last executing test programs:

3.470020152s ago: executing program 0 (id=1468):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)

2.599361842s ago: executing program 0 (id=1483):
socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0)
r2 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0)
r3 = socket(0x1e, 0x4, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0xfffffc1d, 0x70bd27, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x3, 0x258}, @IFLA_BR_MCAST_MEMBERSHIP_INTVL={0xc, 0x1f, 0x1}]}}}]}, 0x48}}, 0x24008080)
setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10)
recvmmsg$unix(r3, &(0x7f0000001cc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000140)=""/36, 0x24}], 0x1}}], 0x1, 0x40010000, 0x0)
ioctl$SIOCX25SFACILITIES(r3, 0x89e3, &(0x7f0000000380)={0x5, 0x8, 0x7, 0xa, 0x8, 0x81})
preadv(r0, &(0x7f0000000280)=[{&(0x7f0000000080)=""/48, 0x30}, {&(0x7f0000000140)=""/9, 0x9}, {&(0x7f0000000180)=""/119, 0x77}, {&(0x7f0000000300)=""/74, 0x4a}], 0x4, 0x0, 0x3)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000004080)=ANY=[@ANYBLOB="020000000400000004000000010400000004"], 0x48)
mmap(&(0x7f0000fa2000/0x4000)=nil, 0x4000, 0x0, 0x82011, r5, 0x0)
write$cgroup_pid(r2, &(0x7f0000000c40), 0x12)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r6 = openat$cgroup_ro(r1, &(0x7f00000000c0)='devices.list\x00', 0x275a, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xa, 0x101, 0x7fff, 0xcc, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x50)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x37}]}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}}, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
socket$pppl2tp(0x18, 0x1, 0x1)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_SAVE(r8, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x40, 0x8, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x400}, 0x4000)
write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12)

1.746505703s ago: executing program 0 (id=1497):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000300)="cd", 0x1)
setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0x31e4, 0x4)

1.639249685s ago: executing program 0 (id=1499):
r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10)
ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x7fff)
listen(r0, 0x2)
accept4(r0, 0x0, 0x0, 0x80800)
sendmsg$inet(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x8081)

766.297103ms ago: executing program 0 (id=1523):
unshare(0x20000400)
connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98)

763.039806ms ago: executing program 0 (id=1525):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0)
r2 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r2, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
connect$unix(r0, &(0x7f0000000000)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)

497.799765ms ago: executing program 1 (id=1532):
bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xc, 0xe, &(0x7f0000000b00)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff6a0af0fff8ffff1971a400fe00000000b7060000080000002d6400000000000045040300010000001704000001000a00b7040000ff010000720af2fe000000008500000049000000b700000070b2000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d761ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a8321e056acf27c34bed69d32394c53361d7e43c5cbd8000000000000080231c61ccd106cb93ce1c0983cdcb48477b450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e44c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6bc7c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c460880000000000000000000000000000007a4604baa70bda5d5f18f54e9638350a6dd81a55ab5528efd1ef5a564908db7cce99e5c569c2947763b90e03b6d1a53b590e4ff4867f0d86b9af58244866b9df33634c8d85ce1b3bfa3e5bec6989c907c2f46b9a837676e07d87bb7dba3f34694ceb5b9faf10eece00bcfd503ed3f3048782665a848d79e443de4ba97db3a9bde69be7612cb1441c61eadd5bb4494ff2eb189c2ab3a241c12f764c0719650c1b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000080), 0x60, 0x10, &(0x7f0000000340), 0xfffffffffffffdef, 0x0, 0xffffffffffffffff, 0xfffffffffffffe96}, 0x42)

449.905333ms ago: executing program 1 (id=1534):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000680)="3e951bb4", 0x4)
setsockopt$inet6_int(r0, 0x29, 0x16, 0x0, 0x0)

370.380807ms ago: executing program 1 (id=1535):
r0 = socket$inet6(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000040)=0x9, 0x4)
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c)
bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0)
bpf$MAP_CREATE(0xe4ffffff00000000, &(0x7f0000000080)=@base={0x4, 0x4, 0x4, 0x40007, 0x4, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NLBL_UNLABEL_C_LIST(r1, 0x0, 0x0)
syz_emit_ethernet(0x6a, &(0x7f0000000100)={@link_local, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x30, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @private1, @private2}}}}}}}, 0x0)

289.667065ms ago: executing program 1 (id=1536):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
write$cgroup_int(r1, &(0x7f0000000200), 0x806000)
ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000740)={0x0, 0x2, 0x2, 0x8000000000400})
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x13, r0, 0x7ca8e000)
writev(r1, &(0x7f0000000080)=[{0x0}], 0x1)
r2 = socket$inet_sctp(0x2, 0x5, 0x84)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, 0x0, &(0x7f00000000c0))
syz_emit_ethernet(0x6a, &(0x7f00000007c0)=ANY=[], 0x0)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2409c8c1, 0x0, 0x0)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$int_in(r0, 0x0, 0x0)

246.721525ms ago: executing program 2 (id=1538):
r0 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', <r1=>0x0})
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x11c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x48, 0x2, {{0xa, [0xb, 0x2, 0xb, 0x8c, 0xf, 0x4, 0x4, 0x6, 0xa, 0xf, 0x10, 0x2, 0xd, 0x8, 0x5, 0xc], 0x1, [0x9, 0x67ef, 0x2, 0x4, 0x4, 0x8, 0x3, 0xfff9, 0x9, 0xd4e8, 0x6, 0x200, 0x10, 0x0, 0xc73, 0x5], [0x800, 0x1, 0x7, 0x3d3e, 0xff, 0x4, 0x2, 0x50ad, 0x81, 0xc5, 0x8002, 0x3, 0x2, 0x7, 0x8, 0xce]}, [@TCA_MQPRIO_MAX_RATE64={0x70}, @TCA_MQPRIO_SHAPER={0x6}, @TCA_MQPRIO_MIN_RATE64={0x1c, 0x3, 0x0, 0x1, [{0xc, 0x3, 0x9}, {0xc, 0x3, 0x8000}]}, @TCA_MQPRIO_MIN_RATE64={0x0, 0x3, 0x0, 0x1, [{0x0, 0x3, 0x6}, {0x0, 0x3, 0x9}, {0x0, 0x3, 0x4160}, {0x0, 0x3, 0x8000000000000000}, {0x0, 0x3, 0x8}, {0x0, 0x3, 0x80000000}, {0x0, 0x3, 0x8}, {0x0, 0x3, 0xb7a}, {0x0, 0x3, 0x7}, {}, {0x0, 0x3, 0x9}, {0x0, 0x3, 0x3}]}]}}}]}, 0x11c}}, 0x0)

246.424184ms ago: executing program 2 (id=1539):
mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42072, 0xffffffffffffffff, 0x0)
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$SIOCX25SCALLUSERDATA(r0, 0x89e5, 0x0)

180.491234ms ago: executing program 2 (id=1540):
r0 = socket(0x10, 0x3, 0x0)
recvmmsg$unix(r0, &(0x7f0000002a00)=[{{0xfffffffffffffffe, 0x0, &(0x7f0000001740)=[{&(0x7f0000000000)=""/143, 0x8f}, {&(0x7f0000001980)=""/234, 0xea}, {&(0x7f0000000280)=""/154, 0x9a}, {&(0x7f0000000340)=""/248, 0xffffff8e}, {&(0x7f0000000200)=""/44, 0x2c}, {&(0x7f00000005c0)=""/4096, 0x1000}, {&(0x7f00000015c0)=""/189, 0xbd}, {&(0x7f0000001680)=""/155, 0x9b}], 0x8, &(0x7f0000001800)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x148}}], 0x1, 0x2022, &(0x7f0000002b80)={0x77359400})
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x2}, 0x10)
write(r0, &(0x7f0000000240)="1400000052004f7fb3e45f2024d2f1c9fb470000", 0x14)

180.354069ms ago: executing program 1 (id=1541):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'sit0\x00', <r1=>0x0})
r2 = socket$can_raw(0x1d, 0x3, 0x1)
bind$can_raw(r2, &(0x7f0000000200)={0x1d, r1}, 0x10)

110.415012ms ago: executing program 2 (id=1542):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r0, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={<r1=>0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x28)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={<r2=>r1, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84)
getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000100)={r2}, &(0x7f0000000280)=0x8)

110.228739ms ago: executing program 2 (id=1543):
recvmmsg(0xffffffffffffffff, &(0x7f0000006940)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000003c0)=""/6, 0x6}], 0x1}, 0x3}], 0x1, 0x2, 0x0)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg$sock(r0, &(0x7f00000044c0), 0x4000000000001c0, 0x0)
recvfrom(r1, &(0x7f0000000040)=""/60, 0x3c, 0x40, 0x0, 0x0)

110.063729ms ago: executing program 1 (id=1544):
listen(0xffffffffffffffff, 0x0)
setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, 0x0, 0x0)
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
socket$nl_netfilter(0x10, 0x3, 0xc)
syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010102, @local}, {0x11, 0x1, 0x0, @empty}}}}}, 0x0)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000048000000030a05020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a3000000000080007006e6174003c000000060a01040000000000000000010000001400048010000180090001006d6173710000000008000b40000000000900010073797a30"], 0xcc}, 0x1, 0x0, 0x0, 0x880}, 0x0)

0s ago: executing program 2 (id=1545):
r0 = socket$netlink(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x8, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="18ffffffff0000000000020000005000181100001629aeded1d432d7a45bd5ddb7970600439cfa95420d10e504b5691668190724fcd8f7d1d0ab6feaf71bc5caa8bcbd69cac829d2c07540cc49207f7c812c7ba5db000000000000", @ANYRES32, @ANYBLOB="0000000000000000b702000014f90000b7030004000000008500000000bc09f475150f0fce5bb857f211df00000000"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94)
r1 = socket$unix(0x1, 0x2, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0, 0x58, 0x0, 0xa}, 0x28)
bind$unix(r1, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
sendmsg$unix(r1, &(0x7f00000000c0)={&(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4040801}, 0x20008840)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
shutdown(r2, 0x0)
recvmmsg(r2, &(0x7f00000004c0), 0xf02, 0xf0, 0x0)
accept4(r2, &(0x7f0000003bc0)=@hci, 0x0, 0x800)
setsockopt$SO_TIMESTAMP(r1, 0x1, 0x1d, &(0x7f0000000080)=0x7, 0x4)
recvmmsg(r1, &(0x7f0000000c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/57, 0x39}, 0x8}], 0x3ffffffffffff2e, 0x1000400000de, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0xd}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, '-'}]}], {0x14}}, 0x78}}, 0x40)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x5c}}, 0x4040)
r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x1, @ANYBLOB="0000000000ad75eae3f545ffc49919f600"/30, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x16, 0xf, &(0x7f00000003c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000015090100000000009500000000000000de9a00000000000056080000000000008500000005000000b700000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:27740' (ED25519) to the list of known hosts.
syzkaller login: [   56.235450][ T5829] cgroup: Unknown subsys name 'net'
[   56.382641][ T5829] cgroup: Unknown subsys name 'cpuset'
[   56.386738][ T5829] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   57.730656][ T5829] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   62.219541][ T5234] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   62.222683][ T5234] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   62.225848][ T5234] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   62.231220][ T5851] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   62.235135][ T5851] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   62.237840][ T5851] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   62.240919][ T5851] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   62.244492][ T5847] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   62.256132][ T5855] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   62.260334][ T5854] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   62.263327][ T5854] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   62.266100][ T5855] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   62.270023][ T5855] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   62.274009][ T5855] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   62.276731][ T5855] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   62.555563][ T5844] chnl_net:caif_netlink_parms(): no params data found
[   62.695684][ T5848] chnl_net:caif_netlink_parms(): no params data found
[   62.774971][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.778582][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.783129][ T5844] bridge_slave_0: entered allmulticast mode
[   62.787383][ T5844] bridge_slave_0: entered promiscuous mode
[   62.792737][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.795785][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.798836][ T5844] bridge_slave_1: entered allmulticast mode
[   62.803091][ T5844] bridge_slave_1: entered promiscuous mode
[   62.807731][ T5853] chnl_net:caif_netlink_parms(): no params data found
[   62.860550][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.878535][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   62.949106][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.952033][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.955655][ T5848] bridge_slave_0: entered allmulticast mode
[   62.960263][ T5848] bridge_slave_0: entered promiscuous mode
[   62.964998][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.968196][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.972183][ T5848] bridge_slave_1: entered allmulticast mode
[   62.976125][ T5848] bridge_slave_1: entered promiscuous mode
[   62.987537][ T5844] team0: Port device team_slave_0 added
[   63.027533][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.033299][ T5844] team0: Port device team_slave_1 added
[   63.044764][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.099787][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.102911][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.114101][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.133224][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.136375][ T5853] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.139967][ T5853] bridge_slave_0: entered allmulticast mode
[   63.143967][ T5853] bridge_slave_0: entered promiscuous mode
[   63.163063][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.166034][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.177453][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.189074][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.193672][ T5853] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.197004][ T5853] bridge_slave_1: entered allmulticast mode
[   63.201264][ T5853] bridge_slave_1: entered promiscuous mode
[   63.219088][ T5848] team0: Port device team_slave_0 added
[   63.238790][ T5848] team0: Port device team_slave_1 added
[   63.251442][ T5853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.272992][ T5853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.280975][ T5844] hsr_slave_0: entered promiscuous mode
[   63.283903][ T5844] hsr_slave_1: entered promiscuous mode
[   63.310952][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.313289][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.321918][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.338511][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.341059][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.349965][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.355342][ T5853] team0: Port device team_slave_0 added
[   63.371698][ T5853] team0: Port device team_slave_1 added
[   63.425505][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.428569][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.439550][ T5853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.447631][ T5848] hsr_slave_0: entered promiscuous mode
[   63.450758][ T5848] hsr_slave_1: entered promiscuous mode
[   63.453424][ T5848] debugfs: 'hsr0' already exists in 'hsr'
[   63.455576][ T5848] Cannot create hsr debugfs directory
[   63.462497][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.465920][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.478148][ T5853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.580579][ T5853] hsr_slave_0: entered promiscuous mode
[   63.582990][ T5853] hsr_slave_1: entered promiscuous mode
[   63.585629][ T5853] debugfs: 'hsr0' already exists in 'hsr'
[   63.587919][ T5853] Cannot create hsr debugfs directory
[   63.725505][ T5844] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   63.734987][ T5844] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   63.760621][ T5844] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   63.778761][ T5844] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   63.836745][ T5848] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   63.855416][ T5848] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   63.871695][ T5848] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   63.885802][ T5848] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   63.928775][ T5853] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   63.941520][ T5853] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   63.952467][ T5853] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   63.958434][ T5853] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   63.967877][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.016817][ T5844] 8021q: adding VLAN 0 to HW filter on device team0
[   64.028772][ T1098] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.031792][ T1098] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.051662][ T1098] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.054034][ T1098] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.082823][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.119137][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[   64.148650][ T1101] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.151513][ T1101] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.165729][ T1101] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.168888][ T1101] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.194359][ T5853] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.217005][ T5853] 8021q: adding VLAN 0 to HW filter on device team0
[   64.235055][ T3620] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.237419][ T3620] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.256418][ T3620] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.259053][ T3620] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.320677][ T5854] Bluetooth: hci0: command tx timeout
[   64.323478][ T5854] Bluetooth: hci2: command tx timeout
[   64.326209][ T5854] Bluetooth: hci1: command tx timeout
[   64.359264][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.374033][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.423511][ T5848] veth0_vlan: entered promiscuous mode
[   64.433467][ T5844] veth0_vlan: entered promiscuous mode
[   64.437251][ T5848] veth1_vlan: entered promiscuous mode
[   64.444872][ T5844] veth1_vlan: entered promiscuous mode
[   64.472662][ T5844] veth0_macvtap: entered promiscuous mode
[   64.477474][ T5853] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.482919][ T5848] veth0_macvtap: entered promiscuous mode
[   64.487110][ T5844] veth1_macvtap: entered promiscuous mode
[   64.495052][ T5848] veth1_macvtap: entered promiscuous mode
[   64.508449][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.517923][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.531769][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.547382][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.556481][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.565667][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.572469][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.576876][ T5853] veth0_vlan: entered promiscuous mode
[   64.586691][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.590124][   T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.593267][   T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.596102][   T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.599026][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.612978][ T5853] veth1_vlan: entered promiscuous mode
[   64.671890][ T5853] veth0_macvtap: entered promiscuous mode
[   64.695963][ T5853] veth1_macvtap: entered promiscuous mode
[   64.714917][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.718208][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.721101][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.736554][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.746678][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.751154][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.754942][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.758800][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.758929][   T32] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.768409][   T32] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.807587][ T1098] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.811899][ T1098] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.858033][ T5844] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   64.864425][   T32] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.865764][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.869524][   T32] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.872670][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.920700][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.924167][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.072259][ T5924] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5'.
[   65.075103][ T5924] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5'.
[   65.077977][ T5924] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5'.
[   65.102578][ T5926] netlink: 'syz.2.7': attribute type 13 has an invalid length.
[   65.426952][ T5945] syz.1.15 uses obsolete (PF_INET,SOCK_PACKET)
[   65.677567][ T5962] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   65.759193][ T5959] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.762702][ T5959] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.827768][ T5959] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   65.834873][ T5959] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   65.932130][ T5968] (unnamed net_device) (uninitialized): option ad_user_port_key: invalid value (65535)
[   65.947906][ T5968] (unnamed net_device) (uninitialized): option ad_user_port_key: allowed values 0 - 1023
[   65.961955][   T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   65.966678][   T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   65.972165][ T5968] Zero length message leads to an empty skb
[   66.006680][   T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.033892][   T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.148183][ T5984] netlink: 'syz.2.29': attribute type 1 has an invalid length.
[   66.162613][ T5984] netlink: 'syz.2.29': attribute type 2 has an invalid length.
[   66.169049][ T5984] netlink: 1172 bytes leftover after parsing attributes in process `syz.2.29'.
[   66.245961][ T5988] netlink: 44 bytes leftover after parsing attributes in process `syz.2.31'.
[   66.395225][ T5998] tipc: Started in network mode
[   66.397691][ T5998] tipc: Node identity 3e2b12d549a7, cluster identity 4711
[   66.402054][ T5234] Bluetooth: hci1: command tx timeout
[   66.404399][ T5234] Bluetooth: hci2: command tx timeout
[   66.406689][ T5234] Bluetooth: hci0: command tx timeout
[   66.410451][ T5998] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   66.415665][ T5998] syzkaller0: entered promiscuous mode
[   66.418107][ T5998] syzkaller0: entered allmulticast mode
[   66.450990][ T5998] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) !
[   66.462894][ T5998] netlink: 12 bytes leftover after parsing attributes in process `syz.1.36'.
[   66.481014][ T5998] tipc: Resetting bearer <eth:syzkaller0>
[   66.509252][ T5997] tipc: Resetting bearer <eth:syzkaller0>
[   66.541050][ T5997] tipc: Disabling bearer <eth:syzkaller0>
[   66.655614][ T6012] pim6reg1: entered promiscuous mode
[   66.657574][ T6012] pim6reg1: entered allmulticast mode
[   66.722207][ T6020] netlink: 16 bytes leftover after parsing attributes in process `syz.2.47'.
[   66.883495][ T6035] syz_tun: entered allmulticast mode
[   66.896274][ T6035] dvmrp1: entered allmulticast mode
[   66.906441][ T6034] syz_tun: left allmulticast mode
[   66.957032][ T6038] netlink: 'syz.0.57': attribute type 1 has an invalid length.
[   67.100156][ T6052] netlink: 4 bytes leftover after parsing attributes in process `syz.0.63'.
[   67.126767][ T6054] netlink: 'syz.2.64': attribute type 2 has an invalid length.
[   67.603369][ T6087] netlink: 277 bytes leftover after parsing attributes in process `syz.2.74'.
[   67.625110][ T6089] netlink: 12 bytes leftover after parsing attributes in process `syz.1.75'.
[   67.774522][ T6105] netlink: 'syz.0.80': attribute type 3 has an invalid length.
[   67.807116][ T6107] Set syz0 is full, maxelem 0 reached
[   67.867629][ T6089] Bluetooth: MGMT ver 1.23
[   68.333898][ T6127] netlink: 'syz.0.87': attribute type 2 has an invalid length.
[   68.480449][ T5234] Bluetooth: hci1: command tx timeout
[   68.481340][ T5847] Bluetooth: hci0: command tx timeout
[   68.484986][ T5854] Bluetooth: hci2: command tx timeout
[   69.255333][ T6185] Driver unsupported XDP return value 0 on prog  (id 21) dev N/A, expect packet loss!
[   69.335525][ T6190] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   69.985636][ T6210] netlink: 'syz.2.122': attribute type 16 has an invalid length.
[   69.989120][ T6210] netlink: 'syz.2.122': attribute type 17 has an invalid length.
[   70.004836][ T6210] IPv6: NLM_F_REPLACE set, but no existing node found!
[   70.495057][ T6225] erspan0: entered promiscuous mode
[   70.498673][ T6225] batman_adv: batadv0: Adding interface: macvlan2
[   70.502418][ T6225] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   70.512933][ T6225] batman_adv: batadv0: Interface activated: macvlan2
[   70.555861][ T6225] __nla_validate_parse: 9 callbacks suppressed
[   70.555876][ T6225] netlink: 12 bytes leftover after parsing attributes in process `syz.1.129'.
[   70.562907][ T5854] Bluetooth: hci2: command tx timeout
[   70.562956][ T5854] Bluetooth: hci0: command tx timeout
[   70.569947][ T5847] Bluetooth: hci1: command tx timeout
[   70.835846][ T6243] netlink: 'syz.2.138': attribute type 83 has an invalid length.
[   70.882008][ T6251] netlink: 32 bytes leftover after parsing attributes in process `syz.0.143'.
[   70.884965][ T6251] netlink: 48 bytes leftover after parsing attributes in process `syz.0.143'.
[   70.896807][ T6251] netlink: 48 bytes leftover after parsing attributes in process `syz.0.143'.
[   70.916098][ T6253] team0: No ports can be present during mode change
[   70.923614][ T6253] vlan0: entered promiscuous mode
[   70.930458][ T6253] tipc: Started in network mode
[   70.932147][ T6253] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711
[   70.940168][ T6253] tipc: Enabled bearer <eth:team0>, priority 0
[   70.997886][ T6257] nbd: must specify a device to reconfigure
[   71.109198][ T6273] mac80211_hwsim hwsim4 wlan1: entered allmulticast mode
[   71.124805][ T6273] bridge_slave_0: left allmulticast mode
[   71.126844][ T6273] bridge_slave_0: left promiscuous mode
[   71.133641][ T6273] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.141787][ T6273] bridge_slave_1: left allmulticast mode
[   71.144012][ T6273] bridge_slave_1: left promiscuous mode
[   71.146420][ T6273] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.154456][ T6273] bond0: (slave bond_slave_0): Releasing backup interface
[   71.161409][ T6273] bond0: (slave bond_slave_1): Releasing backup interface
[   71.170740][ T6273] team0: Port device team_slave_0 removed
[   71.178345][ T6273] team0: Port device team_slave_1 removed
[   71.184151][ T6273] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   71.187445][ T6273] batman_adv: batadv0: Removing interface: batadv_slave_0
[   71.192744][ T6273] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   71.196268][ T6273] batman_adv: batadv0: Removing interface: batadv_slave_1
[   71.203654][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   71.209445][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   71.246473][ T6273] netlink: 'syz.0.152': attribute type 10 has an invalid length.
[   71.249140][ T6273] mac80211_hwsim hwsim4 wlan1: left allmulticast mode
[   71.257931][ T6273] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   72.079983][ T5885] tipc: Node number set to 11578026
[   72.093262][  T792] cfg80211: failed to load regulatory.db
[   72.203117][ T6318] C: renamed from team_slave_0
[   72.214406][ T6318] netlink: 'syz.2.174': attribute type 8 has an invalid length.
[   72.224259][ T6318] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[   72.320865][ T6326] netlink: 204 bytes leftover after parsing attributes in process `syz.2.178'.
[   72.392322][ T6333] netlink: 76 bytes leftover after parsing attributes in process `syz.0.180'.
[   72.401260][ T6336] netlink: 'syz.1.183': attribute type 1 has an invalid length.
[   72.409239][ T6336] netlink: 172 bytes leftover after parsing attributes in process `syz.1.183'.
[   72.418064][ T6336] netlink: 'syz.1.183': attribute type 1 has an invalid length.
[   72.571701][ T6349] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   72.576212][ T6349] syzkaller0: entered promiscuous mode
[   72.578481][ T6349] syzkaller0: entered allmulticast mode
[   72.601517][ T6349] tipc: Resetting bearer <eth:syzkaller0>
[   72.604969][ T6349] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[   72.615363][ T6347] tipc: Resetting bearer <eth:syzkaller0>
[   72.629066][ T6347] tipc: Disabling bearer <eth:syzkaller0>
[   72.637974][ T6352] netlink: 8 bytes leftover after parsing attributes in process `syz.1.191'.
[   73.183565][ T6382] netlink: 92 bytes leftover after parsing attributes in process `syz.2.204'.
[   73.188542][ T6382] netlink: 24 bytes leftover after parsing attributes in process `syz.2.204'.
[   73.319010][ T6388] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   74.024872][ T6428] bridge0: port 1(bridge_slave_0) entered disabled state
[   74.032102][ T6428] bridge0: port 2(bridge_slave_1) entered disabled state
[   74.755354][ T6484] netlink: 'syz.1.252': attribute type 1 has an invalid length.
[   75.627670][ T6546] __nla_validate_parse: 2 callbacks suppressed
[   75.627683][ T6546] netlink: 4 bytes leftover after parsing attributes in process `syz.1.277'.
[   76.146308][ T6567] team0: No ports can be present during mode change
[   76.152568][ T6567] vlan0: entered promiscuous mode
[   76.165127][ T6543] netlink: 156 bytes leftover after parsing attributes in process `syz.0.276'.
[   76.167786][ T6567] team0: Port device vlan0 added
[   76.213499][ T6567] tipc: Enabled bearer <eth:team0>, priority 0
[   76.231903][ T6569] netlink: 'syz.2.285': attribute type 3 has an invalid length.
[   76.235271][ T6569] netlink: 3 bytes leftover after parsing attributes in process `syz.2.285'.
[   76.319045][ T6571] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   76.622753][ T6587] netlink: 704 bytes leftover after parsing attributes in process `syz.1.294'.
[   77.026264][ T6615] vlan0: left promiscuous mode
[   77.479264][ T5885] tipc: Node number set to 2005668565
[   77.748982][ T6660] wg1: entered promiscuous mode
[   77.751205][ T6660] wg1: entered allmulticast mode
[   78.249275][ T6687] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT
[   78.324236][ T6695] warning: `syz.2.343' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   78.516004][ T6718] bond0: entered promiscuous mode
[   78.524882][ T6718] bond_slave_0: entered promiscuous mode
[   78.526852][ T6718] bond_slave_1: entered promiscuous mode
[   78.535260][ T6718] batadv0: entered promiscuous mode
[   78.537537][ T6718] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network
[   78.541242][ T6718] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network
[   78.546990][ T6718] hsr1: entered allmulticast mode
[   78.553451][ T6711] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0
[   78.558809][ T6718] bond0: entered allmulticast mode
[   78.566846][ T6718] bond_slave_0: entered allmulticast mode
[   78.568827][ T6718] bond_slave_1: entered allmulticast mode
[   78.571905][ T6718] batadv0: entered allmulticast mode
[   78.576932][ T6718] 8021q: adding VLAN 0 to HW filter on device hsr1
[   78.585739][ T6718] bond0: left promiscuous mode
[   78.589680][ T6718] bond_slave_0: left promiscuous mode
[   78.596398][ T6718] bond_slave_1: left promiscuous mode
[   78.602281][ T6718] batadv0: left promiscuous mode
[   78.731357][ T6736] netlink: 4 bytes leftover after parsing attributes in process `syz.2.362'.
[   78.734623][ T6736] netlink: 16 bytes leftover after parsing attributes in process `syz.2.362'.
[   78.996333][ T6758] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.371'.
[   79.035807][ T6768] tipc: Started in network mode
[   79.037988][ T6768] tipc: Node identity 5e754d468623, cluster identity 4711
[   79.044335][ T6758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.371'.
[   79.047896][ T6768] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   79.053725][ T6768] syzkaller0: entered promiscuous mode
[   79.055629][ T6768] syzkaller0: entered allmulticast mode
[   79.058496][ T6758] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[   79.066750][ T6758] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[   79.081523][ T6768] tipc: Resetting bearer <eth:syzkaller0>
[   79.086573][ T6767] tipc: Resetting bearer <eth:syzkaller0>
[   79.096298][ T6767] tipc: Disabling bearer <eth:syzkaller0>
[   79.436531][ T6803] netlink: 'syz.1.389': attribute type 5 has an invalid length.
[   79.523182][ T6814] : renamed from batadv_slave_1 (while UP)
[   79.582324][ T6820] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0x2
[   79.608838][ T6822] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   79.615609][ T6822] syzkaller0: entered promiscuous mode
[   79.617596][ T6822] syzkaller0: entered allmulticast mode
[   79.623301][ T6824] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   79.626276][ T6824] batadv_slave_1: entered promiscuous mode
[   79.643680][ T6822] tipc: Resetting bearer <eth:syzkaller0>
[   79.648315][ T6821] tipc: Resetting bearer <eth:syzkaller0>
[   79.656261][ T6821] tipc: Disabling bearer <eth:syzkaller0>
[   79.838795][ T6846] netlink: 'syz.1.410': attribute type 1 has an invalid length.
[   79.841565][ T6846] netlink: 'syz.1.410': attribute type 2 has an invalid length.
[   79.862115][ T6850] netlink: 4 bytes leftover after parsing attributes in process `syz.2.411'.
[   79.955074][ T6862] netlink: 256 bytes leftover after parsing attributes in process `syz.1.416'.
[   80.070562][ T6872] IPVS: Error connecting to the multicast addr
[   80.599039][ T6929] netlink: 'syz.1.448': attribute type 4 has an invalid length.
[   81.226515][   T33] audit: type=1800 audit(1755163689.252:2): pid=6965 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.465" name=CB dev="tmpfs" ino=985 res=0 errno=0
[   81.645606][ T7014] __nla_validate_parse: 5 callbacks suppressed
[   81.645647][ T7014] netlink: 60 bytes leftover after parsing attributes in process `syz.1.487'.
[   81.712142][ T7024] openvswitch: netlink: Message has 20 unknown bytes.
[   81.714423][ T7024] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   81.806967][ T7027] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   81.847268][ T7027] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   81.900965][ T7027] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   81.943979][ T7044] netlink: 4 bytes leftover after parsing attributes in process `syz.0.500'.
[   81.974655][ T7027] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.053104][   T13] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   82.061484][ T5878] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   82.074739][ T5878] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   82.086871][ T5878] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   82.120104][ T7050] trusted_key: syz.0.503 sent an empty control message without MSG_MORE.
[   82.253578][ T7058] (unnamed net_device) (uninitialized): option active_slave: mode dependency failed, not supported in mode balance-xor(2)
[   82.407744][   T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.411679][   T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.416773][   T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.424809][   T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.473543][ T7067] netlink: 'syz.0.511': attribute type 33 has an invalid length.
[   82.476244][ T7067] netlink: 20 bytes leftover after parsing attributes in process `syz.0.511'.
[   82.479259][ T7067] bond0: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0)
[   82.762776][ T7089] netlink: 8 bytes leftover after parsing attributes in process `syz.2.521'.
[   82.766269][ T7089] netlink: 4 bytes leftover after parsing attributes in process `syz.2.521'.
[   82.802483][ T7092] netlink: 'syz.0.522': attribute type 1 has an invalid length.
[   82.808027][ T7092] netlink: 'syz.0.522': attribute type 11 has an invalid length.
[   82.834739][ T7092] netlink: 308 bytes leftover after parsing attributes in process `syz.0.522'.
[   82.838391][ T7092] netlink: 8 bytes leftover after parsing attributes in process `syz.0.522'.
[   82.844189][ T7092] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check.
[   83.088448][ T7115] netlink: 24 bytes leftover after parsing attributes in process `syz.2.529'.
[   83.101219][ T7115] netlink: 24 bytes leftover after parsing attributes in process `syz.2.529'.
[   83.296460][ T7134] netlink: 17 bytes leftover after parsing attributes in process `syz.1.537'.
[   85.972515][ T7305] veth3: entered promiscuous mode
[   86.617907][ T7346] erspan0: entered promiscuous mode
[   86.624811][ T7346] erspan0: left promiscuous mode
[   86.747751][ T7348] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[   86.753451][ T7348] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[   86.911214][ T7356] __nla_validate_parse: 7 callbacks suppressed
[   86.911229][ T7356] netlink: 8 bytes leftover after parsing attributes in process `syz.2.610'.
[   86.931069][ T7358] netlink: 8 bytes leftover after parsing attributes in process `syz.1.611'.
[   86.933997][ T7358] netlink: 12 bytes leftover after parsing attributes in process `syz.1.611'.
[   86.948515][ T7360] netlink: 'syz.2.612': attribute type 8 has an invalid length.
[   87.088351][ T7368] netlink: 36 bytes leftover after parsing attributes in process `syz.2.615'.
[   87.524844][ T7379] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   87.621262][ T7385] openvswitch: netlink: VXLAN extension message has 1 unknown bytes.
[   87.891936][ T7405] netlink: 172 bytes leftover after parsing attributes in process `syz.1.633'.
[   87.894960][ T7405] netlink: 172 bytes leftover after parsing attributes in process `syz.1.633'.
[   88.191138][ T7420] netlink: 8 bytes leftover after parsing attributes in process `syz.2.641'.
[   88.301643][ T7434] netlink: 20 bytes leftover after parsing attributes in process `syz.2.647'.
[   88.525577][ T7469] netlink: 28 bytes leftover after parsing attributes in process `syz.1.660'.
[   88.528385][ T7469] netlink: 28 bytes leftover after parsing attributes in process `syz.1.660'.
[   88.795273][ T7488] netlink: 'syz.2.669': attribute type 1 has an invalid length.
[   89.023658][ T7497] netlink: 'syz.2.673': attribute type 1 has an invalid length.
[   89.598025][ T7535] netlink: 'syz.2.689': attribute type 1 has an invalid length.
[   89.602573][ T7535] netlink: 'syz.2.689': attribute type 11 has an invalid length.
[   90.601142][ T7618] tun0: tun_chr_ioctl cmd 2147767520
[   90.842398][ T7621] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[   91.093087][ T7635] nbd: socks must be embedded in a SOCK_ITEM attr
[   91.096756][ T7635] block nbd0: shutting down sockets
[   91.195143][ T7645] bond1: entered promiscuous mode
[   91.198860][ T7645] 8021q: adding VLAN 0 to HW filter on device bond1
[   91.267260][ T7654] netlink: 'syz.0.746': attribute type 1 has an invalid length.
[   91.368377][ T7668] vlan2: entered allmulticast mode
[   91.372157][ T7668] gretap0: entered allmulticast mode
[   91.657280][ T7705] xt_policy: too many policy elements
[   92.083729][ T7743] __nla_validate_parse: 14 callbacks suppressed
[   92.083741][ T7743] netlink: 8 bytes leftover after parsing attributes in process `syz.2.787'.
[   92.204353][ T7752] netlink: 24 bytes leftover after parsing attributes in process `syz.2.791'.
[   92.235836][ T7752] netlink: 4 bytes leftover after parsing attributes in process `syz.2.791'.
[   92.340332][ T7764] netlink: 24 bytes leftover after parsing attributes in process `syz.1.797'.
[   92.412664][ T7769] netlink: 8 bytes leftover after parsing attributes in process `syz.0.799'.
[   92.789799][ T7803] netlink: 44 bytes leftover after parsing attributes in process `syz.1.813'.
[   92.849867][ T7810] netlink: 8 bytes leftover after parsing attributes in process `syz.0.817'.
[   92.966611][ T7823] Unsupported ieee802154 address type: 0
[   93.789558][ T7859] netlink: 8 bytes leftover after parsing attributes in process `syz.2.839'.
[   93.793146][ T7859] netlink: 8 bytes leftover after parsing attributes in process `syz.2.839'.
[   93.912578][ T7865] netlink: 8 bytes leftover after parsing attributes in process `syz.0.842'.
[   94.507043][ T7922] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check.
[   94.728639][ T7930] Bluetooth: hci0: Opcode 0x0c03 failed: -112
[   94.998529][ T7944] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   95.002110][ T7944] syzkaller0: entered promiscuous mode
[   95.004546][ T7944] syzkaller0: entered allmulticast mode
[   95.021003][ T7944] tipc: Resetting bearer <eth:syzkaller0>
[   95.025213][ T7943] tipc: Resetting bearer <eth:syzkaller0>
[   95.037750][ T7943] tipc: Disabling bearer <eth:syzkaller0>
[   95.151631][ T7954] (unnamed net_device) (uninitialized): option arp_interval: invalid value (18446744073709551615)
[   95.156796][ T7954] (unnamed net_device) (uninitialized): option arp_interval: allowed values 0 - 2147483647
[   95.165763][ T7952] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   95.169530][ T7952] syzkaller0: entered promiscuous mode
[   95.172180][ T7952] syzkaller0: entered allmulticast mode
[   95.194726][ T7952] tipc: Resetting bearer <eth:syzkaller0>
[   95.202831][ T7950] tipc: Resetting bearer <eth:syzkaller0>
[   95.220505][ T7950] tipc: Disabling bearer <eth:syzkaller0>
[   95.464913][ T7983] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   95.468542][ T7983] syzkaller0: entered promiscuous mode
[   95.473558][ T7983] syzkaller0: entered allmulticast mode
[   95.510049][ T7983] tipc: Resetting bearer <eth:syzkaller0>
[   95.524715][ T7982] tipc: Resetting bearer <eth:syzkaller0>
[   95.554310][ T7982] tipc: Disabling bearer <eth:syzkaller0>
[   95.741510][ T8011] openvswitch: netlink: IPv4 tun info is not correct
[   95.774053][ T8013] bridge_slave_1: default FDB implementation only supports local addresses
[   95.976764][ T8034] dvmrp1: left allmulticast mode
[   96.294137][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.298166][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.304086][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.307351][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.311355][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.314659][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.318009][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.322079][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.325552][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.329023][ T8053] netlink: 'syz.2.915': attribute type 29 has an invalid length.
[   96.761156][ T8084] tipc: Failed to remove unknown binding: 66,1,1/0:624924084/624924086
[   96.765814][ T8084] tipc: Failed to remove unknown binding: 66,1,1/0:624924084/624924086
[   96.771523][ T8084] tipc: Failed to remove unknown binding: 66,1,1/0:624924084/624924086
[   96.800593][ T5847] Bluetooth: hci0: Opcode 0x0c1a failed: -110
[   96.835192][ T8090] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048)
[   97.252169][ T8123] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   97.308380][ T8131] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   97.769798][ T5847] Bluetooth: hci2: command tx timeout
[   98.172494][ T8185] __nla_validate_parse: 6 callbacks suppressed
[   98.172510][ T8185] netlink: 32 bytes leftover after parsing attributes in process `syz.2.976'.
[   98.278426][ T8192] ip6gre1: entered allmulticast mode
[   98.427935][ T8200] netlink: 8 bytes leftover after parsing attributes in process `syz.0.983'.
[   98.431695][ T8200] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms)
[   99.118856][ T8223] syzkaller1: entered promiscuous mode
[   99.121523][ T8223] syzkaller1: entered allmulticast mode
[   99.220196][ T8227] netlink: 96 bytes leftover after parsing attributes in process `syz.2.994'.
[   99.284159][ T8231] netlink: 12 bytes leftover after parsing attributes in process `syz.2.996'.
[   99.393064][ T8239] team0: Mode changed to "activebackup"
[   99.755664][ T8263] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   99.863607][ T8268] 8021q: adding VLAN 0 to HW filter on device bond0
[   99.881246][ T8268] team0: Port device bond0 added
[  100.533247][ T8338] sctp: [Deprecated]: syz.2.1043 (pid 8338) Use of struct sctp_assoc_value in delayed_ack socket option.
[  100.533247][ T8338] Use struct sctp_sack_info instead
[  100.668950][ T8347] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1047'.
[  100.890843][ T8355] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1050'.
[  101.352280][ T8364] openvswitch: netlink: Missing key (keys=40, expected=2000)
[  101.566932][ T8384] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1061'.
[  101.604649][ T8386] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1064'.
[  101.609081][ T8386] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1064'.
[  101.613590][ T8386] validate_nla: 52 callbacks suppressed
[  101.613601][ T8386] netlink: 'syz.1.1064': attribute type 12 has an invalid length.
[  101.621817][ T8388] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1063'.
[  101.626074][ T8386] netlink: 'syz.1.1064': attribute type 11 has an invalid length.
[  102.586882][ T8468] openvswitch: netlink: Key 6 has unexpected len 4 expected 2
[  102.883672][ T8499] netlink: 'syz.1.1108': attribute type 4 has an invalid length.
[  102.958723][ T8502] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  102.963420][ T8502] syzkaller0: entered promiscuous mode
[  102.965997][ T8502] syzkaller0: entered allmulticast mode
[  102.986075][ T8502] tipc: Resetting bearer <eth:syzkaller0>
[  102.993182][ T8501] tipc: Resetting bearer <eth:syzkaller0>
[  103.003980][ T8501] tipc: Disabling bearer <eth:syzkaller0>
[  103.363242][ T8530] unknown channel width for channel at 909000KHz?
[  103.366285][ T8530] unknown channel width for channel at 909000KHz?
[  103.640982][   T52] IPVS: starting estimator thread 0...
[  103.719982][ T8563] __nla_validate_parse: 3 callbacks suppressed
[  103.719997][ T8563] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1129'.
[  103.726413][ T8563] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1129'.
[  103.730908][ T8556] IPVS: using max 45 ests per chain, 108000 per kthread
[  104.598709][ T8651] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  104.899668][ T8670] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1179'.
[  105.290014][ T8681] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1184'.
[  105.703253][ T8704] netlink: 'syz.1.1194': attribute type 21 has an invalid length.
[  105.706697][ T8704] netlink: 'syz.1.1194': attribute type 1 has an invalid length.
[  105.888486][ T8717] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1198'.
[  105.893517][ T8717] chnl_net:caif_netlink_parms(): no params data found
[  106.658214][ T8760] netlink: 'syz.2.1218': attribute type 1 has an invalid length.
[  108.325063][ T8829] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  108.334048][ T8829] syzkaller0: entered promiscuous mode
[  108.343671][ T8829] syzkaller0: entered allmulticast mode
[  108.374128][ T8829] tipc: Resetting bearer <eth:syzkaller0>
[  108.390192][ T8828] tipc: Resetting bearer <eth:syzkaller0>
[  108.398146][ T8828] tipc: Disabling bearer <eth:syzkaller0>
[  108.941125][ T8842] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1254'.
[  109.085210][ T8853] netlink: 'syz.0.1259': attribute type 1 has an invalid length.
[  109.087853][ T8853] netlink: 232 bytes leftover after parsing attributes in process `syz.0.1259'.
[  109.146172][ T8852] syzkaller0: entered promiscuous mode
[  109.148209][ T8852] syzkaller0: entered allmulticast mode
[  109.184041][ T8863] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1263'.
[  110.675123][ T8925] netlink: 292 bytes leftover after parsing attributes in process `syz.2.1292'.
[  110.740298][ T8934] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  110.744619][ T8934] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  111.108157][ T8965] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1309'.
[  111.419042][ T8975] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1314'.
[  112.503951][ T9003] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1324'.
[  112.746544][ T9013] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1329'.
[  112.980933][ T9031] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1338'.
[  113.161481][ T9048] syzkaller1: entered promiscuous mode
[  113.163903][ T9048] syzkaller1: entered allmulticast mode
[  113.479141][ T9063] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  113.483379][ T9063] syzkaller0: entered promiscuous mode
[  113.485900][ T9063] syzkaller0: entered allmulticast mode
[  113.504682][ T9063] tipc: Resetting bearer <eth:syzkaller0>
[  113.510538][ T9062] tipc: Resetting bearer <eth:syzkaller0>
[  113.518633][ T9062] tipc: Disabling bearer <eth:syzkaller0>
[  113.632587][ T9067] nbd: illegal input index -1
[  114.246082][ T9111] netlink: 'syz.0.1375': attribute type 39 has an invalid length.
[  114.768331][ T9128] 8021q: adding VLAN 0 to HW filter on device bond0
[  114.809424][ T9128] bond0: (slave rose0): Enslaving as an active interface with an up link
[  115.027577][ T9143] syzkaller0: entered allmulticast mode
[  116.669289][ T9208] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1408'.
[  117.431844][ T9243] delete_channel: no stack
[  117.583849][ T9256] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0)
[  117.585093][ T9258] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1434'.
[  117.706510][ T9268] (unnamed net_device) (uninitialized): option arp_interval: mode dependency failed, not supported in mode balance-tlb(5)
[  117.977963][ T9292] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1450'.
[  118.140367][ T9300] netlink: 'syz.0.1453': attribute type 13 has an invalid length.
[  118.143291][ T9300] netlink: 'syz.0.1453': attribute type 17 has an invalid length.
[  118.183242][ T9300] 8021q: adding VLAN 0 to HW filter on device bond0
[  118.186303][ T9300] 8021q: adding VLAN 0 to HW filter on device team0
[  118.193240][ T9300] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  118.201020][ T5878] bond0: (slave wlan1): link status definitely down, disabling slave
[  118.209385][ T5878] bond0: now running without any active interface!
[  118.362471][ T9311] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.1457'.
[  118.366427][ T9311] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1457'.
[  119.161646][ T9357] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  119.253212][ T9361] netlink: 'syz.1.1478': attribute type 1 has an invalid length.
[  119.294402][ T9361] bond2: (slave gretap1): making interface the new active one
[  119.298029][ T9361] bond2: (slave gretap1): Enslaving as an active interface with an up link
[  119.338417][ T9364] syz_tun: entered allmulticast mode
[  119.494808][ T9373] netlink: 'syz.1.1480': attribute type 13 has an invalid length.
[  119.495688][ T9372] netlink: 'syz.2.1482': attribute type 39 has an invalid length.
[  119.499386][ T9373] netlink: 'syz.1.1480': attribute type 17 has an invalid length.
[  119.558200][ T9373] tipc: Resetting bearer <eth:team0>
[  119.561500][ T9373] tipc: Resetting bearer <eth:team0>
[  119.565163][ T9373] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  119.623495][ T9380] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  119.630786][ T9380] syzkaller0: entered promiscuous mode
[  119.632643][ T9380] syzkaller0: entered allmulticast mode
[  119.654062][ T9380] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) !
[  119.667612][ T9380] tipc: Resetting bearer <eth:syzkaller0>
[  119.672232][ T9379] tipc: Resetting bearer <eth:syzkaller0>
[  119.689747][ T9379] tipc: Disabling bearer <eth:syzkaller0>
[  120.225161][   T52] IPVS: starting estimator thread 0...
[  120.319441][ T9405] IPVS: using max 46 ests per chain, 110400 per kthread
[  120.376520][ T9407] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1496'.
[  120.503819][   T12] IPVS: stop unused estimator thread 0...
[  121.634241][ T9486] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1531'.
[  121.883078][ T9504] netlink: 164 bytes leftover after parsing attributes in process `syz.2.1538'.
[  122.297631][ T9523] ==================================================================
[  122.301051][ T9523] BUG: KASAN: slab-use-after-free in __xfrm_state_lookup+0x6ad/0x8d0
[  122.304495][ T9523] Read of size 2 at addr ffff8880365b45c2 by task syz.0.1546/9523
[  122.308656][ T9523] 
[  122.309757][ T9523] CPU: 0 UID: 0 PID: 9523 Comm: syz.0.1546 Not tainted 6.16.0-syzkaller-12084-g33caa208dba6-dirty #0 PREEMPT(full) 
[  122.309776][ T9523] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  122.309785][ T9523] Call Trace:
[  122.309791][ T9523]  <TASK>
[  122.309798][ T9523]  dump_stack_lvl+0x189/0x250
[  122.309819][ T9523]  ? __kasan_check_byte+0x12/0x40
[  122.309839][ T9523]  ? __pfx_dump_stack_lvl+0x10/0x10
[  122.309854][ T9523]  ? lock_release+0x4b/0x3e0
[  122.309876][ T9523]  ? __virt_addr_valid+0x4a5/0x5c0
[  122.309893][ T9523]  print_report+0xca/0x240
[  122.309906][ T9523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  122.309923][ T9523]  kasan_report+0x118/0x150
[  122.309940][ T9523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  122.309959][ T9523]  __xfrm_state_lookup+0x6ad/0x8d0
[  122.309979][ T9523]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  122.309999][ T9523]  xfrm_state_add+0x27d/0xc40
[  122.310020][ T9523]  xfrm_add_sa+0x35a1/0x4070
[  122.310034][ T9523]  ? __pfx_xfrm_add_sa+0x10/0x10
[  122.310045][ T9523]  ? apparmor_capable+0x137/0x1b0
[  122.310060][ T9523]  ? __nla_parse+0x40/0x60
[  122.310077][ T9523]  xfrm_user_rcv_msg+0x7a3/0xab0
[  122.310117][ T9523]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  122.310141][ T9523]  ? __pfx___mutex_trylock_common+0x10/0x10
[  122.310157][ T9523]  ? rcu_is_watching+0x15/0xb0
[  122.310170][ T9523]  ? trace_contention_end+0x39/0x120
[  122.310184][ T9523]  ? __mutex_lock+0x335/0x1360
[  122.310208][ T9523]  netlink_rcv_skb+0x208/0x470
[  122.310226][ T9523]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  122.310238][ T9523]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  122.310258][ T9523]  ? netlink_deliver_tap+0x2e/0x1b0
[  122.310273][ T9523]  ? netlink_deliver_tap+0x2e/0x1b0
[  122.310290][ T9523]  xfrm_netlink_rcv+0x79/0x90
[  122.310302][ T9523]  netlink_unicast+0x82f/0x9e0
[  122.310319][ T9523]  ? __pfx_netlink_unicast+0x10/0x10
[  122.310333][ T9523]  ? netlink_sendmsg+0x642/0xb30
[  122.310349][ T9523]  ? skb_put+0x11b/0x210
[  122.310366][ T9523]  netlink_sendmsg+0x805/0xb30
[  122.310384][ T9523]  ? __pfx_netlink_sendmsg+0x10/0x10
[  122.310401][ T9523]  ? aa_sock_msg_perm+0xf1/0x1d0
[  122.310418][ T9523]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  122.310431][ T9523]  ? __pfx_netlink_sendmsg+0x10/0x10
[  122.310447][ T9523]  __sock_sendmsg+0x21c/0x270
[  122.310460][ T9523]  ____sys_sendmsg+0x505/0x830
[  122.310479][ T9523]  ? __pfx_____sys_sendmsg+0x10/0x10
[  122.310499][ T9523]  ? import_iovec+0x74/0xa0
[  122.310511][ T9523]  ___sys_sendmsg+0x21f/0x2a0
[  122.310529][ T9523]  ? __pfx____sys_sendmsg+0x10/0x10
[  122.310556][ T9523]  ? __fget_files+0x2a/0x420
[  122.310574][ T9523]  ? __fget_files+0x3a0/0x420
[  122.310594][ T9523]  __x64_sys_sendmsg+0x19b/0x260
[  122.310612][ T9523]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  122.310633][ T9523]  ? rcu_is_watching+0x15/0xb0
[  122.310646][ T9523]  ? do_syscall_64+0xbe/0x3b0
[  122.310664][ T9523]  do_syscall_64+0xfa/0x3b0
[  122.310679][ T9523]  ? lockdep_hardirqs_on+0x9c/0x150
[  122.310693][ T9523]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  122.310705][ T9523]  ? exc_page_fault+0x9f/0xf0
[  122.310719][ T9523]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  122.310732][ T9523] RIP: 0033:0x7f11b1b8ebe9
[  122.310744][ T9523] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  122.310755][ T9523] RSP: 002b:00007f11afdf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  122.310770][ T9523] RAX: ffffffffffffffda RBX: 00007f11b1db5fa0 RCX: 00007f11b1b8ebe9
[  122.310779][ T9523] RDX: 0000000000000804 RSI: 0000200000000100 RDI: 0000000000000004
[  122.310788][ T9523] RBP: 00007f11b1c11e19 R08: 0000000000000000 R09: 0000000000000000
[  122.310796][ T9523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  122.310805][ T9523] R13: 00007f11b1db6038 R14: 00007f11b1db5fa0 R15: 00007ffc1b2e0ee8
[  122.310819][ T9523]  </TASK>
[  122.310824][ T9523] 
[  122.468421][ T9523] Allocated by task 7549:
[  122.470163][ T9523]  kasan_save_track+0x3e/0x80
[  122.472159][ T9523]  __kasan_slab_alloc+0x6c/0x80
[  122.474271][ T9523]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  122.476665][ T9523]  xfrm_state_alloc+0x24/0x2f0
[  122.478835][ T9523]  __find_acq_core+0x8a7/0x1c00
[  122.480954][ T9523]  xfrm_find_acq+0x78/0xa0
[  122.482910][ T9523]  xfrm_alloc_userspi+0x6b3/0xc90
[  122.485070][ T9523]  xfrm_user_rcv_msg+0x7a3/0xab0
[  122.487256][ T9523]  netlink_rcv_skb+0x208/0x470
[  122.489289][ T9523]  xfrm_netlink_rcv+0x79/0x90
[  122.491303][ T9523]  netlink_unicast+0x82f/0x9e0
[  122.493445][ T9523]  netlink_sendmsg+0x805/0xb30
[  122.495602][ T9523]  __sock_sendmsg+0x21c/0x270
[  122.497641][ T9523]  ____sys_sendmsg+0x505/0x830
[  122.499735][ T9523]  ___sys_sendmsg+0x21f/0x2a0
[  122.501827][ T9523]  __x64_sys_sendmsg+0x19b/0x260
[  122.503959][ T9523]  do_syscall_64+0xfa/0x3b0
[  122.505952][ T9523]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  122.508490][ T9523] 
[  122.509559][ T9523] Freed by task 792:
[  122.511301][ T9523]  kasan_save_track+0x3e/0x80
[  122.513441][ T9523]  kasan_save_free_info+0x46/0x50
[  122.515663][ T9523]  __kasan_slab_free+0x5b/0x80
[  122.517757][ T9523]  kmem_cache_free+0x18f/0x400
[  122.519821][ T9523]  xfrm_state_gc_task+0x52d/0x6b0
[  122.521960][ T9523]  process_scheduled_works+0xae1/0x17b0
[  122.524356][ T9523]  worker_thread+0x8a0/0xda0
[  122.526377][ T9523]  kthread+0x711/0x8a0
[  122.528134][ T9523]  ret_from_fork+0x3fc/0x770
[  122.530145][ T9523]  ret_from_fork_asm+0x1a/0x30
[  122.532253][ T9523] 
[  122.533257][ T9523] The buggy address belongs to the object at ffff8880365b4480
[  122.533257][ T9523]  which belongs to the cache xfrm_state of size 928
[  122.538905][ T9523] The buggy address is located 322 bytes inside of
[  122.538905][ T9523]  freed 928-byte region [ffff8880365b4480, ffff8880365b4820)
[  122.544775][ T9523] 
[  122.545764][ T9523] The buggy address belongs to the physical page:
[  122.548456][ T9523] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880365b5b00 pfn:0x365b4
[  122.552547][ T9523] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  122.556036][ T9523] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  122.559017][ T9523] page_type: f5(slab)
[  122.560659][ T9523] raw: 00fff00000000040 ffff88801c3b5b40 dead000000000122 0000000000000000
[  122.563583][ T9523] raw: ffff8880365b5b00 00000000800e000b 00000000f5000000 0000000000000000
[  122.566350][ T9523] head: 00fff00000000040 ffff88801c3b5b40 dead000000000122 0000000000000000
[  122.569707][ T9523] head: ffff8880365b5b00 00000000800e000b 00000000f5000000 0000000000000000
[  122.573162][ T9523] head: 00fff00000000002 ffffea0000d96d01 00000000ffffffff 00000000ffffffff
[  122.576810][ T9523] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  122.580415][ T9523] page dumped because: kasan: bad access detected
[  122.583068][ T9523] page_owner tracks the page as allocated
[  122.585450][ T9523] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6089, tgid 6088 (syz.1.75), ts 67818732324, free_ts 67817691411
[  122.593236][ T9523]  post_alloc_hook+0x240/0x2a0
[  122.595265][ T9523]  get_page_from_freelist+0x21e4/0x22c0
[  122.597465][ T9523]  __alloc_frozen_pages_noprof+0x181/0x370
[  122.599815][ T9523]  alloc_pages_mpol+0x232/0x4a0
[  122.601849][ T9523]  allocate_slab+0x8a/0x370
[  122.603758][ T9523]  ___slab_alloc+0xbeb/0x1410
[  122.605680][ T9523]  kmem_cache_alloc_noprof+0x283/0x3c0
[  122.607939][ T9523]  xfrm_state_alloc+0x24/0x2f0
[  122.609955][ T9523]  xfrm_add_sa+0x17d1/0x4070
[  122.611946][ T9523]  xfrm_user_rcv_msg+0x7a3/0xab0
[  122.614108][ T9523]  netlink_rcv_skb+0x208/0x470
[  122.616192][ T9523]  xfrm_netlink_rcv+0x79/0x90
[  122.618215][ T9523]  netlink_unicast+0x82f/0x9e0
[  122.620281][ T9523]  netlink_sendmsg+0x805/0xb30
[  122.622329][ T9523]  __sock_sendmsg+0x21c/0x270
[  122.624358][ T9523]  ____sys_sendmsg+0x505/0x830
[  122.626420][ T9523] page last free pid 6107 tgid 6106 stack trace:
[  122.629107][ T9523]  __free_frozen_pages+0xbc4/0xd30
[  122.631285][ T9523]  stack_depot_save_flags+0x436/0x860
[  122.633456][ T9523]  kasan_save_track+0x4f/0x80
[  122.635475][ T9523]  __kasan_kmalloc+0x93/0xb0
[  122.637541][ T9523]  __kmalloc_node_track_caller_noprof+0x271/0x4e0
[  122.640106][ T9523]  kstrdup+0x42/0x100
[  122.641397][ T9523]  __request_module+0x2d1/0x5e0
[  122.642960][ T9523]  dev_load+0x190/0x1f0
[  122.644383][ T9523]  dev_ioctl+0x837/0x1150
[  122.645824][ T9523]  sock_ioctl+0x719/0x790
[  122.647269][ T9523]  __se_sys_ioctl+0xfc/0x170
[  122.649165][ T9523]  do_syscall_64+0xfa/0x3b0
[  122.651125][ T9523]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  122.653650][ T9523] 
[  122.654781][ T9523] Memory state around the buggy address:
[  122.657287][ T9523]  ffff8880365b4480: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  122.660609][ T9523]  ffff8880365b4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  122.664065][ T9523] >ffff8880365b4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  122.667526][ T9523]                                            ^
[  122.670156][ T9523]  ffff8880365b4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  122.673501][ T9523]  ffff8880365b4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  122.676961][ T9523] ==================================================================
[  122.680400][ T9523] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  122.683340][ T9523] CPU: 0 UID: 0 PID: 9523 Comm: syz.0.1546 Not tainted 6.16.0-syzkaller-12084-g33caa208dba6-dirty #0 PREEMPT(full) 
[  122.688269][ T9523] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  122.692539][ T9523] Call Trace:
[  122.693934][ T9523]  <TASK>
[  122.695208][ T9523]  dump_stack_lvl+0x99/0x250
[  122.697185][ T9523]  ? __asan_memcpy+0x40/0x70
[  122.699157][ T9523]  ? __pfx_dump_stack_lvl+0x10/0x10
[  122.701391][ T9523]  ? __pfx__printk+0x10/0x10
[  122.703346][ T9523]  vpanic+0x281/0x750
[  122.705016][ T9523]  ? __pfx_vpanic+0x10/0x10
[  122.706989][ T9523]  ? irqentry_exit+0x74/0x90
[  122.708933][ T9523]  panic+0xb9/0xc0
[  122.710568][ T9523]  ? __pfx_panic+0x10/0x10
[  122.712523][ T9523]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  122.715094][ T9523]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  122.717602][ T9523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  122.719811][ T9523]  check_panic_on_warn+0x89/0xb0
[  122.721969][ T9523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  122.724347][ T9523]  end_report+0x78/0x160
[  122.726221][ T9523]  kasan_report+0x129/0x150
[  122.728185][ T9523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  122.730435][ T9523]  __xfrm_state_lookup+0x6ad/0x8d0
[  122.732618][ T9523]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  122.735030][ T9523]  xfrm_state_add+0x27d/0xc40
[  122.737111][ T9523]  xfrm_add_sa+0x35a1/0x4070
[  122.739115][ T9523]  ? __pfx_xfrm_add_sa+0x10/0x10
[  122.741261][ T9523]  ? apparmor_capable+0x137/0x1b0
[  122.743458][ T9523]  ? __nla_parse+0x40/0x60
[  122.745416][ T9523]  xfrm_user_rcv_msg+0x7a3/0xab0
[  122.747576][ T9523]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  122.750010][ T9523]  ? __pfx___mutex_trylock_common+0x10/0x10
[  122.752572][ T9523]  ? rcu_is_watching+0x15/0xb0
[  122.754488][ T9523]  ? trace_contention_end+0x39/0x120
[  122.756755][ T9523]  ? __mutex_lock+0x335/0x1360
[  122.758817][ T9523]  netlink_rcv_skb+0x208/0x470
[  122.760897][ T9523]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  122.763252][ T9523]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  122.765504][ T9523]  ? netlink_deliver_tap+0x2e/0x1b0
[  122.767732][ T9523]  ? netlink_deliver_tap+0x2e/0x1b0
[  122.769975][ T9523]  xfrm_netlink_rcv+0x79/0x90
[  122.772013][ T9523]  netlink_unicast+0x82f/0x9e0
[  122.774104][ T9523]  ? __pfx_netlink_unicast+0x10/0x10
[  122.776302][ T9523]  ? netlink_sendmsg+0x642/0xb30
[  122.778388][ T9523]  ? skb_put+0x11b/0x210
[  122.780252][ T9523]  netlink_sendmsg+0x805/0xb30
[  122.782344][ T9523]  ? __pfx_netlink_sendmsg+0x10/0x10
[  122.784583][ T9523]  ? aa_sock_msg_perm+0xf1/0x1d0
[  122.786723][ T9523]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  122.789107][ T9523]  ? __pfx_netlink_sendmsg+0x10/0x10
[  122.791458][ T9523]  __sock_sendmsg+0x21c/0x270
[  122.793496][ T9523]  ____sys_sendmsg+0x505/0x830
[  122.795596][ T9523]  ? __pfx_____sys_sendmsg+0x10/0x10
[  122.797845][ T9523]  ? import_iovec+0x74/0xa0
[  122.799824][ T9523]  ___sys_sendmsg+0x21f/0x2a0
[  122.801821][ T9523]  ? __pfx____sys_sendmsg+0x10/0x10
[  122.803789][ T9523]  ? __fget_files+0x2a/0x420
[  122.805484][ T9523]  ? __fget_files+0x3a0/0x420
[  122.807450][ T9523]  __x64_sys_sendmsg+0x19b/0x260
[  122.809531][ T9523]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  122.811418][ T9523]  ? rcu_is_watching+0x15/0xb0
[  122.813090][ T9523]  ? do_syscall_64+0xbe/0x3b0
[  122.814745][ T9523]  do_syscall_64+0xfa/0x3b0
[  122.816334][ T9523]  ? lockdep_hardirqs_on+0x9c/0x150
[  122.818236][ T9523]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  122.820528][ T9523]  ? exc_page_fault+0x9f/0xf0
[  122.822147][ T9523]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  122.824565][ T9523] RIP: 0033:0x7f11b1b8ebe9
[  122.826294][ T9523] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  122.833126][ T9523] RSP: 002b:00007f11afdf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  122.835990][ T9523] RAX: ffffffffffffffda RBX: 00007f11b1db5fa0 RCX: 00007f11b1b8ebe9
[  122.838709][ T9523] RDX: 0000000000000804 RSI: 0000200000000100 RDI: 0000000000000004
[  122.841505][ T9523] RBP: 00007f11b1c11e19 R08: 0000000000000000 R09: 0000000000000000
[  122.844575][ T9523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  122.847473][ T9523] R13: 00007f11b1db6038 R14: 00007f11b1db5fa0 R15: 00007ffc1b2e0ee8
[  122.850279][ T9523]  </TASK>
[  122.852027][ T9523] Kernel Offset: disabled
[  122.853488][ T9523] Rebooting in 86400 seconds..

VM DIAGNOSIS:
09:28:50  Registers:
info registers vcpu 0

CPU#0
RAX=000000000000006f RBX=000000000000006f RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000001953 RDI=0000000000001954 RBP=00000000000003f8 RSP=ffffc90007b069d0
R8 =ffff888020e20237 R9 =1ffff110041c4046 R10=dffffc0000000000 R11=ffffffff854e71d0
R12=dffffc0000000000 R13=ffffffff99af48dd R14=ffffffff99de94e0 R15=0000000000000000
RIP=ffffffff854e724c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f11afdf66c0 ffffffff 00c00000
GS =0000 ffff8880b8621000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000100 CR3=00000000262e2000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f11b1d87498 00007f11b1d87470 XMM03=00007f11b1d874a8 00007f11b1d874a0
XMM04=00007f11b28ed100 00007f11b1d87460 XMM05=00007f11b1d87478 00007f11b1d874c0
XMM06=00007f11b1d874b8 00007f11b1d874b0 XMM07=00007f11b1d874a8 00007f11b1d874a0
XMM08=0000000000000000 00007f11b1c12ee7 XMM09=0000000000000000 00007f11b1c12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff89568b01 RBX=dffffc0000000001 RCX=ffffffff89568b59 RDX=0000000000000001
RSI=0000000000000030 RDI=ffffc90008137580 RBP=0000000000000000 RSP=ffffc90008137468
R8 =ffffc900081375af R9 =1ffff92001026eb5 R10=dffffc0000000000 R11=fffff52001026eb0
R12=fffff52001026eb6 R13=0000000000000800 R14=fffff52001026eb6 R15=1ffff92001026eb0
RIP=ffffffff8222fe40 RFL=00000a03 [-O----C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f17bf25c6c0 ffffffff 00c00000
GS =0000 ffff8881a3c21000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00002000001ad030 CR3=00000001094d6000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000010915 00000000000009bf XMM03=0000000000009ade 0000000000000095
XMM04=00000000000000b7 0000000500000085 XMM05=0000000000000856 0000000000009ade
XMM06=0000000000000095 0000000000010915 XMM07=00000000000009bf 0000000500000085
XMM08=5f7265705f736574 6174735f78616d20 XMM09=0000000000000000 00007f17be412fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
