last executing test programs:

1.72679711s ago: executing program 2 (id=317):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in=@dev={0xac, 0x14, 0x14, 0x42}, 0x0, 0x0, 0x0, 0x8000, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xff}}, [@tmpl={0x144, 0x5, [{{@in6=@mcast1, 0x4d2, 0x33}, 0xa, @in6=@empty, 0x3501, 0x1, 0x0, 0x3b, 0x83, 0x5, 0x7}, {{@in6=@local, 0x4d6, 0x3c}, 0xa, @in=@remote, 0x3502, 0x2, 0x0, 0x7, 0x7f, 0x0, 0x4}, {{@in=@multicast1, 0x4d5, 0x6c}, 0x2, @in6=@empty, 0x0, 0x4, 0x3, 0x3, 0x4, 0x2, 0x3}, {{@in6=@private0, 0x4d3, 0x2b}, 0x2, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x0, 0x0, 0x2, 0xfffffffa, 0x401, 0x81}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d3, 0x2b}, 0x0, @in=@private=0xa010100, 0x3502, 0x5, 0x0, 0xd1, 0xe, 0x47b, 0x3}]}]}, 0x1fc}}, 0x4000)

1.661723051s ago: executing program 2 (id=318):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newtaction={0x74, 0x30, 0xcac229faa96ee7df, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ife={0x5c, 0x1, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{}, 0x1}}, @TCA_IFE_DMAC={0xa, 0x3, @dev}, @TCA_IFE_TYPE={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}, 0x1, 0x500}, 0x0)

1.580086866s ago: executing program 2 (id=322):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000400)={0xa, 0x2, 0x13, @loopback, 0x9}, 0x1c)
setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000080)=0xfffffffe, 0x4)
sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c)

649.460571ms ago: executing program 2 (id=346):
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newsa={0xf0, 0x10, 0x713, 0x70bd28, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@local, 0x4e23, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3a}, {@in6=@remote, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {0x0, 0x0, 0x8, 0x100000001, 0x6}, {0x0, 0x0, 0x2, 0xfffffffffffffffc}, {0xc}, 0x70bd28, 0x0, 0x2}}, 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x3, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0)
sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x68, 0x0, 0x1, 0x0, 0x0, {{}, {0x0, 0x410c}, {0x4c, 0x14, {0xffffffee, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0)

528.037236ms ago: executing program 2 (id=351):
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000005, 0x3032, 0xffffffffffffffff, 0x0)
r0 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendmsg$rds(r0, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0x0, @private=0xa010100}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000000300)=[{&(0x7f0000002640)=""/102389, 0x18ff5}], 0x1, 0x1903d}}], 0x48}, 0x0)

468.739911ms ago: executing program 2 (id=355):
bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x4101}, 0x10)
r0 = socket$rds(0x15, 0x5, 0x0)
ppoll(&(0x7f00000001c0)=[{r0}, {r0, 0x6b3f7e8c4e6d7001}], 0x2, 0x0, 0x0, 0x0)
bind$rds(r0, &(0x7f0000000100)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10)
sendmsg$rds(r0, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x4e22, @private=0xa010101}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40a0}, 0x0)
setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000ec0)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10)
r1 = socket$inet6(0xa, 0x3, 0x7)
r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0)=r2, 0x4)
bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0)
sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
r3 = socket$igmp6(0xa, 0x3, 0x2)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488)
syz_extract_tcp_res(0x0, 0x7fff, 0x8)

420.14573ms ago: executing program 0 (id=357):
r0 = socket(0x80000000000000a, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @empty, 0x4}}}, 0x108)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000480)={0x6, {{0xa, 0x0, 0x3, @mcast2}}, {{0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x181}}}, 0x108)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0xa4ffffff, @rand_addr=' \x01\x00'}}}, 0x15a)

358.4724ms ago: executing program 0 (id=359):
socket(0x10, 0x80002, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x800, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x400}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x68, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xf}, {}, {0xf, 0x4}}, [@filter_kind_options=@f_basic={{0xa}, {0x38, 0x2, [@TCA_BASIC_ACT={0x34, 0x3, [@m_mirred={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x0)

285.82711ms ago: executing program 1 (id=360):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000000200000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_smc(0x2b, 0x1, 0x0)
socket$kcm(0x21, 0x2, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000838500000070000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
pipe(&(0x7f0000000040)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, r3, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
socket$can_raw(0x1d, 0x3, 0x1)
socket$can_raw(0x1d, 0x3, 0x1)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$cgroup_int(r4, &(0x7f0000000080)='cgroup.max.descendants\x00', 0x2, 0x0)
socket$packet(0x11, 0x2, 0x300)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20040000)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
r7 = accept4$packet(r3, 0x0, 0x0, 0x80800)
setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000280)={0x0, 0x1, 0x6}, 0x10)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001700)={r1, 0x0, 0x0}, 0x10)
sendmsg$nl_route(r2, 0x0, 0x8891)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6], 0x90}}, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r0, 0x2000000, 0x0, 0x0, &(0x7f0000000c40), 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r9 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0)

221.10233ms ago: executing program 0 (id=361):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="aa8e0cf56164be5b", 0x8)

189.527598ms ago: executing program 1 (id=362):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETSET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000000a0a03000000000000000000010000060900020073790c96000000000900010073797a30"], 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x24002840)

140.336836ms ago: executing program 0 (id=363):
r0 = socket(0x10, 0x2, 0x6)
sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)

140.072341ms ago: executing program 1 (id=364):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff)
sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000780)={0x30, r1, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PEERS={0x8, 0x8, 0x0, 0x1, [{0x4}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010)

61.011103ms ago: executing program 1 (id=365):
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, 0x0, 0xff03)

60.856331ms ago: executing program 0 (id=366):
socket$l2tp(0x2, 0x2, 0x73)
r0 = socket$l2tp(0x2, 0x2, 0x73)
close(r0)

60.611757ms ago: executing program 1 (id=367):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000f00)=ANY=[@ANYBLOB="b702000002000000bfa30000000000000703000000feffff7a0af0fff8bffffd79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000081007d60b7030000000000006a0a00fefdff0000850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465c3a1f59916ffc9bf0bd09279c362f80e5cf8df265e1b40e4c8ae7a89cf8bd819b5c0c000000008da68076774bb4db2c769937000090af27db5b56024dcbbbd2cb2000ce94284673b4e8d5467e357754508535766c801100000000b290a248a120c9c6e39f3052aae80677eeba68562eaeaea5fecf298ca20f274233106e2baf69b1c60f0ce4099f366b89ab63ecf772de7b265040b6b1acbef92b2704550a4d1dd5c50b7420b58a93fe94c756008afcd0b2eb785632e0a85f02a5a6474ae549070000000000001294fba0ed5020e6477cc921fee1f6d8ad6a80d0947cd6d4a561ced23b0b4a902be6af7ec2d1ba000057f301000000000000000000000000100000aaf253886c0b9f6d4731d714ad72e5ad8530a6380ed2d29f47f96a576cd20cef7ed95157ab050000f0077e9d13d8b93eb0f2c6f8941e35e1577c10e509c9b133c849eb709df5c6ba73cccdfa3c58bc5204339b0b487f0eeed581cb202900000d322717c338033213c18a34ee0ca2cf61efb4b3797a642735d6d482ba98d252f36c54333aab1aa736369392239820f5f1557b0bf7ccb0a5a13c714e0b1a5bc3f9caff3283076cda3d0b1a2905cf7bd04f2db530abcbe44bc40528ad807970727fb819afa14aad99f93093ced7dd51995edcf53b907228fa9e83433eedb4ac88d0285594ffb0d14e71d5c57f33702f22b22417bfb38d04c8441ceec8bcaffbe800aa41307bd8325a76f395bc9a8b0c9d905979f34adddb521914f92eed3d3e9de82942a952e86bd67aff5bc2e3c1fcc00f61124dd06df4b8fd356cb365adc037e443820c05c5db160087a9cf471e0eff227f25b2c5cacebfcd55f8c81f5eb1f8d615ca27efb2193bb61665b8ce37f30c2efc9c3b5a4a5d95479fac471ba60fbd0e50223517a07a3484124c5563cd3700000000001825b05a580ea8cb7f85b77b35a06a895b287b47efbe220bc215aca4a65d7018a7f91c4228b35f71a7c183360ab7a7b6b7870086d851ff861ee07bbec801b79afa477ebab255c7265820456fdc3f34f9d729315d856be7ec564613d5e28cf7c405d6e2b6aeb20000b8505a36a8067cb459fab87c8de118117733d30f4fe049658a2c3edd43546ead9c7882858868cff89a49a693731140db1b7b7116060c30690a39de8b3e0eb4f5401e8354870848c546f9defe1a9c534c9030830fec3eeb5faf1d64bb8e80000000f6ff0000000000000055d843352632b829ceb5200a2cdeb63c0bc7e835e061f9ac3c052b5b6f689bf203aeb8858be07691bc83e178181fab55e6ed9e8a17819de49564d0f0c00dd507441b80cd499c39c5d03d6c00cf5be5215bae09a4f52abf8f1c1add498470a0bb9d7ab757a8b28e4accc939b3621e4c2c9e02741c51eeeaad40cf2e1c3659d83ed71fc628807739d70edda93542445e3204828c49bef648efdc2208341357dd158f411d379df9b1feffbe7c7ee80558a040fa3d5a303f36d5c1a66d9644fc0559aa0e291355ee3de6c7a705b8f7b45bb825044b9a82a6fd2f6eeb14eee0c3f71eeea9984e14c57022ef72850b6dc5fda167d6f98f6c1c73feb424b7937e3c7ca0d2525efbdac50eb94797cf3747b83b56cfea8c74dd3f957dc462e715b789934b422b7ddf3e11a6ad6ad9afd5389c728d14"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3f, 0x10, &(0x7f0000000000), 0x2ca}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="b90703600000f007049e0ff08847", 0x0, 0x104, 0xa000000, 0xc1, 0x0, &(0x7f0000000640)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e6955a796ff8e3aae3cac46cec3030dfc999058aea02f0e6dcf2f9d480d328655aca003927bd50ed49d4843c8a0a2a4b26ceb747947200bd644c85e7a8a7d7cfce840c02a7d69c9e0bca410f64d43290abbbf3131e1fa8bd8c3e5f19d5a491d3d4c1a0fe47de9eebaf073ac3da6256bdb681d18fbd607c9b0d710442bcf78bc36fd3c035812bde582a262bff0e4d6181c818fccf542868c6e602d97bea23a101955dc76bcc984142ab30", 0x0}, 0x50)

311.004µs ago: executing program 0 (id=368):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180000008000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000c44185000000040000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200000a000000b703000000000000850000007500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sys_enter\x00', r0}, 0x10)
syz_init_net_socket$bt_rfcomm(0x1f, 0x0, 0x3)

0s ago: executing program 1 (id=369):
r0 = socket(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x68, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x2, 0x0, 0x0, 0x7, 0x8}, {0x12, 0x1, 0x0, 0x1, 0x8001, 0x400}, 0xa5, 0x4, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}, @TCA_TBF_PBURST={0x8, 0x7, 0x75d}]}}]}, 0x68}}, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', <r4=>0x0})
r5 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000002340)=@newqdisc={0x38, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xfff2, 0xa}, {0x2}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_ALPHA={0x8, 0x4, 0x4}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80c0}, 0x4000)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:15965' (ED25519) to the list of known hosts.
syzkaller login: [   55.938075][ T5800] cgroup: Unknown subsys name 'net'
[   56.029056][ T5800] cgroup: Unknown subsys name 'cpuset'
[   56.034188][ T5800] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   57.539935][ T5800] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   62.072654][ T5817] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   62.077015][ T5817] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   62.080469][ T5817] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   62.083652][ T5817] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   62.086999][ T5817] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   62.108562][ T5817] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   62.113055][ T5817] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   62.116462][ T5817] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   62.120442][ T5817] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   62.123622][ T5817] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   62.158043][ T5817] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   62.161124][ T5817] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   62.164011][ T5817] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   62.167218][ T5817] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   62.169919][ T5817] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   62.411797][ T5818] chnl_net:caif_netlink_parms(): no params data found
[   62.452165][ T5814] chnl_net:caif_netlink_parms(): no params data found
[   62.493316][ T5822] chnl_net:caif_netlink_parms(): no params data found
[   62.548052][ T5818] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.551364][ T5818] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.555872][ T5818] bridge_slave_0: entered allmulticast mode
[   62.560007][ T5818] bridge_slave_0: entered promiscuous mode
[   62.580467][ T5818] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.583395][ T5818] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.586312][ T5818] bridge_slave_1: entered allmulticast mode
[   62.589850][ T5818] bridge_slave_1: entered promiscuous mode
[   62.651305][ T5814] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.654794][ T5814] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.658133][ T5814] bridge_slave_0: entered allmulticast mode
[   62.662183][ T5814] bridge_slave_0: entered promiscuous mode
[   62.703369][ T5814] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.706531][ T5814] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.708978][ T5814] bridge_slave_1: entered allmulticast mode
[   62.711895][ T5814] bridge_slave_1: entered promiscuous mode
[   62.727159][ T5818] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.731446][ T5822] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.735313][ T5822] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.738581][ T5822] bridge_slave_0: entered allmulticast mode
[   62.742551][ T5822] bridge_slave_0: entered promiscuous mode
[   62.757589][ T5818] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   62.761438][ T5822] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.765058][ T5822] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.768457][ T5822] bridge_slave_1: entered allmulticast mode
[   62.772397][ T5822] bridge_slave_1: entered promiscuous mode
[   62.779503][ T5814] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.823380][ T5814] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   62.833038][ T5818] team0: Port device team_slave_0 added
[   62.875027][ T5818] team0: Port device team_slave_1 added
[   62.879858][ T5822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   62.895631][ T5814] team0: Port device team_slave_0 added
[   62.900459][ T5822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   62.919997][ T5814] team0: Port device team_slave_1 added
[   62.923247][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_0
[   62.926435][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.936610][ T5818] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   62.968182][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_1
[   62.971102][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   62.982544][ T5818] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.042730][ T5822] team0: Port device team_slave_0 added
[   63.046518][ T5814] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.048845][ T5814] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.058959][ T5814] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.073563][ T5822] team0: Port device team_slave_1 added
[   63.091527][ T5814] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.095314][ T5814] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.105742][ T5814] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.118392][ T5818] hsr_slave_0: entered promiscuous mode
[   63.121908][ T5818] hsr_slave_1: entered promiscuous mode
[   63.139176][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.141849][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.152359][ T5822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.180137][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.183210][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.195038][ T5822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.247069][ T5814] hsr_slave_0: entered promiscuous mode
[   63.250368][ T5814] hsr_slave_1: entered promiscuous mode
[   63.253417][ T5814] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   63.256652][ T5814] Cannot create hsr debugfs directory
[   63.345228][ T5822] hsr_slave_0: entered promiscuous mode
[   63.348668][ T5822] hsr_slave_1: entered promiscuous mode
[   63.351817][ T5822] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   63.357603][ T5822] Cannot create hsr debugfs directory
[   63.633226][ T5818] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   63.661596][ T5818] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   63.670655][ T5818] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   63.688898][ T5818] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   63.730998][ T5814] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   63.748125][ T5814] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   63.755574][ T5814] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   63.788223][ T5814] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   63.831230][ T5822] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   63.837991][ T5822] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   63.846964][ T5822] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   63.856312][ T5822] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   63.971753][ T5818] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.012458][ T5818] 8021q: adding VLAN 0 to HW filter on device team0
[   64.030928][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.034180][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.051584][ T5822] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.058434][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.061492][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.079447][ T5814] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.103965][ T5822] 8021q: adding VLAN 0 to HW filter on device team0
[   64.125867][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.129512][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.147460][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.150437][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.156177][   T55] Bluetooth: hci0: command tx timeout
[   64.167875][   T55] Bluetooth: hci1: command tx timeout
[   64.181754][ T5814] 8021q: adding VLAN 0 to HW filter on device team0
[   64.207653][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.210099][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.226576][ T4383] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.229031][ T4383] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.235907][   T55] Bluetooth: hci2: command tx timeout
[   64.383650][ T5818] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.493567][ T5818] veth0_vlan: entered promiscuous mode
[   64.518135][ T5818] veth1_vlan: entered promiscuous mode
[   64.527313][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.546882][ T5814] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.599415][ T5818] veth0_macvtap: entered promiscuous mode
[   64.610882][ T5818] veth1_macvtap: entered promiscuous mode
[   64.624163][ T5822] veth0_vlan: entered promiscuous mode
[   64.629766][ T5814] veth0_vlan: entered promiscuous mode
[   64.640555][ T5822] veth1_vlan: entered promiscuous mode
[   64.650196][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.662065][ T5814] veth1_vlan: entered promiscuous mode
[   64.669614][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.692178][ T5822] veth0_macvtap: entered promiscuous mode
[   64.697406][ T5818] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.700833][ T5818] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.703881][ T5818] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.708384][ T5818] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.721620][ T5822] veth1_macvtap: entered promiscuous mode
[   64.757015][ T5814] veth0_macvtap: entered promiscuous mode
[   64.766735][ T5814] veth1_macvtap: entered promiscuous mode
[   64.795619][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.807063][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.842855][ T5814] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.847992][ T5822] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.851764][ T5822] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.857664][ T5822] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.861038][ T5822] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.879910][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.883397][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   64.883413][ T5814] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.912381][ T5814] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.918539][ T5814] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.921906][ T5814] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.927766][ T5814] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.959016][ T4456] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   64.962155][ T4456] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.022600][ T4456] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.028645][ T4456] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.050617][ T5818] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   65.076368][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.084747][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.123366][   T32] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.140451][   T32] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.212501][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.220686][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.284202][ T5888] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1'.
[   65.652393][ T5904] netlink: 260 bytes leftover after parsing attributes in process `syz.1.12'.
[   65.657801][ T5904] netlink: 260 bytes leftover after parsing attributes in process `syz.1.12'.
[   65.687204][ T5883] infiniband syz0: set active
[   65.689585][ T5883] infiniband syz0: added batadv_slave_1
[   65.755936][ T5883] RDS/IB: syz0: added
[   65.758168][ T5883] smc: adding ib device syz0 with port count 1
[   65.760967][ T5883] smc:    ib device syz0 port 1 has pnetid 
[   65.901908][ T5913] netlink: 65051 bytes leftover after parsing attributes in process `syz.2.17'.
[   66.057890][ T5920] Zero length message leads to an empty skb
[   66.125010][ T5923] nbd: must specify at least one socket
[   66.247657][   T55] Bluetooth: hci1: command tx timeout
[   66.247772][ T5817] Bluetooth: hci0: command tx timeout
[   66.317668][ T5817] Bluetooth: hci2: command tx timeout
[   66.413818][ T5941] netlink: 50 bytes leftover after parsing attributes in process `syz.2.30'.
[   66.517706][ T5945] netlink: 'syz.2.32': attribute type 1 has an invalid length.
[   66.866753][ T5967] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.40'.
[   67.099633][ T5976] unsupported nlmsg_type 40
[   67.387185][ T5990] netlink: 12 bytes leftover after parsing attributes in process `syz.1.52'.
[   67.560364][ T5996] netlink: 20 bytes leftover after parsing attributes in process `syz.0.55'.
[   67.714229][ T6005] pim6reg1: entered promiscuous mode
[   67.716197][ T6005] pim6reg1: entered allmulticast mode
[   67.847264][ T6010] netlink: 8 bytes leftover after parsing attributes in process `syz.1.61'.
[   67.856085][ T6011] netlink: 32 bytes leftover after parsing attributes in process `syz.0.59'.
[   67.960561][ T6009] 8021q: adding VLAN 0 to HW filter on device bond1
[   67.986150][ T6009] team0: Port device bond1 added
[   68.226450][ T6034] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   68.315528][ T5817] Bluetooth: hci0: command tx timeout
[   68.317567][ T5817] Bluetooth: hci1: command tx timeout
[   68.380088][ T6044] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT
[   68.395082][ T5817] Bluetooth: hci2: command tx timeout
[   68.447780][ T6050] netlink: 'syz.0.78': attribute type 10 has an invalid length.
[   68.493261][ T6048] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[   68.513495][ T6047] (unnamed net_device) (uninitialized): Unable to set peer notification delay as MII monitoring is disabled
[   68.649610][ T6058] netlink: 'syz.1.82': attribute type 9 has an invalid length.
[   69.669092][ T6147] sctp: [Deprecated]: syz.2.117 (pid 6147) Use of int in maxseg socket option.
[   69.669092][ T6147] Use struct sctp_assoc_value instead
[   69.687897][ T6150] syz.0.114 uses obsolete (PF_INET,SOCK_PACKET)
[   69.824071][ T6153] xt_TPROXY: Can be used only with -p tcp or -p udp
[   69.940224][ T6161] netlink: 'syz.0.123': attribute type 29 has an invalid length.
[   69.947929][ T6161] netlink: 'syz.0.123': attribute type 29 has an invalid length.
[   70.021499][ T6164] xt_l2tp: v2 sid > 0xffff: 4294901760
[   70.086954][ T6169] Bluetooth: MGMT ver 1.23
[   70.396518][ T5817] Bluetooth: hci1: command tx timeout
[   70.397877][   T55] Bluetooth: hci0: command tx timeout
[   70.474674][   T55] Bluetooth: hci2: command tx timeout
[   70.781205][   T33] audit: type=1800 audit(1751548536.033:2): pid=6188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.137" name="cgroup.controllers" dev="tmpfs" ino=143 res=0 errno=0
[   71.019853][ T6227] warning: `syz.1.152' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   71.029064][ T6221] __nla_validate_parse: 6 callbacks suppressed
[   71.029086][ T6221] netlink: 16 bytes leftover after parsing attributes in process `syz.2.151'.
[   71.283303][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   71.287148][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   72.541624][ T6311] syzkaller1: tun_chr_ioctl cmd 1074025677
[   72.543897][ T6311] syzkaller1: linktype set to 270
[   72.598052][ T6313] netlink: 24 bytes leftover after parsing attributes in process `syz.2.182'.
[   72.786217][ T6324] netlink: 8 bytes leftover after parsing attributes in process `syz.2.187'.
[   73.034617][ T5817] Bluetooth: hci2: command 0x0405 tx timeout
[   73.212677][ T6336] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   73.250407][    T9] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01)
[   73.253468][    T9] wlan1: send auth to 08:02:11:00:00:00 (try 1/3)
[   73.273153][ T1088] wlan1: authenticated
[   73.275710][ T6336] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   73.285628][ T1088] wlan1: associate with 08:02:11:00:00:00 (try 1/3)
[   73.336538][   T27] wlan1: RX AssocResp from 08:02:11:00:00:00 (capab=0x1 status=0 aid=1)
[   73.340069][   T27] wlan1: associated
[   73.341821][ T6363] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   73.524162][ T6374] netlink: 'syz.0.208': attribute type 1 has an invalid length.
[   73.528174][ T6374] netlink: 144 bytes leftover after parsing attributes in process `syz.0.208'.
[   73.532449][ T6374] netlink: 'syz.0.208': attribute type 1 has an invalid length.
[   73.537061][ T6374] netlink: 76 bytes leftover after parsing attributes in process `syz.0.208'.
[   73.556648][ T6376] netlink: 10 bytes leftover after parsing attributes in process `syz.2.209'.
[   74.341181][ T6421] netlink: 'syz.0.228': attribute type 29 has an invalid length.
[   74.416479][ T6428] netlink: 8 bytes leftover after parsing attributes in process `syz.0.231'.
[   74.467807][ T6430] tipc: Started in network mode
[   74.469781][ T6430] tipc: Node identity 4, cluster identity 4711
[   74.474068][ T6430] tipc: Node number set to 4
[   74.821104][ T6446] netlink: 28 bytes leftover after parsing attributes in process `syz.0.240'.
[   74.827151][ T6446] netlink: 8 bytes leftover after parsing attributes in process `syz.0.240'.
[   74.951891][ T6454] netlink: 8 bytes leftover after parsing attributes in process `syz.2.244'.
[   75.921003][ T6515] netlink: 'syz.0.273': attribute type 1 has an invalid length.
[   76.112010][ T6523] __nla_validate_parse: 3 callbacks suppressed
[   76.112027][ T6523] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.278'.
[   76.199683][ T6527] netlink: 60 bytes leftover after parsing attributes in process `syz.2.279'.
[   76.218221][ T6527] netlink: 16 bytes leftover after parsing attributes in process `syz.2.279'.
[   76.238670][ T6529] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   76.909741][ T6569] syzkaller1: tun_chr_ioctl cmd 1074025677
[   76.912610][ T6569] syzkaller1: linktype set to 6
[   77.139669][ T6590] xt_l2tp: v2 tid > 0xffff: 4294967295
[   77.232297][ T6600] delete_channel: no stack
[   77.552577][ T6625] netlink: 136 bytes leftover after parsing attributes in process `syz.1.320'.
[   77.687711][ T6635] netlink: 8 bytes leftover after parsing attributes in process `syz.0.321'.
[   77.697834][ T6642] netlink: 12 bytes leftover after parsing attributes in process `syz.1.325'.
[   77.700835][ T6642] netlink: 16 bytes leftover after parsing attributes in process `syz.1.325'.
[   77.703791][ T6642] netlink: 12 bytes leftover after parsing attributes in process `syz.1.325'.
[   77.709458][ T6642] netlink: 16 bytes leftover after parsing attributes in process `syz.1.325'.
[   77.714943][ T6642] netlink: 5 bytes leftover after parsing attributes in process `syz.1.325'.
[   77.808304][ T6646] netlink: 'syz.0.327': attribute type 1 has an invalid length.
[   77.827898][ T6648] ip6t_REJECT: TCP_RESET illegal for non-tcp
[   77.835274][ T6646] nbd: socks must be embedded in a SOCK_ITEM attr
[   77.838298][ T6646] block nbd0: shutting down sockets
[   78.468854][ T6685] unknown channel width for channel at 909000KHz?
[   78.474257][ T6685] unknown channel width for channel at 909000KHz?
[   78.644485][ T5817] Bluetooth: hci2: command 0x0405 tx timeout
[   78.662276][ T6701] netlink: 'syz.0.350': attribute type 3 has an invalid length.
[   78.805890][ T6712] RDS: rds_bind could not find a transport for ::ffff:172.30.0.3, load rds_tcp or rds_rdma?
[   78.902252][ T6718] dummy0: entered promiscuous mode
[   78.918016][ T6718] team0: entered promiscuous mode
[   78.920924][ T6718] team_slave_0: entered promiscuous mode
[   78.923822][ T6718] team_slave_1: entered promiscuous mode
[   79.213410][ T6737] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000035: 0000 [#1] SMP KASAN PTI
[   79.218363][ T6737] KASAN: null-ptr-deref in range [0x00000000000001a8-0x00000000000001af]
[   79.222658][ T6737] CPU: 0 UID: 0 PID: 6737 Comm: syz.1.369 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[   79.227642][ T6737] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   79.231257][ T6737] RIP: 0010:htb_qlen_notify+0x31/0xc0
[   79.233368][ T6737] Code: 41 56 41 55 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 5d c6 46 f8 49 8d 9e a8 01 00 00 49 89 dd 49 c1 ed 03 <43> 0f b6 44 25 00 84 c0 75 4d 8b 2b 31 ff 89 ee e8 7a ca 46 f8 85
[   79.241203][ T6737] RSP: 0018:ffffc90008617090 EFLAGS: 00010206
[   79.243731][ T6737] RAX: ffffffff89798813 RBX: 00000000000001a8 RCX: 0000000000080000
[   79.247057][ T6737] RDX: ffffc90003d92000 RSI: 000000000000039c RDI: 000000000000039d
[   79.250322][ T6737] RBP: dffffc0000000000 R08: ffff8880200d5640 R09: 0000000000000002
[   79.253759][ T6737] R10: 00000000ffffffff R11: ffffffff897987f0 R12: dffffc0000000000
[   79.257093][ T6737] R13: 0000000000000035 R14: 0000000000000000 R15: ffff88810974e000
[   79.260402][ T6737] FS:  00007f28c95b46c0(0000) GS:ffff8880b8650000(0000) knlGS:0000000000000000
[   79.264118][ T6737] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   79.266988][ T6737] CR2: 0000200000002340 CR3: 0000000029b66000 CR4: 00000000000006f0
[   79.270535][ T6737] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   79.273834][ T6737] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   79.277183][ T6737] Call Trace:
[   79.278620][ T6737]  <TASK>
[   79.279921][ T6737]  qdisc_tree_reduce_backlog+0x29c/0x480
[   79.282317][ T6737]  ? qdisc_tree_reduce_backlog+0x3c/0x480
[   79.284755][ T6737]  pie_change+0x96d/0xca0
[   79.286650][ T6737]  ? _raw_spin_unlock_irqrestore+0x85/0x110
[   79.289136][ T6737]  ? lockdep_hardirqs_on+0x9c/0x150
[   79.291393][ T6737]  ? __pfx_pie_change+0x10/0x10
[   79.293298][ T6737]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   79.295762][ T6737]  ? timer_init_key+0x171/0x2d0
[   79.297872][ T6737]  ? __pfx_pie_init+0x10/0x10
[   79.299884][ T6737]  pie_init+0x2a3/0x3f0
[   79.301682][ T6737]  qdisc_create+0x7ac/0xea0
[   79.303581][ T6737]  tc_modify_qdisc+0x1426/0x2010
[   79.305719][ T6737]  ? __pfx_tc_modify_qdisc+0x10/0x10
[   79.307917][ T6737]  ? __pfx_tc_modify_qdisc+0x10/0x10
[   79.310076][ T6737]  rtnetlink_rcv_msg+0x77c/0xb70
[   79.312208][ T6737]  ? rtnetlink_rcv_msg+0x1ab/0xb70
[   79.314361][ T6737]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   79.316611][ T6737]  ? ref_tracker_free+0x63a/0x7d0
[   79.318614][ T6737]  ? __copy_skb_header+0xa7/0x550
[   79.320635][ T6737]  ? __pfx_ref_tracker_free+0x10/0x10
[   79.322832][ T6737]  ? __skb_clone+0x63/0x7a0
[   79.324758][ T6737]  netlink_rcv_skb+0x208/0x470
[   79.326828][ T6737]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   79.329108][ T6737]  ? __pfx_netlink_rcv_skb+0x10/0x10
[   79.331375][ T6737]  ? netlink_deliver_tap+0x2e/0x1b0
[   79.333608][ T6737]  ? netlink_deliver_tap+0x2e/0x1b0
[   79.335839][ T6737]  netlink_unicast+0x75b/0x8d0
[   79.337844][ T6737]  netlink_sendmsg+0x805/0xb30
[   79.339885][ T6737]  ? __pfx_netlink_sendmsg+0x10/0x10
[   79.342177][ T6737]  ? aa_sock_msg_perm+0x94/0x160
[   79.344357][ T6737]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   79.346681][ T6737]  ? __pfx_netlink_sendmsg+0x10/0x10
[   79.348942][ T6737]  __sock_sendmsg+0x21c/0x270
[   79.350991][ T6737]  ____sys_sendmsg+0x505/0x830
[   79.352942][ T6737]  ? __pfx_____sys_sendmsg+0x10/0x10
[   79.354676][ T6737]  ? import_iovec+0x74/0xa0
[   79.356171][ T6737]  ___sys_sendmsg+0x21f/0x2a0
[   79.357717][ T6737]  ? __pfx____sys_sendmsg+0x10/0x10
[   79.359828][ T6737]  ? __fget_files+0x2a/0x420
[   79.361776][ T6737]  ? __fget_files+0x3a0/0x420
[   79.363710][ T6737]  __x64_sys_sendmsg+0x19b/0x260
[   79.365804][ T6737]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   79.368082][ T6737]  ? rcu_is_watching+0x15/0xb0
[   79.370157][ T6737]  ? do_syscall_64+0xbe/0x3b0
[   79.372182][ T6737]  do_syscall_64+0xfa/0x3b0
[   79.374132][ T6737]  ? lockdep_hardirqs_on+0x9c/0x150
[   79.376307][ T6737]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   79.378864][ T6737]  ? exc_page_fault+0x9f/0xf0
[   79.380887][ T6737]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   79.383400][ T6737] RIP: 0033:0x7f28c878e929
[   79.385310][ T6737] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   79.393285][ T6737] RSP: 002b:00007f28c95b4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   79.396822][ T6737] RAX: ffffffffffffffda RBX: 00007f28c89b5fa0 RCX: 00007f28c878e929
[   79.400092][ T6737] RDX: 0000000000004000 RSI: 0000200000000040 RDI: 0000000000000008
[   79.403274][ T6737] RBP: 00007f28c8810b39 R08: 0000000000000000 R09: 0000000000000000
[   79.406421][ T6737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   79.409656][ T6737] R13: 0000000000000000 R14: 00007f28c89b5fa0 R15: 00007ffd575cb678
[   79.412850][ T6737]  </TASK>
[   79.414164][ T6737] Modules linked in:
[   79.415994][ T6737] ---[ end trace 0000000000000000 ]---
SYZFAIL: failed to recv rpc
[   79.418211][ T6737] RIP: 0010:htb_qlen_notify+0x31/0xc0
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   79.420618][ T6737] Code: 41 56 41 55 41 54 53 49 89 f6 49 89 ff 49 bc 00 00 00 00 00 fc ff df e8 5d c6 46 f8 49 8d 9e a8 01 00 00 49 89 dd 49 c1 ed 03 <43> 0f b6 44 25 00 84 c0 75 4d 8b 2b 31 ff 89 ee e8 7a ca 46 f8 85
[   79.428657][ T6737] RSP: 0018:ffffc90008617090 EFLAGS: 00010206
[   79.431112][ T6737] RAX: ffffffff89798813 RBX: 00000000000001a8 RCX: 0000000000080000
[   79.434465][ T6737] RDX: ffffc90003d92000 RSI: 000000000000039c RDI: 000000000000039d
[   79.437833][ T6737] RBP: dffffc0000000000 R08: ffff8880200d5640 R09: 0000000000000002
[   79.441129][ T6737] R10: 00000000ffffffff R11: ffffffff897987f0 R12: dffffc0000000000
[   79.444553][ T6737] R13: 0000000000000035 R14: 0000000000000000 R15: ffff88810974e000
[   79.447889][ T6737] FS:  00007f28c95b46c0(0000) GS:ffff8880b8650000(0000) knlGS:0000000000000000
[   79.451662][ T6737] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   79.454542][ T6737] CR2: 0000200000002340 CR3: 0000000029b66000 CR4: 00000000000006f0
[   79.457885][ T6737] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   79.460664][ T6737] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   79.463164][ T6737] Kernel panic - not syncing: Fatal exception in interrupt
[   79.466857][ T6737] Kernel Offset: disabled
[   79.468680][ T6737] Rebooting in 86400 seconds..

VM DIAGNOSIS:
13:15:44  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=000000000000102c RDI=000000000000102d RBP=00000000000003f8 RSP=ffffc900086168d0
R8 =ffff888107660237 R9 =1ffff11020ecc046 R10=dffffc0000000000 R11=ffffffff85474610
R12=dffffc0000000000 R13=ffffffff99ac48f0 R14=ffffffff99dc9760 R15=0000000000000000
RIP=ffffffff8547468c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f28c95b46c0 ffffffff 00c00000
GS =0000 ffff8880b8650000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000002340 CR3=0000000029b66000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f28c8984478 00007f28c8984450 XMM03=00007f28c8984488 00007f28c8984480
XMM04=00007f28c94ed100 00007f28c8984440 XMM05=00007f28c8984458 00007f28c89844a0
XMM06=00007f28c8984498 00007f28c8984490 XMM07=00007f28c8984488 00007f28c8984480
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f28c8811c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff820c71e7 RBX=ffffea0000e36188 RCX=ffff88801f408000 RDX=0000000000000000
RSI=0000000000000000 RDI=0000000000000000 RBP=ffffc900041bf630 RSP=ffffc900041bf3b8
R8 =ffff88801c4439df R9 =1ffff1100388873b R10=dffffc0000000000 R11=ffffed100388873c
R12=dffffc0000000000 R13=ffffea0000e36180 R14=1ffff110072a048d R15=0000000000000000
RIP=ffffffff8b6992a0 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 000055556e1f3500 ffffffff 00c00000
GS =0000 ffff8881a3c50000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fb632ce56c0 CR3=000000001f68c000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007fb632011c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
