1.362'.
[   94.311609][ T6964] netlink: 4 bytes leftover after parsing attributes in process `syz.1.362'.
[   94.314715][ T6964] netlink: 10 bytes leftover after parsing attributes in process `syz.1.362'.
[   94.354282][   T56] block nbd9: Receive control failed (result -107)
[   94.663853][ T6970] netlink: 9472 bytes leftover after parsing attributes in process `syz.1.364'.
[   94.781222][ T6974] netlink: 56 bytes leftover after parsing attributes in process `syz.1.366'.
[   94.899972][ T6981] netlink: 44 bytes leftover after parsing attributes in process `syz.1.369'.
[   94.942458][ T6983] lo: entered allmulticast mode
[   94.950590][ T6982] lo: left allmulticast mode
[   94.960278][ T6985] netlink: 8 bytes leftover after parsing attributes in process `syz.0.371'.
[   94.968592][ T6985] trusted_key: syz.0.371 sent an empty control message without MSG_MORE.
[   95.025100][ T6987] netlink: 4 bytes leftover after parsing attributes in process `syz.1.372'.
[   95.101341][ T6999] netlink: 56 bytes leftover after parsing attributes in process `syz.2.375'.
[   95.179424][ T6997] validate_nla: 7 callbacks suppressed
[   95.179448][ T6997] netlink: 'syz.0.374': attribute type 12 has an invalid length.
[   95.257158][ T7011] syz_tun: entered allmulticast mode
[   95.266681][ T7010] syz_tun: left allmulticast mode
[   95.534961][ T7031] nbd: nbd2 already in use
[   95.644099][ T7048] syz_tun: entered allmulticast mode
[   95.646905][ T7047] syz_tun: left allmulticast mode
[   95.673574][ T7046] "syz.1.391" (7046) uses obsolete ecb(arc4) skcipher
[   95.697478][ T7058] tipc: Started in network mode
[   95.699100][ T7058] tipc: Node identity ac14140f, cluster identity 4711
[   95.705446][ T7058] tipc: New replicast peer: 255.255.255.255
[   95.707873][ T7058] tipc: Enabled bearer <udp:syz2>, priority 10
[   95.728582][ T7046] netlink: 'syz.1.391': attribute type 1 has an invalid length.
[   95.745642][ T7046] 8021q: adding VLAN 0 to HW filter on device bond1
[   95.870389][ T7055] tipc: Enabling of bearer <et:g> rejected, media not registered
[   95.907083][ T7067] xfrm1: entered promiscuous mode
[   95.909351][ T7067] xfrm1: entered allmulticast mode
[   96.146236][ T7097] delete_channel: no stack
[   96.244767][ T7108] syz_tun: entered allmulticast mode
[   96.247427][ T7107] syz_tun: left allmulticast mode
[   96.286538][ T7106] gre1: entered allmulticast mode
[   96.358174][ T7114] openvswitch: netlink: VXLAN extension message has 1 unknown bytes.
[   96.396973][ T7116] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   96.399289][ T7116] batman_adv: batadv0: Removing interface: batadv_slave_0
[   96.402608][ T7116] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   96.404992][ T7116] batman_adv: batadv0: Removing interface: batadv_slave_1
[   96.476029][ T7118] bond3: (slave bridge1): Enslaving as an active interface with an up link
[   96.481476][ T7120] wg1 speed is unknown, defaulting to 1000
[   96.488556][ T7120] wg1 speed is unknown, defaulting to 1000
[   96.496932][ T7118] macvlan2: entered promiscuous mode
[   96.498622][ T7118] macvlan2: entered allmulticast mode
[   96.500754][ T7118] bond3: entered promiscuous mode
[   96.511356][ T7118] bridge1: entered promiscuous mode
[   96.514969][ T7118] 8021q: adding VLAN 0 to HW filter on device macvlan2
[   96.519413][ T7118] bond3: left promiscuous mode
[   96.520908][ T7118] bridge1: left promiscuous mode
[   96.541287][ T7120] wg1 speed is unknown, defaulting to 1000
[   96.549222][ T7125] netlink: 'syz.2.418': attribute type 1 has an invalid length.
[   96.564582][ T7120] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[   96.585242][   T56] block nbd10: Receive control failed (result -107)
[   96.592526][ T7120] wg1 speed is unknown, defaulting to 1000
[   96.596385][ T7120] wg1 speed is unknown, defaulting to 1000
[   96.599212][ T7120] wg1 speed is unknown, defaulting to 1000
[   96.646359][ T7130] dvmrp1: entered allmulticast mode
[   96.660503][ T7128] dvmrp1: left allmulticast mode
[   96.743611][ T7141] netlink: 'syz.2.421': attribute type 12 has an invalid length.
[   96.819989][ T7144] netlink: 'syz.0.424': attribute type 2 has an invalid length.
[   96.835476][ T5896] tipc: Node number set to 2886997007
[   97.133283][ T7181] batadv_slave_1: entered promiscuous mode
[   97.295559][ T7192] netlink: 'syz.1.441': attribute type 12 has an invalid length.
[   97.891362][ T7222] lo: entered allmulticast mode
[   97.895431][ T7221] lo: left allmulticast mode
[   97.989375][ T7225] netlink: 'syz.0.452': attribute type 13 has an invalid length.
[   97.996276][ T7225] netlink: 'syz.0.452': attribute type 17 has an invalid length.
[   98.055694][ T7220] netlink: 'syz.0.452': attribute type 11 has an invalid length.
[   98.067705][ T7225] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   98.092640][ T7231] netlink: 'syz.1.456': attribute type 83 has an invalid length.
[   98.110041][ T7231] Driver unsupported XDP return value 0 on prog  (id 107) dev N/A, expect packet loss!
[   98.422332][ T7267] openvswitch: netlink: VXLAN extension message has 1 unknown bytes.
[   98.549691][ T7279] IPv4: Oversized IP packet from 127.202.26.0
[   98.563756][ T7282] syz_tun: entered allmulticast mode
[   98.568064][ T7281] syz_tun: left allmulticast mode
[   98.640199][ T7284] geneve2: entered promiscuous mode
[   98.659442][ T5861] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0
[   98.665667][ T5861] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0
[   98.674676][ T5861] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0
[   98.677374][ T5861] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0
[   98.825285][ T7303] syz_tun: entered allmulticast mode
[   98.828567][ T7302] syz_tun: left allmulticast mode
[   98.940086][ T7308] netlink: 'syz.1.484': attribute type 3 has an invalid length.
[   98.996070][ T7307] xt_CT: You must specify a L4 protocol and not use inversions on it
[   99.124304][ T7317] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[   99.128175][ T7317] macsec2: entered promiscuous mode
[   99.130067][ T7317] macsec2: entered allmulticast mode
[   99.133531][ T7317] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode
[   99.139977][ T7317] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[   99.318369][ T7329] __nla_validate_parse: 46 callbacks suppressed
[   99.318380][ T7329] netlink: 168 bytes leftover after parsing attributes in process `syz.0.489'.
[   99.442748][ T7333] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.491'.
[   99.514543][ T7340] netlink: 8 bytes leftover after parsing attributes in process `syz.0.494'.
[   99.517483][ T7340] netlink: 4 bytes leftover after parsing attributes in process `syz.0.494'.
[   99.520079][ T7340] netlink: 10 bytes leftover after parsing attributes in process `syz.0.494'.
[   99.565130][   T56] block nbd11: Receive control failed (result -107)
[   99.682001][ T7350] team0: Port device netdevsim0 added
[   99.784307][ T7359] netlink: 168 bytes leftover after parsing attributes in process `syz.1.501'.
[   99.955902][ T7374] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  100.019602][ T7374] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  100.046429][ T7384] lo: entered allmulticast mode
[  100.053459][ T7383] lo: left allmulticast mode
[  100.111628][ T7374] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  100.166446][ T7374] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  100.175853][ T7388] netlink: 168 bytes leftover after parsing attributes in process `syz.1.511'.
[  100.242811][   T13] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  100.253056][   T13] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  100.271134][   T13] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  100.278279][ T7394] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  100.287802][ T5861] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  100.367634][ T7401] lo: entered allmulticast mode
[  100.370740][ T7400] lo: left allmulticast mode
[  100.429550][ T7407] netlink: 28 bytes leftover after parsing attributes in process `syz.2.518'.
[  100.432953][ T7407] netlink: 28 bytes leftover after parsing attributes in process `syz.2.518'.
[  100.579504][ T7409] can: request_module (can-proto-3) failed.
[  100.603098][ T7416] netlink: 44 bytes leftover after parsing attributes in process `syz.0.519'.
[  100.822344][ T7427] syz_tun: entered allmulticast mode
[  100.825423][ T7426] syz_tun: left allmulticast mode
[  101.025614][ T7436] geneve1: mtu less than device minimum
[  101.339026][ T7443] openvswitch: netlink: Tunnel attr 226 out of range max 16
[  101.850064][ T7475] xt_CT: No such helper "pptp"
[  101.890710][ T7482] validate_nla: 3 callbacks suppressed
[  101.890721][ T7482] netlink: 'syz.0.545': attribute type 1 has an invalid length.
[  101.954636][   T56] block nbd12: Receive control failed (result -107)
[  102.379599][ T7506] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0
[  102.522246][ T5221] Bluetooth: hci2: command 0x0405 tx timeout
[  102.533029][ T7525] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  102.537844][ T7525] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  102.758134][ T7536] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  102.760802][ T7536] syzkaller0: entered promiscuous mode
[  102.763259][ T7536] syzkaller0: entered allmulticast mode
[  102.771358][ T7536] tipc: Resetting bearer <eth:syzkaller0>
[  102.777042][ T7535] tipc: Resetting bearer <eth:syzkaller0>
[  102.789014][ T7535] tipc: Disabling bearer <eth:syzkaller0>
[  102.913145][ T7540] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0)
[  103.241252][ T7563] netlink: 'syz.0.572': attribute type 4 has an invalid length.
[  103.249392][ T7563] netlink: 'syz.0.572': attribute type 4 has an invalid length.
[  103.354824][ T7571] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  104.048927][ T7585] syz_tun: entered allmulticast mode
[  104.109524][ T7589] gretap0: entered promiscuous mode
[  104.460752][ T7614] __nla_validate_parse: 24 callbacks suppressed
[  104.460764][ T7614] netlink: 32 bytes leftover after parsing attributes in process `syz.0.589'.
[  104.574100][ T7623] netlink: 56 bytes leftover after parsing attributes in process `syz.0.594'.
[  104.605256][ T5221] Bluetooth: hci2: command 0x0405 tx timeout
[  104.607345][ T5839] Bluetooth: hci2: Opcode 0x0401 failed: -110
[  104.664109][ T7630] netlink: 168 bytes leftover after parsing attributes in process `syz.0.597'.
[  104.736617][ T7639] IPv6: Can't replace route, no match found
[  104.889597][ T7652] netlink: 64 bytes leftover after parsing attributes in process `syz.0.607'.
[  104.894511][ T7651] netlink: 56 bytes leftover after parsing attributes in process `syz.2.606'.
[  105.059606][ T7671] netlink: 44 bytes leftover after parsing attributes in process `syz.2.616'.
[  105.066631][ T7669] netlink: 40 bytes leftover after parsing attributes in process `syz.0.615'.
[  105.117376][ T7680] syzkaller1: entered promiscuous mode
[  105.119157][ T7680] syzkaller1: entered allmulticast mode
[  105.126580][ T7679] lo: entered allmulticast mode
[  105.128401][ T7682] netlink: 168 bytes leftover after parsing attributes in process `syz.0.620'.
[  105.133411][ T7678] lo: left allmulticast mode
[  105.170350][ T7687] netlink: 48 bytes leftover after parsing attributes in process `syz.0.621'.
[  105.173625][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.175786][ T7687] IPv6: NLM_F_CREATE should be set when creating new route
[  105.178250][ T7687] netlink: 48 bytes leftover after parsing attributes in process `syz.0.621'.
[  105.180977][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.194272][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.207623][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.210218][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.214793][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.217337][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.219682][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.223475][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.225985][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.228561][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.230830][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.233591][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.236341][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.238934][ T7694] syz_tun: entered allmulticast mode
[  105.238975][ T7692] netlink: 'syz.1.623': attribute type 1 has an invalid length.
[  105.240830][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.247724][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.247861][ T7693] syz_tun: left allmulticast mode
[  105.250188][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.255194][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.257529][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.259891][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.262484][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.274663][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.277159][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.279538][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.283632][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.287546][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.289855][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.293066][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.303121][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.305507][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.307817][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.313925][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.316293][ T7687] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  105.367047][ T7706] netlink: 'syz.0.628': attribute type 1 has an invalid length.
[  105.406646][   T56] block nbd13: Receive control failed (result -107)
[  105.433849][ T7711] syz_tun: entered allmulticast mode
[  105.437885][ T7710] syz_tun: left allmulticast mode
[  105.588228][ T7730] syz_tun: entered allmulticast mode
[  105.590628][ T7728] syz_tun: left allmulticast mode
[  106.110143][ T7760] syz_tun: entered allmulticast mode
[  106.114137][ T7759] syz_tun: left allmulticast mode
[  106.213977][ T7767] syz_tun: entered allmulticast mode
[  106.217303][ T7766] syz_tun: left allmulticast mode
[  106.520619][ T7778] netlink: 'syz.1.655': attribute type 1 has an invalid length.
[  106.555475][   T55] block nbd14: Receive control failed (result -107)
[  106.620046][ T7780] x_tables: unsorted entry at hook 3
[  106.743284][ T7785] netlink: 'syz.1.657': attribute type 12 has an invalid length.
[  107.005174][ T7797] netlink: 'syz.1.664': attribute type 1 has an invalid length.
[  107.045751][   T55] block nbd15: Receive control failed (result -107)
[  107.058449][ T7799] vlan2: entered promiscuous mode
[  107.060213][ T7799] bond0: entered promiscuous mode
[  107.062947][ T7799] bond_slave_0: entered promiscuous mode
[  107.064970][ T7799] bond_slave_1: entered promiscuous mode
[  107.067021][ T7799] vlan2: entered allmulticast mode
[  107.068710][ T7799] bond0: entered allmulticast mode
[  107.070431][ T7799] bond_slave_0: entered allmulticast mode
[  107.082200][ T7799] bond_slave_1: entered allmulticast mode
[  107.390077][ T7817] netlink: 'syz.0.669': attribute type 12 has an invalid length.
[  107.692456][ T7842] netlink: 'syz.1.678': attribute type 39 has an invalid length.
[  107.706625][ T7846] netlink: 'syz.0.679': attribute type 15 has an invalid length.
[  107.736495][ T7848] netpci0: tun_chr_ioctl cmd 1074025681
[  107.796452][ T7854] syz_tun: entered allmulticast mode
[  107.812504][ T7853] syz_tun: left allmulticast mode
[  107.823983][ T7856] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[  107.918912][ T7863] netlink: 'syz.1.686': attribute type 20 has an invalid length.
[  108.189662][ T7889] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  108.192352][ T7889] syzkaller0: entered promiscuous mode
[  108.195002][ T7889] syzkaller0: entered allmulticast mode
[  108.208097][ T7888] tipc: Resetting bearer <eth:syzkaller0>
[  108.228150][ T7888] tipc: Disabling bearer <eth:syzkaller0>
[  108.297065][ T7899] syz_tun: entered allmulticast mode
[  108.301096][ T7898] syz_tun: left allmulticast mode
[  108.471960][ T7919] netlink: 'syz.1.705': attribute type 1 has an invalid length.
[  108.504993][   T56] block nbd16: Receive control failed (result -107)
[  108.563071][ T7929] netlink: 'syz.1.708': attribute type 1 has an invalid length.
[  108.586951][ T7929] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link
[  108.606061][ T7929] bridge_slave_0: left allmulticast mode
[  108.607866][ T7929] bridge_slave_0: left promiscuous mode
[  108.609731][ T7929] bridge0: port 1(bridge_slave_0) entered disabled state
[  108.616290][ T7929] bridge_slave_1: left allmulticast mode
[  108.618051][ T7929] bridge_slave_1: left promiscuous mode
[  108.619801][ T7929] bridge0: port 2(bridge_slave_1) entered disabled state
[  108.633687][ T7929] bond0: (slave bond_slave_0): Releasing backup interface
[  108.640373][ T7929] bond0: (slave bond_slave_1): Releasing backup interface
[  108.651568][ T7929] team0: Port device team_slave_0 removed
[  108.658660][ T7929] team0: Port device team_slave_1 removed
[  108.669514][ T7929] bond2: (slave ip6gretap1): Releasing backup interface
[  108.681428][ T5896] wg1 speed is unknown, defaulting to 1000
[  108.685380][  T790] lo speed is unknown, defaulting to 1000
[  108.896075][ T7951] syz_tun: entered allmulticast mode
[  108.898567][ T7949] syz_tun: left allmulticast mode
[  108.966908][ T7950] netlink: 'syz.1.714': attribute type 83 has an invalid length.
[  108.990436][ T7955] netlink: 'syz.2.716': attribute type 12 has an invalid length.
[  109.192220][ T7964] xt_CT: You must specify a L4 protocol and not use inversions on it
[  109.303892][ T7970] tun0: tun_chr_ioctl cmd 35111
[  109.526839][ T7990] __nla_validate_parse: 65 callbacks suppressed
[  109.526858][ T7990] netlink: 566 bytes leftover after parsing attributes in process `syz.0.730'.
[  109.695602][ T8002] netlink: 4388 bytes leftover after parsing attributes in process `syz.2.735'.
[  109.730770][ T8004] netlink: 'syz.0.736': attribute type 12 has an invalid length.
[  109.733521][ T8004] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.736'.
[  109.826599][ T8015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.740'.
[  109.846755][ T8005] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  109.858511][ T8015] netlink: 4 bytes leftover after parsing attributes in process `syz.1.740'.
[  109.861217][ T8015] netlink: 10 bytes leftover after parsing attributes in process `syz.1.740'.
[  109.887240][   T55] block nbd17: Receive control failed (result -107)
[  109.898617][ T8021] netlink: 24 bytes leftover after parsing attributes in process `syz.0.741'.
[  109.958798][ T8027] lo: entered allmulticast mode
[  109.964095][ T8025] lo: left allmulticast mode
[  109.973956][ T8028] SET target dimension over the limit!
[  109.996431][ T8030] lo: entered allmulticast mode
[  110.019846][ T8029] lo: left allmulticast mode
[  110.066505][ T8034] netlink: 44 bytes leftover after parsing attributes in process `syz.1.746'.
[  110.109364][ T8038] netlink: 8 bytes leftover after parsing attributes in process `syz.1.748'.
[  110.126331][ T8038] netlink: 4 bytes leftover after parsing attributes in process `syz.1.748'.
[  110.175060][   T56] block nbd18: Receive control failed (result -107)
[  110.370085][ T8060] lo: entered allmulticast mode
[  110.375267][ T8059] lo: left allmulticast mode
[  110.454304][   T56] block nbd19: Receive control failed (result -107)
[  110.534962][ T8068] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  110.560490][ T8072] syz_tun: entered allmulticast mode
[  110.572897][ T8071] syz_tun: left allmulticast mode
[  110.707051][   T56] block nbd20: Receive control failed (result -107)
[  110.708989][ T8089] openvswitch: netlink: ERSPAN option length err (len 256, max 255).
[  111.466451][ T8147] 8021q: adding VLAN 0 to HW filter on device bond5
[  111.480662][ T8147] 8021q: adding VLAN 0 to HW filter on device macvlan2
[  111.489039][ T8147] bond5: (slave macvlan2): Enslaving as a backup interface with an up link
[  111.503270][ T8147] bridge_slave_0: left allmulticast mode
[  111.505670][ T8147] bridge_slave_0: left promiscuous mode
[  111.508073][ T8147] bridge0: port 1(bridge_slave_0) entered disabled state
[  111.517134][ T8147] bridge_slave_1: left allmulticast mode
[  111.519422][ T8147] bridge_slave_1: left promiscuous mode
[  111.524142][ T8147] bridge0: port 2(bridge_slave_1) entered disabled state
[  111.535515][ T8147] bond0: (slave bond_slave_0): Releasing backup interface
[  111.539947][ T8147] bond_slave_0: left allmulticast mode
[  111.543116][ T8147] bond_slave_0: left promiscuous mode
[  111.550234][ T8147] bond0: (slave bond_slave_1): Releasing backup interface
[  111.565406][ T8147] bond_slave_1: left allmulticast mode
[  111.567708][ T8147] bond_slave_1: left promiscuous mode
[  111.576327][ T8147] team0: Port device team_slave_0 removed
[  111.588605][ T8147] team0: Port device team_slave_1 removed
[  111.591593][ T8147] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  111.595465][ T8147] batman_adv: batadv0: Removing interface: batadv_slave_0
[  111.600224][ T8147] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  111.605625][ T8147] batman_adv: batadv0: Removing interface: batadv_slave_1
[  111.617800][ T8147] team0: Port device netdevsim0 removed
[  111.627060][ T8147] bond1: (slave batadv1): Releasing backup interface
[  111.634045][ T8147] bond3: (slave bridge1): Releasing backup interface
[  111.641955][ T8147] bond5: (slave macvlan2): Removing an active aggregator
[  111.656565][ T8147] bond5: (slave macvlan2): Releasing backup interface
[  112.445536][ T8213] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  112.505157][ T8213] validate_nla: 8 callbacks suppressed
[  112.505167][ T8213] netlink: 'syz.0.809': attribute type 12 has an invalid length.
[  112.662682][ T8237] netlink: 'syz.1.817': attribute type 29 has an invalid length.
[  112.791687][ T8258] lo: entered allmulticast mode
[  112.794045][ T8256] lo: left allmulticast mode
[  112.819398][ T8260] lo: entered allmulticast mode
[  112.821485][ T8259] lo: left allmulticast mode
[  112.894831][ T8268] netlink: 'syz.0.825': attribute type 39 has an invalid length.
[  113.073915][ T8280] netlink: 'syz.1.829': attribute type 12 has an invalid length.
[  113.195553][ T8291] netlink: 'syz.1.834': attribute type 1 has an invalid length.
[  113.215920][ T8291] bond3: entered promiscuous mode
[  113.218360][ T8291] bond3: entered allmulticast mode
[  113.227439][ T8291] bridge3: the hash_elasticity option has been deprecated and is always 16
[  113.233064][ T8291] bond3: (slave bridge3): making interface the new active one
[  113.235548][ T8291] bridge3: entered promiscuous mode
[  113.237248][ T8291] bridge3: entered allmulticast mode
[  113.239534][ T8291] bond3: (slave bridge3): Enslaving as an active interface with an up link
[  113.350868][ T8304] netlink: 'syz.0.836': attribute type 4 has an invalid length.
[  113.585844][ T8328] lo: entered allmulticast mode
[  113.596524][ T8327] lo: left allmulticast mode
[  113.704035][ T8334] netlink: 'syz.1.851': attribute type 10 has an invalid length.
[  113.706958][ T8334] team0: entered promiscuous mode
[  113.708649][ T8334] team0: entered allmulticast mode
[  113.710868][ T8334] bridge0: port 1(team0) entered blocking state
[  113.713362][ T8334] bridge0: port 1(team0) entered disabled state
[  114.124740][ T8351] netlink: 'syz.1.859': attribute type 32 has an invalid length.
[  114.130976][ T8346] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  114.368908][ T8360] netlink: 'syz.1.860': attribute type 1 has an invalid length.
[  114.404910][   T56] block nbd21: Receive control failed (result -107)
[  114.490628][ T8368] xt_hashlimit: size too large, truncated to 1048576
[  114.551223][ T8373] lo: entered allmulticast mode
[  114.555204][ T8372] lo: left allmulticast mode
[  114.875026][   T24] lo speed is unknown, defaulting to 1000
[  114.881655][   T24] syz1: Port: 1 Link DOWN
[  114.904369][  T790] wg1 speed is unknown, defaulting to 1000
[  114.907211][  T790] syz0: Port: 1 Link DOWN
[  114.922341][ T8387] veth3: entered allmulticast mode
[  114.924463][   T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  114.928907][   T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  114.951521][   T13] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  114.955525][   T13] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  114.959152][ T8389] tipc: Enabling of bearer <udp:syz2> rejected, already enabled
[  114.965207][ T8389] __nla_validate_parse: 30 callbacks suppressed
[  114.965215][ T8389] netlink: 12 bytes leftover after parsing attributes in process `syz.0.871'.
[  114.969758][ T8389] tipc: Disabling bearer <udp:syz2>
[  114.977655][ T8389] netlink: 'syz.0.871': attribute type 11 has an invalid length.
[  114.986723][ T8389] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  115.060131][ T8392] netlink: 8 bytes leftover after parsing attributes in process `syz.0.872'.
[  115.076901][ T8392] netlink: 4 bytes leftover after parsing attributes in process `syz.0.872'.
[  115.080907][ T8392] netlink: 'syz.0.872': attribute type 1 has an invalid length.
[  115.082237][ T8394] netlink: 40 bytes leftover after parsing attributes in process `syz.2.873'.
[  115.084352][ T8392] netlink: 10 bytes leftover after parsing attributes in process `syz.0.872'.
[  115.124405][   T55] block nbd22: Receive control failed (result -107)
[  115.128879][ T8397] syz_tun: entered allmulticast mode
[  115.133363][ T8396] syz_tun: left allmulticast mode
[  115.185490][ T8400] netlink: 212288 bytes leftover after parsing attributes in process `syz.2.875'.
[  115.246999][ T8403] netlink: 44 bytes leftover after parsing attributes in process `syz.0.876'.
[  115.269695][ T8410] syz_tun: entered allmulticast mode
[  115.289069][ T8409] syz_tun: left allmulticast mode
[  115.365069][  T790] hid-generic 0005:16C0:5505.0001: item fetching failed at offset 0/1
[  115.379618][  T790] hid-generic 0005:16C0:5505.0001: probe with driver hid-generic failed with error -22
[  115.448190][ T8426] netlink: 4 bytes leftover after parsing attributes in process `syz.0.885'.
[  115.497447][ T8426] veth1_macvtap (unregistering): left allmulticast mode
[  115.509635][ T8426] macsec0 (unregistering): left allmulticast mode
[  115.721713][ T8434] netlink: 44 bytes leftover after parsing attributes in process `syz.0.888'.
[  115.753945][ T8438] netlink: 132 bytes leftover after parsing attributes in process `syz.0.889'.
[  115.812414][ T8442] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) !
[  116.744300][   T13] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  116.747417][   T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  116.761349][   T13] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  116.765674][   T13] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  117.044051][   T56] block nbd23: Receive control failed (result -107)
[  117.221141][ T8544] unknown channel width for channel at 909000KHz?
[  117.430055][ T8568] sch_tbf: burst 19872 is lower than device lo mtu (65550) !
[  117.491024][ T8568] lo speed is unknown, defaulting to 1000
[  117.493985][ T8568] wg1 speed is unknown, defaulting to 1000
[  117.684670][ T8581] validate_nla: 6 callbacks suppressed
[  117.684688][ T8581] netlink: 'syz.2.937': attribute type 10 has an invalid length.
[  117.689914][ T8581] team0: entered promiscuous mode
[  117.694054][ T8581] team0: entered allmulticast mode
[  117.697122][ T8581] bridge0: port 1(team0) entered blocking state
[  117.699805][ T8581] bridge0: port 1(team0) entered disabled state
[  117.991421][ T8589] netlink: 'syz.2.940': attribute type 12 has an invalid length.
[  118.060797][ T8591] nbd: must specify a size in bytes for the device
[  118.196079][ T8603] netlink: 'syz.0.946': attribute type 1 has an invalid length.
[  118.235133][   T55] block nbd24: Receive control failed (result -107)
[  118.510242][ T8626] netlink: 'syz.1.952': attribute type 1 has an invalid length.
[  118.571270][ T8626] vlan2: entered allmulticast mode
[  118.581501][ T8626] veth1: entered allmulticast mode
[  118.616066][ T8616] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  118.699682][ T8639] netlink: 'syz.2.959': attribute type 1 has an invalid length.
[  118.756151][   T56] block nbd25: Receive control failed (result -107)
[  118.994736][ T8667] netlink: 'syz.2.966': attribute type 2 has an invalid length.
[  118.998103][ T8667] netlink: 'syz.2.966': attribute type 1 has an invalid length.
[  119.000810][ T8667] netlink: 'syz.2.966': attribute type 9 has an invalid length.
[  119.171160][ T8662] mac80211_hwsim hwsim4 wlan0: left allmulticast mode
[  119.238321][   T12] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0
[  119.241507][   T12] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  119.246947][   T12] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0
[  119.252086][   T13] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0
[  119.258509][   T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  119.261316][   T13] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0
[  119.264339][   T13] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0
[  119.271854][   T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  119.285992][   T13] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0
[  119.288777][   T13] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0
[  119.313121][   T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  119.315846][   T13] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0
[  119.791979][ T8731] netlink: 'syz.1.988': attribute type 1 has an invalid length.
[  119.796802][ T8731] netlink: 'syz.1.988': attribute type 13 has an invalid length.
[  120.133864][ T8750] __nla_validate_parse: 33 callbacks suppressed
[  120.133877][ T8750] netlink: 168 bytes leftover after parsing attributes in process `syz.1.994'.
[  120.346942][ T8761] netlink: 16 bytes leftover after parsing attributes in process `syz.2.999'.
[  120.838355][ T8788] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-/": -EINTR
[  120.945247][ T8803] sch_tbf: burst 19872 is lower than device lo mtu (65550) !
[  120.994573][ T8803] vlan0: entered allmulticast mode
[  120.996558][ T8803] dummy0: entered allmulticast mode
[  121.045725][ T8808] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1013'.
[  121.132474][ T8814] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  121.218125][ T8823] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1019'.
[  121.280178][ T8832] netdevsim netdevsim0 netdevsim0: entered promiscuous mode
[  121.284425][ T8832] netdevsim netdevsim0 netdevsim0: entered allmulticast mode
[  121.288205][ T8832] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.1024'.
[  121.307646][ T8835] lo: entered allmulticast mode
[  121.309716][ T8834] lo: left allmulticast mode
[  121.341275][ T8833] syzkaller0: entered promiscuous mode
[  121.343190][ T8833] syzkaller0: entered allmulticast mode
[  121.405953][ T8843] (unnamed net_device) (uninitialized): option lacp_rate: invalid value (255)
[  121.484950][ T8845] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.1029'.
[  121.554095][ T8855] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1035'.
[  121.655153][ T8864] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN
[  121.669989][ T8862] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1038'.
[  121.755354][ T8875] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1042'.
[  121.758342][ T8875] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1042'.
[  121.762444][ T8875] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  122.009076][ T8900] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  122.165373][ T8911] batadv0: entered promiscuous mode
[  122.167270][ T8911] batadv0: entered allmulticast mode
[  122.170790][ T8911] 8021q: adding VLAN 0 to HW filter on device batadv0
[  122.177019][ T8911] bridge0: port 1(batadv0) entered blocking state
[  122.179422][ T8911] bridge0: port 1(batadv0) entered disabled state
[  122.392891][ T8928] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on
[  122.424205][ T8928] bond1: entered promiscuous mode
[  122.425905][ T8928] bond1: entered allmulticast mode
[  122.428112][ T8928] 8021q: adding VLAN 0 to HW filter on device bond1
[  122.534692][   T12] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled
[  122.538135][   T12] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled
[  122.619934][ T8953] IPVS: Scheduler module ip_vs_sip not found
[  122.632975][ T8953] IPVS: length: 8 != 446622349272
[  122.911492][ T8974] syz_tun: entered allmulticast mode
[  122.916187][ T8973] syz_tun: left allmulticast mode
[  123.205037][ T9000] validate_nla: 13 callbacks suppressed
[  123.205056][ T9000] netlink: 'syz.0.1078': attribute type 32 has an invalid length.
[  123.457824][ T9023] netlink: 'syz.0.1084': attribute type 6 has an invalid length.
[  123.520414][ T9025] netlink: 'syz.2.1085': attribute type 1 has an invalid length.
[  123.554441][   T55] block nbd26: Receive control failed (result -107)
[  123.596544][ T9022] delete_channel: no stack
[  123.643719][ T9033] netlink: 'syz.0.1086': attribute type 1 has an invalid length.
[  123.667110][ T9033] bond6: entered promiscuous mode
[  123.669237][ T9033] 8021q: adding VLAN 0 to HW filter on device bond6
[  123.690526][ T9033] batadv2: entered promiscuous mode
[  123.698354][ T9033] batadv2: entered allmulticast mode
[  123.704114][ T9033] 8021q: adding VLAN 0 to HW filter on device batadv2
[  123.707256][ T9033] bond6: (slave batadv2): making interface the new active one
[  123.711534][ T9033] bond6: (slave batadv2): Enslaving as an active interface with an up link
[  123.984263][ T9052] netlink: 'syz.2.1095': attribute type 1 has an invalid length.
[  124.014526][   T56] block nbd27: Receive control failed (result -107)
[  124.152486][ T9072] tipc: New replicast peer: 255.255.255.255
[  124.155076][ T9072] tipc: Enabled bearer <udp:syz2>, priority 10
[  125.060031][ T9084] netlink: 'syz.1.1102': attribute type 12 has an invalid length.
[  125.060914][ T9095] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[  125.066955][ T9095] ipt_ECN: cannot use operation on non-tcp rule
[  125.101897][ T9099] netlink: 'syz.0.1107': attribute type 2 has an invalid length.
[  125.104339][ T9099] netlink: 'syz.0.1107': attribute type 1 has an invalid length.
[  125.225783][ T9117] netlink: 'syz.0.1113': attribute type 32 has an invalid length.
[  125.251129][ T9108] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  125.254094][ T9108] syzkaller0: entered promiscuous mode
[  125.256307][ T9108] syzkaller0: entered allmulticast mode
[  125.268425][ T9108] openvswitch: netlink: Key 6 has unexpected len 4096 expected 2
[  125.277983][ T9107] tipc: Resetting bearer <eth:syzkaller0>
[  125.288930][ T9107] tipc: Disabling bearer <eth:syzkaller0>
[  125.436015][ T9139] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  125.455142][ T9137] netlink: 'syz.0.1117': attribute type 12 has an invalid length.
[  125.457490][ T9137] __nla_validate_parse: 24 callbacks suppressed
[  125.457498][ T9137] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.1117'.
[  125.612805][ T9142] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1119'.
[  125.720877][ T9153] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1123'.
[  125.836807][ T9171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1127'.
[  125.839791][ T9171] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1127'.
[  125.933429][ T9175] lo speed is unknown, defaulting to 1000
[  125.937138][ T9175] wg1 speed is unknown, defaulting to 1000
[  132.293597][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[  145.468831][ T5221] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  145.472613][ T5221] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  145.475328][ T5221] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  145.485501][ T5221] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  145.487965][ T5221] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  145.489298][ T5833] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  145.499407][ T5833] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  145.499993][ T5221] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  145.509175][ T5833] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  145.518768][ T5833] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  145.542265][ T8419] ==================================================================
[  145.544707][ T8419] BUG: KASAN: slab-use-after-free in __mutex_lock+0x738/0xe80
[  145.546948][ T8419] Read of size 8 at addr ffff88810e3880a0 by task khidpd_16c05505/8419
[  145.550430][ T8419] 
[  145.551232][ T8419] CPU: 0 UID: 0 PID: 8419 Comm: khidpd_16c05505 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9-dirty #0 PREEMPT(full) 
[  145.551244][ T8419] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  145.551250][ T8419] Call Trace:
[  145.551264][ T8419]  <TASK>
[  145.551269][ T8419]  dump_stack_lvl+0x189/0x250
[  145.551284][ T8419]  ? __kasan_check_byte+0x12/0x40
[  145.551296][ T8419]  ? __pfx_dump_stack_lvl+0x10/0x10
[  145.551305][ T8419]  ? lock_release+0x4b/0x3e0
[  145.551315][ T8419]  ? __virt_addr_valid+0x4a5/0x5c0
[  145.551326][ T8419]  print_report+0xca/0x230
[  145.551334][ T8419]  ? __mutex_lock+0x738/0xe80
[  145.551343][ T8419]  kasan_report+0x118/0x150
[  145.551353][ T8419]  ? __mutex_lock+0x738/0xe80
[  145.551362][ T8419]  __mutex_lock+0x738/0xe80
[  145.551370][ T8419]  ? __mutex_lock+0x51b/0xe80
[  145.551378][ T8419]  ? l2cap_unregister_user+0x6a/0x1b0
[  145.551392][ T8419]  ? __pfx___mutex_lock+0x10/0x10
[  145.551399][ T8419]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  145.551415][ T8419]  l2cap_unregister_user+0x6a/0x1b0
[  145.551426][ T8419]  hidp_session_thread+0x3c9/0x410
[  145.551439][ T8419]  ? __pfx_hidp_session_thread+0x10/0x10
[  145.551449][ T8419]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  145.551460][ T8419]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  145.551471][ T8419]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  145.551481][ T8419]  ? __kthread_parkme+0x7b/0x200
[  145.551491][ T8419]  ? __kthread_parkme+0x1a1/0x200
[  145.551500][ T8419]  kthread+0x711/0x8a0
[  145.551511][ T8419]  ? __pfx_hidp_session_thread+0x10/0x10
[  145.551521][ T8419]  ? __pfx_kthread+0x10/0x10
[  145.551530][ T8419]  ? _raw_spin_unlock_irq+0x23/0x50
[  145.551540][ T8419]  ? lockdep_hardirqs_on+0x9c/0x150
[  145.551547][ T8419]  ? __pfx_kthread+0x10/0x10
[  145.551557][ T8419]  ret_from_fork+0x3fc/0x770
[  145.551567][ T8419]  ? __pfx_ret_from_fork+0x10/0x10
[  145.551575][ T8419]  ? __switch_to_asm+0x39/0x70
[  145.551584][ T8419]  ? __switch_to_asm+0x33/0x70
[  145.551592][ T8419]  ? __pfx_kthread+0x10/0x10
[  145.551602][ T8419]  ret_from_fork_asm+0x1a/0x30
[  145.551614][ T8419]  </TASK>
[  145.551617][ T8419] 
[  145.613947][ T8419] Allocated by task 5837:
[  145.615330][ T8419]  kasan_save_track+0x3e/0x80
[  145.616794][ T8419]  __kasan_kmalloc+0x93/0xb0
[  145.618273][ T8419]  __kmalloc_noprof+0x27a/0x4f0
[  145.619790][ T8419]  hci_alloc_dev_priv+0x28/0x2040
[  145.621381][ T8419]  vhci_create_device+0x120/0x6e0
[  145.622944][ T8419]  vhci_write+0x3ce/0x4a0
[  145.624323][ T8419]  vfs_write+0x54b/0xa90
[  145.625644][ T8419]  ksys_write+0x145/0x250
[  145.627005][ T8419]  do_syscall_64+0xfa/0x3b0
[  145.628444][ T8419]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  145.630282][ T8419] 
[  145.631004][ T8419] Freed by task 9179:
[  145.632253][ T8419]  kasan_save_track+0x3e/0x80
[  145.633651][ T8419]  kasan_save_free_info+0x46/0x50
[  145.635153][ T8419]  __kasan_slab_free+0x62/0x70
[  145.636598][ T8419]  kfree+0x18e/0x440
[  145.637789][ T8419]  bt_host_release+0x82/0x90
[  145.639229][ T8419]  device_release+0x9c/0x1c0
[  145.640631][ T8419]  kobject_put+0x22b/0x480
[  145.641983][ T8419]  vhci_release+0x88/0xd0
[  145.643320][ T8419]  __fput+0x44c/0xa70
[  145.644529][ T8419]  task_work_run+0x1d4/0x260
[  145.645916][ T8419]  do_exit+0x6b5/0x22e0
[  145.647199][ T8419]  do_group_exit+0x21c/0x2d0
[  145.648587][ T8419]  get_signal+0x1286/0x1340
[  145.649961][ T8419]  arch_do_signal_or_restart+0x9a/0x750
[  145.651651][ T8419]  exit_to_user_mode_loop+0x75/0x110
[  145.653254][ T8419]  do_syscall_64+0x2bd/0x3b0
[  145.654640][ T8419]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  145.656414][ T8419] 
[  145.657153][ T8419] Last potentially related work creation:
[  145.658834][ T8419]  kasan_save_stack+0x3e/0x60
[  145.660292][ T8419]  kasan_record_aux_stack+0xbd/0xd0
[  145.661840][ T8419]  insert_work+0x3d/0x330
[  145.663194][ T8419]  __queue_work+0xcfc/0xfe0
[  145.664572][ T8419]  queue_work_on+0x181/0x270
[  145.665955][ T8419]  hci_cmd_sync_submit+0x285/0x2b0
[  145.667528][ T8419]  process_scheduled_works+0xae1/0x17b0
[  145.669233][ T8419]  worker_thread+0x8a0/0xda0
[  145.670627][ T8419]  kthread+0x711/0x8a0
[  145.671849][ T8419]  ret_from_fork+0x3fc/0x770
[  145.673259][ T8419]  ret_from_fork_asm+0x1a/0x30
[  145.674696][ T8419] 
[  145.675443][ T8419] Second to last potentially related work creation:
[  145.677375][ T8419]  kasan_save_stack+0x3e/0x60
[  145.678858][ T8419]  kasan_record_aux_stack+0xbd/0xd0
[  145.680472][ T8419]  insert_work+0x3d/0x330
[  145.681757][ T8419]  __queue_work+0xbd9/0xfe0
[  145.683141][ T8419]  queue_work_on+0x181/0x270
[  145.684514][ T8419]  hci_cmd_sync_submit+0x285/0x2b0
[  145.686078][ T8419]  process_scheduled_works+0xae1/0x17b0
[  145.687750][ T8419]  worker_thread+0x8a0/0xda0
[  145.689156][ T8419]  kthread+0x711/0x8a0
[  145.690407][ T8419]  ret_from_fork+0x3fc/0x770
[  145.691832][ T8419]  ret_from_fork_asm+0x1a/0x30
[  145.693333][ T8419] 
[  145.694058][ T8419] The buggy address belongs to the object at ffff88810e388000
[  145.694058][ T8419]  which belongs to the cache kmalloc-8k of size 8192
[  145.698295][ T8419] The buggy address is located 160 bytes inside of
[  145.698295][ T8419]  freed 8192-byte region [ffff88810e388000, ffff88810e38a000)
[  145.702527][ T8419] 
[  145.703292][ T8419] The buggy address belongs to the physical page:
[  145.705274][ T8419] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810e38c000 pfn:0x10e388
[  145.708403][ T8419] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  145.710900][ T8419] flags: 0x57ff00000000240(workingset|head|node=1|zone=2|lastcpupid=0x7ff)
[  145.713474][ T8419] page_type: f5(slab)
[  145.714707][ T8419] raw: 057ff00000000240 ffff88801a442280 ffffea0004814410 ffffea0004479e10
[  145.717283][ T8419] raw: ffff88810e38c000 0000000000020001 00000000f5000000 0000000000000000
[  145.719891][ T8419] head: 057ff00000000240 ffff88801a442280 ffffea0004814410 ffffea0004479e10
[  145.722505][ T8419] head: ffff88810e38c000 0000000000020001 00000000f5000000 0000000000000000
[  145.725116][ T8419] head: 057ff00000000003 ffffea000438e201 00000000ffffffff 00000000ffffffff
[  145.727709][ T8419] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  145.730309][ T8419] page dumped because: kasan: bad access detected
[  145.732244][ T8419] page_owner tracks the page as allocated
[  145.733954][ T8419] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5577, tgid 5577 (dhcpcd), ts 41110283713, free_ts 28665546509
[  145.739950][ T8419]  post_alloc_hook+0x240/0x2a0
[  145.741425][ T8419]  get_page_from_freelist+0x21e4/0x22c0
[  145.743093][ T8419]  __alloc_frozen_pages_noprof+0x181/0x370
[  145.744824][ T8419]  alloc_pages_mpol+0x232/0x4a0
[  145.746304][ T8419]  allocate_slab+0x8a/0x3b0
[  145.747725][ T8419]  ___slab_alloc+0xbfc/0x1480
[  145.749177][ T8419]  __kmalloc_node_track_caller_noprof+0x2f8/0x4e0
[  145.751106][ T8419]  kmalloc_reserve+0x136/0x290
[  145.752580][ T8419]  __alloc_skb+0x142/0x2d0
[  145.753912][ T8419]  netlink_dump+0x167/0xe90
[  145.755311][ T8419]  netlink_recvmsg+0x676/0xa30
[  145.756774][ T8419]  sock_recvmsg+0x22c/0x270
[  145.758183][ T8419]  ____sys_recvmsg+0x1c9/0x460
[  145.759588][ T8419]  ___sys_recvmsg+0x1b5/0x510
[  145.761018][ T8419]  __x64_sys_recvmsg+0x198/0x260
[  145.762536][ T8419]  do_syscall_64+0xfa/0x3b0
[  145.763889][ T8419] page last free pid 5576 tgid 5576 stack trace:
[  145.765823][ T8419]  __free_frozen_pages+0xc71/0xe70
[  145.767391][ T8419]  __put_partials+0x161/0x1c0
[  145.768777][ T8419]  put_cpu_partial+0x17c/0x250
[  145.770293][ T8419]  __slab_free+0x2f7/0x400
[  145.771742][ T8419]  qlist_free_all+0x97/0x140
[  145.773211][ T8419]  kasan_quarantine_reduce+0x148/0x160
[  145.774873][ T8419]  __kasan_slab_alloc+0x22/0x80
[  145.776406][ T8419]  kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[  145.778255][ T8419]  __alloc_skb+0x112/0x2d0
[  145.779581][ T8419]  netlink_sendmsg+0x5c6/0xb30
[  145.781013][ T8419]  __sock_sendmsg+0x21c/0x270
[  145.782491][ T8419]  ____sys_sendmsg+0x505/0x830
[  145.783924][ T8419]  ___sys_sendmsg+0x21f/0x2a0
[  145.785374][ T8419]  __x64_sys_sendmsg+0x19b/0x260
[  145.786894][ T8419]  do_syscall_64+0xfa/0x3b0
[  145.788331][ T8419]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  145.790166][ T8419] 
[  145.790869][ T8419] Memory state around the buggy address:
[  145.792553][ T8419]  ffff88810e387f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  145.794908][ T8419]  ffff88810e388000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  145.797302][ T8419] >ffff88810e388080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  145.799673][ T8419]                                ^
[  145.801252][ T8419]  ffff88810e388100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  145.803693][ T8419]  ffff88810e388180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  145.806067][ T8419] ==================================================================
[  145.808904][ T8419] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  145.811138][ T8419] CPU: 0 UID: 0 PID: 8419 Comm: khidpd_16c05505 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9-dirty #0 PREEMPT(full) 
[  145.814998][ T8419] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  145.818047][ T8419] Call Trace:
[  145.819087][ T8419]  <TASK>
[  145.819974][ T8419]  dump_stack_lvl+0x99/0x250
[  145.821396][ T8419]  ? __asan_memcpy+0x40/0x70
[  145.822814][ T8419]  ? __pfx_dump_stack_lvl+0x10/0x10
[  145.824389][ T8419]  ? __pfx__printk+0x10/0x10
[  145.825779][ T8419]  panic+0x2db/0x790
[  145.827014][ T8419]  ? __pfx_panic+0x10/0x10
[  145.828394][ T8419]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  145.830199][ T8419]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  145.831985][ T8419]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  145.833874][ T8419]  ? print_memory_metadata+0x314/0x400
[  145.835532][ T8419]  ? __mutex_lock+0x738/0xe80
[  145.836948][ T8419]  check_panic_on_warn+0x89/0xb0
[  145.838465][ T8419]  ? __mutex_lock+0x738/0xe80
[  145.839875][ T8419]  end_report+0x78/0x160
[  145.841216][ T8419]  kasan_report+0x129/0x150
[  145.842550][ T8419]  ? __mutex_lock+0x738/0xe80
[  145.843938][ T8419]  __mutex_lock+0x738/0xe80
[  145.845355][ T8419]  ? __mutex_lock+0x51b/0xe80
[  145.846775][ T8419]  ? l2cap_unregister_user+0x6a/0x1b0
[  145.848429][ T8419]  ? __pfx___mutex_lock+0x10/0x10
[  145.849996][ T8419]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  145.851849][ T8419]  l2cap_unregister_user+0x6a/0x1b0
[  145.853486][ T8419]  hidp_session_thread+0x3c9/0x410
[  145.855088][ T8419]  ? __pfx_hidp_session_thread+0x10/0x10
[  145.856822][ T8419]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  145.858677][ T8419]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  145.860623][ T8419]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  145.862543][ T8419]  ? __kthread_parkme+0x7b/0x200
[  145.864105][ T8419]  ? __kthread_parkme+0x1a1/0x200
[  145.865683][ T8419]  kthread+0x711/0x8a0
[  145.866970][ T8419]  ? __pfx_hidp_session_thread+0x10/0x10
[  145.868720][ T8419]  ? __pfx_kthread+0x10/0x10
[  145.870144][ T8419]  ? _raw_spin_unlock_irq+0x23/0x50
[  145.871712][ T8419]  ? lockdep_hardirqs_on+0x9c/0x150
[  145.873322][ T8419]  ? __pfx_kthread+0x10/0x10
[  145.874721][ T8419]  ret_from_fork+0x3fc/0x770
[  145.876143][ T8419]  ? __pfx_ret_from_fork+0x10/0x10
[  145.877690][ T8419]  ? __switch_to_asm+0x39/0x70
[  145.879134][ T8419]  ? __switch_to_asm+0x33/0x70
[  145.880559][ T8419]  ? __pfx_kthread+0x10/0x10
[  145.881954][ T8419]  ret_from_fork_asm+0x1a/0x30
[  145.883416][ T8419]  </TASK>
[  145.884889][ T8419] Kernel Offset: disabled
[  145.886238][ T8419] Rebooting in 86400 seconds..

VM DIAGNOSIS:
12:17:42  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000065 RBX=0000000000000065 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900067df390
R8 =ffff888021398237 R9 =1ffff11004273046 R10=dffffc0000000000 R11=ffffffff85463620
R12=dffffc0000000000 R13=ffffffff99aff8b8 R14=ffffffff99e044c0 R15=0000000000000000
RIP=ffffffff8546369c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8615000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f2ea24e5000 CR3=000000010d370000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff81b4c020 RBX=ffff88813663b1c0 RCX=ffff88810908b980 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc9000246f6c0 RSP=ffffc9000246f560
R8 =ffffffff8fa22cf7 R9 =1ffffffff1f4459e R10=dffffc0000000000 R11=fffffbfff1f4459f
R12=1ffff11009608385 R13=dffffc0000000000 R14=0000000000000000 R15=ffff88804b041c28
RIP=ffffffff81b4c009 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f76f9699c80 ffffffff 00c00000
GS =0000 ffff8881a3c15000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055b2f37ed7d8 CR3=000000010feb4000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ff00ffffffffffff ffffffffffffffff
XMM02=376c6c696b66722f 326963682f68746f XMM03=00000000000000ff ffffffffffffffff
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000035 0000000032313a00
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffff000000ff XMM09=313030302e353035 353a304336313a35
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
