last executing test programs:

9.287579221s ago: executing program 0 (id=954):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@ipmr_getroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x80, 0x20, 0x20, 0xf8, 0x0, 0x2, 0x1, 0x1, 0xc00}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000}, 0x4000800)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r5=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r5, @ANYBLOB="08002600940900000800b7"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
sendmsg$NL80211_CMD_ABORT_SCAN(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r3, 0x2, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x5, 0x39}}}}, ["", "", "", "", "", ""]}, 0x20}}, 0x10)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000100004000000deffffff00000000000a20000000000a01020000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021940000000c0a01030000000000000000070000090900020073797a31000000000900010073797a30000000006800038064000080080003400000000258000b802000"], 0x118}}, 0x0)
r6 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5", 0x4)
r7 = accept4(r6, 0x0, 0x0, 0x80800)
sendmmsg$alg(r7, &(0x7f0000000400), 0x0, 0x0)
recvmsg(r7, &(0x7f00000005c0)={0x0, 0x10, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0x0, 0xf5000000}, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000001980)={0x0, ""/256, 0x0, 0x0, <r8=>0x0})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000580)={<r9=>0x0, 0x7, 0x3})
ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000000980)={{r0}, r8, 0xc, @inherit={0x50, &(0x7f0000000040)={0x0, 0x1, 0x8, 0x6, {0x0, 0x3, 0x2, 0x4}, [0xa630000000000000]}}, @devid=r9})

9.126968337s ago: executing program 0 (id=958):
r0 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000010c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10)
socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$bt_hci(r0, 0x84, 0x11, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r1, 0x29, 0x12, 0x0, 0x2b)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a1400000010000084000afdfd6ccc0d9149d720ddfc162f7842aca058267077d5e7977e25a21b58b0c55bf53979e98c35936eb039865ca07193340bfc8c1d310091958824c9dc8bdd825552447eaf3b39ddefebf347e8a93400"/118], 0x28}, 0x1, 0x0, 0x0, 0x40004}, 0x0)

9.039827465s ago: executing program 0 (id=961):
socket$inet(0xa, 0x801, 0x84)
r0 = socket$vsock_stream(0x28, 0x1, 0x0)
socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32)
r1 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 32)
bind$vsock_stream(r0, &(0x7f00000000c0)={0x28, 0x0, 0x2711}, 0x10) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f00000009c0), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r2, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000a00)={0x64, r3, 0x1, 0x70bd2d, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x4}, {0x6, 0x16, 0xb}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x80}, {0x8, 0xb, 0x6}}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async)
listen(r0, 0x0) (async)
r4 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) (async)
ioctl$BTRFS_IOC_SPACE_INFO(r1, 0xc0109414, &(0x7f0000000b00)={0x717, 0x3, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) (async)
socket$inet6_sctp(0xa, 0x5, 0x84) (async)
socket$inet6_sctp(0xa, 0x5, 0x84)
unshare(0x20000400)
r5 = socket(0xa, 0x3, 0x87)
bind$alg(r5, &(0x7f0000000500)={0x26, 'hash\x00', 0x0, 0x0, 'md4-generic\x00'}, 0x58) (async)
shutdown(r4, 0x0) (async)
pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x1000000003ff}, 0x0, 0x0) (async, rerun: 64)
shutdown(r4, 0x1) (async, rerun: 64)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x118}}, 0x20004805) (async)
sendmmsg$inet(r5, &(0x7f0000000600)=[{{&(0x7f0000000100)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10, &(0x7f0000000580)=[{&(0x7f0000000200)="f970c7007a130c97b5b32305e2b3e24f13a65fc3b225ed75adae9d2c87d211959895c1b800d87ad7d3bdda21f8084d74a63409418a683e26bb33d3693a5fc27123e1de15f4db5b5b4dc2a931bceb642bd03cc13c698b86c27e6af15995bd0b26eec3938919ee226d23c130e7bb7b528479ffabd3bbc7e7ed91d4af1e9a02622b95aef831a9212f9df65a4c9cc76ebb84780623c1148ad94c7185a9ec7760f26ffba72de99f4323", 0xa7}, {&(0x7f0000000300)="a0ffd42d43c73945e8bf0af18f50ee9c5a200cb2e65cbf470fc913db792c4576f164ba6e4e736321003253ae31445d84d0cdba6f98e7928c0d97c591452c1812b7dbbbf86e673384ad99f70c42946bce53c0c453084ade2d84d2cab23b50d382e56a23337ca1c19fce06bf4a355296930be8fefdaf1058183634b5353be80dcf1d18347072836c254deb16618419f33d4649f02dbdd409ed3091979d3786fd9ea6ad5c4705b8814ce4c5c7fac34dff596ded98fc3ff7998e6bbd0f75bec497ba1fc0b56fb4382401", 0xc8}, {&(0x7f0000000140)="463a16ca2dc3ebb90634fd2fda686f4b21e4ce8672fde994ccdba74dc961d4455ad4868501bb656ba669537b72647645a20a95cfe802e2f9c37837e87ffa9edc048096482c24bf3dd9814083533bad2c5dd2fc5f9cc39aca3ec1", 0x5a}, {&(0x7f0000000400)="0e9b802f467710848b0389bd1165529ef14325330bb2cf3b4c9556b933d4bdece40d7d514f2367559b95ee75b263e5cb1c9d76244f45c90a2f34bb28cb709a47abf3", 0x42}, {&(0x7f0000000480)="658da750d9a94d60b54415d126dff696046f3581bc8a6c40f1ceb22791ce0eed", 0x20}, {&(0x7f00000004c0)}], 0x6}}], 0x1, 0x10001)

8.13551812s ago: executing program 0 (id=977):
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1}, 0x18)
connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1}, 0x18)
sendmmsg$inet(r0, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f0000002940)=[{&(0x7f0000002640)="ef0ba606342672dabc", 0x9}], 0x1}}], 0x1, 0x20000010)
recvmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000002540)=""/216, 0xd8}}], 0x1, 0x0, 0x0)

7.269170454s ago: executing program 0 (id=1001):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@newqdisc={0x148, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "0a1fb0699d46dac48f29d158dbe8cfb1979e12979688dc039b90627d7b60f0d5ca47f33eed46409b7c8722ce020df6b24c2e6ac7b97dc04d01be2092874115214b1ebb764511f69cd1e9f6263346363d2c639c7667ce67af25166c2f0f85f36aa8867406119c2a6f1f892e31dea982c5ab0348d560eae59ea49ef95d73202a6e3b5e1eb38244e694e7410d33bc92794ad27031f2a19698b51424df36e2a876a4fc871207bf12a84f1d4d132f5bb7edcf2d08d677e6a7268e106b6ced3c7f53df24092ddb9e0fac6a1153c3fc88bfd1404fef22cf3e825a6e19c6a48a5444eabb459af0ec9a278df4011773d2f2e6529ed0ad424b47ec67522477f979360b76d1"}, @TCA_RED_PARMS={0x14, 0x1, {0x3f26, 0x7, 0x7e, 0x1f, 0xb, 0x14, 0x5}}]}}]}, 0x148}, 0x1, 0x0, 0x0, 0x40000}, 0x4000010) (async)
r2 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async)
recvmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) (async)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='netlink_extack\x00'}, 0x10) (async)
sendmsg$nl_xfrm(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025bd7000000000000000000000000000000000000300000006"], 0x34c}}, 0x0) (async)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000006400f0f27edb010400000000200000000000000008000a400000000009d7b00bd8f8296cddc8d72f7200020073797a32000000000900010073797a3000280011800b00010074617267657400001800028008000240000000000a0001004155444954000000140000001000010000000000000000000000000a38e0e8f161a96c0ff1db0908f453f645e84b0ac574ca48b592086706094d9fddb2ded5c9616ab63809294dd50239fb47673b5d26675ed6a0a0616ca4cb78f71223671ba216af0dac4019f38692740dd7cdb0497e30e1be4e4d2a33f29a5a0a833af757ce34c24c94d5db1f43b764b7b3090f68d916cfc0dd794b4f1fe99e321191aabb2e618c71afa5390e649eea7f02e859fd8b62921e220c2ecac69f28d61c7270f90b4f8db34ba211c0134c240e7d8327cb76c9ec8b22f4a7d7cab9bfe008a041c00e5dc8a5bc89cfe34beb206106a76e7b0abd0b4cad646e2267ca"], 0xac}, 0x1, 0x0, 0x0, 0x44001}, 0x0)

7.068725671s ago: executing program 0 (id=1005):
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
getsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000100), &(0x7f00000001c0)=0x4)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1, 0x3, {0x1, 0x0, 0x1}}, 0x18)
connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1}, 0x18)
sendmmsg$inet(r0, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f0000002940)=[{&(0x7f0000002640)="ef0ba606342672dabc", 0x9}], 0x1}}], 0x1, 0x20000010)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@ipv6_newrule={0x28, 0x20, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@FIB_RULE_POLICY=@FRA_UID_RANGE={0xc, 0x14, {0xee00}}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000002540)=""/216, 0xd8}}], 0x1, 0x0, 0x0)

6.936230391s ago: executing program 32 (id=1005):
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
getsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000100), &(0x7f00000001c0)=0x4)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1, 0x3, {0x1, 0x0, 0x1}}, 0x18)
connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1}, 0x18)
sendmmsg$inet(r0, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f0000002940)=[{&(0x7f0000002640)="ef0ba606342672dabc", 0x9}], 0x1}}], 0x1, 0x20000010)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@ipv6_newrule={0x28, 0x20, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@FIB_RULE_POLICY=@FRA_UID_RANGE={0xc, 0x14, {0xee00}}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0)
recvmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000002540)=""/216, 0xd8}}], 0x1, 0x0, 0x0)

997.910884ms ago: executing program 2 (id=1129):
r0 = socket$nl_route(0x10, 0x3, 0x0)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc) (async)
ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000080)=0xbf)
r1 = socket$can_bcm(0x1d, 0x2, 0x2)
sendmsg$can_bcm(r1, &(0x7f00000001c0)={&(0x7f00000000c0), 0x10, &(0x7f0000000180)={&(0x7f0000000100)={0x7, 0x1424, 0x9, {}, {0x77359400}, {0x0, 0x1, 0x1}, 0x1, @canfd={{0x4}, 0x2b, 0x4, 0x0, 0x0, "cbe235d2891851eb4d63e72ec1ed05aa378e90aaa88142455a90f9d0a3da33207f33bace19accbc5349475df8135c89539c4a9b5da3dcea94acb27eabc6705eb"}}, 0x80}, 0x1, 0x0, 0x0, 0x24004880}, 0x40) (async)
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xcc, 0x0, 0x1, 0x101, 0x0, 0x0, {0x1, 0x0, 0x6}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x4}, @CTA_NAT_DST={0x74, 0xd, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @CTA_NAT_V6_MINIP={0x14, 0x4, @empty}, @CTA_NAT_V4_MINIP={0x8, 0x1, @multicast1}, @CTA_NAT_V4_MINIP={0x8, 0x1, @broadcast}, @CTA_NAT_V4_MINIP={0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, @CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00'}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private2={0xfc, 0x2, '\x00', 0x1}}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @multicast1}]}, @CTA_TUPLE_REPLY={0x20, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_FILTER={0x1c, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x20}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x544}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x108}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8e16423bd828a20f}, 0x4000895) (async)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x40000, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000400)={'veth0_virt_wifi\x00', 0x20}) (async)
ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000440)={'ip6erspan0\x00', {0x2, 0x0, @broadcast}}) (async)
ioctl$TUNGETVNETHDRSZ(r4, 0x800454d7, &(0x7f0000000480)) (async)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x48, 0x2, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_DATA={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0xc010}, 0x8000) (async)
write$tun(r4, &(0x7f0000000600)={@val={0x0, 0x892f}, @val={0x0, 0x80, 0x4, 0x0, 0xbc, 0x5}, @eth={@random="53c58553a445", @empty, @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@can={0xc, {{0x0, 0x1}, 0x5, 0x0, 0x0, 0x0, "733f76b3a871b5d7"}}}}}, 0x30)
ioctl$TUNSETNOCSUM(r4, 0x400454c8, 0x1) (async)
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$IP_VS_SO_SET_EDIT(r5, 0x0, 0x483, &(0x7f0000000640)={0x88, @dev={0xac, 0x14, 0x14, 0x2c}, 0x4e21, 0x4, 'fo\x00', 0x8, 0x8, 0x3c}, 0x2c) (async)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), 0xffffffffffffffff)
sendmsg$IEEE802154_LLSEC_SETPARAMS(r6, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x14, r7, 0x1, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x200000d0}, 0x20) (async)
ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f00000007c0)=0x6) (async)
syz_emit_ethernet(0x1e, &(0x7f0000000800)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}, @random="26979f61bb71", @void, {@can={0xc, {{0x2, 0x0, 0x1}, 0x8, 0x1, 0x0, 0x0, "2454edf042d8991b"}}}}, &(0x7f0000000840)={0x0, 0x1, [0x8bb, 0x978, 0x9dd, 0xcea]}) (async)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000880)='./cgroup/syz1\x00', 0x1ff) (async)
socket$can_raw(0x1d, 0x3, 0x1)
ioctl$FS_IOC_FSGETXATTR(r4, 0x801c581f, &(0x7f00000008c0)={0x10, 0x6, 0x1800000, 0x0, 0x6})
r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000940), r6) (async)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000980)=<r9=>0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000009c0)=<r10=>0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000a00)=<r11=>0x0)
sendmsg$NFC_CMD_GET_DEVICE(r6, &(0x7f0000000ac0)={&(0x7f0000000900), 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x34, r8, 0x20, 0x70bd2b, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r10}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0)

995.874504ms ago: executing program 1 (id=1130):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010102, @local}, {0x11, 0x1, 0x0, @empty}}}}}, 0x0)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000048000000030a05020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a3000000000080007006e6174003c000000060a01040000000000000000010000001400048010000180090001006d6173710000000008000b40"], 0xcc}, 0x1, 0x0, 0x0, 0x880}, 0x0)
r2 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc)
setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57)
r3 = socket$netlink(0x10, 0x3, 0x0)
writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e21, @broadcast}, 0x10)
writev(r3, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000000)=0x6, 0x4)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x468, 0x1e, 0xa, 0x105, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x43c, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0x42c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0xa1, 0x6, 0x1, 0x0, "116dc9611895234599d9b7808ac770cd4f3c763befa2cb1da8934ae025bf8290ffe4d087f911eed1f18ee63392442208044261045530611e38cfc83a413a1ef1fc49563dba72dbec1f5a63f2077fa849e571157b09b1f89848f1d406068970cb245c47f46e9a77b9d5bd3aa75390d5ff281a1ecc0aeb7ec6437106f4675c99d313804b769e0a8cefaff00cd3d554f66830f33723abe6e0b97842e4402c"}, @NFTA_SET_ELEM_USERDATA={0x1c, 0x6, 0x1, 0x0, "260ed8ddf7438b9f5d85e3048a71c18c56d228f300000000"}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x65, 0x6, 0x1, 0x0, "04a361a29fa4a177092873e599095b5a04c0c373626825c69b039f2d5121d73b767c533cbcc0eb7d2d72ca3accdc9134843d9cbe96a2dcedce7b58652e233a11a2e4241b04f9437fec0a06dc34d71eeca97b5b44b2b7c2b56005ceb549ac513873"}, @NFTA_SET_ELEM_DATA={0x240, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc2, 0x1, "722b2fe68f00a7e3851cc8ad8b35abc2818111201fff9e9392d57ed7962d55724b643b8e389b316306dd561520a7a3d221b10268c6f7af11742fa98c04d3b64f0424bc2e0733008f3b2954b45df3abf29e9b478e928526ec98339aca7f60406b8f7396b720cc527cd8c2305edd121f7a8e4f44aa3ec75d5f24d941745df6ccbb56ee13d92a56a22bad2d2d2bf5b29941cf7ad20a884001be6f9211feff91af6118201dd19212fabe69939685fa07eabdad9af7eedfe1a1ceb0bdb16b4ab0"}, @NFTA_DATA_VALUE={0xa9, 0x1, "a836630dc39a2d0380ad357b5977907e1cac1e65c07c440259617a9842bac01c62261a37e68d618dd62e01cca6b4e10562097eddf0306070f203be1c32be07910710bf755cb7a717b3f91de0785d2718ec52f5aec25f921dbef9fe0cdb16a456b9f9b71f1e59464c27d3a39161ee305936cce51189c65fe61505782bcb339fd35a54dde3a4b951b1914734bba43586db67d7fc3ad0754845b0a64ae8ac117733adede919f4"}, @NFTA_DATA_VALUE={0x9a, 0x1, "bb74416c2e0012a058836233fb823a5a13e929c6fd80fb0204b3b5ae409c771599c6416cd91d9b5c979309c7003f76fd10e0da06c1b9794cd494c3887a2ef2c9d20dfe00d749d5f73aeb7fdef8363c0f8fe3b2105802edba7ec5f34950c8d093e672361746fb7a5e56a4ae4bd0ffa411b8a4156bb267"}, @NFTA_DATA_VERDICT={0x50}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPR={0x0, 0x7, 0x0, 0x1, @reject={{}, @void}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x4ec}}, 0x40000)

918.568893ms ago: executing program 2 (id=1131):
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
r1 = socket(0x2d, 0x2, 0x0)
ioctl$SIOCRSSL2CALL(r1, 0x89e2, &(0x7f0000000140)=@default)
r2 = socket(0x400000000010, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0) (async)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) (async)
sendmsg$nl_route_sched(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000f00)=@newtfilter={0x890, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {}, {0xb, 0xe}}, [@filter_kind_options=@f_route={{0xa}, {0x860, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r4}, @TCA_ROUTE4_ACT={0x4}, @TCA_ROUTE4_POLICE={0x848, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x4, 0x8, 0x1, 0xbc4e, 0x1000, 0x6, 0x401, 0x4, 0xfffffff9, 0x7, 0x2, 0xdd, 0x10000, 0xcc9, 0x0, 0x8, 0xe2, 0xffffffff, 0x7ff, 0x5, 0xd, 0xd181e86b, 0x5, 0xfffffff9, 0x3, 0x80000001, 0xbb, 0x26c7014f, 0x8, 0x9, 0xffffffff, 0x4, 0x3, 0x5, 0x4, 0x2, 0xfffffffc, 0x6, 0x6d, 0x0, 0x8, 0x5000, 0x2, 0xf, 0x5, 0x1, 0x7, 0xffffffff, 0x8, 0x8, 0x6, 0x1, 0x2, 0x4, 0x7f, 0x0, 0x6, 0x1, 0x8, 0x4, 0x5, 0xfffffff8, 0x7, 0x0, 0x800000, 0x7b, 0x8, 0x6, 0x4890, 0xc8ef, 0xa5, 0x4, 0xa8a1, 0x70c, 0x6, 0x7, 0x401, 0x3, 0x4, 0x8001, 0x0, 0x3, 0x80000000, 0x9, 0x5, 0x1, 0x2, 0x5, 0x10000, 0x6, 0x6, 0x3, 0xffd, 0x2, 0xf, 0x1000, 0x1, 0x80000000, 0x8, 0x1000, 0x9, 0x8, 0x9, 0x7, 0x0, 0x0, 0x1, 0x3, 0x275d, 0x200, 0x7, 0x100, 0x1, 0x8, 0x10000, 0x40, 0x2fc9, 0x2, 0x6, 0xfff, 0x800, 0x7, 0x3, 0x0, 0x8, 0x18, 0x9, 0x3, 0x2, 0x2, 0x8, 0xb, 0x8, 0x40, 0xa5, 0x9, 0x0, 0x1, 0x1ff, 0x3, 0x4, 0x101, 0x0, 0x0, 0x1, 0x98bf, 0x3, 0xfff, 0x9, 0x67d, 0xc2c3, 0x7, 0x0, 0xe771, 0xfffff962, 0x0, 0x7, 0x0, 0x9, 0x6, 0x6, 0x8, 0x5, 0x0, 0x3, 0x10, 0x40, 0x8, 0x6, 0x0, 0x1, 0x3, 0x8, 0x8b2, 0x8d1, 0x7, 0x800, 0x6, 0xb8, 0x5, 0x27, 0x5, 0x16cf, 0x4, 0x9, 0x8, 0x0, 0x0, 0x7fffffff, 0x8, 0x84d, 0x5, 0x0, 0xfffffffa, 0x9, 0x7, 0xfffffffb, 0x2, 0x9, 0x0, 0x3, 0x80000000, 0x9e16, 0x4, 0x401, 0x9, 0xf5, 0x4, 0x5, 0x4, 0x5, 0xfffffffc, 0x44, 0x4f82, 0x0, 0xffffff80, 0x0, 0x4, 0x7, 0x5, 0x2, 0xdfcb, 0x7fff, 0x53c, 0x9, 0x5, 0x5, 0x1000, 0x3, 0x1, 0x7, 0x2, 0x4, 0x9, 0x0, 0x9, 0x800, 0x1, 0x4, 0x6, 0x10, 0xb3, 0x8, 0x2, 0x8, 0x0, 0x6, 0xc, 0x8, 0xd, 0x5, 0xfa, 0x4, 0x100, 0x2]}, @TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x400, 0xbbb, 0xffffffff, 0xffff, 0x85c, 0x6, 0x9, 0x7, 0xef, 0x8001, 0x3, 0x7, 0x9, 0x46f8, 0x1, 0x5, 0x9, 0x5, 0x2, 0x4, 0x6, 0x8, 0x400, 0x4, 0x81, 0x9, 0x8, 0xf, 0x28, 0x9, 0x100, 0x43b74c2c, 0x1, 0x5, 0xd, 0x0, 0x48000000, 0x0, 0xda1, 0x81, 0x44, 0x4e, 0x1, 0x4, 0x2, 0x2, 0x3fd8, 0x101, 0xf9, 0x69ba, 0xd2, 0x3, 0xe, 0x0, 0xbd, 0x9, 0x1ff, 0x1, 0x6, 0xfff, 0x40, 0xc34, 0xfffffff8, 0xc0000000, 0x0, 0x6, 0x80000000, 0xf4, 0x3, 0x5, 0x74, 0x10, 0x8, 0x3, 0x9, 0x127, 0x3, 0x2, 0x1, 0xf8e, 0x1, 0x9, 0x5, 0x8, 0x36, 0x80000001, 0x6, 0x9, 0xfff, 0x10000, 0xfffffff8, 0x1, 0x6dd6, 0x9, 0x2, 0x8, 0x5bd, 0xfffffffd, 0xe0, 0x34, 0x6, 0x3, 0x4, 0xfc, 0xbf26053a, 0x1, 0xfffffff7, 0x3, 0x1000, 0x1, 0x80, 0x2, 0x2, 0x3ff, 0xffffffff, 0x0, 0x4, 0x7, 0x0, 0x3, 0x2, 0x0, 0x200, 0x9, 0x3, 0x1, 0x9, 0x6f26, 0x7, 0x6, 0x7, 0xed1, 0x5, 0x3, 0xd6, 0x2, 0x8, 0x1000, 0x7, 0x80, 0x8001, 0x2, 0x4, 0x0, 0x2000001, 0x800, 0x7, 0x3a, 0x7, 0x80000001, 0x0, 0x81, 0x3, 0x0, 0x1b8, 0x2, 0x0, 0x4, 0x80, 0x3, 0x1, 0x2, 0x0, 0x80, 0x1, 0x2, 0x401, 0x0, 0x1, 0x1, 0x96731ac4, 0x7, 0x4798, 0x7, 0x6, 0x7, 0x244e4f, 0x7fff, 0x0, 0x81, 0xfffffffa, 0x9, 0xb6, 0x1, 0x6cb, 0x2, 0x4, 0xff, 0x5, 0x9, 0x7, 0x9, 0x4, 0x0, 0x4, 0x3, 0x1, 0x2, 0x1, 0x200, 0xc800, 0x9, 0x94cb, 0xfffffff9, 0x5, 0xffffff20, 0x1, 0x9, 0x6, 0x4, 0x7fff, 0x7, 0x2, 0x5, 0x7, 0x6, 0x80, 0xa9, 0x2, 0x6, 0xd36, 0x5, 0x8, 0x4, 0x10000, 0x7, 0x8001, 0x8001, 0x7, 0x0, 0x502, 0x2a3c, 0x10, 0x94a4, 0x5, 0x7d98, 0x9, 0x3ffb1c8d, 0x2, 0x7f, 0xc20, 0x6, 0x5, 0x5aa9987b, 0xcf, 0x7, 0x6, 0x9, 0x6, 0x6, 0x100, 0x0, 0x4, 0x8, 0x8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x400, 0x3, 0xfffff0f9, 0x8, 0x10001, {0xc, 0x2, 0xd, 0x0, 0x7, 0xc}, {0x5, 0x0, 0x54b3, 0x3a, 0x6, 0x5}, 0xfffffffd, 0x32e7, 0x4}}]}, @TCA_ROUTE4_TO={0x8, 0x2, 0xcd}]}}]}, 0x890}, 0x1, 0x0, 0x0, 0x80}, 0x20004820)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="d00000001900100027bd7000fedbdf250500000000000000002000000c0016800500090000000000080005007f00000108000100ac1e010106001c004e24000075000880807e9e1b13c9a6a1972cc71eed7e5013990cf6f52762d37040691b0c34786eb55baa665b44dce2095b56f81eb4b0eef46101226eb1dc4a7a70643fdbabec765abc9882012b7298cd5e9704a062b5258b56fba1975530298a33ed482d20a65fef362ba0a86b2a4ccf75c9e75a2bd10000000800040093649f08b300"/201, @ANYRES32=r4, @ANYBLOB="06001500040000000600150002000000"], 0xd0}, 0x1, 0x0, 0x0, 0x4c894}, 0x0) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="d00000001900100027bd7000fedbdf250500000000000000002000000c0016800500090000000000080005007f00000108000100ac1e010106001c004e24000075000880807e9e1b13c9a6a1972cc71eed7e5013990cf6f52762d37040691b0c34786eb55baa665b44dce2095b56f81eb4b0eef46101226eb1dc4a7a70643fdbabec765abc9882012b7298cd5e9704a062b5258b56fba1975530298a33ed482d20a65fef362ba0a86b2a4ccf75c9e75a2bd10000000800040093649f08b300"/201, @ANYRES32=r4, @ANYBLOB="06001500040000000600150002000000"], 0xd0}, 0x1, 0x0, 0x0, 0x4c894}, 0x0)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0xca02}) (async)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0xca02})
close(r5)
socket$netlink(0x10, 0x3, 0x0)
unshare(0x24020400) (async)
unshare(0x24020400)
r7 = socket$inet(0x2, 0x1, 0x0)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0)
ioctl$FICLONE(r8, 0x40049409, r7)
preadv(r6, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/124, 0x3}], 0x3e8, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) (async)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local})
openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async)
openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r9)
sendmsg$TIPC_CMD_ENABLE_BEARER(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async)
sendmsg$TIPC_CMD_ENABLE_BEARER(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
r11 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETSETELEM(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000)

499.346983ms ago: executing program 1 (id=1132):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r1)
ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000500)={'wpan1\x00', <r3=>0x0})
sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x4c, r2, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40010}, 0x4000010) (async)
sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000280)={0x250, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_MLSCATLST={0x80, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2143a180}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x67d91739}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1600}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4117b2ff}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9de1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2617a3ad}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x67fb0e1d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xad94}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x85d7c4a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5de4a126}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdca0}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf892}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x67e52301}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x66eb4319}]}]}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x194, 0xc, 0x0, 0x1, [{0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x42345252}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5873}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x81f}]}, {0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5defd2e3}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x83a1ab2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x25e5e178}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6c77f773}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x225d47a3}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x78a1d711}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4fb0a94e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4451189f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x75a572db}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x75b2cf5f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2df9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa375}]}, {0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x43b97e62}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7175}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4bc5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd128}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc415}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1e79eec2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x70187327}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd60c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6d7e5e95}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5c795011}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7ed7445e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc04f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x437bedb1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbbbc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdf53}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x16d03201}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x6bb9}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x11f8dc16}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3ef2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5b83}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdf66}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x11ba3dfa}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdb48}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x760b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x729a877d}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6e96a088}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1934}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x58e51359}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x79505f6b}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe9cb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7294}]}]}]}, 0x250}, 0x1, 0x0, 0x0, 0x80}, 0x4800) (async)
sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000001070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021bc0000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000900003808c000080080003400000000280000b"], 0x140}}, 0x0)

499.098636ms ago: executing program 2 (id=1133):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0204fc020e0000000000000000000000050f000032000e000a00fe88000000000000000000000000000103090000000000000200010000000000000000000000000005000500320000000a004e2000000004fe8000000000000000000000000000bb00800000000000001f6e8039399353d98541ba4896010054b3c9f627259758f9637029c4858adfac588b6d8d6a7a176a7092000000358bee000000000f541d7200e6e64ac99611bd2f09ab11c52e66ed537d15e0eff498bbf6b5837952670caae732071456faa076865acdf63795448dcf1ca24158b28c508900e3f1eec733a5aa777fc910e292a126b0c9ea6fdff01c81a51d0b922ae4b5e4faccc9b091f7b8ec89e3498075b085e8b3516b654acbb2d4c493912ae3b6b2dc94451d424c7b4de5f452e1eb7de7da5083698d04b18e69ace1eb7bee34cc934a46ce6dbd76008391971aceb704dbcef70bd86b199d39ab3590297b3594c3cfe7fce6e577a4d67f8b7b0cc0cb34c1db8f8866b8cb368a18cc7e32ca20162e3fd8cab7aeec7e7b2ee15209b7c1976c7da8070f41b6936715ac1b8ea318e9a6782d9ad5e3bfc121de2185bbe6e56937aa88f934c5297516daf163c15602ef43fdf76b70c653103327ffed7093dedf5ef82048cb0df43ad94a87f3078739c961cbd5b248f7c86bd813b13d015d7158084b1ef90c205e071cffd3950386e1b2308b6c1c258adae13e2925b78fa841867094d0af280374472e1990cf0f73f12055f1bab70c9c835a3224be406bc5f6173d90c24aee3d3dae7c35858b1986ad972ede5faba7b41b293c5860b4a82b5b6dd910c13477ef129b332b4323d7c3e3b09a9e62dab2c1fff43f4accd36f7de23328c97c9aed0f6324aa1f3d594123c1fb7b18ba024f4b494070c4158f36f5869eaa7a7b91f25cd454cb0c8e27390809021a7083330ee6373a29f09c8e02cb59903b5b282cc79cd4f77cd2845880592b000000000000"], 0x70}}, 0x4)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000010000000900010073797a300000000078000000090a010400000000000000000100000008000a40000000000900020073797a30000000000900010073797a300000000008000540000000213c0011800a0001006c696d69740000002c0002800c000240000000000000000008000540000040000c00014000000000000004000800044000000001"], 0xc0}}, 0x0)

430.247647ms ago: executing program 2 (id=1134):
syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000008000086dd61fbddf000083afffe8800000000000000000000000001010000000000000000ff200000000000000180009078000000"], 0x0)

429.729691ms ago: executing program 1 (id=1135):
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x3, 0x10004, 0x5}, 0x50)
socket$inet6_mptcp(0xa, 0x1, 0x106)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000700)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1}, 0x48)
socket$nl_netfilter(0x10, 0x3, 0xc)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket(0x2, 0x80805, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8)
socket$kcm(0x10, 0x2, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socket$alg(0x26, 0x5, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c070054001280080001006873720048000280050003000800000005000300050005d605000300fd00000008000200", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r2], 0x90}}, 0x0)

378.014241ms ago: executing program 2 (id=1136):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) (async)
sendmsg$TIPC_CMD_SHOW_LINK_STATS(r2, 0x0, 0x0) (async)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async)
r3 = socket$kcm(0x2, 0xa, 0x2) (async)
r4 = socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet6_udp_int(r4, 0x11, 0xa, &(0x7f0000000040), 0x4) (async)
sendmmsg$inet6(r4, &(0x7f0000000740)=[{{&(0x7f0000000100)={0x2, 0x4e21, 0x0, @empty}, 0x1c, 0x0}}], 0x300, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
write$tun(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="000086dd000311000400000000006eec00be10a42f01fe8000000000000000000000000000aaff02000000000000000000000000000133"], 0x10da)
r5 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) (async)
bind$inet6(r5, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @empty, 0x5}, 0x1c) (async)
sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x2, @loopback, 0x4}}, 0x0, 0x8dc, 0x800, 0x0, 0x54, 0x6}, 0x9c) (async)
r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x5, 0x7, 0x10001, 0x9, 0x1}, 0x50) (async)
getsockopt$bt_sco_SCO_OPTIONS(r6, 0x11, 0x1, 0x0, &(0x7f0000000280)) (async)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async)
sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x40, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY_END={0x4}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000)

317.115371ms ago: executing program 1 (id=1138):
openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x8802, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0x9}, 0x1c)
sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0)="04", 0x1, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x2, 0x6}, 0x1c)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bea100000000000007010000f8ffffffb702000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000001fc0)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x3, 0x8, 0x7}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x11, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a603f00000000000500000014000500200100000000000000000100000000001c00090008000000", @ANYRES32=r1], 0x4c}, 0x1, 0x0, 0x10000000000}, 0x0)

311.204094ms ago: executing program 1 (id=1139):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000003c000701fcffffff00000000017c0000100036800c00020008000000007000000c0001800602"], 0x30}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000)
sendmsg(r0, &(0x7f00000006c0)={&(0x7f0000000080)=@ax25={{0x3, @default, 0x5}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000400)="b800970469541ecfc8be3ed121136885cc420d1def49019c2fc1e4b9350c0c2eba8ca3d6112edbc7b5529ac549e81e95e158a52c71b38e118e977af9c15ae0d61befc744dfa6eea296e1e0938e39ea850011a94610becb2ee285cdf6e40ea740204f55ee05587b396e17ac65818ed0909bff869e20655f6e24383fc35e1217cf081239d9507512ee086006f45748442cca209c22df3aa183b31ebcc415a7c5009223c9c1e377db36945860b61b8fee177741d6fa3429b47b7ce3a9b9a9f722b15445b90e6cd0", 0xc6}, {&(0x7f0000000300)="aaac1d446fc4496aa30ea479ad25451d05f9195a857afaacc427d243958d2b86f12d4b8d54c291b87dbd4a995d589f1657eed554127ca8ad4980fbfc60d6d5f57e92be06a71c627d38636533d9b8b09d16b5e931f009f956924bca2adfe5b8dbda029d193c07684ba663d501ab494571081559bb500c5081057f42f7c86c3dd05f44fc129723f39862006b04f5401fe2e0bfad837e0e85887972e4cb61cb80f9e8866f0b", 0xa4}, {&(0x7f0000000500)="a94a4a473eab3605db6e60fe8a4e1e9a6cba41ba2fea10a9a910b8cddf62fda12f2509cbf17b5b1b866fb047bd22d40071db234bfda1a642f7309fd62284b4561394392fd99886089fd0096ea89343eb15276160fdf84940423f93ff05588a4b7a9c61161617288a2df73f1582e0b8ecec0ae48d27d295247ded02b1d1bc99afc787d14808692b0e87d2a84e2041eee81da99c15ea010063629d620680c59985d4016cfb05cc5a45aee1e390", 0xac}, {&(0x7f00000005c0)="ef52c2e0ccaf8064aaded474fbb61448d372e1e734721519d69def9fe87c675c7b172b7c060397c49332fd85f1582c38888048cfb9b7a4696613c96aa8f87f5edbf4306669bf22c508de20b2e0c1ec03dac89596622dccfdfb42dea2bc7c186e6d394d215c751973ec587634a9e7a8e4fff312e6b26ebefc9f4024097927c0391991f669e871df1df1fc67033e80a7a7d4121b223309c8cf88c8c52784", 0x9d}], 0x4}, 0x8001)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r2)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700), 0x311200, 0x0)
ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000780)={0x7, &(0x7f0000000740)=[{0x3, 0x7, 0x9, 0x226}, {0x4, 0x5, 0x5, 0x6}, {0xe, 0x81, 0xd, 0x101}, {0xfffc, 0x0, 0x8, 0x3}, {0x2, 0x9, 0x8, 0xfff}, {0x2, 0x0, 0x0, 0xfffffffb}, {0x7, 0xbd, 0x2, 0x2}]})
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="550a00000000000061115400000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90)
sendmsg$ETHTOOL_MSG_COALESCE_GET(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48000}, 0x10)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000180)={0x80000000}, 0x19a)
write(r6, &(0x7f0000000200)="240000001a005f0400f9f407000904018020200000000000000000000800020000000000", 0x24)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x48)
r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0x14, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001e00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r8, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50)
setsockopt$sock_attach_bpf(r5, 0x1, 0x4c, &(0x7f0000000000), 0x4)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000007c0)={'syz_tun\x00', 0x2000})
ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0xff08, 0x0)
setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000200)={@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x2, 0x3, {0xa, 0x4e20, 0x1, @local, 0x1bc}}}, {&(0x7f0000000100)=""/39, 0x27}, &(0x7f0000000140), 0x18}, 0xa0)

237.663554ms ago: executing program 1 (id=1141):
unshare(0x6a040000)
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt(r0, 0x84, 0x7d, &(0x7f00000002c0)="aa8e0cf56164be5b", 0x8)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2000000000000000070000000900e1ff72797a300000000014000000090a0104000000000000000007000000140000001000010000000000000000000084000a0000000000000000"], 0x5c}}, 0x20050800)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x6}, 0x48)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r5 = bpf$ITER_CREATE(0x21, &(0x7f00000002c0), 0x8)
setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f00000004c0)={{0xa, 0x4e20, 0x9, @loopback, 0x10000}, {0xa, 0x4e24, 0xa4, @mcast2, 0x5}, 0x1, {[0x80000000, 0x8000, 0x0, 0x3, 0x1, 0x7, 0xfffffff9, 0x1]}}, 0x5c)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r3}, &(0x7f0000000040), &(0x7f0000000280)=r4}, 0x20)
epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000340)={0x90000008})
r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup/syz0\x00', 0x200002, 0x0)
openat$cgroup_procs(r6, &(0x7f0000000380)='tasks\x00', 0x2, 0x0)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
unshare(0x68050000)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r9=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)={0x24, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x24}, 0x1, 0x0, 0x0, 0x4000043}, 0x0)
r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r11 = socket$packet(0x11, 0x3, 0x300)
getsockopt$packet_int(r11, 0x107, 0xf, 0x0, &(0x7f0000000300))
bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r10, 0x0, 0x0}, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0)
r12 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000f00)=ANY=[@ANYBLOB="300000001800dd8d0000000000000000020000"], 0x30}}, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
recvmmsg(r2, 0x0, 0x0, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)

174.348831ms ago: executing program 3 (id=1144):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWSETELEM={0x1874, 0xc, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x184c, 0x3, 0x0, 0x1, [{0x10f0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @range={{0xa}, @void}}, @NFTA_SET_ELEM_DATA={0x1068, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x1004, 0x1, "82adbde7a0828bedc1fed1f5f1a316149fb51b4749ab7d78ce85680ef0d6b0960489ea28049d918b44bc91e3266d49568b1ff4832df579748b3a97daaefb673d964230b007ef686863c32e62d15954f1321af024c88439618d7feebdf589a4bb57f8b84a452e42770a7af9235cc6acae0ba5a5af7c17df4fae0d24f5e4012dbb5645c949ea870b32c5b4d6467cc36b47c316644f4810e19ac20f0ef323f9f24da9ce7cde12d0b30b83d524b795b9ea0f281b71ee174f6ce4f9fb55321a017fbc89331fe1b7f3498bdf53e90b23ed0135da7fbb8b423f7c54c3f61ac8b76be968fd3b17adfc14018b7e34f3e68922204ab6ad76ddde7f977c5b0dedc66436bb46194995e3a6d0c54f873f651d085694f1d73527bae0d80a4b21da234d4dbedeb158301c481585083ced2f0ea913e44468b96ce00f0661ea37da9bf7b13ea0f0d7b404db51be88815484a794892acbe9f77f98fc568c6eb09794f10597b3094288303c4a635054233a925985e8f43254e9f580e9c71003841869ed553afb3f9dc10fd8b3d112c3aa45aa5d7703fc3995942fbf7bff08a5ad546d475979f8d6ab55cfe1403f9925f9b88106a212e71a3174bf22af76337738229c797f6b89e2241cf533c736916da37dc72bcab09afc66275a2a25aadf96805a79e6d02b915fc1baaeffe3fa9a672daafecd05f2b9b25fbb348d8130f88d70cf76825cd84f70bcd1faab288e1e2b596d2395c54389d0c299fe0cf923c114a5f798b1fe2c3bf5bc1dee204652c5001e53f8838013077dbd08cab33bc25f89edfbe72f769afa03b04ab97279fd12578d90770d528eff29024fed30d626cde85dd77d4a25dbf870546ba53c809cd8185b719566e7f63bc91ee13e4b83930fcecdf1bffb6876bfa4c95973dfa8ed65a28fc8d5fbd17ca7459529e1035be1c68b37367f413825ff63772cd6607082ee710d11189ca92bd34cc8dd6fbf0509c3d386873870c3979b8cd6896d776cf5a475ef429d969ddb31369030c29be2434d70bd518aec20afb2c7b8bd6c23731031ebc9450e4f2d4ceffda784d1134e2c0b7c01f0ba0cc029ebabff0889b06b9301ab98f3a49a39f2913980e5ed6c9a40dd8b10536878c8e045088c4ccd1eedb0160ba0854a81bc22193c2a969daaac88924255e24a124c387ff1e5ba44e16137d661156b2fda15ffbd1a4d67f83050587daad4e99e65d3b6c4ba701b9882147cf79338e417e3672d318d622ba0ccf76175e2637d4bb9b334b4197b76125a949918180abb21cea47c5b030c82c653efaf4f50da6963cdac101c981d4a2dbc54196947e0bbdd13cb62f1e85bf7c4d2b6fcf19f09a2021d335d3415d4f819ba23565ee70d19e0bd58b8caf075cb09573f7df8288e5930f3d0981bcff89f08756cf506f8b667af02f01de8485ce77ce7237cb5df3f368c67c926239a5276651252e751043583f65c1ea8431c20be2a39279f0b39ce356d2305c3d4b6567618b4a22cad8108d87e332962dcab30e777f2c8cd479665196b1bac4e82daf7d99580a447f0c0ec53af500405eadead1a48c51159c546308bee8cb3657079ec481221be6e83d618f77e63a85c8687546e2791a6d6909c8ad095160fa322eeaa514ce71fbd6194365b01cccdbbb17222452a4d1cf3230613f2ea97699e800b4ec6f53f510206dde05276b55bac391ee70a7b03e32201c71e5e0602efc4d345540033446f8f154d109e08e9146f2752f712449d4d32242cd9cd144934175d9349e9abb244a42088f16354026f78deb0f8d9a3635632813d2e35a9e827ef8160743248ed6a12edc2f058d336929d72eb78c2356b1b16bbd88b6df3baf4ba341aa68d36972ecb15fa7c6bcc0aff37f964e61811fbf7f09d6ad393c49fe2dc2a95689d0beb02fab811dc746899679c4b295fc8ece4acb0c3f1b0a65f7079f0b1eae737cbb45812045d3ad426287e459ff15fd9b5ad619cf9942981704744ed6513d3218c1442bce13121d551523829e04d8447fbf970b1ffb676816e4d054cad972d66268b85f354397142cc009726b9cd7246f64597ceacdbc67eb7496c1f67a93a808d8f80dab539ab36426e3021513571f4cd2ba5e57278ca5c58bb1ec988a2c9096dd837664a2fe7fa9bb8c58f1a6a160f3c9b6194f4faf1553001128c11fbfa2696f77dc07a61f90c49754a19d8dc573905feea5cb1f764f2750693c7b247e3927c58c27afdc8f16c2b4b72beaaaae6afe5751527f4a353ad5e9ca21a06f204ee8e7df0fde853d28296b4bccb24867ce5852e67b7d9f84868db32bf8a369ea0c4da3fccfeb4f975a6037e18bd0dd2a91270f253644cd293a7f82beb53fbf568778e57d90f1e026da8b49aa9209895fb4b1455e28a53474a8df0fea0ba03d7271ac8a0406072eb0a26d17353f02b5bb1752b38e44a3984c460ce806607a0a6168567b5b41ba5c4d345e25fa6f3a6bb186111336511773f09414c5111530ffc86bddcece80779a8d4cb292577d03babe8f35689cb5b6c5e21d2910457459b69300b4e8d9d6871d54c680b8cad4cabf805762979197f8799c0000f39391e5e2cdd8b7d758effa9c1956ddc8a75ba1aa95a272fca8be7a6d79505b55f63cf52f39391612a1935afe607a8afce1581cbffcba752e5b0723b16897b6abda43d2c99b8c5d2ef41557ac9501b9f6ecf3276af60d630f65587d640666960f7384dd7b360dfaa9ebd685ec93e5fb1f762e5b8e20e797285487679f19631479777d3b501320636164f9b9b2fbbb326589aece462a014ff75500452229269964b6305da13927c29844be9a77459ea894dc505f9ff80cb33c952adafcf45448c274d0b077adda57654f0474298155b94857bf1a1944382b64c9ee7bef02a42192e72246769120e7edb7c2094dea0eed3282b10130eb02751e65c4a43385404b177ab15f6e5789305aa54cfb933cf026e3f5a8b53cf21aab6235a0078741eee29fa53fe5de3b3c7006731d6178ed131be7bef7e396903d02dc3be0e30a03b37a9c25b267cc625629fd0a62ad33523d2f0b5d67c1a83d2bec4bc4cf24cdfbcc622323682795941dd2ff271534fc8ac91b5d3b6e2f8bd634554bfc5b20cb2779dfc541269d7bcd19df7628330c94c742ce604639b5932e6b7359ecd2993e49897e5e6e2d18a84277b53cb7304fdc7c995e8af0871d78425036e7de898bb3a1b511674a1c1fb61760e230cd870b01c77fade3647e6a002c5f1fa58df448e8c250659353f7ec9c9af0b22f7ac10d3c816fcb66d1f9e7f19df3d476326b6a4593f6f6f3930cbb72a9418dc0501010f177e3763586b52d10f468ac76abbcb0fc3751b547f936a87da8dfd979e2bd4a94c3f4714a0cb8eaa45d60951ccc29d343860633515c18ae76a75525ecb2b30e47c0946c3570f061f823c4fdbb94f2dc39435320c2ad435a8f70e4f3352bcf5b4e24c985098ed502cd48170a8bada182be5cd62f118a309d68c4fc56f6ef47598135a276c11d5dd68a3642482a7d4bf4753c8dfea8b418f3412f7b9a776f347f2e4ff3705b5185980eb5b5872a9534a4463302a8c20fddf253863cfa12ce64761fa9acd49795a59a30adbe8946b825261464ebf91550afde7d308fc084af37b73493f4c5ef32124e169ddae8072fbfe336532ad471972fab1129509c2924cce2afe44c8bd353f2acb37f5c7e12eb3b1d0555b0b5eb16372cdaeb4bcdfb7b2fd63241e09a0cf7135ffca5c44493586eac4d38f597686c532f8bc5455e5ceec577cd527348b6026d4999791c638ba156f693880babe6f6c05eb981541f9308808619296a37166b52805c9a2c5738e523469d2d07593a3964a34df9b82d8d991f1a6fc168cdde096dc72da5c7c882e7d2516d44b04e9c73852a38e0503f428d2a8f56a25b895c1075b1206d1bc76f3684026aeab216a3b3792b2c1c98a4be3fda312f1f5e6fd4303f59d887eb78e67def2fad99796225ce3321674a7d24b179b4c9ed57335c3f4f16330ce8b3d9ad573875f0ce1253341c5aca909e5307af477f8c6fcfb1a5d4f8b4a7ed6150486ab2b080946505b3d5ef63b8b424619d3ba9e63ce484f3941a697047493a0af15befb4089892a773ee04e3afeaed67f3cf64559b2dbcf45c69524454bd7fa9bb90c8491b0bb44966dbc2cddff2daf6ecc3abb2586e870e41329c23d143122ddacb4fb97ccd6aeeb2305d13d0293c73a649f62fc81a919e4155e3241900be9ec4e9a77c52a07604ca19f6b7e47e72cba48b45e61a11f1b0e5bf9cd58d4dfdde1bd4456953c2a9c32e369f6b0532156040e32e91d227347fcb9588c64663432714425fb2888e053e6fea04cda82ec4ded2583dc7705550003a8f8394cd57a982a7a20d6e39f67b45ec005842676288733b48e1d666b5e44e6db4c9a4697046157dacd3ebc5cf726883b5b2fb083e1a5b7306cf38d02a31499d497b89a45662ada84560c00aa1d07e18f4ba47ed87d8fa8f909396f8ac9d6886b5f052fa4db5d56f137f579bfe589175f398fd557e1e0bc2e05daaf8ff58302cbade6f815f5f4919c7feb8b7ae1f3ce95779b8fecc9ee01945eb25fbceae04fba943ad0085fd7116fea8927cf10038f6bdb902afde460cfba3af2f39a513becadc7730415d9ad65745e23c89a22dad97ec8feb8f0ea20d711454db828d3ce0e989991fc7af6e7ca92616752eff3e8daa050a3c04302b70b4bd516a1259f6c31c7957dbeb4de69d61ba2a8f24c5059eacae04bdcdadb7e8d534cc8cb4ec520491fc861962c47e4fe261cce44141780ae2213de4d08618ead3ad77050ad51dd24cb3e50cd380199341e0f5eed66993937f5b7c9ce0eed3976f220a3abd51e52cbd680afd44c63bb2a7e6d90997b6bee09ca300bae38890cd74b692fbc75baffe766ea840dab6de56668590ee3f6df50c061c2e8723a5c0ec84b3be3b9d3ca1b35742d7b10228d7804c0909f3be8e7621e3008cf387fdedf1407b5443c039f55c9258f20dc01f88019db3fcba2aedfe8a8a8d9a57331c547799f3083a9b00a07ed03400613ea12c7cd8c0ddd198fd7bff2136ad6938f42304b6af55de8fc09d8fe38d29233cb2dee05a6c29b40a885eb0dd03313c4a6e199b18a7a044a11675fb5e397381fbcb8bc3cd1a9e205f6eaf703b21679b4b8834cf3301039f0b85c133a06ae7745823ad2d3d236fff9300138dcc41818d2b986eebeb8fb876442669de12f2f039f49a717b396c90343128a7c13d05aa626fdd4966fb89cd3fcf8bf52c9566476a3b39ae0e6a589258bb39c423a42969a07ef512415d35be610860a792458195c2dd86537921f573b8dd7dbabaa8118ab548db236720dfaff2a05bf70cd7e35387414dc35d04bfd2e03218cb6b503b46578bee1b4ae1fb5ef5b9832e1b4568fd1bb682656e3f98bbcfe8ba4d99d649fd0f3dcd8145c2b3e6c9a036f2679874e3adff367539f35f31c2cf9ff9943d9c9fd8f182cfda93f98b53592e47198d54437299d53460e0fad439f6deb41dd7ee150280add90ce811e620ad9c5f9909d4312f4aa9f4edf54986229e4a036b38ba96fbb4739461ea8e9d824989c33007142d6cdb1235c0a6161eed3b59c5067c27a0cde7ac7356b005f95520932d49bdc31f1d36ee2d2bd8c86e1e814786e75dc34b17e0541471bbd15d9d3dd91c00e799363d3088886432531484caabf416fdc22e76b1b12db29b3c20311ab29a6812a31edf8b848ddb5df9e937b96f4c93afe8ae471fd20b3803a7bb9a4bd21731d9f87c211e6a3481c082d98e53ae8f342763e010b1776efa1"}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_KEY_END={0x3c, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @last={{0x9}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x200}, @NFTA_SET_ELEM_EXPIRATION={0xc}, @NFTA_SET_ELEM_EXPRESSIONS={0x10, 0xb, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}]}]}, {0x248, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_ELEM_EXPR={0x2c, 0x7, 0x0, 0x1, @reject={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x2}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x9d}]}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xffff}, @NFTA_SET_ELEM_DATA={0x1d4, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xe8, 0x1, "94c8051aec7cf2d0154f23a5a62706852577ed3e513691d3cbc44a9149a59a299b30ef5c397adb3e1f930fc16cfff6bd042ae2a7a60716dec8fd5e1740b701a9a12d804b2803ae63ecaabf3cf8489ec6d087090f4870c31aa8cca5c6cd9f0c431c339baf04a95d9a544ff433d853fac46ee332e4ff020fd449170e963ae94ede4dc13be8df3223e96f433f87ec4c77bcd1fd6c154511f57b8d546eec85836ca68962678b73de2b3195712cc9bc4a74de4212283a72209fa4543649580829594e9327bea1bb8b39a621ab504d967fe6e8a3b68a598872d0dc1d94e2f827f0241ba2d69e7b"}, @NFTA_DATA_VALUE={0xe7, 0x1, "ef109e85e4d099dc11aaca288bd372de83348dacbec889bffa8f38f2368ffaffd59c8a9eda9777ecbcaf8fc5c110550a895f775044e2e55d68cfd70a438c47a367816c335d6fdb1d902218d8e9625bfccdf8f7abecd6012eab8c2c510b4963cf7a0d62159d870f4d2dbb5f7b37ae5e86735674fc4fb3a8351345107ff775708f76fc81a3a3da0994cddfd6b71e81efce83ad0bed6e4c827ded07f96c873566af34688d81298d8be44cef3080a3c2ca317452bbb2be6a73d713083c8389d14de53f3b3b3d18be5924eea27431fec9a6c30838a7c3a37e3d487f693bced753dfe2e7ac63"}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x1ff}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x100}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @connlimit={{0xe}, @void}}]}, {0x3ec, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_KEY_END={0x3bc, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0xce, 0x1, "ba0b2f75f3dfe38f6c896e6c9b59798ef27ce75b79009e319df2ac0ddb488135f1f4d3f24bd2cc52199af6e18ba2881261702d7e6b4aa3206bed782296b1a1939279ba25e178b246d9b815720d145b5eddaf221707c2555b8bc13e560b1b9564566f23c9929804905e7b2b3bd078208e4f7c51a0dfcc734935563d4c8eca23a6745f924e1dc00df78b247eb6e4c73b08011b6157c7027e203ae2c5048dd4c2c976ca5a39b7387de082b2aa0df6efb8eee6726362177bedc200693d7fe09d9fb330670a2303dfd9cb538a"}, @NFTA_DATA_VALUE={0x74, 0x1, "1e0cc4f6defa63a15786e1a36ac25d67d293644b6fbf2e9966a03d8df3ff8ba85c9b1c09df4314513ae2f7879b99d7ada022f151e51a59af1fadd22a8abd153917e7c78ff02a8d4216e0e0e269ea0c22c406c2f7da71750ec114ee2eb17e238bc9bed3aaaa6a54bb219d4802cff9ee0a"}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0xcf, 0x1, "fd7a9424d9ee89451197fb9062ab5467b3d3ff74f65ed7cee68d6fb61f522b1d03a10ed49c6078bb0ee717f456878511e51a5572a77e15d3112f319539d0720b6a74f368c8ca61cc7dc60cb225cd420238ae4f432c0c05143190310c7af9a744ceae54f3ea41a4c3f9918bd9bfaefb73f08e514f28e479ed61f598e1a0636e3423904a926288466a5d3d34b95ff133d4114875470aec61f48a0b223065fa592c16d55ec40a44288c339a9bb66e0fc093f8d4e583f0654f7f01ffe13c778ac442fa5e5deb5f37b7386c3e99"}, @NFTA_DATA_VALUE={0xd7, 0x1, "914a7ebd2e84b9c62e5ca0a768bab18df6037a6c656fb5e486373643b3cf98157695cd8af938a6555bca8a15a706e5baa62a9e5a714b1d4c315f39c23194edd9d8c21559cbe35c385c69c8e27c454b483f75878658ce044d52d813d68a40a43f9a52af672fd932e0ef60ca3b2f409a83f32eb1d1842e37eb18f186f1c492b062769088cd1f398496105f114284486d3d092770d17b8956b5105ca555b050e5905c7977995ea03612165199d04bd27a29d4558d582a00db4528f81601da453439b0650d5bd852a1a31475b299e2a3dee208372d"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}, {0x4}, {0x114, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @byteorder={{0xe}, @void}}, @NFTA_SET_ELEM_KEY={0x4c, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8}]}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_KEY_END={0x90, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8c, 0x1, "af02099baa324500eb5c3f1cfea4c43b1039237d3589fbe332d91d6dfcd3080ec299a74c03343630f68243999b2759b8955db9fa6f6150e50e9bc2890e55ace5d6d76b4b0f628697ee9a1f5099bbfba2800fa0a6f55977a82324105621e3fe1782fde1906d8244260ef06e7857e34bae54d783136519146509151425dc50e564836f263eb5a78450"}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x409, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x31}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}]}}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x18f8}}, 0x0)

174.048933ms ago: executing program 2 (id=1145):
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$inet6_udp(0xa, 0x2, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r0)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xa2d, @empty, 0x4}, 0x1c)
listen(r1, 0xfffffffc)
r2 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, 0x0, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x20, r5, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x800000000000000}, 0x0)

109.834399ms ago: executing program 3 (id=1146):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x12}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x5}]}], {0x14}}, 0x8c}}, 0x0)

107.519603ms ago: executing program 3 (id=1147):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x94, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x68, 0x3, 0x0, 0x1, [{0x64, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x58, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc}]}}}, {0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x3}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x118}}, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)

60.136791ms ago: executing program 3 (id=1148):
syz_emit_ethernet(0x11, &(0x7f0000000680)={@broadcast, @random="0086ffff00", @void, {@x25={0x805, {0x3, 0x2f, 0x27}}}}, 0x0)
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, 0x0, &(0x7f00000001c0))
r1 = socket$vsock_stream(0x28, 0x1, 0x0)
bind$vsock_stream(r1, &(0x7f0000000440), 0x10)
listen(r1, 0x0)
r2 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r2, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10)
writev(r2, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x1}], 0x1)
r3 = accept4$unix(r1, 0x0, 0x0, 0x0)
recvmmsg(r3, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000000140)=""/120, 0x78}, {&(0x7f0000000040)=""/40, 0x28}, {&(0x7f0000003300)=""/107, 0x6b}], 0x3}}], 0x3fffffffffffed8, 0x2, 0x0)
writev(r3, &(0x7f00000000c0)=[{&(0x7f00000001c0)="1c", 0x1}], 0x1)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010012000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000044000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000210800034000000005140000001100010000000000000000000000000abbe9ce13a83efa583b95a05bc94c9646e04215c912084ffb727b2224421efd052f3a7478b2531c1f9198704637c87e12cc777bbfbd0fd6442f4c6a"], 0x8c}}, 0x0)

59.174176ms ago: executing program 3 (id=1149):
r0 = accept$netrom(0xffffffffffffffff, &(0x7f0000000000)={{0x3, @rose}, [@null, @remote, @default, @null, @rose, @default, @rose]}, &(0x7f0000000080)=0x48)
ioctl$sock_netrom_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={0x0, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={'rose', 0x0}, 0x9, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x0, 0x5, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) (async)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r1, 0x4, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x2, 0x80}}}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xe71}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x1)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000280)={<r2=>r0, 0x6, 0x5d6, 0xfffffffffffffffc})
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff)
sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x90, r3, 0x2, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x50, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x34}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80000001}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}]}, @TIPC_NLA_BEARER={0x2c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'ib', 0x3a, 'dvmrp1\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff5}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'xfrm0\x00'}}]}]}, 0x90}, 0x1, 0x0, 0x0, 0xc042}, 0x4048084) (async)
getsockname$inet6(r2, &(0x7f0000000480)={0xa, 0x0, 0x0, @local}, &(0x7f00000004c0)=0x1c) (async)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000500)) (async, rerun: 32)
getsockname$packet(r2, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000580)=0x14) (rerun: 32)
getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f00000005c0)={'filter\x00', 0xe9, "fe55c2416d02bd5e1bc436be045ed1221916c790b2127d362273ed3fc06ead606d97b257a5835df4e5f80eaf78e06ab107563fc54a26a747b1053a1c787fddea690e0aa98b46b9b6b7fbade2f2c4ae487cb074595f977a5f9cf69c708247d5db45e1eb64e9f3640c48c6c14d682d4c03f350dfe06ff5cb4cd3fb7a14804d3dd76aaad0aad61be5e07c4d1dee5ebcc7f42b68f1cb811a526f45ed191b5034d2272989be423b62b316ed394e44c192f7a61e6c569fafb21d184ee4ecd1d9a551bbb51bf2c4af35f062fdb2da99352ead1eff3e02216c0ac643bd01c6c1ca5bb62a7ad891b3ad32b8738a"}, &(0x7f0000000700)=0x10d) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r2)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r4, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x2c, r5, 0x800, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x68f}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x448}]}, 0x2c}, 0x1, 0x0, 0x0, 0x84}, 0xc8f9e02e25a0ee5d) (async)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000880), 0x40000, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000008c0)={'bridge0\x00', 0x200})
r7 = socket$inet_sctp(0x2, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_AUTOCLOSE(r7, 0x84, 0x4, &(0x7f0000000900), &(0x7f0000000940)=0x4) (async)
ioctl$sock_inet_SIOCSIFDSTADDR(r7, 0x8918, &(0x7f0000000980)={'batadv_slave_1\x00', {0x2, 0x4e24, @multicast2}}) (async)
readv(r4, &(0x7f0000000fc0)=[{&(0x7f00000009c0)=""/13, 0xd}, {&(0x7f0000000a00)=""/115, 0x73}, {&(0x7f0000000a80)=""/74, 0x4a}, {&(0x7f0000000b00)=""/235, 0xeb}, {&(0x7f0000000c00)=""/168, 0xa8}, {&(0x7f0000000cc0)=""/201, 0xc9}, {&(0x7f0000000dc0)=""/198, 0xc6}, {&(0x7f0000000ec0)=""/218, 0xda}], 0x8) (async)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000001040)={'sit0\x00', 0x1000})
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001080)={<r8=>0x0}, &(0x7f00000010c0)=0xc)
syz_open_procfs$namespace(r8, &(0x7f0000001100)='ns/time_for_children\x00') (async)
openat$tun(0xffffffffffffff9c, &(0x7f0000001140), 0x280542, 0x0) (async, rerun: 32)
getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000001180)={0x0, 0x8, 0x150fc07c, 0x0, 0xb67, 0xdc1a, 0x1, 0x5, {<r9=>0x0, @in={{0x2, 0x4e20, @private=0xa010101}}, 0x3c, 0xa2c, 0xe, 0x0, 0x6}}, &(0x7f0000001240)=0xb0) (rerun: 32)
getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000001280)={0x4a, 0xd5b6, 0x7, 0x3, 0x101, 0x0, 0x4, 0xffc0, <r10=>0x0}, &(0x7f00000012c0)=0x20)
getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000001300)={r9, 0x100, 0x7, 0x9893, 0x2, 0x1ff, 0x7fff, 0x3d56cfde, {r10, @in={{0x2, 0x4e21, @multicast1}}, 0x3dca, 0x8, 0x9d9, 0x1, 0x9}}, &(0x7f00000013c0)=0xb0) (async, rerun: 64)
connect$inet(r2, &(0x7f0000001400)={0x2, 0x4e22, @private=0xa010102}, 0x10) (async, rerun: 64)
r11 = socket$tipc(0x1e, 0x7, 0x0)
ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r11, 0x8982, &(0x7f0000001440)={0x8, 'syzkaller1\x00', {'macsec0\x00'}})

0s ago: executing program 3 (id=1150):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0)
sendmsg$kcm(r1, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e21, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x20000000)
sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000004000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319e2e66d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0)
setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000000)=0x6ab7, 0x4)
setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000180)=0x42000000, 0x4)
r2 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000000))
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r3, 0x10, 0x70bd27, 0x25dfdbfd, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20044090}, 0x80c5)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0xc00)
sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c020000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc140011800e000100636f6e6e6c696d69740000000800084000000001f4010980080001407f"], 0x274}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:42084' (ED25519) to the list of known hosts.
syzkaller login: [   47.915860][ T5833] cgroup: Unknown subsys name 'net'
[   48.063301][ T5833] cgroup: Unknown subsys name 'cpuset'
[   48.068693][ T5833] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   49.405446][ T5833] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   52.864190][   T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   52.867084][   T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   52.869809][   T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   52.872552][   T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   52.875179][   T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   52.898630][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   52.915019][ T5852] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   52.918624][ T5852] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   52.929602][ T5852] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   52.933406][ T5852] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   52.940895][ T5852] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   52.954572][ T5845] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   52.961194][ T5845] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   52.965864][ T5845] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   52.969488][ T5845] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   53.151754][ T5843] chnl_net:caif_netlink_parms(): no params data found
[   53.187175][ T5847] chnl_net:caif_netlink_parms(): no params data found
[   53.246582][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.249550][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.252622][ T5843] bridge_slave_0: entered allmulticast mode
[   53.256491][ T5843] bridge_slave_0: entered promiscuous mode
[   53.274485][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.277530][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.280876][ T5843] bridge_slave_1: entered allmulticast mode
[   53.284743][ T5843] bridge_slave_1: entered promiscuous mode
[   53.335931][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   53.348343][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   53.379761][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.382247][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.384598][ T5847] bridge_slave_0: entered allmulticast mode
[   53.387351][ T5847] bridge_slave_0: entered promiscuous mode
[   53.391487][ T5843] team0: Port device team_slave_0 added
[   53.393609][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.395931][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.398286][ T5847] bridge_slave_1: entered allmulticast mode
[   53.401666][ T5847] bridge_slave_1: entered promiscuous mode
[   53.420161][ T5843] team0: Port device team_slave_1 added
[   53.422236][ T5848] chnl_net:caif_netlink_parms(): no params data found
[   53.428468][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   53.443410][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   53.464218][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0
[   53.466739][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   53.475728][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   53.480918][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1
[   53.483274][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   53.492493][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   53.535764][ T5847] team0: Port device team_slave_0 added
[   53.540458][ T5847] team0: Port device team_slave_1 added
[   53.587684][ T5843] hsr_slave_0: entered promiscuous mode
[   53.590441][ T5843] hsr_slave_1: entered promiscuous mode
[   53.601816][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0
[   53.604066][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   53.613345][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   53.626031][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.628417][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.631510][ T5848] bridge_slave_0: entered allmulticast mode
[   53.634183][ T5848] bridge_slave_0: entered promiscuous mode
[   53.637335][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1
[   53.641071][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   53.649361][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   53.657274][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.660915][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.663254][ T5848] bridge_slave_1: entered allmulticast mode
[   53.665909][ T5848] bridge_slave_1: entered promiscuous mode
[   53.720262][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   53.725942][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   53.731798][ T5847] hsr_slave_0: entered promiscuous mode
[   53.734091][ T5847] hsr_slave_1: entered promiscuous mode
[   53.736300][ T5847] debugfs: 'hsr0' already exists in 'hsr'
[   53.738225][ T5847] Cannot create hsr debugfs directory
[   53.767802][ T5848] team0: Port device team_slave_0 added
[   53.777229][ T5848] team0: Port device team_slave_1 added
[   53.817547][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[   53.821078][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   53.832138][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   53.848494][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[   53.852582][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   53.863349][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   53.925155][ T5848] hsr_slave_0: entered promiscuous mode
[   53.928379][ T5848] hsr_slave_1: entered promiscuous mode
[   53.931941][ T5848] debugfs: 'hsr0' already exists in 'hsr'
[   53.934441][ T5848] Cannot create hsr debugfs directory
[   54.027781][ T5843] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   54.047125][ T5843] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   54.052166][ T5843] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   54.072587][ T5843] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   54.142915][ T5847] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   54.162015][ T5847] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   54.166840][ T5847] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   54.178438][ T5847] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   54.216871][ T5848] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   54.222569][ T5848] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   54.226684][ T5848] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   54.231258][ T5848] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   54.291732][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0
[   54.327241][ T5843] 8021q: adding VLAN 0 to HW filter on device team0
[   54.347869][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.351182][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   54.357307][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.360518][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   54.371389][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0
[   54.411426][ T5847] 8021q: adding VLAN 0 to HW filter on device team0
[   54.417806][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[   54.439763][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.442160][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   54.449871][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[   54.471562][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.474681][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   54.481488][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.484548][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   54.500691][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.503525][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   54.572096][ T5848] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   54.618479][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0
[   54.679583][ T5843] veth0_vlan: entered promiscuous mode
[   54.688590][ T5843] veth1_vlan: entered promiscuous mode
[   54.717629][ T5843] veth0_macvtap: entered promiscuous mode
[   54.738574][ T5843] veth1_macvtap: entered promiscuous mode
[   54.757319][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0
[   54.774212][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1
[   54.782791][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[   54.790762][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0
[   54.801904][ T5874] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   54.814293][ T5874] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   54.824707][ T5874] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   54.830901][ T5874] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   54.877425][ T5848] veth0_vlan: entered promiscuous mode
[   54.886425][ T1091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   54.893254][ T1091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   54.899820][ T5847] veth0_vlan: entered promiscuous mode
[   54.909536][   T55] Bluetooth: hci0: command tx timeout
[   54.914914][ T5848] veth1_vlan: entered promiscuous mode
[   54.917589][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   54.918876][ T5847] veth1_vlan: entered promiscuous mode
[   54.922413][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   54.953121][ T5847] veth0_macvtap: entered promiscuous mode
[   54.953493][ T5843] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   54.957517][ T5848] veth0_macvtap: entered promiscuous mode
[   54.968423][ T5847] veth1_macvtap: entered promiscuous mode
[   54.977697][ T5848] veth1_macvtap: entered promiscuous mode
[   54.984268][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0
[   54.989298][ T5845] Bluetooth: hci1: command tx timeout
[   54.992543][   T55] Bluetooth: hci2: command tx timeout
[   55.003918][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.008096][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.017752][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.035193][ T5874] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.041066][ T5911] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   55.043291][ T5874] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.043555][ T5911] IPv6: NLM_F_CREATE should be set when creating new route
[   55.046436][ T5874] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.048794][ T5911] IPv6: NLM_F_CREATE should be set when creating new route
[   55.067910][ T5874] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.071690][ T5874] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.091626][ T5874] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.094789][ T5874] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.098455][ T5874] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.098671][ T5913] netlink: 96 bytes leftover after parsing attributes in process `syz.1.5'.
[   55.145611][ T5915] syz.1.6 uses obsolete (PF_INET,SOCK_PACKET)
[   55.162012][  T744] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.169378][  T744] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.188848][ T1091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.195541][ T1091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.207090][  T549] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.210598][  T549] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.218507][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.224191][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.293325][ T5920] pim6reg1: entered allmulticast mode
[   55.297173][ T5920] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3'.
[   55.347405][ T5924] netlink: 52 bytes leftover after parsing attributes in process `syz.0.8'.
[   55.353492][ T5924] netlink: 52 bytes leftover after parsing attributes in process `syz.0.8'.
[   55.356446][ T5924] netlink: 52 bytes leftover after parsing attributes in process `syz.0.8'.
[   55.361437][ T5924] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8'.
[   55.365664][ T5924] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8'.
[   55.476389][ T5928] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10'.
[   55.615894][ T5941] pimreg: tun_chr_ioctl cmd 2147767506
[   55.726590][ T5938] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12'.
[   55.733020][ T5935] netlink: 'syz.0.12': attribute type 13 has an invalid length.
[   55.735558][ T5935] netlink: 'syz.0.12': attribute type 17 has an invalid length.
[   55.738875][ T5943] Zero length message leads to an empty skb
[   55.747844][ T5935] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[   55.929905][ T5947] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15'.
[   55.940158][ T5947] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.946973][ T5947] bond0: (slave rose0): Enslaving as an active interface with an up link
[   56.211384][ T5967] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   56.427565][ T5985] tipc: Started in network mode
[   56.430533][ T5985] tipc: Node identity 06a2686ff30b, cluster identity 4711
[   56.433338][ T5985] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   56.436329][ T5985] syzkaller0: entered promiscuous mode
[   56.438055][ T5985] syzkaller0: entered allmulticast mode
[   56.461415][ T5990] netlink: 'syz.1.24': attribute type 10 has an invalid length.
[   56.463177][ T5984] tipc: Resetting bearer <eth:syzkaller0>
[   56.471996][ T5983] tipc: Resetting bearer <eth:syzkaller0>
[   56.477298][ T5983] tipc: Disabling bearer <eth:syzkaller0>
[   56.989549][ T5845] Bluetooth: hci0: command tx timeout
[   57.084127][ T5845] Bluetooth: hci1: command tx timeout
[   57.084784][ T6039] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   57.086733][ T5845] Bluetooth: hci2: command tx timeout
[   57.282748][ T6057] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[   58.691151][ T6132] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   59.026484][ T6169] netlink: 'syz.2.68': attribute type 32 has an invalid length.
[   59.079062][ T5845] Bluetooth: hci0: command tx timeout
[   59.159068][ T5845] Bluetooth: hci2: command tx timeout
[   59.159177][   T55] Bluetooth: hci1: command tx timeout
[   59.340367][ T6193] lo speed is unknown, defaulting to 1000
[   59.343363][ T6193] lo speed is unknown, defaulting to 1000
[   59.347379][ T6193] lo speed is unknown, defaulting to 1000
[   59.358850][ T6193] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   59.366023][ T6193] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[   59.384749][ T6199] netlink: 'syz.1.71': attribute type 1 has an invalid length.
[   59.387282][ T6193] lo speed is unknown, defaulting to 1000
[   59.394378][ T6193] lo speed is unknown, defaulting to 1000
[   59.401472][ T6193] lo speed is unknown, defaulting to 1000
[   59.407930][ T6193] lo speed is unknown, defaulting to 1000
[   59.504496][ T6204] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   59.507609][ T6204] IPv6: NLM_F_CREATE should be set when creating new route
[   59.510487][ T6204] IPv6: NLM_F_CREATE should be set when creating new route
[   60.127486][ T6234] __nla_validate_parse: 26 callbacks suppressed
[   60.127495][ T6234] netlink: 12 bytes leftover after parsing attributes in process `syz.1.87'.
[   60.134134][ T6234] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[   60.174948][ T6237] netlink: 52 bytes leftover after parsing attributes in process `syz.2.88'.
[   60.178515][ T6237] netlink: 52 bytes leftover after parsing attributes in process `syz.2.88'.
[   60.185839][ T6237] netlink: 52 bytes leftover after parsing attributes in process `syz.2.88'.
[   60.197644][ T6241] netlink: 8 bytes leftover after parsing attributes in process `syz.1.89'.
[   60.238107][ T6244] netlink: 20 bytes leftover after parsing attributes in process `syz.2.90'.
[   60.248427][ T6244] netlink: 32 bytes leftover after parsing attributes in process `syz.2.90'.
[   60.374507][ T6252] netlink: 4 bytes leftover after parsing attributes in process `syz.1.94'.
[   60.383164][ T6255] netlink: 32 bytes leftover after parsing attributes in process `syz.0.92'.
[   60.524918][ T6262] netlink: 52 bytes leftover after parsing attributes in process `syz.2.96'.
[   60.720858][ T6272] vxcan2: entered promiscuous mode
[   60.757938][ T6274] netlink: 'syz.1.104': attribute type 32 has an invalid length.
[   60.914126][ T6294] netlink: 'syz.1.108': attribute type 3 has an invalid length.
[   61.196527][ T6316] netlink: 'syz.2.116': attribute type 32 has an invalid length.
[   61.229454][ T5845] Bluetooth: hci2: command tx timeout
[   61.230253][ T5852] Bluetooth: hci1: command tx timeout
[   61.240819][ T6320] bond0: (slave tunl0): Error: Device type is different from other slaves
[   61.377104][ T6331] sit1: entered promiscuous mode
[   61.529969][ T6346] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[   61.961595][ T6376] vxcan2: entered promiscuous mode
[   62.363686][ T6399] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   62.406349][ T6401] lo speed is unknown, defaulting to 1000
[   62.516673][ T6409] vxcan2: entered promiscuous mode
[   62.524590][ T6410] vxcan2: entered promiscuous mode
[   62.887915][ T6430] vxcan2: entered promiscuous mode
[   63.087967][ T6437] netlink: zone id is out of range
[   63.089831][ T6437] netlink: zone id is out of range
[   63.091632][ T6437] netlink: set zone limit has 4 unknown bytes
[   63.297630][ T6448] sctp: [Deprecated]: syz.0.158 (pid 6448) Use of struct sctp_assoc_value in delayed_ack socket option.
[   63.297630][ T6448] Use struct sctp_sack_info instead
[   63.319045][ T5852] Bluetooth: hci2: command 0x0405 tx timeout
[   63.471736][ T6461] netlink: 'syz.0.163': attribute type 32 has an invalid length.
[   63.810173][ T6489] netlink: 'syz.1.172': attribute type 5 has an invalid length.
[   63.812675][ T6489] netlink: 'syz.1.172': attribute type 5 has an invalid length.
[   63.892081][ T6493] bridge0: port 3(syz_tun) entered blocking state
[   63.899726][ T6493] bridge0: port 3(syz_tun) entered disabled state
[   63.902615][ T6493] syz_tun: entered allmulticast mode
[   63.906730][ T6493] syz_tun: entered promiscuous mode
[   63.910896][ T6493] bridge0: port 3(syz_tun) entered blocking state
[   63.913246][ T6493] bridge0: port 3(syz_tun) entered forwarding state
[   63.924479][ T6493] delete_channel: no stack
[   64.020184][ T6500] netlink: 'syz.2.177': attribute type 32 has an invalid length.
[   64.278555][ T6527] lo speed is unknown, defaulting to 1000
[   64.381898][   T24] IPVS: starting estimator thread 0...
[   64.489768][ T6530] IPVS: using max 81 ests per chain, 194400 per kthread
[   64.583811][ T5874] IPVS: stop unused estimator thread 0...
[   64.625289][ T6545] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[   64.760533][ T6559] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   65.191693][ T6592] __nla_validate_parse: 45 callbacks suppressed
[   65.191702][ T6592] netlink: 104 bytes leftover after parsing attributes in process `syz.0.201'.
[   65.442228][ T6616] netlink: 28 bytes leftover after parsing attributes in process `syz.2.209'.
[   65.459912][ T6616] netlink: 20 bytes leftover after parsing attributes in process `syz.2.209'.
[   65.463300][ T6616] netlink: 2 bytes leftover after parsing attributes in process `syz.2.209'.
[   65.596744][ T6625] netlink: 12 bytes leftover after parsing attributes in process `syz.0.212'.
[   66.498014][ T6664] netlink: 40 bytes leftover after parsing attributes in process `syz.1.225'.
[   66.507409][ T6665] netlink: 40 bytes leftover after parsing attributes in process `syz.1.225'.
[   66.562764][ T6671] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   66.566123][ T6671] batadv_slave_1: entered promiscuous mode
[   66.570369][ T6671] netlink: 8 bytes leftover after parsing attributes in process `syz.2.228'.
[   66.597971][ T6675] netlink: 4 bytes leftover after parsing attributes in process `syz.2.229'.
[   66.669441][ T6684] tipc: Started in network mode
[   66.671089][ T6684] tipc: Node identity aa1ffda2f0c7, cluster identity 4711
[   66.674080][ T6684] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   66.676562][ T6684] syzkaller0: entered promiscuous mode
[   66.678334][ T6684] syzkaller0: entered allmulticast mode
[   66.683137][ T6684] tipc: Resetting bearer <eth:syzkaller0>
[   66.685701][ T6684] syzkaller0: tun_net_xmit 90
[   66.691336][ T6683] tipc: Resetting bearer <eth:syzkaller0>
[   66.704067][ T6683] tipc: Disabling bearer <eth:syzkaller0>
[   66.823300][ T6697] netlink: 12 bytes leftover after parsing attributes in process `syz.0.234'.
[   67.015281][ T6713] netlink: 'syz.2.237': attribute type 1 has an invalid length.
[   67.033059][ T6713] bond1: entered promiscuous mode
[   67.049204][ T6713] 8021q: adding VLAN 0 to HW filter on device bond1
[   67.081206][ T6713] 8021q: adding VLAN 0 to HW filter on device bond1
[   67.094420][ T6713] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address
[   67.100650][ T6713] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode
[   67.107478][ T6713] bond1: (slave wireguard0): making interface the new active one
[   67.112719][ T6713] wireguard0: entered promiscuous mode
[   67.116290][ T6713] bond1: (slave wireguard0): Enslaving as an active interface with an up link
[   67.132702][ T6719] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   67.135017][ T6719] IPv6: NLM_F_CREATE should be set when creating new route
[   67.137293][ T6719] IPv6: NLM_F_CREATE should be set when creating new route
[   67.927922][ T6764] vxcan2: entered promiscuous mode
[   68.252033][ T6783] lo speed is unknown, defaulting to 1000
[   68.275735][ T6787] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check.
[   68.562858][ T6825] netlink: 'syz.1.279': attribute type 32 has an invalid length.
[   68.700246][ T6837] team0: Device macvlan1 is up. Set it down before adding it as a team port
[   68.795547][ T5870] nci: nci_rsp_packet: unknown rsp opcode 0x73a
[   68.847639][ T6859] netlink: 'syz.1.287': attribute type 32 has an invalid length.
[   68.987901][ T6879] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   69.229942][ T6897] netlink: 'syz.0.297': attribute type 3 has an invalid length.
[   69.444508][ T6914] openvswitch: netlink: Missing key (keys=40, expected=100)
[   69.638212][ T6925] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0)
[   70.371783][ T6947] __nla_validate_parse: 31 callbacks suppressed
[   70.371794][ T6947] netlink: 16 bytes leftover after parsing attributes in process `syz.0.315'.
[   70.565475][ T6956] netlink: 28 bytes leftover after parsing attributes in process `syz.0.319'.
[   70.966276][ T6968] netlink: 60 bytes leftover after parsing attributes in process `syz.0.323'.
[   70.993632][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[   70.996060][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[   71.006213][ T6971] netlink: 'syz.0.324': attribute type 29 has an invalid length.
[   71.154261][ T6979] netlink: 20 bytes leftover after parsing attributes in process `syz.2.328'.
[   71.184598][ T6983] netlink: 4 bytes leftover after parsing attributes in process `syz.0.329'.
[   71.188010][ T6983] netlink: 4 bytes leftover after parsing attributes in process `syz.0.329'.
[   71.195115][ T6986] netlink: 84 bytes leftover after parsing attributes in process `syz.2.330'.
[   71.198813][ T6986] netlink: 84 bytes leftover after parsing attributes in process `syz.2.330'.
[   71.457356][ T7013] netlink: 40 bytes leftover after parsing attributes in process `syz.2.338'.
[   71.460485][ T7013] block nbd0: not configured, cannot reconfigure
[   71.481511][ T7017] lo speed is unknown, defaulting to 1000
[   71.500096][ T7019] Bluetooth: MGMT ver 1.23
[   71.546667][ T7023] vxcan2: entered promiscuous mode
[   71.602935][ T7021] netlink: 20 bytes leftover after parsing attributes in process `syz.1.339'.
[   71.606197][ T7021] netlink: 'syz.1.339': attribute type 13 has an invalid length.
[   71.608654][ T7021] netlink: 'syz.1.339': attribute type 17 has an invalid length.
[   71.637027][ T7021] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   71.761079][ T7040] netlink: 'syz.0.349': attribute type 1 has an invalid length.
[   71.763545][ T7040] netlink: 'syz.0.349': attribute type 1 has an invalid length.
[   71.795128][ T7039] bond2: entered promiscuous mode
[   71.796779][ T7039] bond2: entered allmulticast mode
[   71.800911][ T7039] 8021q: adding VLAN 0 to HW filter on device bond2
[   71.836138][ T7039] lo speed is unknown, defaulting to 1000
[   72.074356][ T7066] syzkaller0: entered promiscuous mode
[   72.076166][ T7066] syzkaller0: entered allmulticast mode
[   72.167972][ T7076] netlink: 'syz.0.360': attribute type 1 has an invalid length.
[   72.171618][ T7076] netlink: 'syz.0.360': attribute type 2 has an invalid length.
[   73.058391][ T7109] vxcan2: entered promiscuous mode
[   73.128794][ T7120] IPv6: sit1: Disabled Multicast RS
[   73.952667][ T7185] IPv6: sit2: Disabled Multicast RS
[   74.508561][ T7211] x_tables: ip_tables: udp match: only valid for protocol 17
[   74.563782][ T7215] IPVS: set_ctl: invalid protocol: 51 255.255.255.255:20003
[   74.613873][ T7219] vxcan2: entered promiscuous mode
[   74.707917][ T7228] netlink: 'syz.0.406': attribute type 32 has an invalid length.
[   75.020580][ T7246] netlink: 'syz.0.411': attribute type 13 has an invalid length.
[   75.064980][ T7246] bridge0: port 2(bridge_slave_1) entered disabled state
[   75.068059][ T7246] bridge0: port 1(bridge_slave_0) entered disabled state
[   75.124464][ T7246] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   75.131469][ T7246] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   75.285129][ T5894] lo speed is unknown, defaulting to 1000
[   75.289328][   T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   75.292205][ T5894] syz2: Port: 1 Link DOWN
[   75.294648][   T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   75.311099][   T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   75.314240][   T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   75.476586][ T7268] __nla_validate_parse: 30 callbacks suppressed
[   75.476596][ T7268] netlink: 4 bytes leftover after parsing attributes in process `syz.2.416'.
[   75.589330][ T7280] netlink: 'syz.1.418': attribute type 32 has an invalid length.
[   76.394828][ T7309] netlink: 16 bytes leftover after parsing attributes in process `syz.2.420'.
[   76.443460][ T7314] netlink: 203516 bytes leftover after parsing attributes in process `syz.2.422'.
[   76.444063][ T7315] tipc: Failed to obtain node identity
[   76.447423][ T7314] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[   76.452114][ T7315] tipc: Enabling of bearer <ib:ip6gre0> rejected, failed to enable media
[   76.453849][ T7314] openvswitch: netlink: Duplicate key (type 0).
[   76.570076][ T7326] netlink: 52 bytes leftover after parsing attributes in process `syz.2.426'.
[   76.573203][ T7326] netlink: 52 bytes leftover after parsing attributes in process `syz.2.426'.
[   76.575909][ T7326] netlink: 52 bytes leftover after parsing attributes in process `syz.2.426'.
[   76.584481][ T7326] netlink: 16 bytes leftover after parsing attributes in process `syz.2.426'.
[   76.702197][ T7335] netlink: 'syz.2.426': attribute type 1 has an invalid length.
[   77.586775][ T7358] netlink: 'syz.1.437': attribute type 32 has an invalid length.
[   77.655155][ T7365] netlink: 52 bytes leftover after parsing attributes in process `syz.2.438'.
[   77.658121][ T7365] netlink: 52 bytes leftover after parsing attributes in process `syz.2.438'.
[   77.663925][ T7365] netlink: 52 bytes leftover after parsing attributes in process `syz.2.438'.
[   77.804717][   T33] audit: type=1800 audit(1755358758.571:2): pid=7384 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.445" name="blkio.bfq.time_recursive" dev="tmpfs" ino=888 res=0 errno=0
[   77.915606][ T7395] netlink: 'syz.2.449': attribute type 3 has an invalid length.
[   78.005108][ T7405] nftables ruleset with unbound chain
[   78.216715][ T7435] netlink: 'syz.1.464': attribute type 21 has an invalid length.
[   78.238053][ T7435] netlink: 'syz.1.464': attribute type 4 has an invalid length.
[   78.252315][ T7435] netlink: 'syz.1.464': attribute type 5 has an invalid length.
[   78.256175][ T7439] siw: device registration error -23
[   78.401350][ T7457] hsr_slave_0: left promiscuous mode
[   78.403920][ T7456] netlink: 'syz.2.472': attribute type 2 has an invalid length.
[   78.409504][ T7457] hsr_slave_1: left promiscuous mode
[   78.626786][ T7478] netlink: 'syz.1.481': attribute type 32 has an invalid length.
[   78.631088][ T7477] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold
[   78.633919][  T976] IPVS: starting estimator thread 0...
[   78.729016][ T7479] IPVS: using max 81 ests per chain, 194400 per kthread
[   78.805892][ T7497] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   78.808537][ T7497] syzkaller0: entered promiscuous mode
[   78.810945][ T7497] syzkaller0: entered allmulticast mode
[   78.825988][ T7497] tipc: Resetting bearer <eth:syzkaller0>
[   78.863024][ T7501] netlink: 'syz.1.488': attribute type 5 has an invalid length.
[   79.136306][ T7507] netlink: 'syz.1.490': attribute type 7 has an invalid length.
[   79.139595][ T7507] netlink: 'syz.1.490': attribute type 8 has an invalid length.
[   79.145041][ T7507] bridge0: entered promiscuous mode
[   79.147934][ T7507] bridge0: left promiscuous mode
[   79.276251][ T7513] nftables ruleset with unbound set
[   79.280593][ T7513] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[   79.376505][ T7519] siw: device registration error -23
[   79.495459][ T7528] vxcan0: entered promiscuous mode
[   79.520795][ T7486] tipc: Resetting bearer <eth:syzkaller0>
[   79.527144][ T7486] tipc: Disabling bearer <eth:syzkaller0>
[   80.286444][ T7551] bridge0: entered promiscuous mode
[   80.291690][ T7551] bridge0: left promiscuous mode
[   80.356196][ T7553] IPv6: NLM_F_CREATE should be specified when creating new route
[   80.482400][ T7564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   80.644771][ T7581] __nla_validate_parse: 34 callbacks suppressed
[   80.644785][ T7581] netlink: 40 bytes leftover after parsing attributes in process `syz.0.513'.
[   80.653428][ T7581] netlink: 168864 bytes leftover after parsing attributes in process `syz.0.513'.
[   80.659384][ T7584] netlink: 40 bytes leftover after parsing attributes in process `syz.0.513'.
[   80.783539][ T7587] netlink: 20 bytes leftover after parsing attributes in process `syz.0.514'.
[   80.853897][ T7591] lo speed is unknown, defaulting to 1000
[   80.892849][ T7596] netlink: 12 bytes leftover after parsing attributes in process `syz.0.516'.
[   81.171642][ T7630] warning: `syz.1.522' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   81.212444][ T7633] netlink: 12 bytes leftover after parsing attributes in process `syz.2.523'.
[   81.227131][ T7633] netlink: 12 bytes leftover after parsing attributes in process `syz.2.523'.
[   81.250326][   T10] cfg80211: failed to load regulatory.db
[   81.262360][ T7633] netlink: 12 bytes leftover after parsing attributes in process `syz.2.523'.
[   81.317908][ T7640] netlink: 52 bytes leftover after parsing attributes in process `syz.2.525'.
[   81.323702][ T7640] netlink: 52 bytes leftover after parsing attributes in process `syz.2.525'.
[   81.809241][ T7687] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[   81.858724][ T7703] bridge0: entered promiscuous mode
[   81.864014][ T7703] bridge0: left promiscuous mode
[   82.102332][ T7729] RDS: rds_bind could not find a transport for ::ffff:172.30.1.2, load rds_tcp or rds_rdma?
[   82.594336][ T7773] validate_nla: 9 callbacks suppressed
[   82.594345][ T7773] netlink: 'syz.1.565': attribute type 142 has an invalid length.
[   82.879473][ T7799] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   82.943240][ T7805] netlink: 'syz.2.577': attribute type 5 has an invalid length.
[   82.955196][ T7805] netlink: 'syz.2.577': attribute type 5 has an invalid length.
[   83.137146][ T7821] netlink: 'syz.1.583': attribute type 32 has an invalid length.
[   83.305514][ T7841] Driver unsupported XDP return value 0 on prog  (id 181) dev N/A, expect packet loss!
[   83.398623][ T7859] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[   83.405178][ T7859] syzkaller1: entered promiscuous mode
[   83.407087][ T7859] syzkaller1: entered allmulticast mode
[   83.713234][ T7872] netlink: 'syz.0.595': attribute type 32 has an invalid length.
[   83.778078][ T7881] netlink: 'syz.2.598': attribute type 7 has an invalid length.
[   83.791421][ T7881] netlink: 'syz.2.598': attribute type 8 has an invalid length.
[   83.805652][ T7881] bridge0: entered promiscuous mode
[   83.810652][ T7881] syz_tun: entered promiscuous mode
[   83.814907][ T7881] bridge0: left promiscuous mode
[   83.820872][ T7881] syz_tun: left promiscuous mode
[   83.857314][ T7886] netlink: 'syz.1.599': attribute type 10 has an invalid length.
[   83.861606][ T7886] team0: Device ipvlan1 failed to register rx_handler
[   83.913178][ T7891] netlink: 'syz.1.601': attribute type 10 has an invalid length.
[   83.914382][ T7892] netlink: 'syz.2.602': attribute type 21 has an invalid length.
[   84.248136][ T7934] vxcan2: entered promiscuous mode
[   86.954957][ T7945] bridge0: entered promiscuous mode
[   86.960744][ T7945] syz_tun: entered promiscuous mode
[   87.262219][ T7945] bridge0: left promiscuous mode
[   87.265055][ T7945] syz_tun: left promiscuous mode
[   87.466886][ T7957] syzkaller0: entered promiscuous mode
[   87.474883][ T7957] syzkaller0: entered allmulticast mode
[   87.482155][ T7963] __nla_validate_parse: 51 callbacks suppressed
[   87.482168][ T7963] netlink: 48 bytes leftover after parsing attributes in process `syz.0.621'.
[   87.862468][ T7981] netlink: 20 bytes leftover after parsing attributes in process `syz.2.626'.
[   88.287419][ T7970] netlink: 84 bytes leftover after parsing attributes in process `syz.1.623'.
[   88.291228][ T7970] netlink: 84 bytes leftover after parsing attributes in process `syz.1.623'.
[   88.343101][ T7985] netlink: 8 bytes leftover after parsing attributes in process `syz.1.628'.
[   88.423384][ T7991] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.631'.
[   88.464923][ T7995] netlink: 28 bytes leftover after parsing attributes in process `syz.0.633'.
[   88.468439][ T7995] validate_nla: 6 callbacks suppressed
[   88.468447][ T7995] netlink: 'syz.0.633': attribute type 7 has an invalid length.
[   88.473638][ T7995] netlink: 'syz.0.633': attribute type 8 has an invalid length.
[   88.477479][ T7995] netlink: 4 bytes leftover after parsing attributes in process `syz.0.633'.
[   88.498300][ T7995] bridge0: entered promiscuous mode
[   88.501178][ T7995] syz_tun: entered promiscuous mode
[   88.503491][ T7995] bridge0: left promiscuous mode
[   88.505591][ T7995] syz_tun: left promiscuous mode
[   88.570207][ T8001] netlink: 8 bytes leftover after parsing attributes in process `syz.2.634'.
[   88.762702][ T8007] netlink: 'syz.1.638': attribute type 32 has an invalid length.
[   88.964128][ T8022] netlink: 84 bytes leftover after parsing attributes in process `syz.2.641'.
[   89.023594][ T8023] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[   89.469676][ T8049] vxcan2: entered promiscuous mode
[   89.686346][ T8053] netlink: 'syz.0.647': attribute type 5 has an invalid length.
[   89.886759][ T8058] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   90.093187][ T8080] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   90.096264][ T8080] IPv6: NLM_F_CREATE should be set when creating new route
[   90.098720][ T8080] IPv6: NLM_F_CREATE should be set when creating new route
[   90.214593][ T8090] netlink: 'syz.1.660': attribute type 11 has an invalid length.
[   90.915735][ T8138] netlink: 'syz.1.671': attribute type 32 has an invalid length.
[   91.233193][ T8164] tipc: Started in network mode
[   91.235417][ T8164] tipc: Node identity 6a79ece287cf, cluster identity 4711
[   91.238630][ T8164] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   91.253402][ T8164] netlink: 'syz.1.678': attribute type 1 has an invalid length.
[   91.258051][ T8164] tipc: Resetting bearer <eth:syzkaller0>
[   91.262541][ T8163] tipc: Disabling bearer <eth:syzkaller0>
[   91.428302][ T8180] netlink: 'syz.1.685': attribute type 7 has an invalid length.
[   91.434348][ T8180] netlink: 'syz.1.685': attribute type 8 has an invalid length.
[   91.440616][ T8180] bridge0: entered promiscuous mode
[   91.444736][ T8180] bridge0: left promiscuous mode
[   92.192826][ T8243] veth0_to_team: entered promiscuous mode
[   92.289825][ T8254] lo speed is unknown, defaulting to 1000
[   92.531133][ T8267] __nla_validate_parse: 31 callbacks suppressed
[   92.531142][ T8267] netlink: 20 bytes leftover after parsing attributes in process `syz.1.711'.
[   92.537427][ T8267] netlink: 12 bytes leftover after parsing attributes in process `syz.1.711'.
[   92.564406][ T8267] netlink: 'syz.1.711': attribute type 1 has an invalid length.
[   92.567376][ T8267] netlink: 'syz.1.711': attribute type 1 has an invalid length.
[   92.571720][ T8267] netlink: 32 bytes leftover after parsing attributes in process `syz.1.711'.
[   92.802515][ T8285] netlink: 28 bytes leftover after parsing attributes in process `syz.0.718'.
[   92.806554][ T8285] netlink: 4 bytes leftover after parsing attributes in process `syz.0.718'.
[   92.816736][ T8285] bridge0: entered promiscuous mode
[   92.819954][ T8285] syz_tun: entered promiscuous mode
[   92.907034][ T8285] bridge0: left promiscuous mode
[   92.914275][ T8285] syz_tun: left promiscuous mode
[   92.976701][ T8289] netlink: 44 bytes leftover after parsing attributes in process `syz.1.720'.
[   93.035717][ T8291] 8021q: adding VLAN 0 to HW filter on device bond1
[   93.205252][ T8312] netlink: 52 bytes leftover after parsing attributes in process `syz.2.728'.
[   93.208778][ T8312] netlink: 52 bytes leftover after parsing attributes in process `syz.2.728'.
[   93.212486][ T8312] netlink: 52 bytes leftover after parsing attributes in process `syz.2.728'.
[   93.216989][ T8312] netlink: 16 bytes leftover after parsing attributes in process `syz.2.728'.
[   93.386914][ T8324] bridge0: entered promiscuous mode
[   93.391318][ T8324] syz_tun: entered promiscuous mode
[   93.393863][ T8324] bridge0: left promiscuous mode
[   93.396315][ T8324] syz_tun: left promiscuous mode
[   93.975680][ T8339] syzkaller1: entered promiscuous mode
[   93.977651][ T8339] syzkaller1: entered allmulticast mode
[   93.982414][ T8339] validate_nla: 5 callbacks suppressed
[   93.982445][ T8339] netlink: 'syz.1.736': attribute type 9 has an invalid length.
[   93.987190][ T8339] netlink: 'syz.1.736': attribute type 7 has an invalid length.
[   93.990126][ T8339] netlink: 'syz.1.736': attribute type 8 has an invalid length.
[   94.121199][ T8351] 8021q: VLANs not supported on ipvlan1
[   94.151699][ T8357] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551612)
[   94.166690][ T8357] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647
[   94.181206][ T8363] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551612)
[   94.184727][ T8363] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647
[   94.419013][ T8392] netlink: 'syz.2.754': attribute type 32 has an invalid length.
[   95.383738][ T8458] netlink: 'syz.1.774': attribute type 3 has an invalid length.
[   95.388797][ T8458] netlink: 'syz.1.774': attribute type 7 has an invalid length.
[   95.398225][ T8458] netlink: 'syz.1.774': attribute type 8 has an invalid length.
[   95.412524][ T8458] bridge0: entered promiscuous mode
[   95.415236][ T8458] bridge0: left promiscuous mode
[   95.723961][  T976] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0
[   95.738461][  T976] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[   95.848370][ T8499] lo speed is unknown, defaulting to 1000
[   95.949884][ T8499] nft_compat: unsupported protocol 0
[   95.967597][   T47] IPVS: starting estimator thread 0...
[   95.974657][ T8499] netlink: 'syz.1.790': attribute type 1 has an invalid length.
[   95.984511][ T8499] netlink: 'syz.1.790': attribute type 1 has an invalid length.
[   96.059041][ T8504] IPVS: using max 81 ests per chain, 194400 per kthread
[   96.181896][ T8510] netlink: 'syz.1.794': attribute type 37 has an invalid length.
[   96.253320][   T13] IPVS: stop unused estimator thread 0...
[   96.841973][ T8545] lo speed is unknown, defaulting to 1000
[   96.955902][ T8539] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   97.218160][ T8567] infiniband syz1: set active
[   97.221743][ T8567] infiniband syz1: added macvlan1
[   97.257054][ T8567] RDS/IB: syz1: added
[   97.258770][ T8567] smc: adding ib device syz1 with port count 1
[   97.261108][ T8567] smc:    ib device syz1 port 1 has pnetid 
[   97.548108][ T8583] __nla_validate_parse: 149 callbacks suppressed
[   97.548122][ T8583] netlink: 28 bytes leftover after parsing attributes in process `syz.2.815'.
[   97.569730][ T8583] bridge1: port 1(veth0_to_bond) entered blocking state
[   97.572477][ T8583] bridge1: port 1(veth0_to_bond) entered disabled state
[   97.575161][ T8583] veth0_to_bond: entered allmulticast mode
[   97.578648][ T8583] veth0_to_bond: entered promiscuous mode
[   97.699853][ T8588] netlink: 180 bytes leftover after parsing attributes in process `syz.0.818'.
[   97.962523][ T8618] netlink: 52 bytes leftover after parsing attributes in process `syz.0.827'.
[   97.965491][ T8618] netlink: 52 bytes leftover after parsing attributes in process `syz.0.827'.
[   97.968241][ T8618] netlink: 52 bytes leftover after parsing attributes in process `syz.0.827'.
[   97.973853][ T8618] netlink: 16 bytes leftover after parsing attributes in process `syz.0.827'.
[   98.168424][ T8633] netlink: 80 bytes leftover after parsing attributes in process `syz.0.833'.
[   98.178481][ T8633] netlink: 28 bytes leftover after parsing attributes in process `syz.0.833'.
[   98.219430][ T8638] netlink: 12 bytes leftover after parsing attributes in process `syz.0.834'.
[   98.222682][ T8638] netlink: 12 bytes leftover after parsing attributes in process `syz.0.834'.
[   99.018223][ T8716] validate_nla: 12 callbacks suppressed
[   99.018237][ T8716] netlink: 'syz.1.858': attribute type 2 has an invalid length.
[   99.146885][ T8730] openvswitch: netlink: IPv4 tun info is not correct
[   99.205431][ T8734] netlink: 'syz.2.865': attribute type 1 has an invalid length.
[   99.220649][ T8734] 8021q: adding VLAN 0 to HW filter on device bond3
[   99.233642][ T8734] bond3: (slave bridge3): making interface the new active one
[   99.236963][ T8734] bond3: (slave bridge3): Enslaving as an active interface with an up link
[   99.246950][ T8734] bond3: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[   99.643257][ T8759] af_packet: tpacket_rcv: packet too big, clamped from 32 to 4294967272. macoff=96
[   99.692299][ T8763] netlink: 'syz.2.876': attribute type 1 has an invalid length.
[  100.036164][ T8794] dvmrp1: tun_chr_ioctl cmd 1074025677
[  100.038478][ T8794] dvmrp1: linktype set to 773
[  100.085608][ T8801] vxcan2: entered promiscuous mode
[  100.154068][ T8804] IPVS: set_ctl: invalid protocol: 79 172.30.1.2:20003
[  100.665985][ T8846] netlink: 'syz.2.906': attribute type 10 has an invalid length.
[  100.668656][ T8846] dummy0: entered promiscuous mode
[  100.671781][ T8846] dummy0: entered allmulticast mode
[  100.674561][ T8846] bridge0: port 3(dummy0) entered blocking state
[  100.676655][ T8846] bridge0: port 3(dummy0) entered disabled state
[  100.681563][ T8846] bridge0: port 3(dummy0) entered blocking state
[  100.683645][ T8846] bridge0: port 3(dummy0) entered forwarding state
[  100.692051][ T8846] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  100.745693][ T8850] trusted_key: syz.2.908 sent an empty control message without MSG_MORE.
[  101.356733][ T8902] lo speed is unknown, defaulting to 1000
[  101.553245][ T8917] sctp: [Deprecated]: syz.0.918 (pid 8917) Use of int in max_burst socket option.
[  101.553245][ T8917] Use struct sctp_assoc_value instead
[  101.572227][ T8904] netlink: 'syz.1.916': attribute type 13 has an invalid length.
[  101.578575][ T8904] netlink: 'syz.1.916': attribute type 17 has an invalid length.
[  101.599887][ T8904] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  101.731049][ T8928] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0
[  101.736085][ T8927] IPVS: stopping master sync thread 8928 ...
[  102.181471][ T8945] netlink: 'syz.2.927': attribute type 32 has an invalid length.
[  102.535782][ T8963] netlink: 'syz.0.932': attribute type 3 has an invalid length.
[  102.569946][ T8967] __nla_validate_parse: 27 callbacks suppressed
[  102.569955][ T8967] netlink: 64 bytes leftover after parsing attributes in process `syz.0.933'.
[  102.576658][ T8967] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.933'.
[  102.622629][ T8971] netlink: 12 bytes leftover after parsing attributes in process `syz.0.934'.
[  102.636341][ T8971] netlink: 'syz.0.934': attribute type 1 has an invalid length.
[  102.658345][ T8975] netlink: 8 bytes leftover after parsing attributes in process `syz.0.935'.
[  102.800277][ T8980] netlink: 8 bytes leftover after parsing attributes in process `syz.1.937'.
[  102.858048][ T8986] netlink: 8 bytes leftover after parsing attributes in process `syz.1.939'.
[  102.936708][ T8992] netlink: 28 bytes leftover after parsing attributes in process `syz.1.942'.
[  102.941938][ T8992] netlink: 'syz.1.942': attribute type 7 has an invalid length.
[  102.944698][ T8992] netlink: 4 bytes leftover after parsing attributes in process `syz.1.942'.
[  102.951733][ T8992] bridge0: entered promiscuous mode
[  102.954503][ T8992] bridge0: left promiscuous mode
[  103.127225][ T8996] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  103.134616][ T8996] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  103.140713][ T8996] bond0 (unregistering): Released all slaves
[  103.310519][ T9008] lo speed is unknown, defaulting to 1000
[  103.579394][ T9022] netlink: 52 bytes leftover after parsing attributes in process `syz.2.951'.
[  103.582534][ T9022] netlink: 52 bytes leftover after parsing attributes in process `syz.2.951'.
[  103.629125][ T9012] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  103.671289][ T9035] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  103.795665][ T9051] bridge0: entered promiscuous mode
[  103.801121][ T9051] bridge0: left promiscuous mode
[  103.957485][ T9067] 8021q: VLANs not supported on ip6_vti0
[  104.459218][ T9093] validate_nla: 6 callbacks suppressed
[  104.459227][ T9093] netlink: 'syz.1.970': attribute type 7 has an invalid length.
[  104.464198][ T9093] netlink: 'syz.1.970': attribute type 8 has an invalid length.
[  104.470399][ T9093] bridge0: entered promiscuous mode
[  104.473257][ T9093] bridge0: left promiscuous mode
[  104.482789][ T9096] smc: removing ib device syz1
[  104.556602][ T9101] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[  104.775276][ T9112] netlink: 'syz.1.976': attribute type 1 has an invalid length.
[  104.806186][ T9112] 8021q: adding VLAN 0 to HW filter on device bond0
[  104.843331][ T9112] bond0: (slave veth3): Enslaving as an active interface with a down link
[  104.858716][ T9112] 8021q: adding VLAN 0 to HW filter on device batadv1
[  104.894920][ T9112] bond0: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open
[  105.019687][ T9118] netlink: 'syz.2.978': attribute type 32 has an invalid length.
[  105.282049][ T9155] IPv6: sit1: Disabled Multicast RS
[  105.401635][ T9174] netlink: 'syz.1.991': attribute type 32 has an invalid length.
[  105.714502][ T9204] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048)
[  105.778337][ T9217] netlink: 'syz.1.1002': attribute type 32 has an invalid length.
[  105.819829][ T9213] 8021q: adding VLAN 0 to HW filter on device bond4
[  105.823828][ T9213] bridge0: port 4(bond4) entered blocking state
[  105.827210][ T9213] bridge0: port 4(bond4) entered disabled state
[  105.830157][ T9213] bond4: entered allmulticast mode
[  105.834066][ T9213] bond4: entered promiscuous mode
[  105.836713][ T9213] bridge0: port 4(bond4) entered blocking state
[  105.839522][ T9213] bridge0: port 4(bond4) entered forwarding state
[  105.847101][ T9214] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR
[  105.963706][   T27] bridge0: port 4(bond4) entered disabled state
[  106.172303][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  106.176530][   T55] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  106.180545][   T55] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  106.185339][   T55] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  106.191811][   T55] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  106.226599][ T9243] lo speed is unknown, defaulting to 1000
[  106.290718][ T9251] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input5
[  106.339901][ T5855] bridge_slave_1: left allmulticast mode
[  106.342000][ T5855] bridge_slave_1: left promiscuous mode
[  106.344946][ T5855] bridge0: port 2(bridge_slave_1) entered disabled state
[  106.349853][ T5855] bridge_slave_0: left allmulticast mode
[  106.354315][ T5855] bridge_slave_0: left promiscuous mode
[  106.358564][ T5855] bridge0: port 1(bridge_slave_0) entered disabled state
[  106.436212][ T9260] netlink: 'syz.1.1014': attribute type 32 has an invalid length.
[  106.642816][ T5855] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  106.647410][ T5855] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  106.652020][ T5855] bond0 (unregistering): Released all slaves
[  106.660151][ T5855] bond1 (unregistering): Released all slaves
[  106.677833][ T9243] chnl_net:caif_netlink_parms(): no params data found
[  106.751029][ T5855] tipc: Left network mode
[  106.793457][ T9243] bridge0: port 1(bridge_slave_0) entered blocking state
[  106.795932][ T9243] bridge0: port 1(bridge_slave_0) entered disabled state
[  106.798683][ T9243] bridge_slave_0: entered allmulticast mode
[  106.801781][ T9243] bridge_slave_0: entered promiscuous mode
[  106.806017][ T9243] bridge0: port 2(bridge_slave_1) entered blocking state
[  106.808461][ T9243] bridge0: port 2(bridge_slave_1) entered disabled state
[  106.811736][ T9243] bridge_slave_1: entered allmulticast mode
[  106.814673][ T9243] bridge_slave_1: entered promiscuous mode
[  106.818219][ T9278] openvswitch: netlink: IP tunnel dst address not specified
[  106.826709][ T9278] netlink: 'syz.1.1017': attribute type 3 has an invalid length.
[  106.855704][ T9243] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  106.862520][ T9243] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  106.911354][ T9243] team0: Port device team_slave_0 added
[  106.914661][ T9243] team0: Port device team_slave_1 added
[  106.947525][ T9243] batman_adv: batadv0: Adding interface: batadv_slave_0
[  106.951052][ T9243] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  106.959642][ T9243] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  106.967099][ T5855] batman_adv: batadv0: Removing interface: batadv_slave_0
[  106.972550][ T5855] batman_adv: batadv0: Removing interface: batadv_slave_1
[  107.182490][ T5855] team0 (unregistering): Port device team_slave_1 removed
[  107.197055][ T5855] team0 (unregistering): Port device team_slave_0 removed
[  107.388295][ T9243] batman_adv: batadv0: Adding interface: batadv_slave_1
[  107.390947][ T9243] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  107.399182][ T9243] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  107.426029][ T9306] vxcan0: entered promiscuous mode
[  107.460980][ T9243] hsr_slave_0: entered promiscuous mode
[  107.463522][ T9243] hsr_slave_1: entered promiscuous mode
[  107.465984][ T9243] debugfs: 'hsr0' already exists in 'hsr'
[  107.467970][ T9243] Cannot create hsr debugfs directory
[  107.490151][ T9309] vxcan2: entered promiscuous mode
[  107.555616][ T9313] netlink: 'syz.2.1027': attribute type 2 has an invalid length.
[  107.558154][ T9313] netlink: 'syz.2.1027': attribute type 3 has an invalid length.
[  107.600769][ T9243] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  107.605341][ T9318] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  107.611953][ T9243] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  107.620156][ T9243] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  107.629869][ T9243] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  107.678390][ T9243] 8021q: adding VLAN 0 to HW filter on device bond0
[  107.692584][ T9243] 8021q: adding VLAN 0 to HW filter on device team0
[  107.698416][ T1091] bridge0: port 1(bridge_slave_0) entered blocking state
[  107.700867][ T1091] bridge0: port 1(bridge_slave_0) entered forwarding state
[  107.717871][ T1091] bridge0: port 2(bridge_slave_1) entered blocking state
[  107.720342][ T1091] bridge0: port 2(bridge_slave_1) entered forwarding state
[  107.725130][ T9334] __nla_validate_parse: 39 callbacks suppressed
[  107.725137][ T9334] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1032'.
[  107.735654][ T5855] IPVS: stop unused estimator thread 0...
[  107.755849][ T9334] netlink: 488 bytes leftover after parsing attributes in process `syz.1.1032'.
[  107.760849][ T9243] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  107.831041][ T9348] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1034'.
[  107.835292][ T9348] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1034'.
[  107.857981][ T9243] 8021q: adding VLAN 0 to HW filter on device batadv0
[  107.883352][ T9243] veth0_vlan: entered promiscuous mode
[  107.888024][ T9243] veth1_vlan: entered promiscuous mode
[  107.902837][ T9243] veth0_macvtap: entered promiscuous mode
[  107.906973][ T9243] veth1_macvtap: entered promiscuous mode
[  107.916613][ T9243] batman_adv: batadv0: Interface activated: batadv_slave_0
[  107.922912][ T9243] batman_adv: batadv0: Interface activated: batadv_slave_1
[  107.930356][ T5855] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  107.936828][ T5855] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  107.943131][ T5855] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  107.946828][ T5855] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  108.269106][   T55] Bluetooth: hci1: command tx timeout
[  108.442501][  T744] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  108.447755][  T744] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  108.469221][  T744] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  108.472480][  T744] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  108.532112][ T9364] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1037'.
[  108.554973][ T9366] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.1038'.
[  108.555586][ T9361] bond5: (slave gretap1): making interface the new active one
[  108.562084][ T9361] bond5: (slave gretap1): Enslaving as an active interface with an up link
[  108.570689][ T9361] vlan2: entered allmulticast mode
[  108.572575][ T9361] bond5: entered allmulticast mode
[  108.574288][ T9361] gretap1: entered allmulticast mode
[  108.576631][ T9361] bond5: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  108.628954][ T9361] netlink: 172 bytes leftover after parsing attributes in process `syz.2.1036'.
[  108.640091][ T9361] netlink: 172 bytes leftover after parsing attributes in process `syz.2.1036'.
[  108.640141][ T9383] lo speed is unknown, defaulting to 1000
[  108.645271][ T9383] lo speed is unknown, defaulting to 1000
[  108.647581][ T9383] lo speed is unknown, defaulting to 1000
[  108.658758][ T9383] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  108.661199][ T9385] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1044'.
[  108.661217][ T9385] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1044'.
[  108.663919][ T9385] bridge0: entered promiscuous mode
[  108.670903][ T9385] syz_tun: entered promiscuous mode
[  108.673080][ T9385] bridge0: left promiscuous mode
[  108.675106][ T9385] syz_tun: left promiscuous mode
[  108.681880][ T9383] lo speed is unknown, defaulting to 1000
[  108.685441][ T9383] lo speed is unknown, defaulting to 1000
[  108.688252][ T9383] lo speed is unknown, defaulting to 1000
[  109.261388][ T9440] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  109.422924][ T9457] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  109.430772][ T9457] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048)
[  109.865693][ T9486] validate_nla: 11 callbacks suppressed
[  109.865704][ T9486] netlink: 'syz.3.1075': attribute type 32 has an invalid length.
[  110.058274][ T9503] netlink: 'syz.1.1079': attribute type 21 has an invalid length.
[  110.341523][ T9530] vxcan2: entered promiscuous mode
[  110.352201][   T55] Bluetooth: hci1: command tx timeout
[  110.410627][ T9543] team0: Device gtp0 is of different type
[  110.520756][ T9557] netem: invalid attributes len -16
[  110.522554][ T9557] netem: change failed
[  110.596347][ T9571] netlink: 'syz.1.1103': attribute type 5 has an invalid length.
[  110.600840][ T9571] netlink: 'syz.1.1103': attribute type 5 has an invalid length.
[  110.702375][ T9589] lo speed is unknown, defaulting to 1000
[  110.913316][ T9612] netlink: 'syz.1.1114': attribute type 8 has an invalid length.
[  111.385855][ T9624] batadv_slave_0: entered promiscuous mode
[  111.388639][ T9624] netlink: 'syz.3.1119': attribute type 5 has an invalid length.
[  111.392886][ T9623] batadv_slave_0: left promiscuous mode
[  111.521417][ T9633] netlink: 'syz.3.1122': attribute type 1 has an invalid length.
[  111.524655][ T9633] netlink: 'syz.3.1122': attribute type 2 has an invalid length.
[  111.548236][ T9637] siw: device registration error -23
[  111.774506][ T9650] netlink: 'syz.2.1127': attribute type 32 has an invalid length.
[  112.057761][ T9671] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:1)
[  112.263485][ T9680] netlink: 'syz.1.1130': attribute type 4 has an invalid length.
[  112.314512][   T24] lo speed is unknown, defaulting to 1000
[  112.316477][   T24] syz2: Port: 1 Link DOWN
[  112.329708][   T24] lo speed is unknown, defaulting to 1000
[  112.332621][   T24] syz2: Port: 1 Link ACTIVE
[  112.429753][   T55] Bluetooth: hci1: command tx timeout
[  112.564210][ T9693] bridge0: entered promiscuous mode
[  112.570729][ T9693] bridge0: left promiscuous mode
[  112.686157][ T9703] : entered promiscuous mode
[  112.703111][ T9703] bridge0: port 3(syz_tun) entered disabled state
[  112.751726][ T9712] lo speed is unknown, defaulting to 1000
[  112.931120][ T9712] __nla_validate_parse: 94 callbacks suppressed
[  112.931130][ T9712] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1141'.
[  112.974034][ T9738] netlink: 488 bytes leftover after parsing attributes in process `syz.3.1150'.
[  113.041075][ T9744] vxcan2: entered promiscuous mode
Connection to localhost closed by remote host.
[  113.180065][ T5843] syz_tun (unregistering): left allmulticast mode
[  113.182325][ T5843] syz_tun (unregistering): left promiscuous mode
[  113.184405][ T5843] bridge0: port 3(syz_tun) entered disabled state
[  113.244826][ T9253] ==================================================================
[  113.247481][ T9253] BUG: KASAN: slab-use-after-free in __mutex_lock+0x7fc/0x1360
[  113.249967][ T9253] Read of size 8 at addr ffff88810e71c0a0 by task khidpd_15c25886/9253
[  113.253978][ T9253] 
[  113.254815][ T9253] CPU: 0 UID: 0 PID: 9253 Comm: khidpd_15c25886 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59-dirty #0 PREEMPT(full) 
[  113.254825][ T9253] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  113.254829][ T9253] Call Trace:
[  113.254833][ T9253]  <TASK>
[  113.254836][ T9253]  dump_stack_lvl+0x189/0x250
[  113.254848][ T9253]  ? __kasan_check_byte+0x12/0x40
[  113.254858][ T9253]  ? __pfx_dump_stack_lvl+0x10/0x10
[  113.254865][ T9253]  ? lock_release+0x4b/0x3e0
[  113.254875][ T9253]  ? __virt_addr_valid+0x4a5/0x5c0
[  113.254884][ T9253]  print_report+0xca/0x240
[  113.254890][ T9253]  ? __mutex_lock+0x7fc/0x1360
[  113.254899][ T9253]  kasan_report+0x118/0x150
[  113.254907][ T9253]  ? __mutex_lock+0x7fc/0x1360
[  113.254916][ T9253]  __mutex_lock+0x7fc/0x1360
[  113.254925][ T9253]  ? __mutex_lock+0x5b6/0x1360
[  113.254934][ T9253]  ? l2cap_unregister_user+0x6a/0x1b0
[  113.254943][ T9253]  ? __pfx___mutex_lock+0x10/0x10
[  113.254952][ T9253]  ? __pfx___timer_delete_sync+0x10/0x10
[  113.254962][ T9253]  l2cap_unregister_user+0x6a/0x1b0
[  113.254969][ T9253]  hidp_session_thread+0x3c9/0x410
[  113.254978][ T9253]  ? __pfx_hidp_session_thread+0x10/0x10
[  113.254985][ T9253]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  113.254992][ T9253]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  113.255000][ T9253]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  113.255008][ T9253]  ? __kthread_parkme+0x7b/0x200
[  113.255015][ T9253]  ? __kthread_parkme+0x1a1/0x200
[  113.255022][ T9253]  kthread+0x711/0x8a0
[  113.255030][ T9253]  ? __pfx_hidp_session_thread+0x10/0x10
[  113.255038][ T9253]  ? __pfx_kthread+0x10/0x10
[  113.255050][ T9253]  ? _raw_spin_unlock_irq+0x23/0x50
[  113.255061][ T9253]  ? lockdep_hardirqs_on+0x9c/0x150
[  113.255073][ T9253]  ? __pfx_kthread+0x10/0x10
[  113.255082][ T9253]  ret_from_fork+0x3fc/0x770
[  113.255089][ T9253]  ? __pfx_ret_from_fork+0x10/0x10
[  113.255096][ T9253]  ? __switch_to_asm+0x39/0x70
[  113.255104][ T9253]  ? __switch_to_asm+0x33/0x70
[  113.255111][ T9253]  ? __pfx_kthread+0x10/0x10
[  113.255118][ T9253]  ret_from_fork_asm+0x1a/0x30
[  113.255133][ T9253]  </TASK>
[  113.255137][ T9253] 
[  113.326050][ T9253] Allocated by task 9243:
[  113.327470][ T9253]  kasan_save_track+0x3e/0x80
[  113.328985][ T9253]  __kasan_kmalloc+0x93/0xb0
[  113.330543][ T9253]  __kmalloc_noprof+0x27a/0x4f0
[  113.332296][ T9253]  hci_alloc_dev_priv+0x28/0x2060
[  113.333912][ T9253]  vhci_create_device+0x120/0x6e0
[  113.335539][ T9253]  vhci_write+0x3ce/0x4a0
[  113.337039][ T9253]  vfs_write+0x5c9/0xb30
[  113.338558][ T9253]  ksys_write+0x145/0x250
[  113.339936][ T9253]  do_syscall_64+0xfa/0x3b0
[  113.341360][ T9253]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  113.343223][ T9253] 
[  113.343990][ T9253] Freed by task 9243:
[  113.345267][ T9253]  kasan_save_track+0x3e/0x80
[  113.346752][ T9253]  kasan_save_free_info+0x46/0x50
[  113.348368][ T9253]  __kasan_slab_free+0x5b/0x80
[  113.350027][ T9253]  kfree+0x18e/0x440
[  113.351627][ T9253]  bt_host_release+0x82/0x90
[  113.353470][ T9253]  device_release+0x9c/0x1c0
[  113.355208][ T9253]  kobject_put+0x22b/0x480
[  113.356931][ T9253]  vhci_release+0x88/0xd0
[  113.358740][ T9253]  __fput+0x44c/0xa70
[  113.360391][ T9253]  task_work_run+0x1d4/0x260
[  113.362024][ T9253]  do_exit+0x6b5/0x2300
[  113.363471][ T9253]  do_group_exit+0x21c/0x2d0
[  113.365207][ T9253]  __x64_sys_exit_group+0x3f/0x40
[  113.367062][ T9253]  x64_sys_call+0x21f7/0x2200
[  113.368790][ T9253]  do_syscall_64+0xfa/0x3b0
[  113.370314][ T9253]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  113.372437][ T9253] 
[  113.373330][ T9253] Last potentially related work creation:
[  113.375408][ T9253]  kasan_save_stack+0x3e/0x60
[  113.376963][ T9253]  kasan_record_aux_stack+0xbd/0xd0
[  113.378634][ T9253]  insert_work+0x3d/0x330
[  113.380067][ T9253]  __queue_work+0xbaf/0xfb0
[  113.381683][ T9253]  queue_work_on+0x181/0x270
[  113.383342][ T9253]  process_scheduled_works+0xae1/0x17b0
[  113.385278][ T9253]  worker_thread+0x8a0/0xda0
[  113.386967][ T9253]  kthread+0x711/0x8a0
[  113.388412][ T9253]  ret_from_fork+0x3fc/0x770
[  113.390069][ T9253]  ret_from_fork_asm+0x1a/0x30
[  113.391758][ T9253] 
[  113.392648][ T9253] Second to last potentially related work creation:
[  113.394985][ T9253]  kasan_save_stack+0x3e/0x60
[  113.396742][ T9253]  kasan_record_aux_stack+0xbd/0xd0
[  113.398510][ T9253]  insert_work+0x3d/0x330
[  113.400149][ T9253]  __queue_work+0xcd2/0xfb0
[  113.401705][ T9253]  call_timer_fn+0x17e/0x5f0
[  113.403253][ T9253]  __run_timer_base+0x646/0x860
[  113.405096][ T9253]  run_timer_softirq+0xb7/0x180
[  113.406822][ T9253]  handle_softirqs+0x286/0x870
[  113.408571][ T9253]  __irq_exit_rcu+0xca/0x1f0
[  113.410155][ T9253]  irq_exit_rcu+0x9/0x30
[  113.411612][ T9253]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  113.413483][ T9253]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  113.415659][ T9253] 
[  113.416517][ T9253] The buggy address belongs to the object at ffff88810e71c000
[  113.416517][ T9253]  which belongs to the cache kmalloc-8k of size 8192
[  113.421700][ T9253] The buggy address is located 160 bytes inside of
[  113.421700][ T9253]  freed 8192-byte region [ffff88810e71c000, ffff88810e71e000)
[  113.426101][ T9253] 
[  113.426899][ T9253] The buggy address belongs to the physical page:
[  113.428890][ T9253] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e718
[  113.431770][ T9253] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  113.434464][ T9253] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  113.436906][ T9253] page_type: f5(slab)
[  113.438231][ T9253] raw: 057ff00000000040 ffff88801a442280 ffffea0000c8bc00 dead000000000004
[  113.441010][ T9253] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  113.443752][ T9253] head: 057ff00000000040 ffff88801a442280 ffffea0000c8bc00 dead000000000004
[  113.446540][ T9253] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  113.449246][ T9253] head: 057ff00000000003 ffffea000439c601 00000000ffffffff 00000000ffffffff
[  113.452053][ T9253] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  113.454921][ T9253] page dumped because: kasan: bad access detected
[  113.457121][ T9253] page_owner tracks the page as allocated
[  113.459151][ T9253] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5600, tgid 5600 (dhcpcd-run-hook), ts 30177901251, free_ts 30136305765
[  113.466238][ T9253]  post_alloc_hook+0x240/0x2a0
[  113.467949][ T9253]  get_page_from_freelist+0x21e4/0x22c0
[  113.469870][ T9253]  __alloc_frozen_pages_noprof+0x181/0x370
[  113.471875][ T9253]  alloc_pages_mpol+0x232/0x4a0
[  113.473444][ T9253]  allocate_slab+0x8a/0x370
[  113.474936][ T9253]  ___slab_alloc+0xbeb/0x1410
[  113.476464][ T9253]  __kmalloc_cache_noprof+0x296/0x3d0
[  113.478202][ T9253]  tomoyo_init_log+0x111f/0x1f70
[  113.479793][ T9253]  tomoyo_supervisor+0x340/0x1480
[  113.481445][ T9253]  tomoyo_env_perm+0x149/0x1e0
[  113.482977][ T9253]  tomoyo_find_next_domain+0x15cf/0x1aa0
[  113.484764][ T9253]  tomoyo_bprm_check_security+0x11c/0x180
[  113.486594][ T9253]  security_bprm_check+0x89/0x270
[  113.488203][ T9253]  bprm_execve+0x8ee/0x1450
[  113.489656][ T9253]  do_execveat_common+0x510/0x6a0
[  113.491271][ T9253]  __x64_sys_execve+0x94/0xb0
[  113.492791][ T9253] page last free pid 5598 tgid 5598 stack trace:
[  113.494776][ T9253]  __free_frozen_pages+0xbc4/0xd30
[  113.496398][ T9253]  __put_partials+0x156/0x1a0
[  113.497907][ T9253]  put_cpu_partial+0x17c/0x250
[  113.499421][ T9253]  __slab_free+0x2d5/0x3c0
[  113.500856][ T9253]  qlist_free_all+0x97/0x140
[  113.502370][ T9253]  kasan_quarantine_reduce+0x148/0x160
[  113.504144][ T9253]  __kasan_slab_alloc+0x22/0x80
[  113.505755][ T9253]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  113.507541][ T9253]  getname_flags+0xb8/0x540
[  113.508985][ T9253]  do_sys_openat2+0xbc/0x1c0
[  113.510459][ T9253]  __x64_sys_openat+0x138/0x170
[  113.512039][ T9253]  do_syscall_64+0xfa/0x3b0
[  113.513516][ T9253]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  113.515454][ T9253] 
[  113.516256][ T9253] Memory state around the buggy address:
[  113.518068][ T9253]  ffff88810e71bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  113.520556][ T9253]  ffff88810e71c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  113.523187][ T9253] >ffff88810e71c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  113.526107][ T9253]                                ^
[  113.527940][ T9253]  ffff88810e71c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  113.530962][ T9253]  ffff88810e71c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  113.533687][ T9253] ==================================================================
[  113.536993][ T9253] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  113.539731][ T9253] CPU: 0 UID: 0 PID: 9253 Comm: khidpd_15c25886 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59-dirty #0 PREEMPT(full) 
[  113.544594][ T9253] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  113.548313][ T9253] Call Trace:
[  113.549532][ T9253]  <TASK>
[  113.550493][ T9253]  dump_stack_lvl+0x99/0x250
[  113.552210][ T9253]  ? __asan_memcpy+0x40/0x70
[  113.553880][ T9253]  ? __pfx_dump_stack_lvl+0x10/0x10
[  113.555626][ T9253]  ? __pfx__printk+0x10/0x10
[  113.557191][ T9253]  vpanic+0x281/0x750
[  113.558516][ T9253]  ? __pfx_vpanic+0x10/0x10
[  113.560073][ T9253]  ? irqentry_exit+0x74/0x90
[  113.561638][ T9253]  panic+0xb9/0xc0
[  113.562818][ T9253]  ? __pfx_panic+0x10/0x10
[  113.564295][ T9253]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  113.566248][ T9253]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  113.568138][ T9253]  ? __mutex_lock+0x7fc/0x1360
[  113.569706][ T9253]  check_panic_on_warn+0x89/0xb0
[  113.571706][ T9253]  ? __mutex_lock+0x7fc/0x1360
[  113.573624][ T9253]  end_report+0x78/0x160
[  113.575343][ T9253]  kasan_report+0x129/0x150
[  113.577147][ T9253]  ? __mutex_lock+0x7fc/0x1360
[  113.579071][ T9253]  __mutex_lock+0x7fc/0x1360
[  113.580927][ T9253]  ? __mutex_lock+0x5b6/0x1360
[  113.582816][ T9253]  ? l2cap_unregister_user+0x6a/0x1b0
[  113.584866][ T9253]  ? __pfx___mutex_lock+0x10/0x10
[  113.586491][ T9253]  ? __pfx___timer_delete_sync+0x10/0x10
[  113.588319][ T9253]  l2cap_unregister_user+0x6a/0x1b0
[  113.590217][ T9253]  hidp_session_thread+0x3c9/0x410
[  113.592021][ T9253]  ? __pfx_hidp_session_thread+0x10/0x10
[  113.593968][ T9253]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  113.596004][ T9253]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  113.598016][ T9253]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  113.600036][ T9253]  ? __kthread_parkme+0x7b/0x200
[  113.601893][ T9253]  ? __kthread_parkme+0x1a1/0x200
[  113.603524][ T9253]  kthread+0x711/0x8a0
[  113.604857][ T9253]  ? __pfx_hidp_session_thread+0x10/0x10
[  113.606711][ T9253]  ? __pfx_kthread+0x10/0x10
[  113.608246][ T9253]  ? _raw_spin_unlock_irq+0x23/0x50
[  113.610092][ T9253]  ? lockdep_hardirqs_on+0x9c/0x150
[  113.611874][ T9253]  ? __pfx_kthread+0x10/0x10
[  113.613517][ T9253]  ret_from_fork+0x3fc/0x770
[  113.615182][ T9253]  ? __pfx_ret_from_fork+0x10/0x10
[  113.616894][ T9253]  ? __switch_to_asm+0x39/0x70
[  113.618511][ T9253]  ? __switch_to_asm+0x33/0x70
[  113.620046][ T9253]  ? __pfx_kthread+0x10/0x10
[  113.621495][ T9253]  ret_from_fork_asm+0x1a/0x30
[  113.623018][ T9253]  </TASK>
[  113.624825][ T9253] Kernel Offset: disabled
[  113.626241][ T9253] Rebooting in 86400 seconds..

VM DIAGNOSIS:
15:39:54  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90007007370
R8 =ffff88801fcb8237 R9 =1ffff11003f97046 R10=dffffc0000000000 R11=ffffffff854efeb0
R12=dffffc0000000000 R13=ffffffff99af98e4 R14=ffffffff99dee3a0 R15=0000000000000000
RIP=ffffffff854eff2c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f0a6c2e7d60 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 00ff000000000000 XMM03=0000000000000000 00000000000000ff
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff8167ea6b RBX=ffffffff8fb69e18 RCX=ffffffff8fb69e1c RDX=ffffffff8fb69e10
RSI=ffffffff90323660 RDI=ffffffff8be333a0 RBP=ffffffff8fb69e18 RSP=ffffc900001c72f8
R8 =0000000000000003 R9 =ffffffff8172c195 R10=ffffc900001c7418 R11=ffffffff81ac3870
R12=ffffffff8167ea7b R13=ffffffff8fb69e14 R14=ffffc900001c73c8 R15=ffffffff8fb69e18
RIP=ffffffff8172d40f RFL=00000287 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1c000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f924f4e7d60 CR3=0000000027306000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00005570ae8916a8 00007f1000000009 XMM01=00007f1000000000 00005570eaff7460
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=3f3f3f3f3f3f3f3f 3f3f3f3f3f3f3f3f
XMM06=9999999999999999 9999999999999999 XMM07=2020202020202020 2020202020202020
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
