last executing test programs:

2.172468865s ago: executing program 2 (id=7090):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
write$tun(r0, &(0x7f0000000800)=ANY=[], 0x141) (async)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x4, &(0x7f0000000100)=ANY=[@ANYRES8=r0], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94)
r1 = socket$rds(0x15, 0x5, 0x0)
setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f0000000000), 0x4) (async)
r2 = socket$alg(0x26, 0x5, 0x0) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async)
sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd70000000000004000000130317"], 0x328}}, 0x84) (async)
socket$nl_route(0x10, 0x3, 0x0) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) (async)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x60, '\x00', 0x0, @sk_skb=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffbffd}, 0x94) (async)
socket(0x26, 0x5, 0x8) (async)
r4 = socket$kcm(0x2b, 0x1, 0x0) (async)
socket$unix(0x1, 0x1, 0x0)
pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x28000000000, 0x1, 0x0, 0x0, 0x8000000000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff, 0xfffffffffffffffc}, 0x0, 0x0) (async)
sendmsg$inet(r4, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2000c08d) (async)
shutdown(r4, 0x1) (async)
bind$alg(r2, 0x0, 0x0) (async)
ioctl$BTRFS_IOC_BALANCE(r3, 0x5000940c, 0x0)
socket$igmp(0x2, 0x3, 0x2)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) (async)
recvmmsg(0xffffffffffffffff, &(0x7f0000000f80)=[{{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000000700)=[{0x0}, {&(0x7f0000000980)=""/209, 0xd1}], 0x2}, 0x2}], 0x2, 0x2101, 0x0)
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000480), r5)
sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r5, &(0x7f0000000700)={0x0, 0x46, &(0x7f00000006c0)={&(0x7f00000003c0)={0x44, r6, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x9a}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}]}, 0x44}}, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)

2.071700135s ago: executing program 2 (id=7091):
r0 = socket(0x2b, 0x80801, 0x1)
listen(r0, 0x0)
ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, 0x0)
getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000000)={'IDLETIMER\x00'}, &(0x7f0000000040)=0x1e)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001240), &(0x7f0000001280)=0xc)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000012c0))
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001500)={{{@in=@multicast1, @in=@broadcast}}, {{@in6=@mcast2}, 0x0, @in6=@empty}}, &(0x7f0000001600)=0xe8)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000003d40))
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)={0x1c, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10000047}, 0x0)
r2 = socket$unix(0x1, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000040)=0x45f1, 0x4)
getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, 0x0, &(0x7f00000000c0))
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94)
r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000400)='cachefiles_ondemand_cread\x00', r3, 0x0, 0x6}, 0x18)
r5 = gettid()
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r5, r4, 0x0, 0x42, 0xfffffffffffffffe}, 0xe)
getuid()
getgid()
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000004040)={{0x1}, &(0x7f0000003fc0), &(0x7f0000004000)='%pB    \x00'}, 0x20)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r6, 0x8008f511, &(0x7f0000004340))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000004080), &(0x7f00000040c0)=0xc)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000004100)={{{@in=@broadcast, @in6=@local}}, {{@in6=@private2}, 0x0, @in6=@loopback}}, &(0x7f0000004200)=0xe8)
r7 = socket(0x10, 0x803, 0x0)
r8 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000039c0)='rdma.current\x00', 0x0, 0x0)
ioctl$TUNSETLINK(r8, 0x400454cd, 0x309)
ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000140)={'netdevsim0\x00', &(0x7f0000000040)=@ethtool_coalesce={0xe, 0x0, 0x5, 0x1, 0xc, 0xfffffffd, 0x6, 0x4, 0x2, 0x84, 0xa, 0x28, 0x8, 0x1001, 0x4, 0x81, 0x0, 0x0, 0x10000, 0x544, 0x0, 0x3, 0x25ab}})
r9 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r9, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0258ff000000000000000058000b4824ca945f64009400ffc094010ebc000000000000008000f0fffeff0300000000fff5dd00000010000100090810000c00000000040000", 0x58}], 0x1)

1.8873368s ago: executing program 2 (id=7093):
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$SIOCX25SFACILITIES(r0, 0x891e, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x290, 0x24, 0x4ee4e6a52ff56541, 0x70bd30, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xf}, {0xb, 0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x10001}, @TCA_STAB={0xb0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0x2c, 0x81, 0x1, 0x1, 0x10000, 0x6, 0x3}}, {0xa, 0x2, [0x9, 0x2, 0x1]}}, {{0x1c, 0x1, {0x3, 0x3, 0x4, 0x1, 0x0, 0x9, 0x1, 0x5}}, {0xe, 0x2, [0x4, 0xe, 0x100, 0x1000, 0x8]}}, {{0x1c, 0x1, {0x70, 0x6, 0xf88, 0x3, 0x0, 0x1, 0x7fff, 0x3}}, {0xa, 0x2, [0x400, 0x7, 0x7fff]}}, {{0x1c, 0x1, {0x6, 0x2, 0x5681, 0x80, 0x1, 0x1, 0x5e, 0x8}}, {0x14, 0x2, [0xa, 0xd864, 0x9, 0x0, 0x3, 0xff, 0x7f, 0xf9]}}]}, @TCA_STAB={0x5c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xd, 0x0, 0x4, 0x2, 0x2, 0x4, 0x8db3, 0x6}}, {0x10, 0x2, [0x3, 0x6, 0x6, 0xffde, 0x4040, 0x81]}}, {{0x1c, 0x1, {0x8, 0x3, 0x4, 0x7b93, 0x3, 0x8000, 0x2, 0x5}}, {0xe, 0x2, [0x8, 0xda55, 0x1, 0x401, 0x2]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x10000}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x7}, @qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x7f, 0xff}}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x7}, @TCA_STAB={0x12c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xc2, 0x2, 0x2, 0x80000000, 0x2, 0x4, 0x8f, 0x1}}, {0x6, 0x2, [0xa29e]}}, {{0x1c, 0x1, {0xd2, 0x9, 0x800, 0x7, 0x1, 0x8, 0x7fffffff, 0x4}}, {0xc, 0x2, [0x3, 0x4, 0x6, 0x5]}}, {{0x1c, 0x1, {0xb0, 0xcc, 0xa4, 0x10002, 0x2, 0xffff, 0xfff}}, {0x4}}, {{0x1c, 0x1, {0x69, 0x7, 0x8, 0x0, 0x1, 0x80000001, 0x0, 0x8}}, {0x14, 0x2, [0x51, 0x0, 0x7, 0x8, 0xebb, 0x5, 0x200, 0x2]}}, {{0x1c, 0x1, {0x7, 0x0, 0x3, 0x3, 0x1, 0x2, 0x80, 0x7}}, {0x12, 0x2, [0xffff, 0x4, 0x0, 0x10, 0x8, 0x6, 0x8]}}, {{0x1c, 0x1, {0x3, 0x1, 0x10, 0xf13d, 0x0, 0x9, 0x0, 0x8}}, {0x14, 0x2, [0x1, 0x65, 0x3, 0x100, 0x6, 0x0, 0x8, 0x401]}}, {{0x1c, 0x1, {0xa, 0x9, 0x8, 0x10, 0x1, 0xfffeffff, 0x2ead11a, 0x6}}, {0x10, 0x2, [0xfff, 0x6, 0xfffd, 0x6, 0xffc0, 0x3ff]}}]}]}, 0x290}}, 0x0) (async)
r1 = socket$kcm(0x2b, 0x1, 0x0)
sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) (async, rerun: 32)
socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32)
r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x8)
setsockopt$ax25_int(r2, 0x101, 0xa, &(0x7f0000000080)=0x9, 0x4) (async, rerun: 32)
r3 = socket(0x1e, 0x4, 0x0) (rerun: 32)
connect$tipc(r3, &(0x7f0000000040)=@id={0x1e, 0x3, 0x0, {0x4e25, 0x2}}, 0x10)
r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) (async)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000cc0), 0xffffffffffffffff)
sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB], 0x1c}], 0x1}, 0x0) (async)
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000000))
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_inet_SIOCSARP(r6, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @link_local}, 0x4a, {}, 'lo\x00'}) (async)
ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f00000002c0)={{0x2, 0x0, @multicast1}, {0x0, @dev}, 0x8, {0x2, 0x0, @rand_addr=0x64010101}, 'lo\x00'}) (async, rerun: 64)
r7 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64)
syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) (async)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r3, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x20000000)
writev(r7, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) (async)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r1)
r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r7)
sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="3447324f85d1ff0f000000000000", @ANYRES16=r8, @ANYBLOB="00042abd7000fddbdf25010000000000000001410000001800170000000f000000097564703a73797a3200000000"], 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x200400c1)

1.63270257s ago: executing program 2 (id=7098):
r0 = socket(0x2b, 0x1, 0x1)
sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000000)={0x38, 0x0, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVKEY={0x18, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}]}, 0x38}}, 0x0)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x1000008, 0x93071, 0xffffffffffffffff, 0x80000000)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1f00000000000000000000000080"], 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x18, 0x8, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000070095"], &(0x7f0000000180)='syzkaller\x00', 0x8, 0x1020, &(0x7f0000001200)=""/4128, 0x40f00}, 0x94)
r2 = socket$inet6(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414003400080004"], 0x2c}}, 0x0)
sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0x401, 0x800000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_FAIL_OVER_MAC={0x5, 0xd, 0x1}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
r5 = socket(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', <r7=>0x0})
r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r9 = socket(0x400000000010, 0x3, 0x0)
r10 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r11=>0x0})
sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x58, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0xfff1, 0xf}, {}, {0xffe0, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x28, 0x2, [@TCA_FLOW_EMATCHES={0x24, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7}}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x14, 0x1, 0x0, 0x0, {{0x9, 0x9, 0x41}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x3}]}}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40010}, 0x2008c014)
sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newneigh={0x30, 0x1c, 0x401, 0x0, 0xfffffffc, {0x2, 0x0, 0x0, r7, 0x20, 0x66, 0x8}, [@NDA_DST_MAC={0xa}, @NDA_PROTOCOL={0x5, 0xc, 0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x1804}, 0x4)
connect$inet6(r4, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4)
setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000140)=@ccm_128={{0x303}, "8053e7eeb87c6375", "0dee47b49df8d449e11633a06f4679fc", "c0ce6b9a", "684976da3acd6bac"}, 0x28)
sendmsg$inet(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000240)='n', 0x1}], 0x1}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1e, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000363b027c024a7220d1f50800000000000000850000008a0000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24}, 0x94)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='illinois', 0x8)

1.548185686s ago: executing program 2 (id=7101):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000380)={@in={{0x2, 0x4e22, @remote}}, 0x0, 0x0, 0x25, 0x0, "394281e595fd9eb506cd1a5555af72cd375de18882e299a83da979fa66c8f49889716b8dc73f6c5518c12abfb88e8b811ed8bd3623253c58eed51af8b75008e2576da2b0f564a63d98fb21dc8ab90d76"}, 0xd8)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0x20, &(0x7f0000000080)={@in6={{0xa, 0x4e21, 0x4b7, @local, 0x1}}, 0x3, 0x0, 0x1a, 0x0, "5e3b86774ef89ec669fabcaff49c2eeb8c4614c85b196a0c67a7768e058e3008931c08d43101cb8242bc42b8e0662749302c1ffcd1d1190000000000000000000000000000000000000000000200"}, 0xd8)
socket$packet(0x11, 0x2, 0x300)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10)

1.012587676s ago: executing program 1 (id=7107):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @broadcast}, 0x10) (async)
shutdown(0xffffffffffffffff, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50)
writev(r1, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async)
r3 = socket$inet_smc(0x2b, 0x1, 0x0)
listen(r3, 0x2) (async)
setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000000040)="5766b1b827f600333b09d3748ee7d700", 0x10) (async)
r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r5 = socket$inet(0x2b, 0x801, 0x0)
r6 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendto$inet6(r6, &(0x7f00000003c0)="2f2c02b92a4c533b6d05cf4b601f8652fc6afe1954766f41e70338a86df7272998f40816fe69ba220f387f0953d69f33860cbea7c38cab11ec583c65bcfa640ca359f0bb1efc5dcaee238f019de40572d96829693e03690ef31102b5981374d092b5a167494b970e96f3d120bb49f850c3e33d2f9d9349958af3356135a1498117adc03241b02dfb313b26a19228714efe01f731e47104efa3d9afe100", 0x9d, 0x4008000, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x7fffffff}, 0x1c) (async)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x66, &(0x7f00000002c0)={0x0, 0xa9ac}, &(0x7f0000000300)=0x8)
ioctl$int_in(r5, 0x5452, &(0x7f0000000280)=0x8) (async)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r7}, 0x10) (async)
ppoll(&(0x7f0000000500)=[{r4}], 0x1, 0x0, 0x0, 0x0) (async)
pselect6(0x40, &(0x7f00000001c0)={0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x5f8, 0x0, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0)
connect$inet(r0, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x16}}, 0x10) (async)
shutdown(r0, 0x1) (async)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'macvlan0\x00', <r9=>0x0})
r10 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=r9, @ANYBLOB="000000000000000014004000000001006261746164760000040002800c001a"], 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40) (async)
socket$inet6(0xa, 0x80002, 0x0)
syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0)
socket$nl_route(0x10, 0x3, 0x0) (async)
bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xe, 0xc, &(0x7f0000000240)=ANY=[@ANYRES64=r2], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94)

952.289645ms ago: executing program 1 (id=7108):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x2, @local}, 0x10)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f00000000c0))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$VHOST_VDPA_SET_CONFIG(r1, 0x4008af74, &(0x7f00000001c0)={0x8, 0xab, "23ee2a6cbe6e37523f0563bcabf01b5d35f7ded963a313bfec07f7848a9a2d8a4ef674065c8ab58d591250c90b917303f1d132e04aabcddca79d28652cb34b89c409e351b68dcaf4a4f55d0d16dae78e8cb79beafbde264e2823ffe2bce7b8b89e99479291f4927b54286d722c05f6cc11b8885e5be87fa0052552b7cd469387aa8002a3aee0be51c5981a9846878d9b69e1f2289e02fe65aaa5824cb34cd84764098b945504c47d377f16"})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002680)={0x2028, 0x3c, 0x107, 0x0, 0x0, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0xb, 0x2, 0x0, 0x1, [@nested={0x4, 0x15}, @generic="83b461"]}, @typed={0x8, 0x5, 0x0, 0x0, @u32=0x9}, @nested={0x1ff0, 0x8, 0x0, 0x1, [@nested={0x1008, 0x48, 0x0, 0x1, [@typed={0x1001, 0x7e, 0x0, 0x0, @binary="6269847fe665d109f237e8aa4ae44e2514f2cde37fe084f741d6bcc181ce33b60a746cd135e0ecb743df5994a5d7531d4dc69b4286f0eb2e067a94bfcb1d9fedcc3ebbe22497c3d26fbb4703b276eb9ba405957ac276c398d7672512fdde0e974136b57b9cb4069433cd41e9409014b94d11820dd926dbf1a529cb695c96fd87ae807f14189bde5e66a781c0a8f834fb71491cf3747e563bf97d4381b2616614d65fd05c613c1893ca6284730cafd60f239cd4dbf9bcd38ef2f58b8a6cdb12fa560bf030e0b03555d4f4885584b3b90833426b73b2fb10bdf2f6c6c4c1ed01ec4433aa60c971a2a6a262e9f6e2754edceb165579abe5a6a9cb950341330ce6b127fd413bf592728e1c4c93a44ba4fac87a1eadce5b0ab06b5946182c4fb06edb0a8af229254a656c0f198c66b13b80d802ea2f6cc8b72697073e8f519c601d2183fd07a34535e203a42d8bf3b67fe3dc561012dfdb4fc0921e727ab4f203516fc620bb67ccfefe2e5b54f48a4e3c7209edea271b4fc1f4c166dbf9cf672492a1fe8bd66b332dd5c398744c47dff3513b410b05189847696a7769f8aa369dc8e495eb7ed5a65b8bff2dd308a33e724672092ce3869f44cfe6a6609bcab86156dad58886c71c781def420ca6165af9d1d86c64a44597194b3554342907242e3b0c90bd34c758e55febca1f1e622cdafb184edaf9aa9a78db29dc75188f8daaedbada26fe4aa3d47124557f0e108c171e040a0e432b2a692507869189e780c789bf6cdfa78c9bfdd70cab3428f1fccd956da26387c213f072887ca4bf1cbb970bb590cbebe25de8fbc01f5e2763a7e84ec6ebecba3adc83b5fd51eab2362a9a684645db8ff844ac59b2c9061cc4994029666194033b4750f53f051716755981f27d7d59bb5dfc3c7938a0bf6f9fa7ba42df6799ce5c5c1e5bdc3e2d3318657fe11e79fded29af5b19d926bf6caa2021386dea2b65414b6af4636652e605824d0988a9bfa77f3ba6d802b3e74adc5acd1ba3ec58955fedf76ac2180d7502ac58807f59eb78bde17678b1ddd5f4d2ff5829ac55adb0a846ae2058680ea0d0c393eed1771f365ae7b30ba68b60e8253e64b91056af02f8067762631ae00a7aec9e11750ffb3f23db5fbff9fc0fe70d9b39d0bc01d7525987acbbca0271f9eadffeb9daa04dc35033b69614ea669ba1910973f7cbe64597c80492c75622a05a6f8e9976c42d27b0cc4f11d14ae58ffddb2563e264f2a9eb02f418b3f9e1336b75071c34f054bd2985acbc0558917dc7b1da59f568acc5841422d3807630110cffc4dbc5dc6e3c13923f220009c920ea98485b382e8cdcc97970ee384ba0745eae7190ff8da592324049994fb85bdd3441f556f672d1dbf74130673fdeadb7b101ed6e192fc2c3c88cc3bb0237655555f5fe93c18b5e0310044be0f01ad5802b6fc83cbf98d4825704d1ae4e2c71b1df430a06f8fe5aa5d69fb699b107272ba187953e8f98dd761f702467a470c0f76574be777ed9b441d63d2795142e26160b3cd645617a369faa3fe79785ea21d325c4da1608b499f75dc80fdf738902f5284c7ec34e1eca30e86b3928e74764332d728e93a4840758521af2579863d3cd0fc564e4cfc10b7f45e9da01c3e722d330390b74be977716d11af83439aa18ad395ebd8feac1538f236d10e2f2df9e93b9f44e8ac7b297a91997483c74ebbb004b85008ea113be842076d222b73f68640d9ed8d8f29391e0d98336889e66ced137b53472d34f2e2ed733ba6808ff4d4c5e6c43ccd6b3fd1f20e7e89ff92f6b7dbad5d71c0dbe7988b36c1e2407af8680a04ca83527ebfe15cec2f83515a01376332c4c92afb8a6dae17d78b94d995104866ea2382be72d3d6416dae77fb2e6c2a3bdf43ed1695171234cb6d972ea22f8166366839b0e2adfe559603f00938af296b9b3ac8e27ebf4de11d3b66bd37228348d068e1afd21c23760ce9d43c851df1fcb8403a2a0c42b34b1d9eb53a74ae168499621e5a7146506f1a4a50434e10cb22ef2e5140b5bc84a87b10d1fa045b93f42d2b45ad106eb5727ffd739157ff803478ec44ff4da487669a81987597bb9db70e9e2f294bda987158e851c9972d3da14ba0cc84651ba6686403ce12fe49582110f2adb8015b243f9063adf38105a4b234809a845f011b15f09e9a8c350561503310f4b999b4201245a5770a824e52e12dda7c3cd7d3155175c47ed707d47b82882420580949d1b11e4b797fa50030673dcbc67eeabf6c927d2dd1ee5083cb8a151b6c9306d62766e2da7f3476a4e67dea0261c6f9082e3b707ae6c71456935a1bfacabe9cdc19494aa85bd92ff14afc9cc9527f87440335cc7730e03bfb753dd4302dd57e19a685b46ed1a7abe551e3f8ef79b1c47bfa4ee892a8f250706d18d45fa9aae02b9905a66249721956e06be0620d32402ef579150e61e9d48ac6b91da3349564d2c6268c0417d5b268a7f3f55b9a4fe1302936216516d3e6da20ce58979a4405d22d45fbb79e6f9dd1df43fa0faeb2e10391f53dcf9197dccc94e99ae0fbb40ee0aa8f99c7dd564c39cdb1691d2230a1ebbb8d4471296d80d318407eacf3b54ad57b48ca0fbaebc41b5fded9b569233ae6bd1d579edb6e547af6f4a3fb36f650dcbdeb2c6cc0d8a63c2118fbe5e7542b821ce959335567ac80a9a1014c8111a855f45dced1c4e7fe8799581346f6551c3ae3f0c4df81f0e9685825202f77d5435d8560e434625f4c66375481c146c2fc904e71f34b9d73d72d4b984c32a05c6fb2c18042d89be1a179ec0853ad32285a3e1ca6410d2f80a4acafb0c4c201ef4e73a4f252f94af707d6778ef957dd30e8181dd3c5414e9c73c8fd415603a60b9631af437081a864e4a20d1ffca9e85ff09a7a9856cda192cb31d5fc7f4faccf11a67611e2a150e9976cf10dd5efd0495886573511323d7501d9e0dc5f98366e0b4a6d0465a63ab08ace7463e14b3158d0f14def4c8822b9352c4c60d1876d6a8e6f165d8105925c63f92d2b853e8f85f76bf2ae79b6f8f5ee079c5429e0af81085ba4629ec03dd7b60f61d77b7d7958e4bdb77a124da8cccc7a0a118c439eff9efdfbf23c3e4f36f129cf85f0e6ae5294bfeff29ec622c2d307f05c6ffe545d9913f7314c62800428bdab35aaadf999649dfe41fb39afb04834d408032e5bcf047377575eace64f71efa94c7a2741893341b9616993d986f27d145bcf173d4b5a8eadd242a6e8ea71c5ace620dfc56a77807087e6298408d551cad16fa644c88b8990210aa03fcaf9bbadb66e8c71fcee171f9b10549b35645e161eb11a85351c2eacd3492907efddb9dde627e9e827ae24708e798c7a119abb8cccfb8b8f472afe3739a6eae7c08b04603660803a5e6e1054441d12ad7f1908e2c80c80f29e76a1eb9c66571d353fabc8f5714c11416cc3d8e8d3b83dbeaace4fe0747f32c43e60067179dd397ce81c58e3d6e566c9e65c1b439107aca3a1f81e638127ecff2f429b1c6f5faec8ff0420ec3257428fdfb60d5064a1da3c84d25eac722bbfa1ff58ebbd13c021ae37d19ce74ef9737809f8643c36d09ddfb7da04c96bf1fc84d6b8b2ad95dbe325ed29d1961d15da29dba900912dd02ab017cd5df918d13c252d4900c360821b2582c16a1e8ea1deaef6983fe13e2a20e477a96c7288607bb070830972846b5ba30bebed0f668e5b6d5d39f2622497c57bb8cafb23f9ddf57e594d77f11011e16ec397db8966d3eb8fd1a5969e07588db3026100ef761d4f5c04e42246f57e0c34dc1a16b8b7dcca4b14cdd6fccea3cc1f1f2088188db7ba2c8bc9c84e8f0e78c87d2f22312bb5c803b57c4f52f9ac866e99248d2a6b445fe5390ca99c593364109ccf23a3a210bde45b11f114d358558cd08b684adce1e85adb8418ac20a279803bf6a9da19eb74a46fa6d30e0acc9cee1841f3293adde91275f5faa07a86079ef9875005b00a448144c6bb4163c89ec63ded7641947163734dd2da5cf3ade4436db2f308a7126a90b31b8b0c0d0032536a56c96d3cea70d3226dff8e8e147992c410e5e699c9f9af0229e463066de24e101047ac1693d9a5fbfb0c45091d82374165b12c03bf486cfed9c55e1a942ac6c08e693b2fbb9c671971d6a13e4723876ea0176f6bf81a2d63148f42ab90b37092f228c7d33d11e669c1a12025d693a9d8ed16a00265df58510c5841db0910038409ec1dbcbafcf301ecb5e63de17d1172f96aedba9592be058d50c6bef6a28d197f97202494af348646ae676be08d9538a980e986fe23451eb46cec545e51244e7be72e495cbfa30466184cdb3439750a6125ca0ea1a7df6e81499bb81729b98717fae12d9d0973d3efe31a9102819dda5ec9b898e6f133395b334efeddea7915cc5f652456c469f9aed8aecc2eae7a25074e1856b0527adb86aa365f1be4216cd8ea51d8965ed057b4d78a4ef993df67f1b664b1f0cdb55efc9c3a1533dd99f4af5ed9fd3fe465b5ffad35d035c9ad982a9cf7dcfe6a930f495304db5f2b9b20db129fdfd7b88aa07c9713adf733bf6c70018f562eaa7f206c33d5c7eb524c74c411008df7d42895c8fd6863cc77e39b5f8352e1983ade98a88abd3ecb947f7273e8e10af9f197a227d44644cb3b8e9720384f0cfeefb3f25d437d1b380facb5b0c20e91411abf1ee6f2fbfacd26de4370ad02d41160652f53c911f951a2c2a9879b910e5e86d0dc182d92cf1c37c678aabb9cf1eb715495d4f4b662f69f62294299a69a8131dcc741f753e1785e166fbf967950990b2400ccacd36b591cc6bc182078e63fd2d870c62714cc66badda8ccee9a6c2d2793a712f63b42edcfc1bcde334ad615640b9839598fe7f9774b5ce7a7f5fc67d0a771410baa36128933f46187d9d25dd18d010ec7e11954f1ffbc16c1bc59d986bab494efad71903553dfa42c28233fd4a66a3ca14cf34a22a3b225f024cfc664d2f26b17180c8e833862049ab31e8e0f54406f49c8f46243032f89e344d9152764bc217a7fe6f83bce80bff80b8c2ee55985a38d6953aed1d899dc60c47460996bbb7728ce051ad0aae83f9e69cdd1046251d539f703667315cc04755636a11c9c6e2cdedc99719951361fdad021911ff79b443c60a6f08bc81baa2c2094cdc65081243e4bb242acac9246edefc6004c1f9a2919781794de1737e1e23f1a9e0f3159ba61df3be61031f5a3be1c3765a10b738a2d974dd47baa207686cc31d7589d56cb88486dc2728d07ac5cdc5cb0c1da4649efc7c8e48cbe3b4279de8a24c8ad03ab3526fd0d766ec89668aa52b8b9de6f8c1f2ea7056f9d459608de18f0e53392f666c670c0e41753010fed54b42c1ad29fa0f74dc62c2b530efc67a179211e9da37425182ffd73de4229c32c819fd7d1534518671ab7984e824f5e3a369e05b5b9894554b5fb46acbadceecc58993f34b8df9c8a7cfe6bfa7b82800208bfad1adc9278b297e5e599a4e570402848ceb432631397c50020716e6ee7df01551254dec14798a6ad4178edb8bd71bf7ce53774203918d920f02d4f59c1f136656b63534b12d9ca5787aec382f09da17edb59775d30fb63bc98eca130aff7a8ca36d07840908ddd4694ecca2d214d63b41fef5e1f79c0bbe8d24cae15ad6567e4d296e32d4b20d5ab48c66bbb601e5cfd39733acff18db7eb2f3ba730d4c77a4c50f165c7620c76d71c7b78e0eef38d0c7d6cfc864ecfe80c410efb06fc55255bad6bde49e709d6fa208cdae8cec582f6221d65849d7a1a1fa98a9ffe839"}]}, @nested={0xfe4, 0x105, 0x0, 0x1, [@typed={0x8, 0x13f, 0x0, 0x0, @uid}, @nested={0xfd5, 0xea, 0x0, 0x1, [@generic="0a7d59fc86e2b6fb8d7b15ab4f181c466787aba129ad568649b468280a1754513f10768df67d301bb2d6d4ea8a178d04e60e65779fe36d955d40ca17935bb0ca91bfbddef182fb403a26c6d4dbf0e17d482c50fdeaa6446765ef1041e9d1fcc19cfa7146ec293ce5d723f10dc3d04a04e6fb9661932e9fd15e174b3dfd4e1798d660ffe1de5106955e62a3e99d872f7c86a32e9fffb470cd26", @nested={0x6f5, 0x3a, 0x0, 0x1, [@generic="f37d7d7eaa26f4e62ccc983285e3e8aff796d849a5ee2e14d0fa81dbc3451b3f802d1cda7c940baa31aa393c4a3de0974cdd531be7c298a37b25626b03d5237f4a89355762aef807b1f62389b03351adf5678793f5b206d8e241f9d34525548413a3fb0010c532abcd6bb7a243b2f31509021b53c118e0d8ee23cd", @nested={0x515, 0x116, 0x0, 0x1, [@typed={0x8, 0xdd, 0x0, 0x0, @u32=0x3}, @nested={0x3f5, 0xa, 0x0, 0x1, [@generic="b4e4c59d0e98277f4608489f2845ca558250db257f98ee8c6180cfa837ece90445ab672305c9fecb4fd9f1b005c65244440c75daa3c93069a0ab82206097358e0a8353b7a5cdfc9c3e61905c5ed0e6a300ea84d5064ea5f3ef3f6cf8c1e9763ae6766cfbf5d0fb2ffbc2387d805abaa6742fd8dbff729ea28523f43a932be47a76fe4945e141d4052c6846e31c336e5dad70b64f87e0d7300ca768d79c72a1084da3f7cd7fa7c016db7e2b6498e951f15f62041dd7802772cfe65d40891346a85950f9326c24593fa60f0a2758e2f710cd78ea07c89a9056db", @nested={0x12d, 0x94, 0x0, 0x1, [@typed={0x8, 0x11d, 0x0, 0x0, @pid}, @nested={0x4, 0xd2}, @generic="1f12b5e2a3a48113ca9c2827bad2cb78149d058b1c15bdb043e13997da7d94c02b2fb5da88632204fb3a4428c82791ddec", @nested={0x4, 0x28}, @typed={0xa1, 0x4e, 0x0, 0x0, @binary="984f3b627efc6c6c5521ed4306da91dea7c62c2adb99af94890a87cc7d66395e650568cee55005e37e086b742f10e68e2d5ed29cbd34f166d767dee739da3fcbc25075ad852986b1db687fe5103afd028348e1598981307c2aa93268de2badf86387ac1b6dc7bcd84ae5109b83dfd50774577c7aaf6b18a272ffe88345583747f1bbbf66d2b4410fcbba4c23fc849ac339f7868b12a8000aea1bbcd1a5"}, @typed={0x8, 0x100, 0x0, 0x0, @fd=r2}, @typed={0x39, 0x24, 0x0, 0x0, @binary="f2e4b3b01ea8b0846aa3e45b0cb6585e140be95fc85a5a1b05b2710577a4d3f8dd8f96c99f49f5b630db2a166768818f46ec21fc06"}]}, @typed={0xbd, 0x1, 0x0, 0x0, @binary="2ef0ee35250ca97b11c042f9b95bc639869f7a5ae184b17b6be04167b71869598d4367852110edb790acef25da3accf5928e1af084561c6b0a83751aa54e0b68cacec128723709694c8960c0a08dfc2635b308f291f64676c17eb701e6f9a81f1e37e9e0c80eca6b720685f9766ae16d4a9e8d87b656d08c124c77a6faf07b696969cc5d03fb6c954f4ba901927bbc281c080b6c7f89bde68cb1919dc08da7e65aeee888ab1cd0752f48d72cb36411157c9f124833afbc5925"}, @typed={0x8, 0x5d, 0x0, 0x0, @ipv4=@local}, @typed={0x8, 0x113, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}, @nested={0x105, 0xf5, 0x0, 0x1, [@generic="1c91728150a06dd80d92c669c1ffb33d93b10e7002cdf7411094dde86b0effb8f46cd676112bb98f5173b52ad15bc20e01e0177790b25e7da0e5ba1bf374a9b3289e41a09de6dc70478e7606f65586285694cfba47796c9bdb7f1ffa1aaea4ee29dc8f6300b4c373eb3fa3d7940d26c1985605ad19a53fe74755857f0b478907c7dfd26d90950957c661547872d2039a8603", @typed={0x8, 0x52, 0x0, 0x0, @u32=0x2}, @nested={0x4, 0x103}, @generic="7e66817e5eb7d5a5cddaae4aab0fce314b57f38a7be49888fb818a69bbaad25bb5", @generic="8f6c58953e3a5eafe49fa2944072846e7672febfc83e04597fc13da1cc5b81d5248bb82ba2d12a6604fa8fd0dc0f5618efc97a8f38af1aaf90ab38fbb50348f3b39b"]}, @typed={0xf, 0x17, 0x0, 0x0, @str='8{+]$:!{[:\x00'}]}, @generic="ad7fd6ebebe32d2501bca78d0588d78f4e656d13e53c2c4ab15d58f2a62deb8d91365115cbedb1c9ddfdb46ce0fb1975470b4e8c8b0936c6b793571571555222fb73eaf397b30203a574d4b1ab5120c37d516208b454336e6b303d1ddf2d8f79e61aeba0e1dd90f57378f033116271bb555a839baada4b56e3d386be8df7a11674f2a41f5c88800ceed175eac60e5d02ca7878c5d966cfc9d91f98c3a3c7165dd21cb8e55e35dd4007760bdcd8e1a052b8902595c20686ec39a7ba46793e8bf12a8dce3b0173c298da98cd9cf925d457b5061daa034f5ab5946d6c4779fc92af84a3f30c006169321763b795cbd68f450202f1", @generic="bdafb9308bf6", @typed={0x8, 0x104, 0x0, 0x0, @fd=r2}, @nested={0x4, 0x71}, @typed={0x8, 0xc9, 0x0, 0x0, @pid}, @nested={0x4, 0xe2}]}, @generic="29b630dd4a4e2704a80ca3bd93fb4979432fbe4334f77eaf996439a374830a686c017aa079a18bb53250498243b33e8f326283a21b1d6881be95732d6100372b930ad615da9c67501128d29601b10b7420c19be68b4c2821b392d1ba25e15de6a7a7b9a68c96d4e7aa8c1e3bd844d0e3f1d966276316096f198b4557a328b535bb397b28c910e869f1ef0eca39910274e253d985d6ecf7964c480eea7b9261ad684d680df58d44482dfab9c2f15a1cf793bf49d59eda6c190c76c956cd9ecdf2e3061be2c9c95cd52ddad6df0b63c044bf56b135725801f77dc3dd065f82926c3d68b4de1db51b6d55c62b", @generic="3005046c0947180ab792d8bf087229686238068a2060c769962c20e0672d9fb7b5c0d0ca6ad66d537c8170d7c2a321803b3c26c206aa2f1825a3b0550cc6a8fc5a9ab6d26e8d85b6cdd66790a93c29719ecb2168b4996d09cf325ebb49e00d5d19ad729e5863a0e4d22e07a580e70757032d70"]}, @nested={0x83d, 0x133, 0x0, 0x1, [@generic="09c15be1c94253dbca3b1b05d34aca0cc5070940a6fee2917b7869069a718a16bd16d2a35b3e4cc476cc58313219e9d4f7f9e15f6d04851dbef8b089ef6378e0c52ee65c5c0e214d937d66b87179c9af782f34d4b7ad218382a62eaf3e1faa732cb0a5d050490fd5951c594aeeb16f4c24ec36e51a9ad216907aff8557ea2244855fe16c0fd002c333722c1106df89a86015487a73eaa93c779e3dfff7a73b087cfc99cf2745e6516b5d1ae42afe63bf8472cd3c6e216ad285a8bf38444f1a5e596a9a020ab84150f521ea0bc5fc4198938c6bfdb2b7ff0a70fd6f0ac4502d8e8ee82d8124d1f9255f42b453484264a37ba3b2c7e97b3aaa63", @typed={0x14, 0xda, 0x0, 0x0, @ipv6=@remote}, @generic="de6e21dd998362e696fc939c5e0def599505ac4eaee12572c2659356bedd79a1312d7b602b98b23af36d671f5a787e64a552da84bb82460980209756d7e3da0d6f970a318752c4ba44079b40886bc2369c63532fd6db463d43d03866db26cee4e4fa59259cf5c18d3a42391ea0cfae5cbed10448d2fbd92e7c66e3e0000b0c6033bf378b517bed26b53ccbbc8624cd4908999ed27dfff0b4947f607392453d0af2daae57ea45c6f6a55420bc3076c1db28e95415f4f6cbcf34ebe447d8e42a52a482b7cf3d771fb570607e6c040b951a10c9694bdfac9622908a76087c9965d243cadb4eee5551c4ae44b16153fefa6a14180dce7ae9f62e495953fc4e84941e8df70a64d907f8ab9f9d3e9cc673d6600b9540906b1f3a30bcfd8d3cd9877f8d25b66e61e81cebf4a42021dc36cc3a934ea4ccd4c4cc7c8568fb12e70662d0829116e685133ac196354748fdd93d59dd2dd29014f2e2338dfd97e3657ca371968067701937e01cec3c2662b3df442c68566e11163c6e981ccb8707afebf800e075a7a6fc42b35a46330184a1d9b195fcc3aba0fdb937d84a34d6895e3aecdd3fc3d2481702b2d3a761b603e319c1f47c2a9c4eda088f161740b429b6d989c0af8c973678012bdce569070275c2d86a823cc7c63d2e1ee32f867323b1df311c9cf99971c96128260a0c39c7eda7ba995d7a7fd3574b8825780994951cbe6ee3246877d891414726654fb32bd8a50dbcd86da85664ce73090264e1ee33bdb17e9c5d4d2dd31cd61cece7bc07fe39489243dd5245fd49159e0fc69e46811feb1f82d6b248487776936500a3a676faeab3a1caef45be669a36ae7fc54713d8e0ae384b4fb02a9855c9c98a903441736bfd069b2db61ffb5c52de52cf7c219158e55e96d2cf3caeeea98c8a33a662286a5da6334f2c627f89bddb67ca585b84b3bf0493cddc274f7df11c51cf1712cafc237aa216011ff248f01677991cde09e8a6d97683c2ead0c91d505979d2ca8587e67f8091e00973db5a584c4ce70380ce389d42745217b91b44986b512faad6ad7a2535986cefc951dcbb8a6dad5932e4c58b3828d7be9c117fcacd2a51c69380490b0ebc8dcc880d175a5134fb04bdd05f615a257793dbee297a62e24df33e52cc8e65c6980d80b3f9ad775ec584989f1ad60eb8a134539ad94c5477ff99801a55349ae481c2316ea5ddbe54a0f4fa8f094199d4531ec55e46d64cbd620e86af41b9cd8cdf1b49d28686c718cc0ec9f2f822bd0a8e9e3be650f7ff74acb2edcbec330263a694082a7412889d1aadc5f8ecefbc1ad5409c401ff322afc83198de90edd724e2ce09830befb4353593b63c92a4e2123038000f352c3dda4dfc223551fc478899fe5968e6e8d76029bec385685b27268d23bdce218d59d0eec1b416cafc48e2720b4f9166796ff5b06a96b4ec3ef77eb06ea29cf83e718d50c71b2761ef288603df4eb329bf7ef6e02b50542fd6a345358ff864f3806253a9bddc27529c282163a6b1bf1dafed86942d245beec628d790f935a7bd05e63e4c6c3f32fc9455e20fecbc7813e3e1ea94bd08633ebdab7276c30a57d3f591ea2c4502b76777e9ef382292ce61aab73bf11fbf054b9e06fa60fcf166be6e42cf1606565b36d6750207d8b4daf6169545f6cc9d0d4dc2e64aab1e0a9c9075b52e1315977899b6de01d83cdad2ef9fb96ac3a1124617dc3c874e7a24d34c957fe876a8feb3422ed198322b9552ed87fcb9fbde550894e8ce17c447ed03f5711b7dc35128202c9bab54880cac7aa98858b12b7275731a5eca2509c18941aeb74987087a66ba2e8f54f99ea3b692b370d88e6c59afc100d872ea70d3a96b03823951c165b236d4b067834ea96a52bc3fcd49562a8c15c594107a381cc2f65788001c306ada9f80245f94c7594b1262477394977f5104be34bd2ca0acfe3b42e00e32b1273e516f4d7a393ffed021b224298deee9156218c29c61821410bb49c48d052e30728c94b1659e07e0afea1335cc0853aea67132448f16365a738e274a8e94df76e6f342e8a6680ddd8daf794fc956230da4a0ba338a32209d9b21a93c5c1b784a505300e4691ba2984caa5914ae4cf6409bf7d5ff3860366e11e549edfca96ce9aa413c964b75abcd7261157d0e362a884a150fe8b68194254ccc6ecc3820e3c4510660f182acf41244943062ed7e1abeb7f95e10a284329eb2ebbff04b268b8e8f01bd48600ce8ca3c9054dbe3631084eb1b92fbd7f4a70b778be01610bb0b0a4057110e77828688ae286fc77eb186c71ec6dd77a30f0269f54450d3d5c35bb3a7b2f4e6bbc00cee6027fbc1d7ef5d017c6d281293afc83863c4a21478d24bcb1168fe40e3000734d32d6b364a2132538b6152bc89f5983d876df0fa74197492e0a20688269e03f3d3867108342252e8d925b0ed5b1c2b173461a50a3af69c25c40b17a322c354b26cfccb60774e3a384f9cf206dfca1794ff0b189ce3c4534d9cd1cd4b024039eb4807fcde33f2750af7f80422e1f694b56a03d7cbac214bc201e4cbeee98ebd6ff83c6b2736fbc2f60b68e29d79d12618e6912ab04a632719"]}]}]}]}]}, 0x2028}, 0x1, 0x0, 0x0, 0xc000}, 0x4040)
setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000000100)=0x20000, 0x4)

951.419259ms ago: executing program 1 (id=7109):
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000440)={0x30, 0x2, 0x6, 0x201, 0x0, 0x0, {0x6, 0x0, 0x2}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x100000}]}]}, 0x30}}, 0x8000) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000007c0), 0xffffffffffffffff) (async)
r2 = socket(0x1e, 0x5, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000040)={'batadv0\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000f00000008000300", @ANYRES32=r3, @ANYBLOB="0800320000000000050033"], 0x2c}}, 0x0)
r4 = socket$inet_smc(0x2b, 0x1, 0x0) (async)
r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async)
r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x200040d0)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000012000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85823d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2ba9c29faa38c409d32b6b7d6cf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e933119c5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247fa62fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120bed64069dcf82d3e5e0361e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a1000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0daca8d4c1090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac46a0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c607ef50a991c410f7c60e45b5c193f813a36d841165b91b5e170f6ba24558df57145eb8142a6ed87c6d5cbae3e52d569996604669a6e9ca1a3689c795970b4bcd00881faff52a6766fafa07ed7d4a49f47d34fd76a394adcb33a270b6a14e74bca7c2ea92dd845d3f774fde1bbea911c1ea76d52f7912e2597e6a33380647ed44956730b5b84662b8e659124379c0d86b1d28fdfa3cd2013103e3048c4ad4f5a4dcd133b2fc8fae3b51e4433cee7c08e67c7d7ed4432045e10f8718e5c163b1704fa2c707b61a1a9f63edfceff1a0cd7baf4a15b2fd607a09d398d73243bdcc664fbd5f582e48af2a18b02f0184a7bdd95ac78241e6749e74b152702333c56588375f806f10578eaae329c4f8dfb83e5524e2c9aa59ce7828bd1f146b2a4150fb2a8ced08e2ffac81e921e8a6f0071361a0acdbd125fb5f5e9ffe98e38508582a496afd30ca460dbfca77915a18b7b9ef6c1d6e13bc12fe43063cfecfafb05bf2339ad61533fbf3e410b403182742fa2d40c402cb83c2fef46a36f17c1abf97b0e2d114bd1472ab4207aa060f9e5d91c4a4911b1a1df47b858be141ab3386f26f561df35678489dc1b9f10eee1b2ab3dfdaedd7e06ff8a127f1743fcb32d7f80d40aebc1ea72edc348f5f9ba4bace97db948c24c679c74cd4336a7233d836082bb0e8b013bd1ee3612cd43cd2a3cb83754bb3408"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000001c0), 0xfffffedf, 0x10, &(0x7f0000000040), 0xffffff95, 0x0, 0xffffffffffffffff, 0x10}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000240)="63eced000000000a9f33c9f7b9e5", 0x0, 0xc698, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async)
ioctl$int_in(r5, 0x5421, &(0x7f0000000000)=0xd)
connect$inet(r4, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) (async)
close(r4)

822.433871ms ago: executing program 1 (id=7110):
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000061187b000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000061187b000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = socket$inet(0x2, 0x1, 0x100)
ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000100))
getsockopt$SO_J1939_SEND_PRIO(0xffffffffffffffff, 0x6b, 0x3, &(0x7f00000002c0), &(0x7f0000000300)=0x4)
sendmsg$sock(r0, &(0x7f0000000280)={&(0x7f0000000000)=@hci={0x1f, 0xffffffffffffffff}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)="24b19e81a2cbc22077e6b6d5cbb09b44d1eaf0a12bf4f128d296561de44c683240c3f0bfabd67593a916c59ac5c71461a8da02b2cbe4d7a85deda52a7006f49fda14f7863b9d7efcacd0ad20a6eb03ec34efdc6cafff59dc6fd4", 0xac}], 0x1, &(0x7f0000000180)=[@txtime={{0x18, 0x1, 0x3d, 0x300000}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}, @mark={{0x14, 0x1, 0x24, 0x7}}, @timestamping={{0x14, 0x1, 0x25, 0x80000000}}, @mark={{0x14, 0x1, 0x24, 0x83}}, @mark={{0x14, 0x1, 0x24, 0x6}}, @txtime={{0x18, 0x1, 0x3d, 0x8000000000000000}}, @txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18, 0x1, 0x3d, 0xcf2}}], 0xd8}, 0x80) (async)
sendmsg$sock(r0, &(0x7f0000000280)={&(0x7f0000000000)=@hci={0x1f, 0xffffffffffffffff}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)="24b19e81a2cbc22077e6b6d5cbb09b44d1eaf0a12bf4f128d296561de44c683240c3f0bfabd67593a916c59ac5c71461a8da02b2cbe4d7a85deda52a7006f49fda14f7863b9d7efcacd0ad20a6eb03ec34efdc6cafff59dc6fd4", 0xac}], 0x1, &(0x7f0000000180)=[@txtime={{0x18, 0x1, 0x3d, 0x300000}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}, @mark={{0x14, 0x1, 0x24, 0x7}}, @timestamping={{0x14, 0x1, 0x25, 0x80000000}}, @mark={{0x14, 0x1, 0x24, 0x83}}, @mark={{0x14, 0x1, 0x24, 0x6}}, @txtime={{0x18, 0x1, 0x3d, 0x8000000000000000}}, @txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18, 0x1, 0x3d, 0xcf2}}], 0xd8}, 0x80)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$cgroup_ro(r1, &(0x7f0000000500)='memory.current\x00', 0x275a, 0x0) (async)
r2 = openat$cgroup_ro(r1, &(0x7f0000000500)='memory.current\x00', 0x275a, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendfile(r3, r2, 0x0, 0xc4f)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000003c0)={{0x1, <r4=>0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000380)='%-010d \x00'}, 0x20)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{r4}, &(0x7f0000000400), &(0x7f0000000440)='%pK    \x00'}, 0x20)

772.598486ms ago: executing program 1 (id=7111):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000140)=0x90)
write$tun(r0, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0xfdef)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r1)
socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket(0x2b, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00'})
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$sock_int(r4, 0x1, 0x10, &(0x7f0000000100)=0xffff, 0x4)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000010000304000000000000000000007400", @ANYRESOCT=r2, @ANYBLOB="0000040000000000000012800b00ffff6272696467650000140002800600002d00003d72662ccf"], 0x44}, 0x1, 0x0, 0x0, 0x40800}, 0x20)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) (async)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async)
ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000140)=0x90) (async)
write$tun(r0, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0xfdef) (async)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r1) (async)
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0) (async)
socket(0x2b, 0x1, 0x0) (async)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) (async)
socket$inet6_udp(0xa, 0x2, 0x0) (async)
setsockopt$sock_int(r4, 0x1, 0x10, &(0x7f0000000100)=0xffff, 0x4) (async)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000010000304000000000000000000007400", @ANYRESOCT=r2, @ANYBLOB="0000040000000000000012800b00ffff6272696467650000140002800600002d00003d72662ccf"], 0x44}, 0x1, 0x0, 0x0, 0x40800}, 0x20) (async)

682.933287ms ago: executing program 1 (id=7112):
r0 = socket$inet6(0xa, 0x1, 0x100)
sendmsg$inet(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000000c0)="5980a642beaf34ff0f0000121690ad0d2b", 0x11}], 0x1}, 0x2000c001)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r3=>0x0})
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e50226bd70000100000007000000", @ANYRES32=r3, @ANYBLOB="20000100", @ANYRES32=r3, @ANYBLOB="0000fe0f00"/24], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x20000100)
r4 = socket$kcm(0x10, 0x2, 0x4)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c40)=ANY=[@ANYBLOB="440100001000010000000000ffdbdf25000000000000000000000000000000007f00000100"/64, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="e0000002000000000000000000000000000000003200ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000200000000000000000000000200000000000000000000004c0012006d6f7275733634302d67656e6572696300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000800180005000000"], 0x144}}, 0x0)
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0)
ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000000000)=0x3)
ioctl$PPPIOCSPASS(r6, 0x40107447, &(0x7f0000000080)={0x2, &(0x7f0000000100)=[{0x48, 0xff, 0x0, 0xffeffffe}, {0x6, 0x60, 0x0, 0x8}]})
ioctl$PPPIOCSDEBUG(r6, 0x40047440, &(0x7f0000000140)=0x5)
write$ppp(r6, &(0x7f0000000300)="5af9", 0x2)
r7 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8)
r8 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SIOCX25SDTEFACILITIES(r8, 0x89eb, &(0x7f0000000100)={0x62f8, 0xfa, 0x0, 0x2, 0x0, 0xf, 0x23, "345a9ed53047a3b99c5449d3bfc73db06e790664", "82fd93d3b72fb1353ca302f38d202f3f33b46294"})
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r9=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r9, 0x10f, 0x8a, &(0x7f00000000c0), 0x4)
bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1c, 0xe, &(0x7f0000000ac0)=ANY=[@ANYRES16=r9], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0xfffffffe}, 0x10}, 0x94)
sendto$inet6(r7, &(0x7f0000000580)="81", 0x1, 0xc001, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x82, 0x0, &(0x7f0000000340))
sendmsg$inet(r4, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600)

680.924711ms ago: executing program 2 (id=7113):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf250401f2800800180009ac0f"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001b80)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000020000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c7d376238975d43a4505f80fc88943c4f0cf08e467b592f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872971c7c56f0979bd10b97163c1d6d0e196bf02f46c7e81eb72c00000000d0d26b5069f8a98f7dc8f76b74635fde9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193161f45346b1004006000000e1ffff8816326d7d25c32aac1c7d5b5be399f6609876b5887437a172fbc02a74067529194e533583412dff048f000000008b260000b2728a0481e9f0da43bb6cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13caec04a347383420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bf1339454c13ad3e328a100000000b515a1000000000000000eb2e9c15b6c8f6198282df27badac8507bc7d202e0990e0"], &(0x7f0000000340)='GPL\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0xffff0000, 0x31, 0x0, &(0x7f0000001a40)="2b206d074843b397737ea49da2aa", 0x0, 0xf000, 0x720e, 0x0, 0x0, 0x0, 0x0}, 0x50)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x48, 0x2, 0x6, 0x301, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4840}, 0x0)
r3 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r4 = socket(0x11, 0x2, 0x0)
r5 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_int(r5, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4)
connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e20, @dev}, 0x10)
setsockopt$sock_int(r4, 0x1, 0x2e, &(0x7f0000000040)=0x3, 0x4)
r6 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, &(0x7f0000000080)={0xa0179e08})
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
r8 = getuid()
sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@newsa={0x134, 0x10, 0x713, 0x70bd2d, 0x25dfdbfd, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@loopback, 0x0, 0x6, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, r8}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x3c}, @in6=@private1, {0x3, 0xfffffffffffffffa, 0x7, 0x100000}, {0x0, 0xfffffffffffffffe, 0xfffffffffffffff8}, {0x0, 0x0, 0x8}, 0x0, 0x0, 0xa, 0x1}, [@replay_esn_val={0x44, 0x17, {0xa, 0x70bd29, 0x70bd2a, 0x70bd27, 0x70bd2a, 0x7, [0x7f, 0x7, 0x9, 0x7, 0x3, 0x4, 0xc7, 0x4, 0x8, 0x1]}}]}, 0x134}}, 0x0)
getsockopt$inet6_int(r3, 0x29, 0x9, &(0x7f0000000140), &(0x7f0000000180)=0x4)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYRESDEC=r6, @ANYRES32=0x0, @ANYRES64, @ANYBLOB="0000000000000000000000000000000000000000e000000000000000"], 0x48)
unshare(0x22020600)
socket$kcm(0x11, 0x3, 0x0)
r9 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000003c0)="5e47bbe70d9a67183c664db69715708ea907189660812cccacb1aeca259a5395e481b83d8c89fc29d84e79c8100d076d755de22e555405a95a6918a36a270035631bb18f1973c897785e88d7a123a0fca9bae9abf3ad19d69d909b5c3d7d56f0897fb65c4797d077320c15b78fed0b89c559b4d6e07495266d", 0x79}], 0x1, 0x0, 0xb}, 0x4004800)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
r11 = socket$inet(0x2b, 0x801, 0x0)
setsockopt$ARPT_SO_SET_ADD_COUNTERS(r11, 0x0, 0x61, &(0x7f00000001c0)={'filter\x00', 0x4}, 0x68)
ioctl$sock_SIOCETHTOOL(r10, 0x8946, 0x0)

519.530879ms ago: executing program 0 (id=7115):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r1}, 0x4)
close(r1) (async)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) (async)
ioctl$SIOCSIFHWADDR(r1, 0x8b0f, &(0x7f0000000000)={'sit0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
socket$kcm(0xa, 0x922000000003, 0x11)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800030002000000080007006401010108000700ac1414bb0800020003"], 0x78}}, 0x0) (async)
listen(r0, 0xffffff7f) (async)
ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x894b, 0x0)

452.267405ms ago: executing program 0 (id=7116):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000340)}], 0x2)
r1 = socket$inet6(0xa, 0x3, 0x5)
sendmmsg(r1, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @mcast2, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x29, 0x37, 'R'}], 0x18}}], 0x1, 0x4000000)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r3, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0)
sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x34, r3, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x43ef}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140)
r4 = socket(0x2b, 0x80801, 0x1)
sendmmsg(r4, 0x0, 0x0, 0x20000090)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00', <r5=>0x0})
r6 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x3, {0x0, 0x0, 0x12, r5, {0x0, 0x6}, {0xffff, 0xffff}, {0x1}}}, 0x24}}, 0x0)
connect$netlink(0xffffffffffffffff, 0x0, 0x0)
close(0x3)
socket$can_raw(0x1d, 0x3, 0x1)
socket$netlink(0x10, 0x3, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0)
ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000100)=0x5)
connect$netrom(0xffffffffffffffff, 0x0, 0x0)
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000300)='wg1\x00', 0x10)
syz_init_net_socket$ax25(0x3, 0x5, 0x1)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000006, 0x4ca31, 0xffffffffffffffff, 0xd1d1d000)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000180)={'pimreg0\x00', 0x1})
ioctl$TUNSETOFFLOAD(r7, 0x400454ce, 0x19)

163.296759ms ago: executing program 0 (id=7117):
r0 = socket$kcm(0x2b, 0x1, 0x0)
sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x45}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2000c08d)
shutdown(r0, 0x1)

158.978424ms ago: executing program 0 (id=7118):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) (async)
r1 = socket$inet_sctp(0x2, 0x5, 0x84)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000180)={<r2=>r1, 0x10001, 0xe, 0x9})
accept$netrom(r2, &(0x7f0000000040)={{0x3, @netrom}, [@netrom, @rose, @bcast, @remote, @netrom, @netrom, @default, @bcast]}, &(0x7f0000000100)=0xfffffffffffffe73) (async)
r3 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r3, 0x107, 0x13, &(0x7f0000000140), 0x4) (async)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r5 = socket(0x400000000010, 0x3, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0) (async)
r7 = socket$unix(0x1, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 64)
r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (rerun: 64)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r8}, 0x18)
r9 = socket$vsock_stream(0x28, 0x1, 0x0) (async)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000380)={'ip6gre0\x00', <r10=>0x0, 0xd618f3e5fb036c7d, 0xf3, 0x9, 0xa, 0x54, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8000, 0x7800, 0x8, 0xe7}}) (async)
ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f00000004c0)={'team0\x00', <r11=>0x0}) (async)
r12 = socket$unix(0x1, 0x1, 0x0)
r13 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000380)={'bond0\x00', <r14=>0x0})
sendmsg$nl_route_sched(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r14, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_mq={0x7}, @TCA_RATE={0x6, 0x5, {0x1, 0x80}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000001}, 0x0)
sendmsg$ETHTOOL_MSG_COALESCE_GET(r9, &(0x7f0000000540)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x6f1097e98b922a28}, 0xc, &(0x7f0000000500)={&(0x7f0000000700)={0xd0, 0x0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}, @HEADER={0x4}]}, 0xd0}, 0x1, 0x0, 0x0, 0x80c1}, 0x0)
connect$vsock_stream(r9, &(0x7f0000000140)={0x28, 0x0, 0x0, @my=0x1}, 0x10)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r15=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r15, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) (async)
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000027c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, r15, {0x10, 0xf}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}}, 0x0) (async)
sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd2c, 0x25dfdc00, {0x0, 0x0, 0x0, r15, {0x10, 0xffe0}, {}, {0x7, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x20048150)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) (async)
syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0)

1.083826ms ago: executing program 0 (id=7119):
r0 = socket$inet(0x2, 0x1, 0x100)
setsockopt$sock_int(r0, 0x1, 0x48, &(0x7f0000000040)=0x3, 0x4)
r1 = syz_init_net_socket$llc(0x1a, 0x802, 0x0)
r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[], 0x30}, 0x40880)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x9, 0xe, &(0x7f0000002380)=ANY=[@ANYRESOCT=r0], &(0x7f0000000340)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002300)={r3, 0x18000000000002a0, 0x19, 0x0, &(0x7f0000000140)="b9ff0300600d698cff9e14f008004de7f9c7643600e0000200", 0x0, 0xe03, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x50)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010100, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, {0x0, 0x0, 0x200000000000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2, 0x2b}, 0xa, @in6=@local, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x2}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x8040)
socketpair(0x28, 0x1, 0x28, &(0x7f00000000c0)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$sock_SIOCDELDLCI(r4, 0x8981, &(0x7f0000000100)={'bridge_slave_1\x00', 0xce})
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r2}, 0x4)
r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180), 0x4)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYRESHEX=r4], &(0x7f0000000240)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x0, r6}, 0x94)
bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x1, 0x0, 0x3, 0x4a}, 0x10)
close(r0)
connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @loopback}, 0x10)

0s ago: executing program 0 (id=7120):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'veth1_to_bridge\x00', 0x200}, 0x18)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f00000002c0)={0x2, 'veth1_virt_wifi\x00'}, 0x18)
syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x6c}}, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', <r5=>0x0})
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x60880, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r7 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x50, 0x2c, 0xd27, 0x70bd25, 0x6, {0x0, 0x0, 0x0, r8, {0x0, 0xe}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8035}, @TCA_FLOWER_KEY_ARP_SHA={0xa, 0x3f, @local}, @TCA_FLOWER_KEY_ENC_UDP_DST_PORT_MASK={0x6}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x24020000}, 0x44010)
sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, r5}]}, 0x20}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0)
sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000069000b00eaffaccc870d4a9f67d000000000000008000100020000003d6d06c6ec7cc536cca5127e6b513141026d6b4357ec402bfbc02b17e376a53225620eab7c7161f364ed36cc0150cc3668a461a7d5f9d63798ad11cb9076dfcba049433b3f9b8e2b31785b98a178e20cbee417392336bddaed7399a61bfa8f74338805646c723d5cc8d8e68f1338fc70d8da3712c91cad68bf6a9d6414114f305554284f60985bf55f33b846d7a25c006fd3e95183d37162ebaea15433dd2acde1efb431313f84c87f4273795b6e51e3622c25d47028af6c6728be50b7f5b84e0a633b99c9855c5e173a7b3e33bc7dc8784ebf32dc044e37518fde699d27e3128d2b0a8c9ff8475efc51319b4e58bef1b1dacd1a8932214c2dbf795710"], 0x20}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a000000000000000400040030db918bc8ccf0be2dd96793159ba6a59ac3d6bdbeea02dc4f60f807c9b1f96d01fd76e189f2aad75bddc1cb9f51a262dd6585b4d25b1b99de9a1b38b6989dc6ea"], 0x1c}}, 0x0)
r10 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2400000068000100fefffffffcffff7f000000001d0000000a0002000100000004000000a779fad3d93551fbb6c7e7334db6de6cd97194a297da7b2fc6864284ccedd4740f998bfa3e098586529d0c240efbd47a078a68d1cf3ff14e465bcee3fea7d0f7742ae78922227d02640d3ca9cdc2c121fa59b504e21e03d86c42a1f59631ad"], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
r11 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendto$inet6(r11, 0x0, 0x0, 0x4, 0x0, 0x0)
setsockopt$inet6_int(r11, 0x29, 0x4a, 0x0, 0x0)

kernel console output (not intermixed with test programs):

29853][T27429] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5429'.
[  520.912649][T27446] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  520.916278][T27445] IPVS: stopping backup sync thread 27446 ...
[  520.922257][T27445] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5434'.
[  520.963172][T27448] netlink: 96 bytes leftover after parsing attributes in process `syz.2.5435'.
[  521.013712][T27450] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5436'.
[  521.100614][T27454] netlink: 'syz.2.5438': attribute type 4 has an invalid length.
[  521.195380][T27458] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5440'.
[  521.229593][T27458] bond23: (slave vxcan5): The slave device specified does not support setting the MAC address
[  521.235491][T27458] bond23: (slave vxcan5): Error -95 calling set_mac_address
[  521.277098][T27460] macvlan2: entered promiscuous mode
[  521.281918][T27460] macvlan2: entered allmulticast mode
[  521.284473][T27460] bond23: (slave macvlan2): Error -98 calling set_mac_address
[  521.664004][T27477] IPVS: persistence engine module ip_vs_pe_ not found
[  521.733991][T27483] netdevsim netdevsim0: Direct firmware load for .. failed with error -2
[  521.737128][T27483] netdevsim netdevsim0: Falling back to sysfs fallback for: ..
[  522.748684][T27528] IPVS: stopping backup sync thread 27530 ...
[  522.891884][T27546] : entered promiscuous mode
[  522.898959][T27546] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5456'.
[  522.902234][T27546] openvswitch: netlink: Flow actions attr not present in new flow.
[  522.929575][T27554] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  523.102099][T27566] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  523.105210][T27566] CPU: 1 UID: 0 PID: 27566 Comm: syz.0.5462 Not tainted syzkaller #0 PREEMPT(full) 
[  523.105229][T27566] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  523.105238][T27566] Call Trace:
[  523.105245][T27566]  <TASK>
[  523.105252][T27566]  dump_stack_lvl+0x189/0x250
[  523.105275][T27566]  ? __pfx_dump_stack_lvl+0x10/0x10
[  523.105292][T27566]  ? __pfx__printk+0x10/0x10
[  523.105315][T27566]  ? kernfs_path_from_node+0x2f/0x290
[  523.105329][T27566]  ? kernfs_path_from_node+0x250/0x290
[  523.105341][T27566]  ? kernfs_path_from_node+0x2f/0x290
[  523.105357][T27566]  sysfs_warn_dup+0x8e/0xa0
[  523.105369][T27566]  sysfs_do_create_link_sd+0xc0/0x110
[  523.105384][T27566]  device_add_class_symlinks+0x1cf/0x240
[  523.105403][T27566]  device_add+0x475/0xb50
[  523.105422][T27566]  wiphy_register+0x1ba6/0x28d0
[  523.105451][T27566]  ? __pfx_wiphy_register+0x10/0x10
[  523.105464][T27566]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  523.105488][T27566]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  523.105510][T27566]  ieee80211_register_hw+0x3484/0x4100
[  523.105538][T27566]  ? ieee80211_register_hw+0x13f1/0x4100
[  523.105564][T27566]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  523.105583][T27566]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  523.105609][T27566]  ? __hrtimer_setup+0x187/0x210
[  523.105622][T27566]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  523.105638][T27566]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  523.105682][T27566]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  523.105700][T27566]  ? trace_kmalloc+0x1f/0xd0
[  523.105715][T27566]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  523.105764][T27566]  ? kstrndup+0xbf/0x160
[  523.105788][T27566]  hwsim_new_radio_nl+0xea4/0x1b10
[  523.105817][T27566]  ? __pfx___nla_validate_parse+0x10/0x10
[  523.105842][T27566]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  523.105869][T27566]  ? __nla_parse+0x40/0x60
[  523.105886][T27566]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  523.105911][T27566]  genl_family_rcv_msg_doit+0x215/0x300
[  523.105932][T27566]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  523.105957][T27566]  ? bpf_lsm_capable+0x9/0x20
[  523.105973][T27566]  ? security_capable+0x7e/0x2e0
[  523.105995][T27566]  genl_rcv_msg+0x60e/0x790
[  523.106018][T27566]  ? __pfx_genl_rcv_msg+0x10/0x10
[  523.106033][T27566]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  523.106060][T27566]  netlink_rcv_skb+0x208/0x470
[  523.106073][T27566]  ? __lock_acquire+0xab9/0xd20
[  523.106092][T27566]  ? __pfx_genl_rcv_msg+0x10/0x10
[  523.106111][T27566]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  523.106142][T27566]  ? down_read+0x1ad/0x2e0
[  523.106159][T27566]  genl_rcv+0x28/0x40
[  523.106175][T27566]  netlink_unicast+0x82f/0x9e0
[  523.106202][T27566]  ? __pfx_netlink_unicast+0x10/0x10
[  523.106223][T27566]  ? netlink_sendmsg+0x642/0xb30
[  523.106235][T27566]  ? skb_put+0x11b/0x210
[  523.106252][T27566]  netlink_sendmsg+0x805/0xb30
[  523.106274][T27566]  ? __pfx_netlink_sendmsg+0x10/0x10
[  523.106290][T27566]  ? aa_sock_msg_perm+0xf1/0x1d0
[  523.106306][T27566]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  523.106320][T27566]  ? __pfx_netlink_sendmsg+0x10/0x10
[  523.106336][T27566]  __sock_sendmsg+0x21c/0x270
[  523.106359][T27566]  ____sys_sendmsg+0x505/0x830
[  523.106377][T27566]  ? __pfx_____sys_sendmsg+0x10/0x10
[  523.106401][T27566]  ? import_iovec+0x74/0xa0
[  523.106420][T27566]  ___sys_sendmsg+0x21f/0x2a0
[  523.106439][T27566]  ? __pfx____sys_sendmsg+0x10/0x10
[  523.106485][T27566]  ? __fget_files+0x2a/0x420
[  523.106497][T27566]  ? __fget_files+0x3a0/0x420
[  523.106518][T27566]  __x64_sys_sendmsg+0x19b/0x260
[  523.106537][T27566]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  523.106560][T27566]  ? rcu_is_watching+0x15/0xb0
[  523.106578][T27566]  ? do_syscall_64+0xbe/0x3b0
[  523.106596][T27566]  do_syscall_64+0xfa/0x3b0
[  523.106609][T27566]  ? lockdep_hardirqs_on+0x9c/0x150
[  523.106622][T27566]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  523.106636][T27566]  ? exc_page_fault+0x9f/0xf0
[  523.106650][T27566]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  523.106661][T27566] RIP: 0033:0x7f3b12d8ec29
[  523.106675][T27566] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  523.106687][T27566] RSP: 002b:00007f3b13bfe038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  523.106701][T27566] RAX: ffffffffffffffda RBX: 00007f3b12fd6090 RCX: 00007f3b12d8ec29
[  523.106711][T27566] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b
[  523.106719][T27566] RBP: 00007f3b12e11e41 R08: 0000000000000000 R09: 0000000000000000
[  523.106756][T27566] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  523.106764][T27566] R13: 00007f3b12fd6128 R14: 00007f3b12fd6090 R15: 00007ffe5a211518
[  523.106788][T27566]  </TASK>
[  523.903656][T27581] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5465'.
[  524.377016][T27591] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0
[  524.381850][T27591] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0
[  524.563688][T27614] netlink: 'syz.1.5475': attribute type 2 has an invalid length.
[  524.633817][T27617] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  524.636311][T27617] IPv6: NLM_F_CREATE should be set when creating new route
[  525.216964][T27637] __nla_validate_parse: 6 callbacks suppressed
[  525.216975][T27637] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5482'.
[  525.322672][T27640] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5483'.
[  525.344127][T27640] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  525.347296][T27640] IPv6: NLM_F_CREATE should be set when creating new route
[  525.356959][T27642] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  525.465475][T27652] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5487'.
[  525.786871][T27669] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5492'.
[  525.804251][T27669] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  525.806988][T27669] IPv6: NLM_F_CREATE should be set when creating new route
[  525.902343][T27674] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5494'.
[  526.192242][T27692] netlink: 84 bytes leftover after parsing attributes in process `syz.1.5500'.
[  526.195395][T27692] openvswitch: netlink: Flow actions attr not present in new flow.
[  526.199550][T27692] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5500'.
[  526.203739][T27692] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5500'.
[  526.265646][T27695] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5501'.
[  526.335507][T27696] netlink: 76 bytes leftover after parsing attributes in process `syz.1.5501'.
[  526.435104][T27705] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  526.439803][T27704] IPVS: stopping backup sync thread 27705 ...
[  526.641943][T27721] netlink: 'syz.0.5509': attribute type 6 has an invalid length.
[  527.017586][T27731] block nbd3: server does not support multiple connections per device.
[  527.023579][T27731] block nbd3: shutting down sockets
[  527.168739][T27755] IPVS: Error connecting to the multicast addr
[  527.212960][   T33] audit: type=1800 audit(1758551836.609:4): pid=27753 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.5517" name="memory.events" dev="tmpfs" ino=8975 res=0 errno=0
[  527.223435][   T33] audit: type=1804 audit(1758551836.609:5): pid=27753 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.5517" name="memory.events" dev="tmpfs" ino=8975 res=1 errno=0
[  527.265987][T27763] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  527.269257][T27763] IPv6: NLM_F_CREATE should be set when creating new route
[  527.333802][T27771] IPVS: set_ctl: invalid protocol: 135 172.20.20.187:20001
[  527.367412][T27773] tun14: tun_chr_ioctl cmd 1074025675
[  527.369284][T27773] tun14: persist enabled
[  527.370828][T27773] tun14: tun_chr_ioctl cmd 1074025675
[  527.372965][T27773] tun14: persist enabled
[  527.487960][T27786] tap0: tun_chr_ioctl cmd 1074025677
[  527.490169][T27786] tap0: linktype set to 270
[  527.780166][T27803] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  527.783509][T27803] CPU: 1 UID: 0 PID: 27803 Comm: syz.2.5531 Not tainted syzkaller #0 PREEMPT(full) 
[  527.783528][T27803] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  527.783537][T27803] Call Trace:
[  527.783544][T27803]  <TASK>
[  527.783551][T27803]  dump_stack_lvl+0x189/0x250
[  527.783575][T27803]  ? __pfx_dump_stack_lvl+0x10/0x10
[  527.783593][T27803]  ? __pfx__printk+0x10/0x10
[  527.783616][T27803]  ? kernfs_path_from_node+0x2f/0x290
[  527.783633][T27803]  ? kernfs_path_from_node+0x250/0x290
[  527.783648][T27803]  ? kernfs_path_from_node+0x2f/0x290
[  527.783692][T27803]  sysfs_warn_dup+0x8e/0xa0
[  527.783710][T27803]  sysfs_do_create_link_sd+0xc0/0x110
[  527.783727][T27803]  device_add_class_symlinks+0x1cf/0x240
[  527.783747][T27803]  device_add+0x475/0xb50
[  527.783768][T27803]  wiphy_register+0x1ba6/0x28d0
[  527.783797][T27803]  ? __pfx_wiphy_register+0x10/0x10
[  527.783811][T27803]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  527.783834][T27803]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  527.783856][T27803]  ieee80211_register_hw+0x3484/0x4100
[  527.783887][T27803]  ? ieee80211_register_hw+0x13f1/0x4100
[  527.783913][T27803]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  527.783934][T27803]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  527.783961][T27803]  ? __hrtimer_setup+0x187/0x210
[  527.783982][T27803]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  527.784000][T27803]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  527.784045][T27803]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  527.784064][T27803]  ? trace_kmalloc+0x1f/0xd0
[  527.784081][T27803]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  527.784100][T27803]  ? kstrndup+0xbf/0x160
[  527.784123][T27803]  hwsim_new_radio_nl+0xea4/0x1b10
[  527.784146][T27803]  ? __pfx___nla_validate_parse+0x10/0x10
[  527.784172][T27803]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  527.784202][T27803]  ? __nla_parse+0x40/0x60
[  527.784220][T27803]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  527.784247][T27803]  genl_family_rcv_msg_doit+0x215/0x300
[  527.784271][T27803]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  527.784301][T27803]  ? bpf_lsm_capable+0x9/0x20
[  527.784318][T27803]  ? security_capable+0x7e/0x2e0
[  527.784344][T27803]  genl_rcv_msg+0x60e/0x790
[  527.784368][T27803]  ? __pfx_genl_rcv_msg+0x10/0x10
[  527.784385][T27803]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  527.784416][T27803]  netlink_rcv_skb+0x208/0x470
[  527.784429][T27803]  ? __lock_acquire+0xab9/0xd20
[  527.784449][T27803]  ? __pfx_genl_rcv_msg+0x10/0x10
[  527.784469][T27803]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  527.784498][T27803]  ? down_read+0x1ad/0x2e0
[  527.784517][T27803]  genl_rcv+0x28/0x40
[  527.784533][T27803]  netlink_unicast+0x82f/0x9e0
[  527.784584][T27803]  ? __pfx_netlink_unicast+0x10/0x10
[  527.784606][T27803]  ? netlink_sendmsg+0x642/0xb30
[  527.784619][T27803]  ? skb_put+0x11b/0x210
[  527.784639][T27803]  netlink_sendmsg+0x805/0xb30
[  527.784661][T27803]  ? __pfx_netlink_sendmsg+0x10/0x10
[  527.784706][T27803]  ? aa_sock_msg_perm+0xf1/0x1d0
[  527.784722][T27803]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  527.784736][T27803]  ? __pfx_netlink_sendmsg+0x10/0x10
[  527.784752][T27803]  __sock_sendmsg+0x21c/0x270
[  527.784774][T27803]  ____sys_sendmsg+0x505/0x830
[  527.784796][T27803]  ? __pfx_____sys_sendmsg+0x10/0x10
[  527.784821][T27803]  ? import_iovec+0x74/0xa0
[  527.784841][T27803]  ___sys_sendmsg+0x21f/0x2a0
[  527.784860][T27803]  ? __pfx____sys_sendmsg+0x10/0x10
[  527.784906][T27803]  ? __fget_files+0x2a/0x420
[  527.784918][T27803]  ? __fget_files+0x3a0/0x420
[  527.784939][T27803]  __x64_sys_sendmsg+0x19b/0x260
[  527.784959][T27803]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  527.784990][T27803]  ? rcu_is_watching+0x15/0xb0
[  527.785009][T27803]  ? do_syscall_64+0xbe/0x3b0
[  527.785028][T27803]  do_syscall_64+0xfa/0x3b0
[  527.785041][T27803]  ? lockdep_hardirqs_on+0x9c/0x150
[  527.785056][T27803]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  527.785070][T27803]  ? exc_page_fault+0x9f/0xf0
[  527.785085][T27803]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  527.785098][T27803] RIP: 0033:0x7fca7398ec29
[  527.785111][T27803] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  527.785124][T27803] RSP: 002b:00007fca747a8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  527.785139][T27803] RAX: ffffffffffffffda RBX: 00007fca73bd6180 RCX: 00007fca7398ec29
[  527.785149][T27803] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b
[  527.785157][T27803] RBP: 00007fca73a11e41 R08: 0000000000000000 R09: 0000000000000000
[  527.785165][T27803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  527.785172][T27803] R13: 00007fca73bd6218 R14: 00007fca73bd6180 R15: 00007ffc0307a248
[  527.785195][T27803]  </TASK>
[  528.629618][T27838] netlink: 'syz.2.5540': attribute type 5 has an invalid length.
[  528.641505][T27837] netlink: 'syz.2.5540': attribute type 5 has an invalid length.
[  528.782153][T27846] netlink: 'syz.2.5541': attribute type 2 has an invalid length.
[  529.614732][T27860] netlink: 'syz.0.5546': attribute type 4 has an invalid length.
[  530.074915][T27882] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0
[  530.416072][T27901] netdevsim netdevsim0: Direct firmware load for .. failed with error -2
[  530.435286][T27901] netdevsim netdevsim0: Falling back to sysfs fallback for: ..
[  530.634733][T27921] IPVS: stopping backup sync thread 27554 ...
[  530.694068][T27921] __nla_validate_parse: 22 callbacks suppressed
[  530.694082][T27921] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5563'.
[  530.694551][T27923] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5563'.
[  530.854673][T27933] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5566'.
[  532.255930][T27993] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  532.422932][T28002] bond0: option all_slaves_active: invalid value (3)
[  532.571045][T28009] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5588'.
[  532.672195][T28014] netlink: 'syz.1.5590': attribute type 1 has an invalid length.
[  532.674803][T28014] netlink: 16150 bytes leftover after parsing attributes in process `syz.1.5590'.
[  532.697406][T28014] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5590'.
[  532.986238][T28030] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5594'.
[  533.003903][T28033] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  533.003974][T28032] IPVS: stopping backup sync thread 28033 ...
[  533.374390][T28081] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20001
[  533.519557][T28090] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5607'.
[  533.551030][T28090] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5607'.
[  533.554804][T28090] 8021q: VLANs not supported on ipvlan1
[  533.696925][T28100] netlink: 248 bytes leftover after parsing attributes in process `syz.0.5610'.
[  534.164365][T28113] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition
[  534.169236][T28113] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0)
[  534.225037][T28115] IPVS: set_ctl: invalid protocol: 34213 172.20.20.19:20003
[  534.335428][T28131] netlink: 'syz.0.5619': attribute type 1 has an invalid length.
[  535.163316][T28165] IPVS: set_ctl: invalid protocol: 34213 172.20.20.19:20003
[  535.376339][T28181] IPVS: Error connecting to the multicast addr
[  535.528690][T28190] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  535.545035][T28187] IPVS: Scheduler module ip_vs_sip not found
[  535.879113][T28208] __nla_validate_parse: 4 callbacks suppressed
[  535.879127][T28208] netlink: 56 bytes leftover after parsing attributes in process `syz.1.5642'.
[  535.894954][T28208] syzkaller0 speed is unknown, defaulting to 1000
[  535.898382][T28208] syzkaller0 speed is unknown, defaulting to 1000
[  535.901912][T28208] syzkaller0 speed is unknown, defaulting to 1000
[  535.916643][T28208] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  535.937527][T28208] syzkaller0 speed is unknown, defaulting to 1000
[  535.942251][T28208] syzkaller0 speed is unknown, defaulting to 1000
[  535.947790][T28208] syzkaller0 speed is unknown, defaulting to 1000
[  536.261648][T28211] _Z`Ԁ@: entered promiscuous mode
[  536.438727][T28219] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5646'.
[  536.545528][T28225] IPVS: stopping backup sync thread 27993 ...
[  536.701458][T28232] netlink: 'syz.1.5649': attribute type 1 has an invalid length.
[  536.705965][T28232] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5649'.
[  536.776976][T28235] netlink: 348 bytes leftover after parsing attributes in process `syz.2.5650'.
[  537.204347][T28244] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  537.212193][T28244] syzkaller0: entered promiscuous mode
[  537.214739][T28244] syzkaller0: entered allmulticast mode
[  537.224463][T28244] tipc: Resetting bearer <eth:syzkaller0>
[  537.231946][T28243] tipc: Resetting bearer <eth:syzkaller0>
[  537.243124][T28243] tipc: Disabling bearer <eth:syzkaller0>
[  537.757826][T28275] block nbd3: server does not support multiple connections per device.
[  537.761690][T28275] block nbd3: shutting down sockets
[  537.774177][T28278] tipc: Enabling of bearer <udp:syz2> rejected, failed to enable media
[  537.814973][T28286] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5662'.
[  538.042653][T28301] syzkaller0 speed is unknown, defaulting to 1000
[  538.155712][T28311] netlink: 3 bytes leftover after parsing attributes in process `syz.2.5665'.
[  538.161129][T28311] 0X: renamed from caif0
[  538.173215][T28311] 0X: entered allmulticast mode
[  538.178005][T28311] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check.
[  538.522585][T28332] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5668'.
[  538.535121][ T7658] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)
[  538.540851][T28337] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  538.541513][T28332] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  538.545312][T28334] IPVS: stopping backup sync thread 28337 ...
[  538.548497][T28332] IPv6: NLM_F_CREATE should be set when creating new route
[  538.643961][T28347] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5673'.
[  538.907898][ T5237] Bluetooth: hci2: command 0x0405 tx timeout
[  538.956162][T28371] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5681'.
[  538.963605][T28365] syzkaller0 speed is unknown, defaulting to 1000
[  539.154955][T28391] netlink: 248 bytes leftover after parsing attributes in process `syz.0.5686'.
[  540.365316][T28450] IPVS: Scheduler module ip_vs_sip not found
[  540.513673][T28459] sctp: [Deprecated]: syz.1.5704 (pid 28459) Use of int in max_burst socket option.
[  540.513673][T28459] Use struct sctp_assoc_value instead
[  540.619703][T28467] syzkaller0 speed is unknown, defaulting to 1000
[  540.756734][T28474] openvswitch: netlink: Key type 29 is not supported
[  540.913403][T28486] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition
[  540.925029][T28486] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0)
[  541.149805][T28493] __nla_validate_parse: 7 callbacks suppressed
[  541.149815][T28493] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5714'.
[  541.185565][T28495] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5715'.
[  541.194621][T28495] openvswitch: netlink: nsh attribute has 1 unknown bytes.
[  541.197592][T28495] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  541.224803][T28499] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode
[  541.227686][T28499] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode
[  541.284166][T28504] netdevsim netdevsim0: Direct firmware load for .. failed with error -2
[  541.284953][T28506] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5720'.
[  541.291580][T28504] netdevsim netdevsim0: Falling back to sysfs fallback for: ..
[  541.335477][T28507] netlink: 'syz.2.5719': attribute type 4 has an invalid length.
[  541.339894][T28506] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5720'.
[  541.436208][T28512] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5721'.
[  541.692790][T28517] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  541.697612][T28516] IPVS: stopping backup sync thread 28517 ...
[  541.826305][T28524] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.5725'.
[  542.008692][T28530] netlink: 'syz.2.5727': attribute type 4 has an invalid length.
[  542.143339][T28532] netlink: 'syz.0.5728': attribute type 3 has an invalid length.
[  542.146172][T28532] netlink: 'syz.0.5728': attribute type 1 has an invalid length.
[  542.149199][T28532] netlink: 192 bytes leftover after parsing attributes in process `syz.0.5728'.
[  542.152640][T28532] NCSI netlink: No device for ifindex 0
[  542.612317][T28546] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5732'.
[  542.720616][T28551] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5733'.
[  542.798974][T28552] can: request_module (can-proto-0) failed.
[  542.882855][T28561] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5734'.
[  543.389958][T28597] netlink: zone id is out of range
[  543.392307][T28597] netlink: zone id is out of range
[  543.394640][T28597] netlink: zone id is out of range
[  543.396961][T28597] netlink: zone id is out of range
[  543.399614][T28597] netlink: zone id is out of range
[  543.405067][T28597] netlink: zone id is out of range
[  543.406906][T28597] netlink: zone id is out of range
[  543.409737][T28592] block nbd3: server does not support multiple connections per device.
[  543.412577][T28592] block nbd3: shutting down sockets
[  543.419825][T28597] netlink: get zone limit has 8 unknown bytes
[  543.443849][T28595] syzkaller0 speed is unknown, defaulting to 1000
[  544.506039][T28619] IPVS: persistence engine module ip_vs_pe_ not found
[  544.597077][T28634] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  544.603126][T28634] CPU: 1 UID: 0 PID: 28634 Comm: syz.2.5755 Not tainted syzkaller #0 PREEMPT(full) 
[  544.603139][T28634] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  544.603145][T28634] Call Trace:
[  544.603149][T28634]  <TASK>
[  544.603153][T28634]  dump_stack_lvl+0x189/0x250
[  544.603175][T28634]  ? __pfx_dump_stack_lvl+0x10/0x10
[  544.603189][T28634]  ? __pfx__printk+0x10/0x10
[  544.603212][T28634]  ? kernfs_path_from_node+0x2f/0x290
[  544.603226][T28634]  ? kernfs_path_from_node+0x250/0x290
[  544.603240][T28634]  ? kernfs_path_from_node+0x2f/0x290
[  544.603257][T28634]  sysfs_warn_dup+0x8e/0xa0
[  544.603272][T28634]  sysfs_do_create_link_sd+0xc0/0x110
[  544.603288][T28634]  device_add_class_symlinks+0x1cf/0x240
[  544.603308][T28634]  device_add+0x475/0xb50
[  544.603328][T28634]  wiphy_register+0x1ba6/0x28d0
[  544.603356][T28634]  ? __pfx_wiphy_register+0x10/0x10
[  544.603369][T28634]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  544.603393][T28634]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  544.603414][T28634]  ieee80211_register_hw+0x3484/0x4100
[  544.603442][T28634]  ? ieee80211_register_hw+0x13f1/0x4100
[  544.603489][T28634]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  544.603503][T28634]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  544.603519][T28634]  ? __hrtimer_setup+0x187/0x210
[  544.603527][T28634]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  544.603536][T28634]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  544.603561][T28634]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  544.603571][T28634]  ? trace_kmalloc+0x1f/0xd0
[  544.603580][T28634]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  544.603590][T28634]  ? kstrndup+0xbf/0x160
[  544.603603][T28634]  hwsim_new_radio_nl+0xea4/0x1b10
[  544.603616][T28634]  ? __pfx___nla_validate_parse+0x10/0x10
[  544.603630][T28634]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  544.603652][T28634]  ? __nla_parse+0x40/0x60
[  544.603662][T28634]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  544.603677][T28634]  genl_family_rcv_msg_doit+0x215/0x300
[  544.603691][T28634]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  544.603707][T28634]  ? bpf_lsm_capable+0x9/0x20
[  544.603718][T28634]  ? security_capable+0x7e/0x2e0
[  544.603733][T28634]  genl_rcv_msg+0x60e/0x790
[  544.603746][T28634]  ? __pfx_genl_rcv_msg+0x10/0x10
[  544.603756][T28634]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  544.603773][T28634]  netlink_rcv_skb+0x208/0x470
[  544.603780][T28634]  ? __lock_acquire+0xab9/0xd20
[  544.603792][T28634]  ? __pfx_genl_rcv_msg+0x10/0x10
[  544.603803][T28634]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  544.603819][T28634]  ? down_read+0x1ad/0x2e0
[  544.603829][T28634]  genl_rcv+0x28/0x40
[  544.603839][T28634]  netlink_unicast+0x82f/0x9e0
[  544.603854][T28634]  ? __pfx_netlink_unicast+0x10/0x10
[  544.603867][T28634]  ? netlink_sendmsg+0x642/0xb30
[  544.603874][T28634]  ? skb_put+0x11b/0x210
[  544.603885][T28634]  netlink_sendmsg+0x805/0xb30
[  544.603899][T28634]  ? __pfx_netlink_sendmsg+0x10/0x10
[  544.603909][T28634]  ? aa_sock_msg_perm+0xf1/0x1d0
[  544.603918][T28634]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  544.603926][T28634]  ? __pfx_netlink_sendmsg+0x10/0x10
[  544.603935][T28634]  __sock_sendmsg+0x21c/0x270
[  544.603948][T28634]  ____sys_sendmsg+0x505/0x830
[  544.603960][T28634]  ? __pfx_____sys_sendmsg+0x10/0x10
[  544.603973][T28634]  ? import_iovec+0x74/0xa0
[  544.603985][T28634]  ___sys_sendmsg+0x21f/0x2a0
[  544.603996][T28634]  ? __pfx____sys_sendmsg+0x10/0x10
[  544.604021][T28634]  ? __fget_files+0x2a/0x420
[  544.604028][T28634]  ? __fget_files+0x3a0/0x420
[  544.604039][T28634]  __x64_sys_sendmsg+0x19b/0x260
[  544.604049][T28634]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  544.604063][T28634]  ? rcu_is_watching+0x15/0xb0
[  544.604074][T28634]  ? do_syscall_64+0xbe/0x3b0
[  544.604084][T28634]  do_syscall_64+0xfa/0x3b0
[  544.604092][T28634]  ? lockdep_hardirqs_on+0x9c/0x150
[  544.604099][T28634]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  544.604107][T28634]  ? exc_page_fault+0x9f/0xf0
[  544.604115][T28634]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  544.604123][T28634] RIP: 0033:0x7fca7398ec29
[  544.604131][T28634] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  544.604138][T28634] RSP: 002b:00007fca747ea038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  544.604147][T28634] RAX: ffffffffffffffda RBX: 00007fca73bd5fa0 RCX: 00007fca7398ec29
[  544.604153][T28634] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000007
[  544.604158][T28634] RBP: 00007fca73a11e41 R08: 0000000000000000 R09: 0000000000000000
[  544.604163][T28634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  544.604168][T28634] R13: 00007fca73bd6038 R14: 00007fca73bd5fa0 R15: 00007ffc0307a248
[  544.604181][T28634]  </TASK>
[  544.794175][T28640] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  544.796904][T28640] CPU: 0 UID: 0 PID: 28640 Comm: syz.0.5756 Not tainted syzkaller #0 PREEMPT(full) 
[  544.796916][T28640] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  544.796922][T28640] Call Trace:
[  544.796926][T28640]  <TASK>
[  544.796930][T28640]  dump_stack_lvl+0x189/0x250
[  544.796947][T28640]  ? __pfx_dump_stack_lvl+0x10/0x10
[  544.796957][T28640]  ? __pfx__printk+0x10/0x10
[  544.796971][T28640]  ? kernfs_path_from_node+0x2f/0x290
[  544.796980][T28640]  ? kernfs_path_from_node+0x250/0x290
[  544.796988][T28640]  ? kernfs_path_from_node+0x2f/0x290
[  544.796998][T28640]  sysfs_warn_dup+0x8e/0xa0
[  544.797008][T28640]  sysfs_do_create_link_sd+0xc0/0x110
[  544.797018][T28640]  device_add_class_symlinks+0x1cf/0x240
[  544.797030][T28640]  device_add+0x475/0xb50
[  544.797041][T28640]  wiphy_register+0x1ba6/0x28d0
[  544.797057][T28640]  ? __pfx_wiphy_register+0x10/0x10
[  544.797065][T28640]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  544.797079][T28640]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  544.797092][T28640]  ieee80211_register_hw+0x3484/0x4100
[  544.797109][T28640]  ? ieee80211_register_hw+0x13f1/0x4100
[  544.797123][T28640]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  544.797135][T28640]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  544.797151][T28640]  ? __hrtimer_setup+0x187/0x210
[  544.797158][T28640]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  544.797167][T28640]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  544.797208][T28640]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  544.797220][T28640]  ? trace_kmalloc+0x1f/0xd0
[  544.797230][T28640]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  544.797241][T28640]  ? kstrndup+0xbf/0x160
[  544.797254][T28640]  hwsim_new_radio_nl+0xea4/0x1b10
[  544.797267][T28640]  ? __pfx___nla_validate_parse+0x10/0x10
[  544.797282][T28640]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  544.797299][T28640]  ? __nla_parse+0x40/0x60
[  544.797308][T28640]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  544.797323][T28640]  genl_family_rcv_msg_doit+0x215/0x300
[  544.797337][T28640]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  544.797353][T28640]  ? bpf_lsm_capable+0x9/0x20
[  544.797363][T28640]  ? security_capable+0x7e/0x2e0
[  544.797378][T28640]  genl_rcv_msg+0x60e/0x790
[  544.797391][T28640]  ? __pfx_genl_rcv_msg+0x10/0x10
[  544.797401][T28640]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  544.797418][T28640]  netlink_rcv_skb+0x208/0x470
[  544.797425][T28640]  ? __lock_acquire+0xab9/0xd20
[  544.797437][T28640]  ? __pfx_genl_rcv_msg+0x10/0x10
[  544.797448][T28640]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  544.797495][T28640]  ? down_read+0x1ad/0x2e0
[  544.797509][T28640]  genl_rcv+0x28/0x40
[  544.797519][T28640]  netlink_unicast+0x82f/0x9e0
[  544.797536][T28640]  ? __pfx_netlink_unicast+0x10/0x10
[  544.797549][T28640]  ? netlink_sendmsg+0x642/0xb30
[  544.797557][T28640]  ? skb_put+0x11b/0x210
[  544.797568][T28640]  netlink_sendmsg+0x805/0xb30
[  544.797581][T28640]  ? __pfx_netlink_sendmsg+0x10/0x10
[  544.797591][T28640]  ? aa_sock_msg_perm+0xf1/0x1d0
[  544.797600][T28640]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  544.797609][T28640]  ? __pfx_netlink_sendmsg+0x10/0x10
[  544.797617][T28640]  __sock_sendmsg+0x21c/0x270
[  544.797631][T28640]  ____sys_sendmsg+0x505/0x830
[  544.797645][T28640]  ? __pfx_____sys_sendmsg+0x10/0x10
[  544.797658][T28640]  ? import_iovec+0x74/0xa0
[  544.797670][T28640]  ___sys_sendmsg+0x21f/0x2a0
[  544.797681][T28640]  ? __pfx____sys_sendmsg+0x10/0x10
[  544.797706][T28640]  ? __fget_files+0x2a/0x420
[  544.797713][T28640]  ? __fget_files+0x3a0/0x420
[  544.797724][T28640]  __x64_sys_sendmsg+0x19b/0x260
[  544.797735][T28640]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  544.797749][T28640]  ? rcu_is_watching+0x15/0xb0
[  544.797760][T28640]  ? do_syscall_64+0xbe/0x3b0
[  544.797770][T28640]  do_syscall_64+0xfa/0x3b0
[  544.797778][T28640]  ? lockdep_hardirqs_on+0x9c/0x150
[  544.797786][T28640]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  544.797794][T28640]  ? exc_page_fault+0x9f/0xf0
[  544.797802][T28640]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  544.797810][T28640] RIP: 0033:0x7f3b12d8ec29
[  544.797818][T28640] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  544.797825][T28640] RSP: 002b:00007f3b13bfe038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  544.797833][T28640] RAX: ffffffffffffffda RBX: 00007f3b12fd6090 RCX: 00007f3b12d8ec29
[  544.797839][T28640] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b
[  544.797844][T28640] RBP: 00007f3b12e11e41 R08: 0000000000000000 R09: 0000000000000000
[  544.797849][T28640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  544.797854][T28640] R13: 00007f3b12fd6128 R14: 00007f3b12fd6090 R15: 00007ffe5a211518
[  544.797867][T28640]  </TASK>
[  545.095147][T28646] openvswitch: netlink: ct_state flags 7fffffff unsupported
[  545.402328][T28664] IPVS: set_ctl: invalid protocol: 109 100.1.1.2:0
[  545.593405][T28682] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  545.607489][T28681] IPVS: stopping backup sync thread 28682 ...
[  545.696362][T28689] netlink: 'syz.0.5771': attribute type 1 has an invalid length.
[  545.854546][T28693] IPVS: persistence engine module ip_vs_pe_ not found
[  546.760197][T28749] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode
[  547.436170][T28749] team0: Port device team_slave_0 removed
[  547.441289][T28749] team0: Port device team_slave_1 removed
[  547.445108][T28749] batman_adv: batadv0: Removing interface: batadv_slave_0
[  547.452117][T28749] batman_adv: batadv0: Removing interface: batadv_slave_1
[  547.456297][T28749] batman_adv: batadv0: Removing interface: ipvlan2
[  547.462165][T28749] bond1: (slave batadv1): Releasing active interface
[  547.468012][T28749] bond3: (slave bridge14): Releasing backup interface
[  547.473571][T28749] bond4: (slave gretap1): Releasing active interface
[  547.531263][T28755] IPVS: stopping backup sync thread 28759 ...
[  547.543218][T28761] __nla_validate_parse: 14 callbacks suppressed
[  547.543231][T28761] netlink: 248 bytes leftover after parsing attributes in process `syz.0.5795'.
[  547.556296][T28755] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5793'.
[  547.604843][T28768] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5796'.
[  547.629389][T28768] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  547.632186][T28768] IPv6: NLM_F_CREATE should be set when creating new route
[  547.720630][T28777] syzkaller1: entered promiscuous mode
[  547.722903][T28777] syzkaller1: entered allmulticast mode
[  547.762305][T28781] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  547.766303][T28781] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode
[  547.769972][T28781] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode
[  547.774245][T28781] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) !
[  547.886671][T28795] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  547.891402][T28794] IPVS: stopping backup sync thread 28795 ...
[  547.923371][T28797] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5807'.
[  548.004663][T28799] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5808'.
[  548.008777][T28799] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5808'.
[  548.635197][T28813] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5811'.
[  548.898330][T28805] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  548.949488][T28827] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5815'.
[  549.056860][T28827] IPVS: persistence engine module ip_vs_pe_ not found
[  549.057918][T28838] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  549.071315][T28828] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5816'.
[  549.075174][T28828] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5816'.
[  549.106988][T28839] openvswitch: netlink: nsh attribute has unmatched MD type 0.
[  549.110842][T28839] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  549.417825][T28855] tun9: tun_chr_ioctl cmd 1074025675
[  549.419931][T28855] tun9: persist enabled
[  549.421541][T28855] tun9: tun_chr_ioctl cmd 1074025675
[  549.423630][T28855] tun9: persist enabled
[  549.431211][T28855] tun9: tun_chr_ioctl cmd 37730
[  550.162794][T28901] netlink: 'syz.0.5834': attribute type 21 has an invalid length.
[  550.166714][T28901] netlink: 'syz.0.5834': attribute type 21 has an invalid length.
[  550.541077][T28911] syzkaller0 speed is unknown, defaulting to 1000
[  550.664543][T28925] nbd: must specify a device to reconfigure
[  550.977011][T28944] netlink: 'syz.1.5848': attribute type 4 has an invalid length.
[  551.284826][T28963] syzkaller0 speed is unknown, defaulting to 1000
[  551.365461][T28969] syzkaller0 speed is unknown, defaulting to 1000
[  551.513759][T28984] lo speed is unknown, defaulting to 1000
[  551.519140][T28984] lo speed is unknown, defaulting to 1000
[  551.522045][T28984] lo speed is unknown, defaulting to 1000
[  551.591927][T28987] IPVS: persistence engine module ip_vs_pe_ not found
[  551.598908][T28987] rdma_rxe: rxe_newlink: failed to add lo
[  551.709812][T28984] infiniband syz0: set down
[  551.716598][T28984] infiniband syz0: added lo
[  551.720776][T28984] syz0: rxe_create_cq: returned err = -12
[  551.723232][T28984] infiniband syz0: Couldn't create ib_mad CQ
[  551.725875][T28984] infiniband syz0: Couldn't open port 1
[  551.731047][T26595] lo speed is unknown, defaulting to 1000
[  551.745052][T28984] RDS/IB: syz0: added
[  551.746895][T28984] smc: adding ib device syz0 with port count 1
[  551.751078][T28984] smc:    ib device syz0 port 1 has pnetid 
[  551.754782][T26595] lo speed is unknown, defaulting to 1000
[  551.758557][T28984] lo speed is unknown, defaulting to 1000
[  551.886827][T28984] lo speed is unknown, defaulting to 1000
[  552.030519][T28984] lo speed is unknown, defaulting to 1000
[  552.182703][T28984] lo speed is unknown, defaulting to 1000
[  552.225768][T29022] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048)
[  552.513879][T29040] netlink: 'syz.0.5875': attribute type 21 has an invalid length.
[  552.518697][T29038] IPVS: Scheduler module ip_vs_sip not found
[  552.519440][T29040] netlink: 'syz.0.5875': attribute type 30 has an invalid length.
[  553.129895][T29058] syzkaller0 speed is unknown, defaulting to 1000
[  553.134539][T29058] lo speed is unknown, defaulting to 1000
[  553.443193][T29045] Bluetooth: hci0: Opcode 0x0401 failed: -4
[  553.481448][T29062] __nla_validate_parse: 14 callbacks suppressed
[  553.481463][T29062] netlink: 248 bytes leftover after parsing attributes in process `syz.0.5880'.
[  553.706339][T29077] netlink: 248 bytes leftover after parsing attributes in process `syz.0.5886'.
[  553.711050][T29076] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5885'.
[  553.754589][T29076] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5885'.
[  553.823673][T29080] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5887'.
[  553.992148][T29091] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5890'.
[  554.076265][T29093] netlink: 248 bytes leftover after parsing attributes in process `syz.2.5891'.
[  554.228656][T29095] syzkaller0 speed is unknown, defaulting to 1000
[  554.234409][T29095] lo speed is unknown, defaulting to 1000
[  554.237164][T29101] syzkaller0 speed is unknown, defaulting to 1000
[  554.237658][T29105] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5894'.
[  554.358294][T29101] lo speed is unknown, defaulting to 1000
[  554.446832][T29115] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5897'.
[  555.083233][T29142] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5903'.
[  555.093260][T29142] IPVS: set_ctl: invalid protocol: 29 10.1.1.1:4096
[  555.289906][T29148] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  555.294536][T29147] IPVS: stopping backup sync thread 29148 ...
[  555.479311][T29159] tun10: tun_chr_ioctl cmd 1074025675
[  555.481435][T29159] tun10: persist enabled
[  555.483781][T29159] tun10: tun_chr_ioctl cmd 1074025675
[  555.485917][T29159] tun10: persist enabled
[  555.494603][T29159] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  555.866745][T29196] netlink: 'syz.0.5916': attribute type 21 has an invalid length.
[  555.872852][T29196] netlink: 'syz.0.5916': attribute type 30 has an invalid length.
[  555.975048][T29203] netlink: 'syz.1.5920': attribute type 1 has an invalid length.
[  556.628646][T29221] IPVS: set_ctl: invalid protocol: 6557 0.0.0.0:0
[  556.632272][T29221] IPVS: set_ctl: invalid protocol: 6557 0.0.0.0:0
[  557.221805][T29252] syzkaller0 speed is unknown, defaulting to 1000
[  557.225932][T29252] lo speed is unknown, defaulting to 1000
[  557.797563][T29274] netlink: 'syz.2.5935': attribute type 4 has an invalid length.
[  557.846122][T29284] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  557.849889][T29283] IPVS: stopping backup sync thread 29284 ...
[  557.994480][T29288] netlink: 'syz.2.5938': attribute type 29 has an invalid length.
[  558.003331][T29288] netlink: 'syz.2.5938': attribute type 29 has an invalid length.
[  558.007129][T29288] unsupported nla_type 58
[  558.146878][T29296] IPVS: set_ctl: invalid protocol: 34213 172.20.20.19:20003
[  558.150290][T29297] IPVS: set_ctl: invalid protocol: 34213 172.20.20.19:20003
[  558.225907][T29301] tap0: tun_chr_ioctl cmd 1074025678
[  558.227979][T29301] tap0: group set to 0
[  559.284935][T29317] __nla_validate_parse: 15 callbacks suppressed
[  559.284946][T29317] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5948'.
[  559.306482][T29317] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5948'.
[  559.312154][T29317] netlink: 'syz.2.5948': attribute type 1 has an invalid length.
[  559.315581][T29317] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5948'.
[  559.444623][T29323] syzkaller0 speed is unknown, defaulting to 1000
[  559.448238][T29323] lo speed is unknown, defaulting to 1000
[  559.519749][T29327] syzkaller0 speed is unknown, defaulting to 1000
[  559.565900][T29327] lo speed is unknown, defaulting to 1000
[  560.109906][T29343] 8021q: VLANs not supported on lo
[  560.179927][T29347] netlink: 'syz.0.5954': attribute type 1 has an invalid length.
[  560.193254][T29347] bond8: entered promiscuous mode
[  560.195168][T29347] 8021q: adding VLAN 0 to HW filter on device bond8
[  560.246416][T29353] netdevsim netdevsim0: Direct firmware load for .. failed with error -2
[  560.253519][T29353] netdevsim netdevsim0: Falling back to sysfs fallback for: ..
[  560.263181][T29355] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20000
[  560.268081][T29355] IPVS: set_ctl: invalid protocol: 29 10.1.1.1:4096
[  560.572603][T29376] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5962'.
[  560.574913][T29377] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5962'.
[  561.228797][T29391] IPVS: stopping backup sync thread 29392 ...
[  561.411551][T29410] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5971'.
[  561.515032][T29418] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  561.662069][T29432] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5976'.
[  561.679834][T29432] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  561.682861][T29432] CPU: 0 UID: 0 PID: 29432 Comm: syz.1.5976 Not tainted syzkaller #0 PREEMPT(full) 
[  561.682873][T29432] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  561.682878][T29432] Call Trace:
[  561.682882][T29432]  <TASK>
[  561.682888][T29432]  dump_stack_lvl+0x189/0x250
[  561.682904][T29432]  ? __pfx_dump_stack_lvl+0x10/0x10
[  561.682913][T29432]  ? __pfx__printk+0x10/0x10
[  561.682927][T29432]  ? kernfs_path_from_node+0x2f/0x290
[  561.682936][T29432]  ? kernfs_path_from_node+0x250/0x290
[  561.682944][T29432]  ? kernfs_path_from_node+0x2f/0x290
[  561.682954][T29432]  sysfs_warn_dup+0x8e/0xa0
[  561.682963][T29432]  sysfs_do_create_link_sd+0xc0/0x110
[  561.682973][T29432]  device_add_class_symlinks+0x1cf/0x240
[  561.682985][T29432]  device_add+0x475/0xb50
[  561.682997][T29432]  wiphy_register+0x1ba6/0x28d0
[  561.683013][T29432]  ? __pfx_wiphy_register+0x10/0x10
[  561.683020][T29432]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  561.683035][T29432]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  561.683047][T29432]  ieee80211_register_hw+0x3484/0x4100
[  561.683064][T29432]  ? ieee80211_register_hw+0x13f1/0x4100
[  561.683079][T29432]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  561.683092][T29432]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  561.683107][T29432]  ? __hrtimer_setup+0x187/0x210
[  561.683115][T29432]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  561.683125][T29432]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  561.683149][T29432]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  561.683159][T29432]  ? trace_kmalloc+0x1f/0xd0
[  561.683169][T29432]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  561.683180][T29432]  ? kstrndup+0xbf/0x160
[  561.683192][T29432]  hwsim_new_radio_nl+0xea4/0x1b10
[  561.683205][T29432]  ? __pfx___nla_validate_parse+0x10/0x10
[  561.683220][T29432]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  561.683236][T29432]  ? __nla_parse+0x40/0x60
[  561.683246][T29432]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  561.683285][T29432]  genl_family_rcv_msg_doit+0x215/0x300
[  561.683299][T29432]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  561.683316][T29432]  ? bpf_lsm_capable+0x9/0x20
[  561.683327][T29432]  ? security_capable+0x7e/0x2e0
[  561.683343][T29432]  genl_rcv_msg+0x60e/0x790
[  561.683357][T29432]  ? __pfx_genl_rcv_msg+0x10/0x10
[  561.683367][T29432]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  561.683385][T29432]  netlink_rcv_skb+0x208/0x470
[  561.683393][T29432]  ? __lock_acquire+0xab9/0xd20
[  561.683405][T29432]  ? __pfx_genl_rcv_msg+0x10/0x10
[  561.683416][T29432]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  561.683432][T29432]  ? down_read+0x1ad/0x2e0
[  561.683443][T29432]  genl_rcv+0x28/0x40
[  561.683452][T29432]  netlink_unicast+0x82f/0x9e0
[  561.683467][T29432]  ? __pfx_netlink_unicast+0x10/0x10
[  561.683480][T29432]  ? netlink_sendmsg+0x642/0xb30
[  561.683487][T29432]  ? skb_put+0x11b/0x210
[  561.683498][T29432]  netlink_sendmsg+0x805/0xb30
[  561.683510][T29432]  ? __pfx_netlink_sendmsg+0x10/0x10
[  561.683520][T29432]  ? aa_sock_msg_perm+0xf1/0x1d0
[  561.683529][T29432]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  561.683537][T29432]  ? __pfx_netlink_sendmsg+0x10/0x10
[  561.683546][T29432]  __sock_sendmsg+0x21c/0x270
[  561.683559][T29432]  ____sys_sendmsg+0x505/0x830
[  561.683571][T29432]  ? __pfx_____sys_sendmsg+0x10/0x10
[  561.683590][T29432]  ? import_iovec+0x74/0xa0
[  561.683602][T29432]  ___sys_sendmsg+0x21f/0x2a0
[  561.683613][T29432]  ? __pfx____sys_sendmsg+0x10/0x10
[  561.683637][T29432]  ? __fget_files+0x2a/0x420
[  561.683644][T29432]  ? __fget_files+0x3a0/0x420
[  561.683655][T29432]  __x64_sys_sendmsg+0x19b/0x260
[  561.683666][T29432]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  561.683680][T29432]  ? rcu_is_watching+0x15/0xb0
[  561.683690][T29432]  ? do_syscall_64+0xbe/0x3b0
[  561.683701][T29432]  do_syscall_64+0xfa/0x3b0
[  561.683709][T29432]  ? lockdep_hardirqs_on+0x9c/0x150
[  561.683717][T29432]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  561.683725][T29432]  ? exc_page_fault+0x9f/0xf0
[  561.683734][T29432]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  561.683742][T29432] RIP: 0033:0x7fe04998ec29
[  561.683750][T29432] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  561.683756][T29432] RSP: 002b:00007fe04a7eb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  561.683766][T29432] RAX: ffffffffffffffda RBX: 00007fe049bd5fa0 RCX: 00007fe04998ec29
[  561.683772][T29432] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000007
[  561.683777][T29432] RBP: 00007fe049a11e41 R08: 0000000000000000 R09: 0000000000000000
[  561.683782][T29432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  561.683787][T29432] R13: 00007fe049bd6038 R14: 00007fe049bd5fa0 R15: 00007ffc5d475628
[  561.683800][T29432]  </TASK>
[  561.929637][T29445] netlink: 'syz.0.5980': attribute type 9 has an invalid length.
[  562.000950][T29447] IPVS: Scheduler module ip_vs_sip not found
[  562.033722][T29454] netlink: 'syz.0.5982': attribute type 16 has an invalid length.
[  562.037137][T29454] netlink: 'syz.0.5982': attribute type 17 has an invalid length.
[  562.112700][T29454] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5982'.
[  562.162927][T29459] netlink: 256 bytes leftover after parsing attributes in process `syz.0.5984'.
[  562.180282][T29459] netlink: 'syz.0.5984': attribute type 4 has an invalid length.
[  562.271699][T29467] netlink: 'syz.0.5988': attribute type 142 has an invalid length.
[  562.365902][T29471] veth0_to_bond: left allmulticast mode
[  562.372676][T29471] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode
[  562.375602][T29471] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode
[  562.422344][T29480] netlink: 248 bytes leftover after parsing attributes in process `syz.0.5994'.
[  562.425890][T29471] geneve4: left promiscuous mode
[  562.434857][T29471] geneve5: left promiscuous mode
[  562.437076][T29471] geneve5: left allmulticast mode
[  562.461146][   T12] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 256 - 0
[  562.464326][   T12] netdevsim netdevsim1 eth0: unset [1, 1] type 2 family 0 port 6081 - 0
[  562.468800][   T12] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 256 - 0
[  562.472203][   T12] netdevsim netdevsim1 eth1: unset [1, 1] type 2 family 0 port 6081 - 0
[  562.526715][   T12] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 256 - 0
[  562.537807][   T12] netdevsim netdevsim1 eth2: unset [1, 1] type 2 family 0 port 6081 - 0
[  562.557397][   T12] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 256 - 0
[  562.561445][   T12] netdevsim netdevsim1 eth3: unset [1, 1] type 2 family 0 port 6081 - 0
[  562.586150][T29486] IPVS: set_ctl: invalid protocol: 31091 97.108.108.101:29184
[  562.656659][T29483] team0 (unregistering): Port device bridge0 removed
[  562.768332][T29502] openvswitch: netlink: Flow actions attr not present in new flow.
[  562.976379][T29516] netlink: 'syz.0.6005': attribute type 10 has an invalid length.
[  564.292899][T29567] __nla_validate_parse: 8 callbacks suppressed
[  564.292914][T29567] netlink: 248 bytes leftover after parsing attributes in process `syz.1.6018'.
[  564.611482][T29576] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  564.616788][T29575] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6019'.
[  564.620158][T29575] netlink: 'syz.2.6019': attribute type 30 has an invalid length.
[  564.623409][T29575] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6019'.
[  564.792465][T29601] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6025'.
[  564.795935][T29600] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6025'.
[  565.051720][T29617] IPVS: persistence engine module ip_vs_pe_ not found
[  565.302767][T29631] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  565.306507][T29630] IPVS: stopping backup sync thread 29631 ...
[  565.355449][T29634] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  565.360285][T29633] IPVS: stopping backup sync thread 29634 ...
[  565.398055][T29636] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  565.436634][T29636] _Z`Ԁ@: entered promiscuous mode
[  565.530507][T29649] netlink: 'syz.1.6040': attribute type 10 has an invalid length.
[  565.554281][T29654] netdevsim netdevsim0: Direct firmware load for .. failed with error -2
[  565.558830][T29654] netdevsim netdevsim0: Falling back to sysfs fallback for: ..
[  565.613137][T29661] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6043'.
[  565.665756][T29667] IPVS: stopping backup sync thread 29576 ...
[  565.781593][T29681] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6048'.
[  565.822950][T29689] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  565.826917][T29688] IPVS: stopping backup sync thread 29689 ...
[  565.923501][T29691] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6051'.
[  566.118174][T29705] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  566.121671][T29705] CPU: 0 UID: 0 PID: 29705 Comm: syz.1.6055 Not tainted syzkaller #0 PREEMPT(full) 
[  566.121690][T29705] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  566.121698][T29705] Call Trace:
[  566.121705][T29705]  <TASK>
[  566.121712][T29705]  dump_stack_lvl+0x189/0x250
[  566.121737][T29705]  ? __pfx_dump_stack_lvl+0x10/0x10
[  566.121754][T29705]  ? __pfx__printk+0x10/0x10
[  566.121777][T29705]  ? kernfs_path_from_node+0x2f/0x290
[  566.121792][T29705]  ? kernfs_path_from_node+0x250/0x290
[  566.121805][T29705]  ? kernfs_path_from_node+0x2f/0x290
[  566.121822][T29705]  sysfs_warn_dup+0x8e/0xa0
[  566.121837][T29705]  sysfs_do_create_link_sd+0xc0/0x110
[  566.121853][T29705]  device_add_class_symlinks+0x1cf/0x240
[  566.121873][T29705]  device_add+0x475/0xb50
[  566.121892][T29705]  wiphy_register+0x1ba6/0x28d0
[  566.121920][T29705]  ? __pfx_wiphy_register+0x10/0x10
[  566.121933][T29705]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  566.121957][T29705]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  566.121977][T29705]  ieee80211_register_hw+0x3484/0x4100
[  566.122006][T29705]  ? ieee80211_register_hw+0x13f1/0x4100
[  566.122032][T29705]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  566.122052][T29705]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  566.122079][T29705]  ? __hrtimer_setup+0x187/0x210
[  566.122092][T29705]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  566.122109][T29705]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  566.122152][T29705]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  566.122171][T29705]  ? trace_kmalloc+0x1f/0xd0
[  566.122185][T29705]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  566.122249][T29705]  ? kstrndup+0xbf/0x160
[  566.122273][T29705]  hwsim_new_radio_nl+0xea4/0x1b10
[  566.122295][T29705]  ? __pfx___nla_validate_parse+0x10/0x10
[  566.122321][T29705]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  566.122351][T29705]  ? __nla_parse+0x40/0x60
[  566.122370][T29705]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  566.122397][T29705]  genl_family_rcv_msg_doit+0x215/0x300
[  566.122422][T29705]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  566.122450][T29705]  ? bpf_lsm_capable+0x9/0x20
[  566.122467][T29705]  ? security_capable+0x7e/0x2e0
[  566.122491][T29705]  genl_rcv_msg+0x60e/0x790
[  566.122514][T29705]  ? __pfx_genl_rcv_msg+0x10/0x10
[  566.122531][T29705]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  566.122568][T29705]  netlink_rcv_skb+0x208/0x470
[  566.122580][T29705]  ? __lock_acquire+0xab9/0xd20
[  566.122600][T29705]  ? __pfx_genl_rcv_msg+0x10/0x10
[  566.122619][T29705]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  566.122650][T29705]  ? down_read+0x1ad/0x2e0
[  566.122668][T29705]  genl_rcv+0x28/0x40
[  566.122685][T29705]  netlink_unicast+0x82f/0x9e0
[  566.122712][T29705]  ? __pfx_netlink_unicast+0x10/0x10
[  566.122734][T29705]  ? netlink_sendmsg+0x642/0xb30
[  566.122746][T29705]  ? skb_put+0x11b/0x210
[  566.122764][T29705]  netlink_sendmsg+0x805/0xb30
[  566.122784][T29705]  ? __pfx_netlink_sendmsg+0x10/0x10
[  566.122801][T29705]  ? aa_sock_msg_perm+0xf1/0x1d0
[  566.122816][T29705]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  566.122830][T29705]  ? __pfx_netlink_sendmsg+0x10/0x10
[  566.122844][T29705]  __sock_sendmsg+0x21c/0x270
[  566.122866][T29705]  ____sys_sendmsg+0x505/0x830
[  566.122888][T29705]  ? __pfx_____sys_sendmsg+0x10/0x10
[  566.122911][T29705]  ? import_iovec+0x74/0xa0
[  566.122931][T29705]  ___sys_sendmsg+0x21f/0x2a0
[  566.122949][T29705]  ? __pfx____sys_sendmsg+0x10/0x10
[  566.122994][T29705]  ? __fget_files+0x2a/0x420
[  566.123006][T29705]  ? __fget_files+0x3a0/0x420
[  566.123026][T29705]  __x64_sys_sendmsg+0x19b/0x260
[  566.123045][T29705]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  566.123077][T29705]  ? do_syscall_64+0xbe/0x3b0
[  566.123096][T29705]  do_syscall_64+0xfa/0x3b0
[  566.123110][T29705]  ? lockdep_hardirqs_on+0x9c/0x150
[  566.123123][T29705]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  566.123135][T29705]  ? exc_page_fault+0x9f/0xf0
[  566.123151][T29705]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  566.123164][T29705] RIP: 0033:0x7fe04998ec29
[  566.123177][T29705] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  566.123189][T29705] RSP: 002b:00007fe04a7ca038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  566.123236][T29705] RAX: ffffffffffffffda RBX: 00007fe049bd6090 RCX: 00007fe04998ec29
[  566.123246][T29705] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b
[  566.123256][T29705] RBP: 00007fe049a11e41 R08: 0000000000000000 R09: 0000000000000000
[  566.123264][T29705] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  566.123271][T29705] R13: 00007fe049bd6128 R14: 00007fe049bd6090 R15: 00007ffc5d475628
[  566.123295][T29705]  </TASK>
[  566.652731][T29729] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6063'.
[  566.727588][T29729] block nbd3: server does not support multiple connections per device.
[  566.731462][T29729] block nbd3: shutting down sockets
[  566.764430][T29735] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  566.768428][T29734] IPVS: stopping backup sync thread 29735 ...
[  566.813426][T29737] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6065'.
[  566.961236][T29743] IPVS: Scheduler module ip_vs_sip not found
[  567.548924][T26595] page_pool_release_retry() stalled pool shutdown: id 44, 1 inflight 60 sec
[  567.556612][T29767] syzkaller0 speed is unknown, defaulting to 1000
[  567.561115][T29767] lo speed is unknown, defaulting to 1000
[  567.693926][T29783] IPVS: stopping backup sync thread 29784 ...
[  567.694169][T29784] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  569.092596][T29866] veth1: entered allmulticast mode
[  569.470789][T29887] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition
[  569.474520][T29887] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0)
[  569.511418][T29891] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  569.511529][T29890] IPVS: stopping backup sync thread 29891 ...
[  569.551605][T29893] xt_socket: unknown flags 0xfc
[  569.558051][T29893] __nla_validate_parse: 7 callbacks suppressed
[  569.558062][T29893] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.6107'.
[  569.612524][T29900] netlink: 144 bytes leftover after parsing attributes in process `syz.2.6110'.
[  569.808615][T29913] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6114'.
[  570.279219][ T7658] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)
[  570.856693][T29948] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6126'.
[  570.910334][T29949] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6126'.
[  570.960209][T29951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6127'.
[  571.271794][T29961] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable
[  571.363516][T29969] IPVS: stopping backup sync thread 29970 ...
[  571.363559][T29970] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  571.602369][T29986] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6137'.
[  571.606347][T29988] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6138'.
[  571.884059][T30005] netlink: 'syz.2.6141': attribute type 1 has an invalid length.
[  571.886905][T30005] nbd: must specify at least one socket
[  571.913197][T30009] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6142'.
[  571.917398][T30009] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6142'.
[  572.300594][T30020] netlink: 'syz.0.6145': attribute type 1 has an invalid length.
[  572.578943][T30032] block nbd3: server does not support multiple connections per device.
[  572.582601][T30032] block nbd3: shutting down sockets
[  572.614920][T30034] tun11: tun_chr_ioctl cmd 1074025675
[  572.619359][T30034] tun11: persist enabled
[  572.621736][T30034] tun11: tun_chr_ioctl cmd 1074025675
[  572.623775][T30034] tun11: persist enabled
[  572.678035][T30039] netlink: 'syz.1.6151': attribute type 83 has an invalid length.
[  572.703106][T30040] IPVS: set_ctl: invalid protocol: 34213 172.20.20.19:20003
[  572.724523][T30045] openvswitch: netlink: Flow key attr not present in new flow.
[  572.742211][T30045] netlink: 'syz.1.6153': attribute type 3 has an invalid length.
[  573.809786][T30078] IPVS: persistence engine module ip_vs_pe_ not found
[  574.165939][T30107] sock: sock_timestamping_bind_phc: sock not bind to device
[  574.709923][T30125] __nla_validate_parse: 5 callbacks suppressed
[  574.709938][T30125] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6176'.
[  574.880375][T30129] netlink: 284 bytes leftover after parsing attributes in process `syz.2.6177'.
[  574.976675][T30131] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6178'.
[  575.042259][T30132] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6178'.
[  575.324548][T30141] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  575.324762][T30140] IPVS: stopping backup sync thread 30141 ...
[  576.005142][T30157] mac80211_hwsim hwsim5 wlan1: left allmulticast mode
[  576.013677][T30157] netlink: 'syz.0.6187': attribute type 10 has an invalid length.
[  576.019240][T30158] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode
[  576.022196][T30158] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode
[  576.476283][T30183] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6192'.
[  576.558536][T30189] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6194'.
[  576.609892][T30193] IPVS: set_ctl: invalid protocol: 113 224.0.0.1:20000
[  577.031007][T30218] netlink: 'syz.2.6202': attribute type 5 has an invalid length.
[  577.033750][T30218] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6202'.
[  577.436667][T30253] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6208'.
[  577.441810][T30253] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6208'.
[  577.444940][T30253] netlink: 'syz.1.6208': attribute type 12 has an invalid length.
[  577.449678][T30253] netlink: 'syz.1.6208': attribute type 14 has an invalid length.
[  577.455476][T30253] sctp: [Deprecated]: syz.1.6208 (pid 30253) Use of struct sctp_assoc_value in delayed_ack socket option.
[  577.455476][T30253] Use struct sctp_sack_info instead
[  577.486841][T30255] netlink: 248 bytes leftover after parsing attributes in process `syz.1.6209'.
[  578.360379][T30275] netlink: 'syz.2.6216': attribute type 21 has an invalid length.
[  578.725229][T30289] netlink: 'syz.2.6220': attribute type 4 has an invalid length.
[  579.578858][T30342] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:0
[  579.590920][T30345] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  579.595653][T30344] IPVS: stopping backup sync thread 30345 ...
[  579.674594][T30355] IPVS: stopping backup sync thread 30357 ...
[  579.674599][T30357] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  579.821870][T30368] veth6: entered promiscuous mode
[  580.210812][T30381] syzkaller0 speed is unknown, defaulting to 1000
[  580.238835][T30381] lo speed is unknown, defaulting to 1000
[  580.746901][T30418] __nla_validate_parse: 9 callbacks suppressed
[  580.746917][T30418] netlink: 248 bytes leftover after parsing attributes in process `syz.1.6254'.
[  580.981600][T30428] syzkaller0 speed is unknown, defaulting to 1000
[  580.985295][T30428] lo speed is unknown, defaulting to 1000
[  581.053364][T30426] syzkaller0 speed is unknown, defaulting to 1000
[  581.059006][T30430] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6256'.
[  581.160915][T30426] lo speed is unknown, defaulting to 1000
[  581.277464][T30441] IPVS: set_ctl: invalid protocol: 320 0.32.0.0:26624
[  581.786139][T30474] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6269'.
[  581.791411][T30474] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6269'.
[  581.795264][T30474] netlink: 'syz.0.6269': attribute type 6 has an invalid length.
[  582.069446][T30489] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6271'.
[  582.574540][T30512] syzkaller0 speed is unknown, defaulting to 1000
[  582.579587][T30512] lo speed is unknown, defaulting to 1000
[  582.605637][T30518] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6280'.
[  582.610913][T30515] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6280'.
[  582.623414][T30517] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6279'.
[  582.641059][T30516] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6279'.
[  582.669113][T30515] IPVS: persistence engine module ip_vs_pe_ not found
[  582.716643][T30519] syzkaller0 speed is unknown, defaulting to 1000
[  582.735732][T30519] lo speed is unknown, defaulting to 1000
[  582.767080][T30529] IPVS: set_ctl: invalid protocol: 1344 0.32.0.0:19456
[  582.991854][T30548] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  583.022476][T30548] syzkaller0 speed is unknown, defaulting to 1000
[  583.048762][T30548] lo speed is unknown, defaulting to 1000
[  583.378745][T30563] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0
[  583.385188][T30563] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0
[  583.449949][T30565] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6290'.
[  583.728981][T30576] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  583.732579][T30576] CPU: 0 UID: 0 PID: 30576 Comm: syz.0.6294 Not tainted syzkaller #0 PREEMPT(full) 
[  583.732597][T30576] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  583.732605][T30576] Call Trace:
[  583.732610][T30576]  <TASK>
[  583.732616][T30576]  dump_stack_lvl+0x189/0x250
[  583.732638][T30576]  ? __pfx_dump_stack_lvl+0x10/0x10
[  583.732652][T30576]  ? __pfx__printk+0x10/0x10
[  583.732672][T30576]  ? kernfs_path_from_node+0x2f/0x290
[  583.732687][T30576]  ? kernfs_path_from_node+0x250/0x290
[  583.732699][T30576]  ? kernfs_path_from_node+0x2f/0x290
[  583.732716][T30576]  sysfs_warn_dup+0x8e/0xa0
[  583.732729][T30576]  sysfs_do_create_link_sd+0xc0/0x110
[  583.732746][T30576]  device_add_class_symlinks+0x1cf/0x240
[  583.732766][T30576]  device_add+0x475/0xb50
[  583.732786][T30576]  wiphy_register+0x1ba6/0x28d0
[  583.732812][T30576]  ? __pfx_wiphy_register+0x10/0x10
[  583.732825][T30576]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  583.732847][T30576]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  583.732865][T30576]  ieee80211_register_hw+0x3484/0x4100
[  583.732892][T30576]  ? ieee80211_register_hw+0x13f1/0x4100
[  583.732916][T30576]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  583.732936][T30576]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  583.732961][T30576]  ? __hrtimer_setup+0x187/0x210
[  583.732973][T30576]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  583.733016][T30576]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  583.733066][T30576]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  583.733082][T30576]  ? trace_kmalloc+0x1f/0xd0
[  583.733096][T30576]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  583.733112][T30576]  ? kstrndup+0xbf/0x160
[  583.733134][T30576]  hwsim_new_radio_nl+0xea4/0x1b10
[  583.733154][T30576]  ? __pfx___nla_validate_parse+0x10/0x10
[  583.733178][T30576]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  583.733205][T30576]  ? __nla_parse+0x40/0x60
[  583.733221][T30576]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  583.733263][T30576]  genl_family_rcv_msg_doit+0x215/0x300
[  583.733287][T30576]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  583.733312][T30576]  ? bpf_lsm_capable+0x9/0x20
[  583.733328][T30576]  ? security_capable+0x7e/0x2e0
[  583.733351][T30576]  genl_rcv_msg+0x60e/0x790
[  583.733372][T30576]  ? __pfx_genl_rcv_msg+0x10/0x10
[  583.733387][T30576]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  583.733414][T30576]  netlink_rcv_skb+0x208/0x470
[  583.733427][T30576]  ? __lock_acquire+0xab9/0xd20
[  583.733446][T30576]  ? __pfx_genl_rcv_msg+0x10/0x10
[  583.733463][T30576]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  583.733490][T30576]  ? down_read+0x1ad/0x2e0
[  583.733508][T30576]  genl_rcv+0x28/0x40
[  583.733523][T30576]  netlink_unicast+0x82f/0x9e0
[  583.733548][T30576]  ? __pfx_netlink_unicast+0x10/0x10
[  583.733569][T30576]  ? netlink_sendmsg+0x642/0xb30
[  583.733582][T30576]  ? skb_put+0x11b/0x210
[  583.733599][T30576]  netlink_sendmsg+0x805/0xb30
[  583.733620][T30576]  ? __pfx_netlink_sendmsg+0x10/0x10
[  583.733636][T30576]  ? aa_sock_msg_perm+0xf1/0x1d0
[  583.733652][T30576]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  583.733665][T30576]  ? __pfx_netlink_sendmsg+0x10/0x10
[  583.733680][T30576]  __sock_sendmsg+0x21c/0x270
[  583.733700][T30576]  ____sys_sendmsg+0x505/0x830
[  583.733720][T30576]  ? __pfx_____sys_sendmsg+0x10/0x10
[  583.733744][T30576]  ? import_iovec+0x74/0xa0
[  583.733764][T30576]  ___sys_sendmsg+0x21f/0x2a0
[  583.733781][T30576]  ? __pfx____sys_sendmsg+0x10/0x10
[  583.733826][T30576]  ? __fget_files+0x2a/0x420
[  583.733837][T30576]  ? __fget_files+0x3a0/0x420
[  583.733856][T30576]  __x64_sys_sendmsg+0x19b/0x260
[  583.733873][T30576]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  583.733897][T30576]  ? rcu_is_watching+0x15/0xb0
[  583.733915][T30576]  ? do_syscall_64+0xbe/0x3b0
[  583.733933][T30576]  do_syscall_64+0xfa/0x3b0
[  583.733967][T30576]  ? lockdep_hardirqs_on+0x9c/0x150
[  583.733980][T30576]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  583.734019][T30576]  ? exc_page_fault+0x9f/0xf0
[  583.734034][T30576]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  583.734046][T30576] RIP: 0033:0x7f3b12d8ec29
[  583.734065][T30576] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  583.734076][T30576] RSP: 002b:00007f3b13c1f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  583.734092][T30576] RAX: ffffffffffffffda RBX: 00007f3b12fd5fa0 RCX: 00007f3b12d8ec29
[  583.734102][T30576] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000007
[  583.734110][T30576] RBP: 00007f3b12e11e41 R08: 0000000000000000 R09: 0000000000000000
[  583.734118][T30576] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  583.734125][T30576] R13: 00007f3b12fd6038 R14: 00007f3b12fd5fa0 R15: 00007ffe5a211518
[  583.734149][T30576]  </TASK>
[  583.779612][T30578] IPVS: fo: TCP 172.20.20.170:0 - no destination available
[  583.894522][T30590] netlink: 'syz.1.6299': attribute type 1 has an invalid length.
[  583.916526][T30590] netlink: 'syz.1.6299': attribute type 2 has an invalid length.
[  583.925102][T30592] IPVS: Scheduler module ip_vs_sip not found
[  583.985678][T30599] : renamed from vlan0
[  584.209841][T30611] syzkaller0 speed is unknown, defaulting to 1000
[  584.213509][T30611] lo speed is unknown, defaulting to 1000
[  584.251735][T30613] sctp: [Deprecated]: syz.0.6302 (pid 30613) Use of int in max_burst socket option.
[  584.251735][T30613] Use struct sctp_assoc_value instead
[  584.258684][T30614] sctp: [Deprecated]: syz.0.6302 (pid 30614) Use of int in max_burst socket option.
[  584.258684][T30614] Use struct sctp_assoc_value instead
[  584.592211][T30618] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  584.631792][T30626] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  584.636116][T30625] IPVS: stopping backup sync thread 30626 ...
[  585.900149][T30662] __nla_validate_parse: 7 callbacks suppressed
[  585.900159][T30662] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6317'.
[  585.973931][T30658] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6317'.
[  586.046763][T30665] netlink: 248 bytes leftover after parsing attributes in process `syz.1.6318'.
[  586.357528][T30693] netlink: 248 bytes leftover after parsing attributes in process `syz.1.6326'.
[  586.993018][T30715] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6332'.
[  587.007356][T30715] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6332'.
[  587.163696][T30722] netlink: 152 bytes leftover after parsing attributes in process `syz.1.6334'.
[  587.178477][T30722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6334'.
[  587.664325][T30753] IPVS: persistence engine module ip_vs_pe_ not found
[  587.780730][T30759] netlink: 'syz.1.6344': attribute type 1 has an invalid length.
[  588.021972][T30780] tun12: tun_chr_ioctl cmd 1074025675
[  588.023742][T30780] tun12: persist enabled
[  588.036076][T30780] tun12: tun_chr_ioctl cmd 1074025675
[  588.038318][T30780] tun12: persist enabled
[  588.081664][T30783] netlink: 'syz.0.6352': attribute type 6 has an invalid length.
[  588.099070][T30787] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6350'.
[  588.103855][T30787] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.6350'.
[  588.206184][T30797] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  588.214297][T30796] IPVS: stopping backup sync thread 30797 ...
[  588.332314][T30799] IPVS: Scheduler module ip_vs_sip not found
[  588.456561][T30811] bond0: option all_slaves_active: invalid value (3)
[  589.183703][T30845] dvmrp1: entered allmulticast mode
[  589.186171][T30846] dvmrp1: left allmulticast mode
[  589.435767][T30860] netlink: 'syz.2.6372': attribute type 281 has an invalid length.
[  590.349417][T30899] syzkaller0 speed is unknown, defaulting to 1000
[  590.352523][T30899] lo speed is unknown, defaulting to 1000
[  590.413643][T30901] IPVS: persistence engine module ip_vs_pe_ not found
[  591.128630][T30928] __nla_validate_parse: 6 callbacks suppressed
[  591.128642][T30928] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6391'.
[  591.135577][T30928] nbd: must specify a size in bytes for the device
[  591.176873][T30930] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6392'.
[  591.180242][T30931] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6392'.
[  591.385126][T30940] syzkaller0 speed is unknown, defaulting to 1000
[  591.390400][T30940] lo speed is unknown, defaulting to 1000
[  591.700418][T30951] IPVS: stopping backup sync thread 30952 ...
[  591.793414][T30958] netlink: 'syz.2.6398': attribute type 15 has an invalid length.
[  591.883174][T30960] IPVS: persistence engine module ip_vs_pe_ not found
[  592.121197][T30977] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6404'.
[  592.124741][T30977] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6404'.
[  592.144834][T30977] IPVS: persistence engine module ip_vs_pe_ not found
[  592.148617][T30977] IPVS: set_ctl: invalid protocol: 1 172.20.20.170:0
[  592.194323][T30980] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6405'.
[  592.200844][T30980] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6405'.
[  592.895765][T31027] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6416'.
[  592.909161][T28239] Bluetooth: hci2: command 0x0405 tx timeout
[  593.022944][T31032] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6417'.
[  593.255387][T31041] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  593.259856][T31040] IPVS: stopping backup sync thread 31041 ...
[  593.322072][T31043] netlink: 6 bytes leftover after parsing attributes in process `syz.0.6421'.
[  593.481397][T31059] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  593.484634][T31059] syzkaller0: entered promiscuous mode
[  593.486818][T31059] syzkaller0: entered allmulticast mode
[  593.500434][T31059] tipc: Resetting bearer <eth:syzkaller0>
[  593.514559][T31059] tipc: Resetting bearer <eth:syzkaller0>
[  593.524790][T31059] tipc: Disabling bearer <eth:syzkaller0>
[  595.007932][T31116] netlink: 'syz.1.6442': attribute type 1 has an invalid length.
[  595.011149][T31116] netlink: 'syz.1.6442': attribute type 4 has an invalid length.
[  595.031740][T31116] IPVS: Error connecting to the multicast addr
[  595.330657][T31140] tap0: tun_chr_ioctl cmd 1074025680
[  595.338973][T31140] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  595.343200][T31140] mac80211_hwsim hwsim7 D: renamed from syzkaller0
[  595.347906][T31140] tipc: Disabling bearer <eth:syzkaller0>
[  596.282160][T31168] __nla_validate_parse: 6 callbacks suppressed
[  596.282175][T31168] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6457'.
[  596.371807][T31170] tipc: Enabling of bearer <udp:syz2> rejected, failed to enable media
[  596.569966][T31186] netlink: 'syz.0.6462': attribute type 2 has an invalid length.
[  596.623351][T31193] IPVS: length: 141 != 24
[  596.626633][T31193] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6464'.
[  596.685077][T31198] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 3, id = 0
[  596.689638][T31197] IPVS: stopping backup sync thread 31198 ...
[  596.841286][T31214] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6470'.
[  596.844967][T31214] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6470'.
[  596.956956][T31231] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6471'.
[  596.972660][T31228] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  596.975559][T31228] IPv6: NLM_F_CREATE should be set when creating new route
[  596.978472][T31228] IPv6: NLM_F_CREATE should be set when creating new route
[  596.981505][T31228] IPv6: NLM_F_CREATE should be set when creating new route
[  596.993197][T31228] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  596.994953][T31234] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  597.000654][T31233] IPVS: stopping backup sync thread 31234 ...
[  597.035274][T31237] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6475'.
[  597.130067][T31250] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6478'.
[  597.294974][T31273] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6484'.
[  597.625518][T31296] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.6490'.
[  598.232577][T31325] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6497'.
[  598.944489][T31335] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  598.949367][T31333] IPVS: stopping backup sync thread 31335 ...
[  599.149714][T31345] D speed is unknown, defaulting to 1000
[  599.152851][T31345] lo speed is unknown, defaulting to 1000
[  599.153231][T31344] D speed is unknown, defaulting to 1000
[  599.245236][T31344] lo speed is unknown, defaulting to 1000
[  600.625335][T31372] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  600.629062][T31372] CPU: 1 UID: 0 PID: 31372 Comm: syz.1.6510 Not tainted syzkaller #0 PREEMPT(full) 
[  600.629082][T31372] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  600.629090][T31372] Call Trace:
[  600.629097][T31372]  <TASK>
[  600.629103][T31372]  dump_stack_lvl+0x189/0x250
[  600.629125][T31372]  ? __pfx_dump_stack_lvl+0x10/0x10
[  600.629142][T31372]  ? __pfx__printk+0x10/0x10
[  600.629164][T31372]  ? kernfs_path_from_node+0x2f/0x290
[  600.629179][T31372]  ? kernfs_path_from_node+0x250/0x290
[  600.629192][T31372]  ? kernfs_path_from_node+0x2f/0x290
[  600.629209][T31372]  sysfs_warn_dup+0x8e/0xa0
[  600.629224][T31372]  sysfs_do_create_link_sd+0xc0/0x110
[  600.629241][T31372]  device_add_class_symlinks+0x1cf/0x240
[  600.629260][T31372]  device_add+0x475/0xb50
[  600.629280][T31372]  wiphy_register+0x1ba6/0x28d0
[  600.629307][T31372]  ? __pfx_wiphy_register+0x10/0x10
[  600.629321][T31372]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  600.629344][T31372]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  600.629366][T31372]  ieee80211_register_hw+0x3484/0x4100
[  600.629395][T31372]  ? ieee80211_register_hw+0x13f1/0x4100
[  600.629421][T31372]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  600.629441][T31372]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  600.629468][T31372]  ? __hrtimer_setup+0x187/0x210
[  600.629480][T31372]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  600.629498][T31372]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  600.629542][T31372]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  600.629561][T31372]  ? trace_kmalloc+0x1f/0xd0
[  600.629577][T31372]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  600.629596][T31372]  ? kstrndup+0xbf/0x160
[  600.629618][T31372]  hwsim_new_radio_nl+0xea4/0x1b10
[  600.629640][T31372]  ? __pfx___nla_validate_parse+0x10/0x10
[  600.629668][T31372]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  600.629697][T31372]  ? __nla_parse+0x40/0x60
[  600.629714][T31372]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  600.629740][T31372]  genl_family_rcv_msg_doit+0x215/0x300
[  600.629764][T31372]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  600.629820][T31372]  ? bpf_lsm_capable+0x9/0x20
[  600.629840][T31372]  ? security_capable+0x7e/0x2e0
[  600.629867][T31372]  genl_rcv_msg+0x60e/0x790
[  600.629891][T31372]  ? __pfx_genl_rcv_msg+0x10/0x10
[  600.629914][T31372]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  600.629945][T31372]  netlink_rcv_skb+0x208/0x470
[  600.629958][T31372]  ? __lock_acquire+0xab9/0xd20
[  600.629978][T31372]  ? __pfx_genl_rcv_msg+0x10/0x10
[  600.629998][T31372]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  600.630028][T31372]  ? down_read+0x1ad/0x2e0
[  600.630046][T31372]  genl_rcv+0x28/0x40
[  600.630063][T31372]  netlink_unicast+0x82f/0x9e0
[  600.630091][T31372]  ? __pfx_netlink_unicast+0x10/0x10
[  600.630114][T31372]  ? netlink_sendmsg+0x642/0xb30
[  600.630127][T31372]  ? skb_put+0x11b/0x210
[  600.630146][T31372]  netlink_sendmsg+0x805/0xb30
[  600.630167][T31372]  ? __pfx_netlink_sendmsg+0x10/0x10
[  600.630184][T31372]  ? aa_sock_msg_perm+0xf1/0x1d0
[  600.630200][T31372]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  600.630215][T31372]  ? __pfx_netlink_sendmsg+0x10/0x10
[  600.630229][T31372]  __sock_sendmsg+0x21c/0x270
[  600.630249][T31372]  ____sys_sendmsg+0x505/0x830
[  600.630271][T31372]  ? __pfx_____sys_sendmsg+0x10/0x10
[  600.630292][T31372]  ? import_iovec+0x74/0xa0
[  600.630313][T31372]  ___sys_sendmsg+0x21f/0x2a0
[  600.630331][T31372]  ? __pfx____sys_sendmsg+0x10/0x10
[  600.630378][T31372]  ? __fget_files+0x2a/0x420
[  600.630390][T31372]  ? __fget_files+0x3a0/0x420
[  600.630411][T31372]  __x64_sys_sendmsg+0x19b/0x260
[  600.630430][T31372]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  600.630462][T31372]  ? do_syscall_64+0xbe/0x3b0
[  600.630480][T31372]  do_syscall_64+0xfa/0x3b0
[  600.630494][T31372]  ? lockdep_hardirqs_on+0x9c/0x150
[  600.630507][T31372]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  600.630521][T31372]  ? exc_page_fault+0x9f/0xf0
[  600.630536][T31372]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  600.630548][T31372] RIP: 0033:0x7fe04998ec29
[  600.630561][T31372] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  600.630571][T31372] RSP: 002b:00007fe04a7eb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  600.630586][T31372] RAX: ffffffffffffffda RBX: 00007fe049bd5fa0 RCX: 00007fe04998ec29
[  600.630595][T31372] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000c
[  600.630603][T31372] RBP: 00007fe049a11e41 R08: 0000000000000000 R09: 0000000000000000
[  600.630611][T31372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  600.630619][T31372] R13: 00007fe049bd6038 R14: 00007fe049bd5fa0 R15: 00007ffc5d475628
[  600.630641][T31372]  </TASK>
[  600.913164][T31375] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  600.916982][T31374] IPVS: stopping backup sync thread 31375 ...
[  601.042266][T31369] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  601.044378][T31369] Bluetooth: hci1: Error when powering off device on rfkill (-4)
[  601.057960][T31369] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  601.060050][T31369] Bluetooth: hci2: Error when powering off device on rfkill (-4)
[  601.094526][T31369] tipc: Resetting bearer <eth:syzkaller0>
[  601.252448][T31386] D speed is unknown, defaulting to 1000
[  601.260846][T31386] lo speed is unknown, defaulting to 1000
[  602.131714][T31401] D speed is unknown, defaulting to 1000
[  602.153227][T31401] lo speed is unknown, defaulting to 1000
[  602.666726][T31445] netlink: 'syz.1.6532': attribute type 39 has an invalid length.
[  602.726556][T31448] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  602.733026][T31448] __nla_validate_parse: 3 callbacks suppressed
[  602.733036][T31448] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6532'.
[  602.738720][T31448] netlink: 43 bytes leftover after parsing attributes in process `syz.1.6532'.
[  602.743869][T31448] netlink: 'syz.1.6532': attribute type 5 has an invalid length.
[  602.746736][T31448] netlink: 43 bytes leftover after parsing attributes in process `syz.1.6532'.
[  602.773709][T31448] vlan0: entered allmulticast mode
[  602.776573][T31448] bridge_slave_0: entered allmulticast mode
[  603.741866][T31475] IPVS: Scheduler module ip_vs_sip not found
[  604.099530][T31505] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6548'.
[  604.186310][T31509] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6550'.
[  604.694612][T31556] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  604.877159][T31571] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6568'.
[  604.880847][T31568] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6567'.
[  604.943647][T31574] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6565'.
[  604.953121][T31574] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6565'.
[  604.964114][T31574] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6565'.
[  605.037442][T31573] block nbd3: server does not support multiple connections per device.
[  605.041254][T31573] block nbd3: shutting down sockets
[  605.636357][T31589] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode
[  605.639785][T31589] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode
[  605.642904][T31590] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  605.869235][T31594] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  605.873701][T31593] IPVS: stopping backup sync thread 31594 ...
[  606.039356][T31603] IPVS: persistence engine module ip_vs_pe_ not found
[  606.132379][T31607] IPVS: persistence engine module ip_vs_pe_ not found
[  606.513821][T31622] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  606.513891][T31621] IPVS: stopping backup sync thread 31622 ...
[  606.541483][T31621] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  606.762366][T31637] tipc: Resetting bearer <eth:syzkaller0>
[  607.252036][T31676] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  607.252199][T31675] IPVS: stopping backup sync thread 31676 ...
[  607.401794][T31687] netlink: 'syz.2.6600': attribute type 5 has an invalid length.
[  607.412259][T31687] IPVS: set_ctl: invalid protocol: 29 10.1.1.1:4096
[  607.756638][T31714] __nla_validate_parse: 10 callbacks suppressed
[  607.756653][T31714] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6611'.
[  607.900353][T31726] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048)
[  607.904516][T31726] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6613'.
[  607.930591][T31727] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6613'.
[  608.015887][T31735] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6615'.
[  608.137938][T31746] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6617'.
[  608.296220][T31764] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  608.300865][T31764] CPU: 1 UID: 0 PID: 31764 Comm: syz.0.6620 Not tainted syzkaller #0 PREEMPT(full) 
[  608.300883][T31764] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  608.300891][T31764] Call Trace:
[  608.300897][T31764]  <TASK>
[  608.300903][T31764]  dump_stack_lvl+0x189/0x250
[  608.300927][T31764]  ? __pfx_dump_stack_lvl+0x10/0x10
[  608.300942][T31764]  ? __pfx__printk+0x10/0x10
[  608.300964][T31764]  ? kernfs_path_from_node+0x2f/0x290
[  608.300980][T31764]  ? kernfs_path_from_node+0x250/0x290
[  608.300994][T31764]  ? kernfs_path_from_node+0x2f/0x290
[  608.301012][T31764]  sysfs_warn_dup+0x8e/0xa0
[  608.301026][T31764]  sysfs_do_create_link_sd+0xc0/0x110
[  608.301043][T31764]  device_add_class_symlinks+0x1cf/0x240
[  608.301063][T31764]  device_add+0x475/0xb50
[  608.301083][T31764]  wiphy_register+0x1ba6/0x28d0
[  608.301112][T31764]  ? __pfx_wiphy_register+0x10/0x10
[  608.301125][T31764]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  608.301150][T31764]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  608.301172][T31764]  ieee80211_register_hw+0x3484/0x4100
[  608.301203][T31764]  ? ieee80211_register_hw+0x13f1/0x4100
[  608.301229][T31764]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  608.301250][T31764]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  608.301277][T31764]  ? __hrtimer_setup+0x187/0x210
[  608.301290][T31764]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  608.301307][T31764]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  608.301350][T31764]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  608.301368][T31764]  ? trace_kmalloc+0x1f/0xd0
[  608.301384][T31764]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  608.301402][T31764]  ? kstrndup+0xbf/0x160
[  608.301426][T31764]  hwsim_new_radio_nl+0xea4/0x1b10
[  608.301449][T31764]  ? __pfx___nla_validate_parse+0x10/0x10
[  608.301499][T31764]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  608.301530][T31764]  ? __nla_parse+0x40/0x60
[  608.301548][T31764]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  608.301575][T31764]  genl_family_rcv_msg_doit+0x215/0x300
[  608.301600][T31764]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  608.301629][T31764]  ? bpf_lsm_capable+0x9/0x20
[  608.301647][T31764]  ? security_capable+0x7e/0x2e0
[  608.301674][T31764]  genl_rcv_msg+0x60e/0x790
[  608.301727][T31764]  ? __pfx_genl_rcv_msg+0x10/0x10
[  608.301746][T31764]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  608.301784][T31764]  netlink_rcv_skb+0x208/0x470
[  608.301797][T31764]  ? __lock_acquire+0xab9/0xd20
[  608.301817][T31764]  ? __pfx_genl_rcv_msg+0x10/0x10
[  608.301836][T31764]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  608.301866][T31764]  ? down_read+0x1ad/0x2e0
[  608.301884][T31764]  genl_rcv+0x28/0x40
[  608.301900][T31764]  netlink_unicast+0x82f/0x9e0
[  608.301928][T31764]  ? __pfx_netlink_unicast+0x10/0x10
[  608.301951][T31764]  ? netlink_sendmsg+0x642/0xb30
[  608.301964][T31764]  ? skb_put+0x11b/0x210
[  608.301984][T31764]  netlink_sendmsg+0x805/0xb30
[  608.302007][T31764]  ? __pfx_netlink_sendmsg+0x10/0x10
[  608.302024][T31764]  ? aa_sock_msg_perm+0xf1/0x1d0
[  608.302039][T31764]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  608.302054][T31764]  ? __pfx_netlink_sendmsg+0x10/0x10
[  608.302069][T31764]  __sock_sendmsg+0x21c/0x270
[  608.302092][T31764]  ____sys_sendmsg+0x505/0x830
[  608.302113][T31764]  ? __pfx_____sys_sendmsg+0x10/0x10
[  608.302138][T31764]  ? import_iovec+0x74/0xa0
[  608.302158][T31764]  ___sys_sendmsg+0x21f/0x2a0
[  608.302175][T31764]  ? __pfx____sys_sendmsg+0x10/0x10
[  608.302218][T31764]  ? __fget_files+0x2a/0x420
[  608.302230][T31764]  ? __fget_files+0x3a0/0x420
[  608.302252][T31764]  __x64_sys_sendmsg+0x19b/0x260
[  608.302271][T31764]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  608.302297][T31764]  ? rcu_is_watching+0x15/0xb0
[  608.302315][T31764]  ? do_syscall_64+0xbe/0x3b0
[  608.302334][T31764]  do_syscall_64+0xfa/0x3b0
[  608.302347][T31764]  ? lockdep_hardirqs_on+0x9c/0x150
[  608.302360][T31764]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  608.302373][T31764]  ? exc_page_fault+0x9f/0xf0
[  608.302388][T31764]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  608.302401][T31764] RIP: 0033:0x7f3b12d8ec29
[  608.302414][T31764] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  608.302426][T31764] RSP: 002b:00007f3b13bfe038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  608.302441][T31764] RAX: ffffffffffffffda RBX: 00007f3b12fd6090 RCX: 00007f3b12d8ec29
[  608.302450][T31764] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000e
[  608.302458][T31764] RBP: 00007f3b12e11e41 R08: 0000000000000000 R09: 0000000000000000
[  608.302467][T31764] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  608.302476][T31764] R13: 00007f3b12fd6128 R14: 00007f3b12fd6090 R15: 00007ffe5a211518
[  608.302501][T31764]  </TASK>
[  608.566929][T31774] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6625'.
[  608.572217][T31775] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6625'.
[  608.647390][T31784] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6628'.
[  609.009099][T31803] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6632'.
[  609.023218][T31753] delete_channel: no stack
[  609.121520][T31803] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6632'.
[  609.219095][T31811] syzkaller1: entered promiscuous mode
[  609.221423][T31811] syzkaller1: entered allmulticast mode
[  609.225777][T31811] batadv_slave_1: entered promiscuous mode
[  609.236280][T31810] batadv_slave_1: left promiscuous mode
[  609.437520][T31813] block nbd3: server does not support multiple connections per device.
[  609.443375][T31813] block nbd3: shutting down sockets
[  609.654013][T31828] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  610.477947][T31870] block nbd3: server does not support multiple connections per device.
[  610.483291][T31870] block nbd3: shutting down sockets
[  610.547810][T31872] bridge0: entered promiscuous mode
[  610.770486][T31896] sctp: [Deprecated]: syz.0.6659 (pid 31896) Use of int in maxseg socket option.
[  610.770486][T31896] Use struct sctp_assoc_value instead
[  613.068823][T31974] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition
[  613.073132][T31974] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0)
[  613.100909][T31975] __nla_validate_parse: 6 callbacks suppressed
[  613.100920][T31975] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6680'.
[  614.236493][T32013] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6694'.
[  614.252406][T32013] netlink: 'syz.2.6694': attribute type 1 has an invalid length.
[  614.270586][T32013] bond24: entered promiscuous mode
[  614.272559][T32013] bond24: entered allmulticast mode
[  614.295951][T32013] bridge40: entered promiscuous mode
[  614.306488][T32013] bridge40: entered allmulticast mode
[  614.310960][T32013] bond24: (slave bridge40): making interface the new active one
[  614.314328][T32013] bond24: (slave bridge40): Enslaving as an active interface with an up link
[  614.415397][T32033] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  614.437059][T32033] CPU: 1 UID: 0 PID: 32033 Comm: syz.0.6697 Not tainted syzkaller #0 PREEMPT(full) 
[  614.437072][T32033] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  614.437078][T32033] Call Trace:
[  614.437082][T32033]  <TASK>
[  614.437087][T32033]  dump_stack_lvl+0x189/0x250
[  614.437102][T32033]  ? __pfx_dump_stack_lvl+0x10/0x10
[  614.437113][T32033]  ? __pfx__printk+0x10/0x10
[  614.437126][T32033]  ? kernfs_path_from_node+0x2f/0x290
[  614.437136][T32033]  ? kernfs_path_from_node+0x250/0x290
[  614.437144][T32033]  ? kernfs_path_from_node+0x2f/0x290
[  614.437154][T32033]  sysfs_warn_dup+0x8e/0xa0
[  614.437164][T32033]  sysfs_do_create_link_sd+0xc0/0x110
[  614.437175][T32033]  device_add_class_symlinks+0x1cf/0x240
[  614.437207][T32033]  device_add+0x475/0xb50
[  614.437219][T32033]  wiphy_register+0x1ba6/0x28d0
[  614.437235][T32033]  ? __pfx_wiphy_register+0x10/0x10
[  614.437242][T32033]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  614.437256][T32033]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  614.437268][T32033]  ieee80211_register_hw+0x3484/0x4100
[  614.437286][T32033]  ? ieee80211_register_hw+0x13f1/0x4100
[  614.437302][T32033]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  614.437314][T32033]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  614.437331][T32033]  ? __hrtimer_setup+0x187/0x210
[  614.437338][T32033]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  614.437348][T32033]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  614.437371][T32033]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  614.437382][T32033]  ? trace_kmalloc+0x1f/0xd0
[  614.437391][T32033]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  614.437402][T32033]  ? kstrndup+0xbf/0x160
[  614.437414][T32033]  hwsim_new_radio_nl+0xea4/0x1b10
[  614.437427][T32033]  ? __pfx___nla_validate_parse+0x10/0x10
[  614.437442][T32033]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  614.437460][T32033]  ? __nla_parse+0x40/0x60
[  614.437470][T32033]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  614.437485][T32033]  genl_family_rcv_msg_doit+0x215/0x300
[  614.437499][T32033]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  614.437515][T32033]  ? bpf_lsm_capable+0x9/0x20
[  614.437525][T32033]  ? security_capable+0x7e/0x2e0
[  614.437541][T32033]  genl_rcv_msg+0x60e/0x790
[  614.437555][T32033]  ? __pfx_genl_rcv_msg+0x10/0x10
[  614.437564][T32033]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  614.437582][T32033]  netlink_rcv_skb+0x208/0x470
[  614.437590][T32033]  ? __lock_acquire+0xab9/0xd20
[  614.437602][T32033]  ? __pfx_genl_rcv_msg+0x10/0x10
[  614.437642][T32033]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  614.437671][T32033]  ? down_read+0x1ad/0x2e0
[  614.437690][T32033]  genl_rcv+0x28/0x40
[  614.437705][T32033]  netlink_unicast+0x82f/0x9e0
[  614.437739][T32033]  ? __pfx_netlink_unicast+0x10/0x10
[  614.437758][T32033]  ? netlink_sendmsg+0x642/0xb30
[  614.437765][T32033]  ? skb_put+0x11b/0x210
[  614.437775][T32033]  netlink_sendmsg+0x805/0xb30
[  614.437788][T32033]  ? __pfx_netlink_sendmsg+0x10/0x10
[  614.437798][T32033]  ? aa_sock_msg_perm+0xf1/0x1d0
[  614.437807][T32033]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  614.437815][T32033]  ? __pfx_netlink_sendmsg+0x10/0x10
[  614.437824][T32033]  __sock_sendmsg+0x21c/0x270
[  614.437837][T32033]  ____sys_sendmsg+0x505/0x830
[  614.437849][T32033]  ? __pfx_____sys_sendmsg+0x10/0x10
[  614.437869][T32033]  ? import_iovec+0x74/0xa0
[  614.437887][T32033]  ___sys_sendmsg+0x21f/0x2a0
[  614.437905][T32033]  ? __pfx____sys_sendmsg+0x10/0x10
[  614.437947][T32033]  ? __fget_files+0x2a/0x420
[  614.437960][T32033]  ? __fget_files+0x3a0/0x420
[  614.437979][T32033]  __x64_sys_sendmsg+0x19b/0x260
[  614.437997][T32033]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  614.438017][T32033]  ? rcu_is_watching+0x15/0xb0
[  614.438033][T32033]  ? do_syscall_64+0xbe/0x3b0
[  614.438050][T32033]  do_syscall_64+0xfa/0x3b0
[  614.438064][T32033]  ? lockdep_hardirqs_on+0x9c/0x150
[  614.438077][T32033]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  614.438090][T32033]  ? exc_page_fault+0x9f/0xf0
[  614.438104][T32033]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  614.438117][T32033] RIP: 0033:0x7f3b12d8ec29
[  614.438129][T32033] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  614.438139][T32033] RSP: 002b:00007f3b13bfe038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  614.438153][T32033] RAX: ffffffffffffffda RBX: 00007f3b12fd6090 RCX: 00007f3b12d8ec29
[  614.438164][T32033] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000c
[  614.438173][T32033] RBP: 00007f3b12e11e41 R08: 0000000000000000 R09: 0000000000000000
[  614.438181][T32033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  614.438189][T32033] R13: 00007f3b12fd6128 R14: 00007f3b12fd6090 R15: 00007ffe5a211518
[  614.438211][T32033]  </TASK>
[  614.722121][T32045] D speed is unknown, defaulting to 1000
[  614.726173][T32045] lo speed is unknown, defaulting to 1000
[  614.752193][T32047] netlink: 277 bytes leftover after parsing attributes in process `syz.2.6703'.
[  614.781316][T32048] netlink: 'syz.1.6702': attribute type 10 has an invalid length.
[  614.784012][T32048] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6702'.
[  614.787076][T32048] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check.
[  614.793305][T32048] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6702'.
[  614.810181][T32050] netlink: 'syz.2.6703': attribute type 2 has an invalid length.
[  614.815702][T32050] netlink: 51 bytes leftover after parsing attributes in process `syz.2.6703'.
[  615.011728][T32056] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6705'.
[  615.216843][T32062] D speed is unknown, defaulting to 1000
[  615.222071][T32062] lo speed is unknown, defaulting to 1000
[  615.338454][T32065] D speed is unknown, defaulting to 1000
[  615.385476][T32069] IPVS: Scheduler module ip_vs_sip not found
[  615.428551][T32065] lo speed is unknown, defaulting to 1000
[  615.639510][T32080] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR
[  615.767034][T32092] netlink: 'syz.2.6712': attribute type 1 has an invalid length.
[  615.958904][T32104] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6717'.
[  616.066766][T32101] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6714'.
[  616.190137][T32114] netlink: 'syz.0.6719': attribute type 3 has an invalid length.
[  616.197476][T32114] netlink: 'syz.0.6719': attribute type 3 has an invalid length.
[  616.442744][T32120] D speed is unknown, defaulting to 1000
[  616.448157][T32120] lo speed is unknown, defaulting to 1000
[  616.602988][T32122] D speed is unknown, defaulting to 1000
[  616.695553][T32122] lo speed is unknown, defaulting to 1000
[  617.015506][T32146] netlink: 256 bytes leftover after parsing attributes in process `syz.0.6726'.
[  617.101858][T32146] block nbd3: server does not support multiple connections per device.
[  617.105036][T32146] block nbd3: shutting down sockets
[  617.319606][T32167] IPVS: set_ctl: invalid protocol: 34213 172.20.20.19:20003
[  617.422755][T32177] syzkaller0: entered promiscuous mode
[  617.424725][T32177] syzkaller0: entered allmulticast mode
[  618.805011][T32198] batadv_slave_1: entered allmulticast mode
[  618.821605][T32198] dvmrp8: entered allmulticast mode
[  618.856063][T32198] D speed is unknown, defaulting to 1000
[  618.860651][T32198] lo speed is unknown, defaulting to 1000
[  618.900244][T32205] dvmrp0: entered allmulticast mode
[  619.049252][T32211] D speed is unknown, defaulting to 1000
[  619.071292][T32215] netlink: 248 bytes leftover after parsing attributes in process `syz.1.6744'.
[  619.096988][T32211] lo speed is unknown, defaulting to 1000
[  619.183798][T32197] batadv_slave_1: left allmulticast mode
[  619.188470][T32197] dvmrp8: left allmulticast mode
[  619.702248][T32247] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6752'.
[  620.143483][T32270] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  620.150352][T32269] IPVS: stopping backup sync thread 32270 ...
[  620.255602][T32274] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6760'.
[  620.572121][T32296] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6764'.
[  620.593646][T32296] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6764'.
[  620.617403][T32299] IPVS: persistence engine module ip_vs_pe_ not found
[  620.702935][T32307] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6767'.
[  620.763889][T32314] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  620.768860][T32313] IPVS: stopping backup sync thread 32314 ...
[  620.773991][T32313] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.6769'.
[  620.780101][T32316] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6770'.
[  620.967721][T32320] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition
[  620.972244][T32320] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0)
[  621.123935][T32333] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.6776'.
[  621.250015][T32342] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6778'.
[  621.592071][T32365] netlink: 'syz.1.6782': attribute type 4 has an invalid length.
[  621.740112][T32372] netlink: 'syz.0.6785': attribute type 1 has an invalid length.
[  621.777640][T32375] netlink: 'syz.2.6784': attribute type 10 has an invalid length.
[  622.038557][T32407] netlink: 'syz.1.6793': attribute type 83 has an invalid length.
[  622.402082][T32434] delete_channel: no stack
[  623.846016][T32488] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  623.849586][T32487] IPVS: stopping backup sync thread 32488 ...
[  625.034167][T32496] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  625.104989][T32520] __nla_validate_parse: 11 callbacks suppressed
[  625.105005][T32520] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6816'.
[  625.905199][T32527] netlink: 'syz.0.6819': attribute type 4 has an invalid length.
[  626.030936][T32549] IPVS: set_ctl: invalid protocol: 34213 172.20.20.19:20003
[  626.090609][T32555] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6826'.
[  626.094443][T32554] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6826'.
[  626.133871][T32556] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check.
[  626.140105][T32555] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check.
[  626.161229][T32541] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6820'.
[  626.275169][T32563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6828'.
[  627.540582][T32573] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6832'.
[  627.568808][T32576] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6833'.
[  627.577551][T32576] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6833'.
[  627.582785][T32578] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6833'.
[  627.738928][T32584] sock: sock_timestamping_bind_phc: sock not bind to device
[  628.396913][T32590] D speed is unknown, defaulting to 1000
[  628.401694][T32590] lo speed is unknown, defaulting to 1000
[  628.447395][T32591] netlink: 244 bytes leftover after parsing attributes in process `syz.0.6835'.
[  628.459635][T32582] delete_channel: no stack
[  628.467364][T32583] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  628.608643][   T33] audit: type=1800 audit(1758551938.009:6): pid=32596 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.6837" name="memory.events" dev="tmpfs" ino=12238 res=0 errno=0
[  629.034027][T32639] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  629.039550][T32639] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode
[  629.042105][T32639] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode
[  630.310750][T32682] __nla_validate_parse: 3 callbacks suppressed
[  630.310766][T32682] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6857'.
[  630.427094][T32708] netlink: 'syz.2.6865': attribute type 3 has an invalid length.
[  630.433780][T32708] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.6865'.
[  630.569799][T32720] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  630.573604][T32719] IPVS: stopping backup sync thread 32720 ...
[  630.574369][T32721] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6868'.
[  630.578628][T32719] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6869'.
[  630.583923][T32719] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6869'.
[  630.865882][T32730] netlink: 'syz.2.6871': attribute type 29 has an invalid length.
[  631.365252][T32738] IPVS: Error connecting to the multicast addr
[  631.551214][T32749] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  631.555777][T32747] IPVS: stopping backup sync thread 32749 ...
[  631.636243][T32747] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6876'.
[  631.789220][T32761] block nbd3: server does not support multiple connections per device.
[  631.795098][T32761] block nbd3: shutting down sockets
[  631.813204][T32765] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6880'.
[  632.368554][  T315] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6885'.
[  632.560006][  T318] D speed is unknown, defaulting to 1000
[  632.564032][  T318] lo speed is unknown, defaulting to 1000
[  632.936850][  T328] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6888'.
[  633.151939][  T342] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6891'.
[  633.155023][  T336] IPVS: Scheduler module ip_vs_sip not found
[  633.778840][  T376] block nbd3: server does not support multiple connections per device.
[  633.782198][  T376] block nbd3: shutting down sockets
[  634.126069][  T415] IPVS: stopping backup sync thread 417 ...
[  634.126169][  T417] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  634.359510][  T427] veth15: entered promiscuous mode
[  634.366564][  T427] netlink: 'syz.1.6916': attribute type 4 has an invalid length.
[  635.165238][  T460] tun15: tun_chr_ioctl cmd 1074025673
[  635.171644][  T461] tun15: tun_chr_ioctl cmd 1074025675
[  635.173587][  T461] tun15: persist enabled
[  635.175288][  T460] tun15: tun_chr_ioctl cmd 1074025675
[  635.177900][  T460] tun15: persist enabled
[  635.287565][  T468] IPVS: Scheduler module ip_vs_sip not found
[  635.340561][  T473] __nla_validate_parse: 7 callbacks suppressed
[  635.340576][  T473] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6928'.
[  635.489681][  T481] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6932'.
[  635.515512][  T492] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6935'.
[  635.690399][  T514] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6939'.
[  635.694261][  T514] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6939'.
[  635.796761][  T526] netlink: 248 bytes leftover after parsing attributes in process `syz.2.6943'.
[  635.907570][  T529] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6945'.
[  636.061585][  T542] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6947'.
[  636.121945][  T532] D speed is unknown, defaulting to 1000
[  636.128085][  T532] lo speed is unknown, defaulting to 1000
[  636.158662][  T550] IPVS: set_ctl: invalid protocol: 22 172.20.20.170:20000
[  636.191831][  T554] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6949'.
[  636.455623][  T571] netlink: 248 bytes leftover after parsing attributes in process `syz.1.6954'.
[  636.582085][  T573] netlink: 'syz.2.6955': attribute type 5 has an invalid length.
[  636.719159][  T573] geneve4: entered promiscuous mode
[  636.737336][  T573] geneve4: entered allmulticast mode
[  636.741131][ T5854] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 256 - 0
[  636.744157][ T5854] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 256 - 0
[  636.747523][   T12] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 256 - 0
[  636.750515][   T12] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 256 - 0
[  637.332099][  T604] IPVS: set_ctl: invalid protocol: 29 10.1.1.1:4096
[  637.432892][  T609] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  637.748846][  T633] IPVS: stopping backup sync thread 634 ...
[  637.751450][  T634] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  638.616553][  T697] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  638.643776][  T697] syzkaller0: entered promiscuous mode
[  638.645862][  T697] syzkaller0: entered allmulticast mode
[  638.665587][  T697] tipc: Resetting bearer <eth:syzkaller0>
[  638.743978][  T696] tipc: Resetting bearer <eth:syzkaller0>
[  638.755723][  T696] tipc: Disabling bearer <eth:syzkaller0>
[  639.282897][  T722] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  639.285760][  T722] CPU: 1 UID: 0 PID: 722 Comm: syz.1.6997 Not tainted syzkaller #0 PREEMPT(full) 
[  639.285777][  T722] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  639.285786][  T722] Call Trace:
[  639.285792][  T722]  <TASK>
[  639.285798][  T722]  dump_stack_lvl+0x189/0x250
[  639.285820][  T722]  ? __pfx_dump_stack_lvl+0x10/0x10
[  639.285836][  T722]  ? __pfx__printk+0x10/0x10
[  639.285853][  T722]  ? kernfs_path_from_node+0x2f/0x290
[  639.285862][  T722]  ? kernfs_path_from_node+0x250/0x290
[  639.285870][  T722]  ? kernfs_path_from_node+0x2f/0x290
[  639.285880][  T722]  sysfs_warn_dup+0x8e/0xa0
[  639.285889][  T722]  sysfs_do_create_link_sd+0xc0/0x110
[  639.285898][  T722]  device_add_class_symlinks+0x1cf/0x240
[  639.285910][  T722]  device_add+0x475/0xb50
[  639.285920][  T722]  wiphy_register+0x1ba6/0x28d0
[  639.285936][  T722]  ? __pfx_wiphy_register+0x10/0x10
[  639.285944][  T722]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  639.285957][  T722]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  639.285969][  T722]  ieee80211_register_hw+0x3484/0x4100
[  639.285986][  T722]  ? ieee80211_register_hw+0x13f1/0x4100
[  639.286000][  T722]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  639.286012][  T722]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  639.286028][  T722]  ? __hrtimer_setup+0x187/0x210
[  639.286035][  T722]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  639.286044][  T722]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  639.286068][  T722]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  639.286079][  T722]  ? trace_kmalloc+0x1f/0xd0
[  639.286088][  T722]  ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0
[  639.286099][  T722]  ? kstrndup+0xbf/0x160
[  639.286111][  T722]  hwsim_new_radio_nl+0xea4/0x1b10
[  639.286123][  T722]  ? __pfx___nla_validate_parse+0x10/0x10
[  639.286138][  T722]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  639.286154][  T722]  ? __nla_parse+0x40/0x60
[  639.286164][  T722]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  639.286179][  T722]  genl_family_rcv_msg_doit+0x215/0x300
[  639.286192][  T722]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  639.286208][  T722]  ? bpf_lsm_capable+0x9/0x20
[  639.286218][  T722]  ? security_capable+0x7e/0x2e0
[  639.286233][  T722]  genl_rcv_msg+0x60e/0x790
[  639.286246][  T722]  ? __pfx_genl_rcv_msg+0x10/0x10
[  639.286256][  T722]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  639.286273][  T722]  netlink_rcv_skb+0x208/0x470
[  639.286280][  T722]  ? __lock_acquire+0xab9/0xd20
[  639.286292][  T722]  ? __pfx_genl_rcv_msg+0x10/0x10
[  639.286302][  T722]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  639.286347][  T722]  ? down_read+0x1ad/0x2e0
[  639.286357][  T722]  genl_rcv+0x28/0x40
[  639.286367][  T722]  netlink_unicast+0x82f/0x9e0
[  639.286387][  T722]  ? __pfx_netlink_unicast+0x10/0x10
[  639.286400][  T722]  ? netlink_sendmsg+0x642/0xb30
[  639.286407][  T722]  ? skb_put+0x11b/0x210
[  639.286417][  T722]  netlink_sendmsg+0x805/0xb30
[  639.286429][  T722]  ? __pfx_netlink_sendmsg+0x10/0x10
[  639.286439][  T722]  ? aa_sock_msg_perm+0xf1/0x1d0
[  639.286448][  T722]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  639.286456][  T722]  ? __pfx_netlink_sendmsg+0x10/0x10
[  639.286465][  T722]  __sock_sendmsg+0x21c/0x270
[  639.286478][  T722]  ____sys_sendmsg+0x505/0x830
[  639.286490][  T722]  ? __pfx_____sys_sendmsg+0x10/0x10
[  639.286503][  T722]  ? import_iovec+0x74/0xa0
[  639.286515][  T722]  ___sys_sendmsg+0x21f/0x2a0
[  639.286526][  T722]  ? __pfx____sys_sendmsg+0x10/0x10
[  639.286550][  T722]  ? __fget_files+0x2a/0x420
[  639.286557][  T722]  ? __fget_files+0x3a0/0x420
[  639.286568][  T722]  __x64_sys_sendmsg+0x19b/0x260
[  639.286579][  T722]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  639.286593][  T722]  ? rcu_is_watching+0x15/0xb0
[  639.286603][  T722]  ? do_syscall_64+0xbe/0x3b0
[  639.286613][  T722]  do_syscall_64+0xfa/0x3b0
[  639.286621][  T722]  ? lockdep_hardirqs_on+0x9c/0x150
[  639.286628][  T722]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  639.286637][  T722]  ? exc_page_fault+0x9f/0xf0
[  639.286646][  T722]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  639.286653][  T722] RIP: 0033:0x7fe04998ec29
[  639.286661][  T722] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  639.286667][  T722] RSP: 002b:00007fe04a7eb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  639.286677][  T722] RAX: ffffffffffffffda RBX: 00007fe049bd5fa0 RCX: 00007fe04998ec29
[  639.286682][  T722] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000029
[  639.286687][  T722] RBP: 00007fe049a11e41 R08: 0000000000000000 R09: 0000000000000000
[  639.286691][  T722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  639.286696][  T722] R13: 00007fe049bd6038 R14: 00007fe049bd5fa0 R15: 00007ffc5d475628
[  639.286709][  T722]  </TASK>
[  639.673568][  T739] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  639.679669][  T738] IPVS: stopping backup sync thread 739 ...
[  639.959641][  T760] netlink: 'syz.0.7006': attribute type 4 has an invalid length.
[  640.660604][  T763] IPVS: persistence engine module ip_vs_pe_ not found
[  640.732253][  T774] __nla_validate_parse: 21 callbacks suppressed
[  640.732264][  T774] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7010'.
[  640.787445][  T774] IPVS: stopping backup sync thread 609 ...
[  640.792864][  T777] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  640.792922][  T776] IPVS: stopping backup sync thread 777 ...
[  640.838622][  T776] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  640.843141][  T782] netlink: 248 bytes leftover after parsing attributes in process `syz.2.7013'.
[  640.926605][  T776] syzkaller0: MTU too low for tipc bearer
[  640.930613][  T776] tipc: Disabling bearer <eth:syzkaller0>
[  640.937714][  T776] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7011'.
[  641.013726][  T779] netlink: 'syz.0.7012': attribute type 10 has an invalid length.
[  641.022074][  T779] team0: Port device 0! added
[  641.063049][  T793] netlink: 100 bytes leftover after parsing attributes in process `syz.1.7015'.
[  641.070771][  T793] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7015'.
[  641.074179][  T793] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7015'.
[  641.317146][  T815] openvswitch: netlink: Flow key attribute not present in set flow.
[  641.323722][  T815] netlink: 'syz.2.7022': attribute type 4 has an invalid length.
[  641.935561][  T826] netlink: 248 bytes leftover after parsing attributes in process `syz.0.7025'.
[  642.105175][  T831] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7026'.
[  642.106719][  T832] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7027'.
[  642.115525][  T831] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7026'.
[  642.120827][  T831] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check.
[  642.143851][  T832] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  642.147078][  T832] IPv6: NLM_F_CREATE should be set when creating new route
[  642.172603][  T832] netlink: 'syz.1.7027': attribute type 4 has an invalid length.
[  642.186383][  T835] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  642.186536][  T834] IPVS: stopping backup sync thread 835 ...
[  642.214049][  T834] bridge35: entered promiscuous mode
[  642.216514][  T834] bridge35: entered allmulticast mode
[  642.221004][  T834] team0: Port device bridge35 added
[  642.284435][  T841] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  642.477012][  T852] sctp: [Deprecated]: syz.2.7034 (pid 852) Use of struct sctp_assoc_value in delayed_ack socket option.
[  642.477012][  T852] Use struct sctp_sack_info instead
[  642.624848][  T865] nbd: must specify at least one socket
[  643.108744][  T909] block nbd3: server does not support multiple connections per device.
[  643.122955][  T909] block nbd3: shutting down sockets
[  643.128455][  T909] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  643.800480][  T948] netlink: 'syz.2.7057': attribute type 4 has an invalid length.
[  643.893445][  T950] tipc: Enabling of bearer <udp:s> rejected, already enabled
[  643.898946][  T950] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  644.901113][  T975] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  644.905633][  T974] IPVS: stopping backup sync thread 975 ...
[  645.885929][ T1011] netlink: 'syz.1.7074': attribute type 10 has an invalid length.
[  645.900757][ T1011] bond0: (slave bridge0): Enslaving as an active interface with an up link
[  646.241912][ T1026] __nla_validate_parse: 6 callbacks suppressed
[  646.241927][ T1026] netlink: 248 bytes leftover after parsing attributes in process `syz.1.7077'.
[  646.292889][ T1027] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7077'.
[  646.392557][ T1030] netlink: 64 bytes leftover after parsing attributes in process `syz.2.7078'.
[  646.629370][ T1053] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7083'.
[  647.347003][ T1100] netlink: 248 bytes leftover after parsing attributes in process `syz.0.7089'.
[  647.662555][ T1114] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7092'.
[  647.666449][ T1114] netlink: 7 bytes leftover after parsing attributes in process `syz.0.7092'.
[  647.925463][ T1139] netlink: 44 bytes leftover after parsing attributes in process `syz.0.7096'.
[  648.070038][ T1148] bond0: option fail_over_mac: unable to set because the bond device has slaves
[  648.075533][ T1150] IPVS: stopping backup sync thread 1151 ...
[  648.077621][ T1151] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  648.110181][ T1150] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7099'.
[  648.136486][ T1155] netlink: 248 bytes leftover after parsing attributes in process `syz.1.7100'.
[  648.704178][ T1182] netlink: 'syz.1.7108': attribute type 2 has an invalid length.
[  649.208915][ T1212] tipc: New replicast peer: 255.255.255.255
[  649.213266][ T1212] tipc: Enabled bearer <udp:syz2>, priority 10
[  649.700846][ T1224] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  649.705087][ T1223] IPVS: stopping backup sync thread 1224 ...
[  649.767484][    C1] ==================================================================
[  649.770982][    C1] BUG: KASAN: slab-use-after-free in xfrm_state_find+0x2cf2/0x5400
[  649.774397][    C1] Read of size 1 at addr ffff888027b69e30 by task swapper/1/0
[  649.778629][    C1] 
[  649.779706][    C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) 
[  649.779723][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  649.779732][    C1] Call Trace:
[  649.779738][    C1]  <IRQ>
[  649.779745][    C1]  dump_stack_lvl+0x189/0x250
[  649.779761][    C1]  ? __kasan_check_byte+0x12/0x40
[  649.779779][    C1]  ? __pfx_dump_stack_lvl+0x10/0x10
[  649.779792][    C1]  ? lock_release+0x4b/0x3e0
[  649.779811][    C1]  ? __virt_addr_valid+0x4a5/0x5c0
[  649.779828][    C1]  print_report+0xca/0x240
[  649.779840][    C1]  ? xfrm_state_find+0x2cf2/0x5400
[  649.779854][    C1]  kasan_report+0x118/0x150
[  649.779870][    C1]  ? xfrm_state_find+0x2cf2/0x5400
[  649.779886][    C1]  xfrm_state_find+0x2cf2/0x5400
[  649.779900][    C1]  ? __lock_acquire+0xab9/0xd20
[  649.779921][    C1]  ? unwind_next_frame+0xa5/0x2390
[  649.779937][    C1]  ? xfrm_state_find+0x1da/0x5400
[  649.779953][    C1]  ? __pfx_xfrm_state_find+0x10/0x10
[  649.779972][    C1]  xfrm_resolve_and_create_bundle+0x768/0x2f80
[  649.779998][    C1]  ? xfrm_policy_lookup_bytype+0x2a7/0x1250
[  649.780016][    C1]  ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10
[  649.780035][    C1]  ? xfrm_policy_lookup_bytype+0x123/0x1250
[  649.780053][    C1]  ? xfrm_policy_lookup_bytype+0x11ef/0x1250
[  649.780080][    C1]  ? xfrm_expand_policies+0x41f/0x6a0
[  649.780099][    C1]  xfrm_lookup_with_ifid+0x58a/0x1a70
[  649.780119][    C1]  ? __pfx_xfrm_lookup_with_ifid+0x10/0x10
[  649.780137][    C1]  ? dst_cache_get+0x10e/0x5b0
[  649.780158][    C1]  xfrm_lookup_route+0x3c/0x1c0
[  649.780176][    C1]  tipc_udp_xmit+0x1c3/0xaa0
[  649.780220][    C1]  ? tipc_udp_xmit+0xa4/0xaa0
[  649.780235][    C1]  ? __pfx_tipc_udp_xmit+0x10/0x10
[  649.780249][    C1]  ? __pskb_copy_fclone+0x9b5/0xfb0
[  649.780265][    C1]  ? __asan_memcpy+0x40/0x70
[  649.780279][    C1]  ? __pskb_copy_fclone+0x9b5/0xfb0
[  649.780305][    C1]  tipc_udp_send_msg+0x27f/0x3f0
[  649.780322][    C1]  tipc_bearer_xmit_skb+0x2b3/0x400
[  649.780336][    C1]  ? tipc_bearer_xmit_skb+0xa9/0x400
[  649.780349][    C1]  ? __pfx_tipc_bearer_xmit_skb+0x10/0x10
[  649.780365][    C1]  tipc_disc_timeout+0x580/0x6d0
[  649.780379][    C1]  ? __pfx_tipc_disc_timeout+0x10/0x10
[  649.780396][    C1]  call_timer_fn+0x17e/0x5f0
[  649.780413][    C1]  ? __pfx_tipc_disc_timeout+0x10/0x10
[  649.780424][    C1]  ? call_timer_fn+0xbe/0x5f0
[  649.780440][    C1]  ? __pfx_call_timer_fn+0x10/0x10
[  649.780459][    C1]  ? _raw_spin_unlock_irq+0x23/0x50
[  649.780477][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  649.780489][    C1]  ? __pfx_tipc_disc_timeout+0x10/0x10
[  649.780499][    C1]  __run_timer_base+0x61a/0x860
[  649.780515][    C1]  ? ktime_get+0x3e/0x1f0
[  649.780531][    C1]  ? __pfx___run_timer_base+0x10/0x10
[  649.780545][    C1]  ? seqcount_lockdep_reader_access+0x15f/0x1c0
[  649.780563][    C1]  run_timer_softirq+0xb7/0x180
[  649.780579][    C1]  handle_softirqs+0x286/0x870
[  649.780592][    C1]  ? __irq_exit_rcu+0xca/0x1f0
[  649.780605][    C1]  ? __pfx_handle_softirqs+0x10/0x10
[  649.780619][    C1]  ? irqtime_account_irq+0xb6/0x1c0
[  649.780635][    C1]  __irq_exit_rcu+0xca/0x1f0
[  649.780647][    C1]  ? __pfx___irq_exit_rcu+0x10/0x10
[  649.780662][    C1]  irq_exit_rcu+0x9/0x30
[  649.780673][    C1]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  649.780685][    C1]  </IRQ>
[  649.780690][    C1]  <TASK>
[  649.780695][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  649.780709][    C1] RIP: 0010:pv_native_safe_halt+0x13/0x20
[  649.780722][    C1] Code: 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d b3 f9 0d 00 f3 0f 1e fa fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90
[  649.780734][    C1] RSP: 0018:ffffc90000177de0 EFLAGS: 00000282
[  649.780746][    C1] RAX: a4b2721e3a82e100 RBX: ffffffff819693f8 RCX: a4b2721e3a82e100
[  649.780756][    C1] RDX: 0000000000000001 RSI: ffffffff8d9b9cae RDI: ffffffff8be33c00
[  649.780766][    C1] RBP: ffffc90000177f20 R08: ffff888136632f9b R09: 1ffff11026cc65f3
[  649.780774][    C1] R10: dffffc0000000000 R11: ffffed1026cc65f4 R12: ffffffff8fa3a630
[  649.780783][    C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff110200d6000
[  649.780793][    C1]  ? do_idle+0x1e8/0x510
[  649.780808][    C1]  default_idle+0x13/0x20
[  649.780822][    C1]  default_idle_call+0x74/0xb0
[  649.780833][    C1]  do_idle+0x1e8/0x510
[  649.780846][    C1]  ? __pfx_do_idle+0x10/0x10
[  649.780861][    C1]  cpu_startup_entry+0x44/0x60
[  649.780874][    C1]  start_secondary+0x101/0x110
[  649.780892][    C1]  common_startup_64+0x13e/0x147
[  649.780913][    C1]  </TASK>
[  649.780919][    C1] 
[  649.966540][    C1] Allocated by task 28593:
[  649.968451][    C1]  kasan_save_track+0x3e/0x80
[  649.970495][    C1]  __kasan_slab_alloc+0x6c/0x80
[  649.972593][    C1]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  649.974948][    C1]  xfrm_state_alloc+0x24/0x2f0
[  649.977044][    C1]  __find_acq_core+0x8a7/0x1c00
[  649.979201][    C1]  xfrm_find_acq+0x78/0xa0
[  649.981149][    C1]  xfrm_alloc_userspi+0x6b3/0xc90
[  649.983353][    C1]  xfrm_user_rcv_msg+0x7a3/0xab0
[  649.985513][    C1]  netlink_rcv_skb+0x208/0x470
[  649.987592][    C1]  xfrm_netlink_rcv+0x79/0x90
[  649.989643][    C1]  netlink_unicast+0x82f/0x9e0
[  649.991732][    C1]  netlink_sendmsg+0x805/0xb30
[  649.993826][    C1]  __sock_sendmsg+0x21c/0x270
[  649.995815][    C1]  ____sys_sendmsg+0x505/0x830
[  649.997898][    C1]  ___sys_sendmsg+0x21f/0x2a0
[  649.999952][    C1]  __x64_sys_sendmsg+0x19b/0x260
[  650.002088][    C1]  do_syscall_64+0xfa/0x3b0
[  650.004040][    C1]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  650.006593][    C1] 
[  650.007648][    C1] Freed by task 9:
[  650.009263][    C1]  kasan_save_track+0x3e/0x80
[  650.011224][    C1]  kasan_save_free_info+0x46/0x50
[  650.013240][    C1]  __kasan_slab_free+0x5b/0x80
[  650.015306][    C1]  kmem_cache_free+0x18f/0x400
[  650.017350][    C1]  xfrm_state_gc_task+0x52d/0x6b0
[  650.019438][    C1]  process_scheduled_works+0xae1/0x17b0
[  650.021349][    C1]  worker_thread+0x8a0/0xda0
[  650.023108][    C1]  kthread+0x711/0x8a0
[  650.024830][    C1]  ret_from_fork+0x439/0x7d0
[  650.026837][    C1]  ret_from_fork_asm+0x1a/0x30
[  650.028890][    C1] 
[  650.029935][    C1] The buggy address belongs to the object at ffff888027b69b00
[  650.029935][    C1]  which belongs to the cache xfrm_state of size 928
[  650.035517][    C1] The buggy address is located 816 bytes inside of
[  650.035517][    C1]  freed 928-byte region [ffff888027b69b00, ffff888027b69ea0)
[  650.040446][    C1] 
[  650.041423][    C1] The buggy address belongs to the physical page:
[  650.043808][    C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888027b6a880 pfn:0x27b68
[  650.047369][    C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  650.050568][    C1] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  650.053390][    C1] page_type: f5(slab)
[  650.055068][    C1] raw: 00fff00000000040 ffff888104a09280 dead000000000122 0000000000000000
[  650.058204][    C1] raw: ffff888027b6a880 00000000800e0008 00000000f5000000 0000000000000000
[  650.061208][    C1] head: 00fff00000000040 ffff888104a09280 dead000000000122 0000000000000000
[  650.064348][    C1] head: ffff888027b6a880 00000000800e0008 00000000f5000000 0000000000000000
[  650.067405][    C1] head: 00fff00000000002 ffffea00009eda01 00000000ffffffff 00000000ffffffff
[  650.070737][    C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  650.073740][    C1] page dumped because: kasan: bad access detected
[  650.075979][    C1] page_owner tracks the page as allocated
[  650.077985][    C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 17265, tgid 17262 (syz.1.2583), ts 331094313197, free_ts 329401999546
[  650.085234][    C1]  post_alloc_hook+0x240/0x2a0
[  650.086929][    C1]  get_page_from_freelist+0x21e4/0x22c0
[  650.088807][    C1]  __alloc_frozen_pages_noprof+0x181/0x370
[  650.091256][    C1]  alloc_pages_mpol+0x232/0x4a0
[  650.093292][    C1]  allocate_slab+0x8a/0x370
[  650.095210][    C1]  ___slab_alloc+0xbeb/0x1420
[  650.097084][    C1]  kmem_cache_alloc_noprof+0x283/0x3c0
[  650.098912][    C1]  xfrm_state_alloc+0x24/0x2f0
[  650.100692][    C1]  xfrm_state_find+0x37d4/0x5400
[  650.102403][    C1]  xfrm_resolve_and_create_bundle+0x768/0x2f80
[  650.104698][    C1]  xfrm_lookup_with_ifid+0x2a7/0x1a70
[  650.106793][    C1]  xfrm_lookup_route+0x3c/0x1c0
[  650.108884][    C1]  udp_sendmsg+0x142e/0x2170
[  650.110705][    C1]  __sock_sendmsg+0x19c/0x270
[  650.112358][    C1]  ____sys_sendmsg+0x52d/0x830
[  650.113959][    C1]  ___sys_sendmsg+0x21f/0x2a0
[  650.115704][    C1] page last free pid 3053 tgid 3053 stack trace:
[  650.118317][    C1]  __free_frozen_pages+0xbc4/0xd30
[  650.120436][    C1]  free_large_kmalloc+0x13a/0x1f0
[  650.122517][    C1]  build_detached_freelist+0x22a/0x270
[  650.124780][    C1]  kmem_cache_free_bulk+0xbe/0x520
[  650.126905][    C1]  kvfree_rcu_bulk+0xe5/0x1f0
[  650.128745][    C1]  kfree_rcu_monitor+0x211/0x2a0
[  650.130400][    C1]  process_scheduled_works+0xae1/0x17b0
[  650.132265][    C1]  worker_thread+0x8a0/0xda0
[  650.133819][    C1]  kthread+0x711/0x8a0
[  650.135434][    C1]  ret_from_fork+0x439/0x7d0
[  650.137018][    C1]  ret_from_fork_asm+0x1a/0x30
[  650.138875][    C1] 
[  650.139901][    C1] Memory state around the buggy address:
[  650.142337][    C1]  ffff888027b69d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  650.144989][    C1]  ffff888027b69d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  650.147658][    C1] >ffff888027b69e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  650.150472][    C1]                                      ^
[  650.152441][    C1]  ffff888027b69e80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[  650.155228][    C1]  ffff888027b69f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  650.158280][    C1] ==================================================================
[  650.161737][    C1] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  650.164378][    C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) 
[  650.167622][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  650.171439][    C1] Call Trace:
[  650.172808][    C1]  <IRQ>
[  650.173909][    C1]  dump_stack_lvl+0x99/0x250
[  650.175618][    C1]  ? __asan_memcpy+0x40/0x70
[  650.177340][    C1]  ? __pfx_dump_stack_lvl+0x10/0x10
[  650.179293][    C1]  ? __pfx__printk+0x10/0x10
[  650.180968][    C1]  vpanic+0x281/0x750
[  650.182626][    C1]  ? __pfx_vpanic+0x10/0x10
[  650.184437][    C1]  ? asm_common_interrupt+0x26/0x40
[  650.186473][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  650.188757][    C1]  panic+0xb9/0xc0
[  650.190250][    C1]  ? __pfx_panic+0x10/0x10
[  650.191780][    C1]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  650.193801][    C1]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  650.196006][    C1]  ? xfrm_state_find+0x2cf2/0x5400
[  650.198087][    C1]  check_panic_on_warn+0x89/0xb0
[  650.200058][    C1]  ? xfrm_state_find+0x2cf2/0x5400
[  650.202230][    C1]  end_report+0x78/0x160
[  650.203974][    C1]  kasan_report+0x129/0x150
[  650.205950][    C1]  ? xfrm_state_find+0x2cf2/0x5400
[  650.208098][    C1]  xfrm_state_find+0x2cf2/0x5400
[  650.209973][    C1]  ? __lock_acquire+0xab9/0xd20
[  650.211698][    C1]  ? unwind_next_frame+0xa5/0x2390
[  650.213470][    C1]  ? xfrm_state_find+0x1da/0x5400
[  650.215260][    C1]  ? __pfx_xfrm_state_find+0x10/0x10
[  650.217144][    C1]  xfrm_resolve_and_create_bundle+0x768/0x2f80
[  650.219201][    C1]  ? xfrm_policy_lookup_bytype+0x2a7/0x1250
[  650.221156][    C1]  ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10
[  650.223382][    C1]  ? xfrm_policy_lookup_bytype+0x123/0x1250
[  650.225549][    C1]  ? xfrm_policy_lookup_bytype+0x11ef/0x1250
[  650.227966][    C1]  ? xfrm_expand_policies+0x41f/0x6a0
[  650.230056][    C1]  xfrm_lookup_with_ifid+0x58a/0x1a70
[  650.232243][    C1]  ? __pfx_xfrm_lookup_with_ifid+0x10/0x10
[  650.234292][    C1]  ? dst_cache_get+0x10e/0x5b0
[  650.235911][    C1]  xfrm_lookup_route+0x3c/0x1c0
[  650.237911][    C1]  tipc_udp_xmit+0x1c3/0xaa0
[  650.239731][    C1]  ? tipc_udp_xmit+0xa4/0xaa0
[  650.241388][    C1]  ? __pfx_tipc_udp_xmit+0x10/0x10
[  650.243119][    C1]  ? __pskb_copy_fclone+0x9b5/0xfb0
[  650.244805][    C1]  ? __asan_memcpy+0x40/0x70
[  650.246812][    C1]  ? __pskb_copy_fclone+0x9b5/0xfb0
[  650.248949][    C1]  tipc_udp_send_msg+0x27f/0x3f0
[  650.250895][    C1]  tipc_bearer_xmit_skb+0x2b3/0x400
[  650.253163][    C1]  ? tipc_bearer_xmit_skb+0xa9/0x400
[  650.255491][    C1]  ? __pfx_tipc_bearer_xmit_skb+0x10/0x10
[  650.257910][    C1]  tipc_disc_timeout+0x580/0x6d0
[  650.260040][    C1]  ? __pfx_tipc_disc_timeout+0x10/0x10
[  650.262440][    C1]  call_timer_fn+0x17e/0x5f0
[  650.264464][    C1]  ? __pfx_tipc_disc_timeout+0x10/0x10
[  650.266821][    C1]  ? call_timer_fn+0xbe/0x5f0
[  650.268897][    C1]  ? __pfx_call_timer_fn+0x10/0x10
[  650.270917][    C1]  ? _raw_spin_unlock_irq+0x23/0x50
[  650.273211][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  650.275500][    C1]  ? __pfx_tipc_disc_timeout+0x10/0x10
[  650.277877][    C1]  __run_timer_base+0x61a/0x860
[  650.279984][    C1]  ? ktime_get+0x3e/0x1f0
[  650.281890][    C1]  ? __pfx___run_timer_base+0x10/0x10
[  650.284209][    C1]  ? seqcount_lockdep_reader_access+0x15f/0x1c0
[  650.286882][    C1]  run_timer_softirq+0xb7/0x180
[  650.288906][    C1]  handle_softirqs+0x286/0x870
[  650.290901][    C1]  ? __irq_exit_rcu+0xca/0x1f0
[  650.292816][    C1]  ? __pfx_handle_softirqs+0x10/0x10
[  650.294722][    C1]  ? irqtime_account_irq+0xb6/0x1c0
[  650.296923][    C1]  __irq_exit_rcu+0xca/0x1f0
[  650.298935][    C1]  ? __pfx___irq_exit_rcu+0x10/0x10
[  650.300741][    C1]  irq_exit_rcu+0x9/0x30
[  650.302162][    C1]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  650.304038][    C1]  </IRQ>
[  650.305096][    C1]  <TASK>
[  650.306202][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  650.308201][    C1] RIP: 0010:pv_native_safe_halt+0x13/0x20
[  650.310122][    C1] Code: 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d b3 f9 0d 00 f3 0f 1e fa fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90
[  650.316902][    C1] RSP: 0018:ffffc90000177de0 EFLAGS: 00000282
[  650.319022][    C1] RAX: a4b2721e3a82e100 RBX: ffffffff819693f8 RCX: a4b2721e3a82e100
[  650.321782][    C1] RDX: 0000000000000001 RSI: ffffffff8d9b9cae RDI: ffffffff8be33c00
[  650.324479][    C1] RBP: ffffc90000177f20 R08: ffff888136632f9b R09: 1ffff11026cc65f3
[  650.327305][    C1] R10: dffffc0000000000 R11: ffffed1026cc65f4 R12: ffffffff8fa3a630
[  650.330094][    C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff110200d6000
[  650.332860][    C1]  ? do_idle+0x1e8/0x510
[  650.334361][    C1]  default_idle+0x13/0x20
[  650.335981][    C1]  default_idle_call+0x74/0xb0
[  650.337713][    C1]  do_idle+0x1e8/0x510
[  650.339214][    C1]  ? __pfx_do_idle+0x10/0x10
[  650.340813][    C1]  cpu_startup_entry+0x44/0x60
[  650.342519][    C1]  start_secondary+0x101/0x110
[  650.344151][    C1]  common_startup_64+0x13e/0x147
[  650.345920][    C1]  </TASK>
[  650.347676][    C1] Kernel Offset: disabled
[  650.349170][    C1] Rebooting in 86400 seconds..

VM DIAGNOSIS:
14:39:19  Registers:
info registers vcpu 0

CPU#0
RAX=eac78fbcdc4e7000 RBX=ffffffff819693f8 RCX=eac78fbcdc4e7000 RDX=0000000000000001
RSI=ffffffff8d9b9cae RDI=ffffffff8be33c00 RBP=ffffffff8de07eb8 RSP=ffffffff8de07d80
R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4
R12=ffffffff8fa3a630 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a20
RIP=ffffffff8b7a33f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8615000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c38a285 CR3=0000000037ad4000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000061 RBX=0000000000000061 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900001df990
R8 =ffff888107f80237 R9 =1ffff11020ff0046 R10=dffffc0000000000 R11=ffffffff854f91c0
R12=dffffc0000000000 R13=ffffffff99b00904 R14=ffffffff99df5420 R15=0000000000000000
RIP=ffffffff854f923c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c15000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f3b13c1efc8 CR3=0000000133a60000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fe049ba7498 00007fe049ba7470 XMM03=00007fe049ba74a8 00007fe049ba74a0
XMM04=00007fe04a70d100 00007fe049ba7460 XMM05=00007fe049ba7478 00007fe049ba74c0
XMM06=00007fe049ba74b8 00007fe049ba74b0 XMM07=00007fe049ba74a8 00007fe049ba74a0
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 00007fe049a12fed
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
