last executing test programs:

1.675416615s ago: executing program 0 (id=1188):
syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff)
socket$pppl2tp(0x18, 0x1, 0x1)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)={0x14, r1, 0x1, 0x0, 0x25dfdbfb}, 0x14}}, 0x0)
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan4\x00'})
r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0)
bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null]}, 0x48)
setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000040)=@rose={'rose', 0x0}, 0x10)
sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x10)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000200180000000000000000000850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x9, 0x8, 0x4, 0x4009, 0xa, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value=0x3f000000}, 0x48)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x3b, &(0x7f0000000000)='/proc/sys/net/ipv4\x00\x00s/sync_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd11=\x11\xc8\xdd\x15\xcc\xd2\xf1d\'%\x11c\x91l,'}, 0x30)
bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0), 0x18)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000080), 0x4)
sendmmsg$inet(r4, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0)
close(r5)
r6 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r6, &(0x7f0000000140)=[{&(0x7f0000000080)="5800000014001923fc834b80040d8c560a067f020000000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd001a0010000100080c10000000000000000000", 0x58}], 0x1)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x18, 0x24, 0x301, 0x0, 0x80, {0x11}, [@nested={0x4, 0x12f}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x0)
ioctl$FS_IOC_GETFLAGS(r6, 0x80086601, &(0x7f0000000040))
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r8)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="796100000000000000007e00000033000300", @ANYRES32=0x0, @ANYBLOB="a739dfe54ad99ffa18c27526b51001fb4f778791377c"], 0x1c}}, 0x4000054)

783.457029ms ago: executing program 0 (id=1208):
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x25, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x90}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80)

725.063613ms ago: executing program 0 (id=1209):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002000)={0x18, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
recvmmsg(r1, 0x0, 0x0, 0x100, &(0x7f0000002040)={0x0, 0x989680})
sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0)

646.107094ms ago: executing program 0 (id=1211):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c70000000000000000000000000000000008000100544545000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000000}, 0x0)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000000000000000000000700000082"], 0x18}}], 0x1, 0x0)
r3 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc)
r4 = socket$netlink(0x10, 0x3, 0x0)
writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)
writev(r4, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1)
r5 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r5, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @loopback}, 0xc)
setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027f"], 0x57)
setsockopt$inet_mreqsrc(r3, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc)
sendmsg$ETHTOOL_MSG_LINKINFO_GET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000fb1900000018000180140002006e657464657673"], 0x2c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r6)
sendmsg$NFC_CMD_GET_SE(0xffffffffffffffff, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000011c0)={0x14, r7, 0x5953a6d8b15e6715, 0x70bd2c}, 0x14}}, 0x0)
sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x40081)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'tunl0\x00'})
r8 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x10012, r8, 0x0)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={r8, 0x20, &(0x7f0000000280)={&(0x7f0000002280)=""/4102, 0x1006, 0x0, 0x0}}, 0x10)

543.404203ms ago: executing program 0 (id=1216):
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
ioctl(r0, 0x8b1b, &(0x7f0000000040))

485.081047ms ago: executing program 0 (id=1219):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e20, @private=0xa010100}]}, &(0x7f00000002c0)=0x10)
r1 = socket(0x2, 0x80805, 0x0)
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={<r3=>0x0}, &(0x7f0000000040)=0x8)
setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000240)={0x6, 0x101, 0x206, 0xb4, 0x754d, 0x4, 0xc, 0xf, r3}, 0x20)

324.248517ms ago: executing program 1 (id=1224):
setsockopt$MRT_ADD_MFC(0xffffffffffffffff, 0x0, 0xcc, &(0x7f0000000280)={@broadcast, @dev={0xac, 0x14, 0x14, 0x3f}, 0x0, "7ea97ddb2ac127ffa5b7216fe75ebaa2855a422a8bf8ec7caf003751804500", 0xfffffffc, 0xfffffffd, 0x7, 0x7}, 0x3c)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x76980a90ff78c56d}}}, 0x28}, 0x1, 0x0, 0x0, 0x5810}, 0x48044)
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f00000000c0), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB="050000000808"], 0x80}, 0x1, 0x0, 0x0, 0x4000011}, 0x4000000)
sendmsg$can_bcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0)

276.078684ms ago: executing program 1 (id=1226):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYBLOB="44000000180001002cbd7000000000000a0000000000fd020000000008000400", @ANYRES32=r1, @ANYBLOB="0600150008000000180016"], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x0)

275.978867ms ago: executing program 2 (id=1227):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0xffffff1f, 0x1}}, 0x20)

224.613876ms ago: executing program 1 (id=1228):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)={0x24, r1, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c841}, 0x20000010)

222.240877ms ago: executing program 2 (id=1229):
r0 = socket$kcm(0x10, 0x400000002, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="33fe000078009106000000000000004a07"], 0xfe33)

156.711571ms ago: executing program 1 (id=1230):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="600000000206050000000000000000000704000014000780080008400000009805001400200000000500010006000100050005000a00000005000400000000000900020071797a310000000011000300686173683a6e65742c6e6574"], 0x60}}, 0x20000000)

156.486286ms ago: executing program 2 (id=1231):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000000340)=ANY=[@ANYBLOB="340000001200010025bd70000400000000000000000000000000000000000000000004d502006c000c0015"], 0x34}, 0x1, 0x0, 0x0, 0x14040015}, 0x24004040)

106.843994ms ago: executing program 1 (id=1232):
syz_emit_ethernet(0x4f, &(0x7f0000000a80)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6c370c890019840141000000000000000000020000000000fe8000000000000000000000000000aaa5ba94e385673ccfd3fe184ab0643975bcc85fbf438632261b"], 0x0)

106.688834ms ago: executing program 2 (id=1233):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0xc}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfff}, 0x94)

106.310354ms ago: executing program 1 (id=1234):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000084ffffffff000000000300000000000000000000000200000000000000000000000000000b03000000000000000000000902"], 0x0, 0x56, 0x0, 0x3}, 0x20)
unshare(0x26020480)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="02030003120000002cbd7000fbdbdf2503000900800000001cdc0dca1d9f68846960e56de42944af05000600000000000a00000000000000000000000000000000000000000000010b0000000000000002000100000000000000070c0000000005000500000000000a00000000000000fc01000000000000000000000000000107000000000000000100140007"], 0x90}, 0x1, 0x7}, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f0000000080))
connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10)
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={<r4=>r0})
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000004c0)={'syztnl0\x00', &(0x7f0000000200)={'ip6tnl0\x00', <r6=>0x0, 0x2b, 0x4, 0x8, 0x9, 0x21, @mcast1, @local, 0x8, 0x1, 0x63, 0x7f}})
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000005c0)={'ip_vti0\x00', &(0x7f0000000500)={'ip_vti0\x00', <r7=>0x0, 0x1, 0x10, 0x2, 0x401, {{0x23, 0x4, 0x2, 0x3, 0x8c, 0x67, 0x0, 0x4, 0x29, 0x0, @remote, @local, {[@lsrr={0x83, 0x23, 0x3e, [@empty, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @local, @multicast2, @dev={0xac, 0x14, 0x14, 0x15}, @remote]}, @lsrr={0x83, 0x7, 0xa6, [@broadcast]}, @timestamp_prespec={0x44, 0x4c, 0xee, 0x3, 0xe, [{@multicast2, 0xf}, {@broadcast, 0x8d}, {@multicast2, 0x1}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x200}, {@multicast2, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x400}, {@rand_addr=0x64010100, 0x7fffffff}, {@remote, 0x9}]}]}}}}})
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'ip6_vti0\x00', <r8=>0x0, 0x29, 0x5, 0x2, 0x2, 0x2, @local, @dev={0xfe, 0x80, '\x00', 0x19}, 0x700, 0x7800, 0x9981, 0x8}})
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000006c0)={'team0\x00', <r9=>0x0})
sendmsg$ETHTOOL_MSG_DEBUG_GET(r4, &(0x7f0000000800)={&(0x7f0000000100), 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0xc0, r5, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x8040}, 0x10)
setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1}, {0x7}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8)
sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x12}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x3, 0xa, 0x0, 0x0, 0x2f}, {0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x6}, {0x0, 0x400000000}, 0x203, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@local, 0x1, 0x33}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0xb7, 0x0, 0x0, 0x1}}, 0xe4)

55.731639ms ago: executing program 2 (id=1235):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf250401f280080018000aac0f"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0)

0s ago: executing program 2 (id=1236):
r0 = socket$unix(0x1, 0x2, 0x0)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000080)=0x7, 0x4)
close(0x3)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:51897' (ED25519) to the list of known hosts.
syzkaller login: [   56.622282][ T5773] cgroup: Unknown subsys name 'net'
[   56.755267][ T5773] cgroup: Unknown subsys name 'cpuset'
[   56.765612][ T5773] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.855939][ T5773] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   64.869179][ T5850] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   64.883417][ T5853] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   64.886452][ T5853] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   64.901439][ T5856] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   64.903898][ T5856] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   64.907077][ T5857] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   64.910755][ T5857] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   64.913091][ T5857] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   64.916071][ T5857] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   64.919915][ T5857] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   64.931837][ T5236] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   64.935418][ T5236] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   64.940603][ T5236] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   64.958969][ T5236] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   64.962167][ T5236] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   65.328483][ T5851] chnl_net:caif_netlink_parms(): no params data found
[   65.352293][ T5854] chnl_net:caif_netlink_parms(): no params data found
[   65.373655][ T5847] chnl_net:caif_netlink_parms(): no params data found
[   65.553975][ T5854] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.556983][ T5854] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.562102][ T5854] bridge_slave_0: entered allmulticast mode
[   65.565055][ T5854] bridge_slave_0: entered promiscuous mode
[   65.601985][ T5854] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.604887][ T5854] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.607958][ T5854] bridge_slave_1: entered allmulticast mode
[   65.612079][ T5854] bridge_slave_1: entered promiscuous mode
[   65.616231][ T5851] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.618958][ T5851] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.623138][ T5851] bridge_slave_0: entered allmulticast mode
[   65.627063][ T5851] bridge_slave_0: entered promiscuous mode
[   65.632329][ T5851] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.634980][ T5851] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.637684][ T5851] bridge_slave_1: entered allmulticast mode
[   65.642395][ T5851] bridge_slave_1: entered promiscuous mode
[   65.685885][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.688875][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.692023][ T5847] bridge_slave_0: entered allmulticast mode
[   65.696141][ T5847] bridge_slave_0: entered promiscuous mode
[   65.701334][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.704239][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.707221][ T5847] bridge_slave_1: entered allmulticast mode
[   65.711237][ T5847] bridge_slave_1: entered promiscuous mode
[   65.759454][ T5854] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.766490][ T5851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.773384][ T5851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.795035][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.802032][ T5854] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.820810][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.877449][ T5851] team0: Port device team_slave_0 added
[   65.882723][ T5854] team0: Port device team_slave_0 added
[   65.897425][ T5854] team0: Port device team_slave_1 added
[   65.902256][ T5851] team0: Port device team_slave_1 added
[   65.906747][ T5847] team0: Port device team_slave_0 added
[   65.938267][ T5847] team0: Port device team_slave_1 added
[   65.972265][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.974447][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.983352][ T5851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.988595][ T5854] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.991769][ T5854] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   66.002593][ T5854] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   66.017724][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0
[   66.019903][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   66.028180][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   66.033105][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_1
[   66.035773][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   66.044650][ T5851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   66.049099][ T5854] batman_adv: batadv0: Adding interface: batadv_slave_1
[   66.052528][ T5854] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   66.061823][ T5854] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   66.066579][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1
[   66.069215][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   66.079678][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   66.164532][ T5851] hsr_slave_0: entered promiscuous mode
[   66.167939][ T5851] hsr_slave_1: entered promiscuous mode
[   66.184390][ T5854] hsr_slave_0: entered promiscuous mode
[   66.187077][ T5854] hsr_slave_1: entered promiscuous mode
[   66.189316][ T5854] debugfs: 'hsr0' already exists in 'hsr'
[   66.192813][ T5854] Cannot create hsr debugfs directory
[   66.208108][ T5847] hsr_slave_0: entered promiscuous mode
[   66.211405][ T5847] hsr_slave_1: entered promiscuous mode
[   66.214067][ T5847] debugfs: 'hsr0' already exists in 'hsr'
[   66.216312][ T5847] Cannot create hsr debugfs directory
[   66.584853][ T5847] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   66.594035][ T5847] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   66.601607][ T5847] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   66.615595][ T5847] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   66.667395][ T5851] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   66.673244][ T5851] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   66.692747][ T5851] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   66.701251][ T5851] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   66.752561][ T5854] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   66.758619][ T5854] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   66.766524][ T5854] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   66.772081][ T5854] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   66.879036][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.908608][ T5851] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.914498][ T5847] 8021q: adding VLAN 0 to HW filter on device team0
[   66.929672][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.932970][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.946764][ T5851] 8021q: adding VLAN 0 to HW filter on device team0
[   66.961131][ T5853] Bluetooth: hci1: command tx timeout
[   66.963582][ T5236] Bluetooth: hci0: command tx timeout
[   66.967187][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.970132][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.976500][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.979360][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   67.005513][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.008064][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   67.018820][ T5854] 8021q: adding VLAN 0 to HW filter on device bond0
[   67.040391][ T5236] Bluetooth: hci2: command tx timeout
[   67.051415][ T5854] 8021q: adding VLAN 0 to HW filter on device team0
[   67.069429][ T5847] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   67.084151][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   67.086991][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   67.106543][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   67.109039][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   67.166359][ T5854] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   67.175604][ T5854] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   67.294382][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.318002][ T5854] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.344676][ T5851] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.375219][ T5847] veth0_vlan: entered promiscuous mode
[   67.392462][ T5847] veth1_vlan: entered promiscuous mode
[   67.424013][ T5854] veth0_vlan: entered promiscuous mode
[   67.441860][ T5854] veth1_vlan: entered promiscuous mode
[   67.447453][ T5851] veth0_vlan: entered promiscuous mode
[   67.464008][ T5851] veth1_vlan: entered promiscuous mode
[   67.478281][ T5847] veth0_macvtap: entered promiscuous mode
[   67.493188][ T5847] veth1_macvtap: entered promiscuous mode
[   67.505709][ T5854] veth0_macvtap: entered promiscuous mode
[   67.524918][ T5851] veth0_macvtap: entered promiscuous mode
[   67.532999][ T5854] veth1_macvtap: entered promiscuous mode
[   67.542738][ T5851] veth1_macvtap: entered promiscuous mode
[   67.559189][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.572336][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.582009][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.592611][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.604463][ T5708] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.612059][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.615653][ T5708] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.624200][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.642101][ T5708] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.657144][ T5708] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.668494][ T5708] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.677414][ T5708] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.696941][ T5708] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.702875][ T5708] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.720320][ T5708] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.737796][ T5708] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.742883][ T5708] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.768949][ T5708] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.778638][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.790447][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.852074][ T1869] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.855292][ T1869] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.894337][ T1869] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.897430][ T1869] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.952235][ T1004] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.955399][ T1004] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.978545][ T5847] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   67.987564][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.994703][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.995389][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   68.008922][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   68.286726][ T5922] Zero length message leads to an empty skb
[   68.672113][ T5945] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   68.676855][ T5945] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13'.
[   68.683022][ T5945] bridge_slave_1: left allmulticast mode
[   68.685403][ T5945] bridge_slave_1: left promiscuous mode
[   68.688422][ T5945] bridge0: port 2(bridge_slave_1) entered disabled state
[   68.695280][ T5945] bridge_slave_0: left allmulticast mode
[   68.697127][ T5945] bridge_slave_0: left promiscuous mode
[   68.698934][ T5945] bridge0: port 1(bridge_slave_0) entered disabled state
[   69.042085][ T5236] Bluetooth: hci0: command tx timeout
[   69.043682][ T5853] Bluetooth: hci1: command tx timeout
[   69.120987][ T5853] Bluetooth: hci2: command tx timeout
[   69.467337][ T5985] netlink: 'syz.1.22': attribute type 1 has an invalid length.
[   69.471295][ T5985] netlink: 'syz.1.22': attribute type 3 has an invalid length.
[   69.474228][ T5985] netlink: 564 bytes leftover after parsing attributes in process `syz.1.22'.
[   69.537210][ T5988] sch_tbf: burst 19872 is lower than device lo mtu (65550) !
[   69.650700][ T5994] netlink: 4436 bytes leftover after parsing attributes in process `syz.1.24'.
[   69.654750][ T5994] x_tables: ip_tables: osf.0 match: invalid size 48 (kernel) != (user) 4096
[   70.315601][ T6048] wg1: entered promiscuous mode
[   70.317643][ T6048] wg1: entered allmulticast mode
[   71.126371][ T5853] Bluetooth: hci1: command tx timeout
[   71.126470][ T5236] Bluetooth: hci0: command tx timeout
[   71.198660][ T6074] IPVS: set_ctl: invalid protocol: 94 255.255.255.255:20001
[   71.204709][ T5236] Bluetooth: hci2: command tx timeout
[   71.275654][ T6079] bond0: (slave gretap0): Opening slave failed
[   71.362334][ T6081] TCP: tcp_parse_options: Illegal window scaling value 128 > 14 received
[   71.475765][ T6090] netlink: 'syz.0.46': attribute type 5 has an invalid length.
[   71.683285][ T6102] Bluetooth: MGMT ver 1.23
[   71.848823][ T6107] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.852390][ T6107] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.972588][ T6107] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   71.994153][   T33] audit: type=1804 audit(1758544889.638:2): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.56" name="/newroot/24/cgroup.controllers" dev="tmpfs" ino=140 res=1 errno=0
[   71.994595][ T6107] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   72.014262][   T33] audit: type=1800 audit(1758544889.648:3): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.56" name="cgroup.controllers" dev="tmpfs" ino=140 res=0 errno=0
[   72.164794][ T5708] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   72.416756][ T6118] bridge0: port 2(bridge_slave_1) entered disabled state
[   72.420525][ T6118] bridge0: port 1(bridge_slave_0) entered disabled state
[   72.629770][ T6118] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   72.651704][ T6118] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   72.905090][ T5708] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   72.908837][ T6129] warning: `syz.1.60' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   72.915064][ T5708] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   72.921978][ T5708] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.041283][ T5708] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.082773][ T5708] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.095408][ T5708] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.102393][ T6142] netlink: 64 bytes leftover after parsing attributes in process `syz.0.63'.
[   73.107194][ T5708] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   73.130897][ T6143] tipc: Started in network mode
[   73.133275][ T6143] tipc: Node identity 221a2c65b6b4, cluster identity 4711
[   73.137646][ T6143] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   73.150910][ T6143] syzkaller0: entered promiscuous mode
[   73.153098][ T6143] syzkaller0: entered allmulticast mode
[   73.200168][ T5236] Bluetooth: hci1: command tx timeout
[   73.210841][ T5236] Bluetooth: hci0: command tx timeout
[   73.282127][ T5236] Bluetooth: hci2: command tx timeout
[   73.363472][ T6153] tipc: Resetting bearer <eth:syzkaller0>
[   73.412967][ T6151] 8021q: adding VLAN 0 to HW filter on device bond1
[   73.416964][ T6140] tipc: Resetting bearer <eth:syzkaller0>
[   73.434942][ T6140] tipc: Disabling bearer <eth:syzkaller0>
[   73.461487][ T6156] 8021q: adding VLAN 0 to HW filter on device macvlan2
[   73.467537][ T6156] bond1: (slave macvlan2): Enslaving as a backup interface with an up link
[   73.478513][ T6151] bridge_slave_0: left allmulticast mode
[   73.488562][ T6151] bridge_slave_0: left promiscuous mode
[   73.491197][ T6151] bridge0: port 1(bridge_slave_0) entered disabled state
[   73.503752][ T6151] bridge_slave_1: left allmulticast mode
[   73.506033][ T6151] bridge_slave_1: left promiscuous mode
[   73.508321][ T6151] bridge0: port 2(bridge_slave_1) entered disabled state
[   73.528679][ T6123] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[   73.549253][ T6151] bond0: (slave bond_slave_0): Releasing backup interface
[   73.563353][ T6151] bond0: (slave bond_slave_1): Releasing backup interface
[   73.572974][ T6151] team0: Port device team_slave_0 removed
[   73.576891][ T6151] team0: Port device team_slave_1 removed
[   73.579404][ T6151] batman_adv: batadv0: Removing interface: batadv_slave_0
[   73.584892][ T6151] batman_adv: batadv0: Removing interface: batadv_slave_1
[   73.588439][ T6151] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[   73.656123][ T6123] bond1: (slave macvlan2): link status up again after 0 ms
[   73.658755][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   73.678759][ T6123] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[   73.781685][ T6154] IPVS: wlc: FWM 3 0x00000003 - no destination available
[   73.783963][    C1] IPVS: wlc: FWM 3 0x00000003 - no destination available
[   73.788520][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   73.791507][ T6167] netlink: 20 bytes leftover after parsing attributes in process `syz.1.73'.
[   73.796255][ T5900] IPVS: starting estimator thread 0...
[   73.880829][ T6168] IPVS: using max 63 ests per chain, 151200 per kthread
[   73.902225][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   74.144739][ T6190] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   74.167388][ T6190] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[   74.724554][ T6227] syz.1.97 uses obsolete (PF_INET,SOCK_PACKET)
[   74.889350][ T6242] trusted_key: syz.2.103 sent an empty control message without MSG_MORE.
[   75.061997][ T6256] netlink: 12 bytes leftover after parsing attributes in process `syz.2.111'.
[   75.225395][ T6266] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.115'.
[   75.240096][ T6270] netlink: 28 bytes leftover after parsing attributes in process `syz.2.117'.
[   75.250092][ T6270] netlink: 28 bytes leftover after parsing attributes in process `syz.2.117'.
[   75.416528][ T6284] netlink: 'syz.1.123': attribute type 22 has an invalid length.
[   75.638661][ T6308] netlink: 12 bytes leftover after parsing attributes in process `syz.0.131'.
[   75.684306][ T6308] 8021q: adding VLAN 0 to HW filter on device bond2
[   75.733931][ T6308] netlink: 4 bytes leftover after parsing attributes in process `syz.0.131'.
[   76.046796][ T6324] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   76.057949][ T6324] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   76.184464][ T6123] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   76.188130][ T6123] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   76.192115][ T6123] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   76.195631][ T6123] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   76.292657][ T6342] netlink: 36 bytes leftover after parsing attributes in process `syz.2.136'.
[   76.431694][ T6123] net_ratelimit: 19 callbacks suppressed
[   76.431729][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   76.483850][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   76.486068][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   76.509153][ T6356] netlink: 16 bytes leftover after parsing attributes in process `syz.2.141'.
[   76.539931][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   76.561217][ T6360] netlink: 'syz.2.142': attribute type 1 has an invalid length.
[   76.653530][ T6370] netlink: 28 bytes leftover after parsing attributes in process `syz.1.145'.
[   76.666690][ T6360] veth3: entered promiscuous mode
[   76.671868][ T6360] bond1: (slave veth3): Enslaving as a backup interface with a down link
[   76.682903][ T6360] bond0: (slave bond_slave_0): Releasing backup interface
[   76.696112][ T6360] bond0: (slave bond_slave_1): Releasing backup interface
[   76.701013][ T6360] team0: Port device team_slave_0 removed
[   76.711688][ T6360] team0: Port device team_slave_1 removed
[   76.718083][ T6360] batman_adv: batadv0: Removing interface: batadv_slave_0
[   76.726031][ T6360] batman_adv: batadv0: Removing interface: batadv_slave_1
[   76.729625][ T6360] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[   76.790137][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   76.900839][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   77.024755][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   77.132732][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   77.252360][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   77.360040][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   77.473697][ T6123] bond1: (slave macvlan2): failed to get link speed/duplex
[   77.518996][ T6430] unknown channel width for channel at 909000KHz?
[   77.523206][ T6430] unknown channel width for channel at 909000KHz?
[   77.526196][ T6430] unknown channel width for channel at 909000KHz?
[   77.610113][ T5236] Bluetooth: hci2: command tx timeout
[   78.678760][ T6498] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue
[   79.241705][ T6534] __nla_validate_parse: 7 callbacks suppressed
[   79.241726][ T6534] netlink: 14560 bytes leftover after parsing attributes in process `syz.2.217'.
[   79.314689][ T6538] netlink: 68 bytes leftover after parsing attributes in process `syz.0.218'.
[   79.442493][ T6546] netlink: 'syz.1.223': attribute type 3 has an invalid length.
[   79.445669][ T6546] netlink: 'syz.1.223': attribute type 3 has an invalid length.
[   79.452532][ T6546] netlink: 16 bytes leftover after parsing attributes in process `syz.1.223'.
[   79.475282][ T6548] RDS: rds_bind could not find a transport for fe80::2a, load rds_tcp or rds_rdma?
[   79.553500][ T6554] netlink: 16 bytes leftover after parsing attributes in process `syz.2.227'.
[   79.601828][ T6559] netlink: 8 bytes leftover after parsing attributes in process `syz.0.229'.
[   79.868333][ T6577] netlink: 'syz.2.237': attribute type 1 has an invalid length.
[   79.873347][ T6577] netlink: 172 bytes leftover after parsing attributes in process `syz.2.237'.
[   79.876853][ T6577] netlink: 'syz.2.237': attribute type 1 has an invalid length.
[   80.088058][ T6589] netlink: 44 bytes leftover after parsing attributes in process `syz.0.242'.
[   80.899443][ T6609] netlink: 16 bytes leftover after parsing attributes in process `syz.1.248'.
[   81.317413][ T6630] netlink: 8168 bytes leftover after parsing attributes in process `syz.2.258'.
[   81.401345][ T6632] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:9317
[   81.480178][ T5708] net_ratelimit: 29 callbacks suppressed
[   81.480190][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   81.590044][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   81.700028][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   81.810078][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   81.921534][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   82.032363][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   82.171154][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   82.309991][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   82.321000][ T6680] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   82.349476][ T6682] netlink: 'syz.1.284': attribute type 3 has an invalid length.
[   82.398205][ T6684] netlink: 'syz.2.285': attribute type 4 has an invalid length.
[   82.402551][ T6686] netlink: 40 bytes leftover after parsing attributes in process `syz.1.286'.
[   82.430117][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   82.475538][ T6688] pimreg: entered allmulticast mode
[   82.484882][ T6688] pimreg: left allmulticast mode
[   82.550540][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   82.604350][ T6694] syzkaller1: entered promiscuous mode
[   82.607679][ T6694] syzkaller1: entered allmulticast mode
[   82.620258][ T6694] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 324
[   82.738751][ T6703] ..0: renamed from hsr0
[   82.747830][ T6703] ..0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   82.763965][ T6703] ..0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   82.777469][ T6703] ..0: entered allmulticast mode
[   82.779077][ T6703] hsr_slave_0: entered allmulticast mode
[   82.781220][ T6703] hsr_slave_1: entered allmulticast mode
[   82.821391][ T6711] veth4: entered allmulticast mode
[   84.252511][ T6763] __nla_validate_parse: 2 callbacks suppressed
[   84.252531][ T6763] netlink: 220 bytes leftover after parsing attributes in process `syz.0.318'.
[   84.509716][ T6781] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 4300
[   85.068817][ T6808] netlink: 136 bytes leftover after parsing attributes in process `syz.2.336'.
[   85.096916][   T51] IPVS: starting estimator thread 0...
[   85.180755][ T6812] IPVS: using max 46 ests per chain, 110400 per kthread
[   85.433718][ T6827] tipc: Started in network mode
[   85.438310][ T6827] tipc: Node identity 52fd088d56dd, cluster identity 4711
[   85.489146][ T6827] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   85.492903][ T6828] syzkaller0: entered promiscuous mode
[   85.495211][ T6828] syzkaller0: entered allmulticast mode
[   85.511161][ T6827] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) !
[   85.518561][ T6827] tipc: Resetting bearer <eth:syzkaller0>
[   85.526557][ T6826] tipc: Resetting bearer <eth:syzkaller0>
[   85.542777][ T6826] tipc: Disabling bearer <eth:syzkaller0>
[   86.733932][   T10] cfg80211: failed to load regulatory.db
[   87.440039][ T5708] net_ratelimit: 33 callbacks suppressed
[   87.440055][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   87.611685][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   87.650878][ T6889] netlink: 4 bytes leftover after parsing attributes in process `syz.1.376'.
[   87.685027][ T6889] batman_adv: batadv0: Removing interface: batadv_slave_1
[   87.712388][ T6891] netlink: 28 bytes leftover after parsing attributes in process `syz.2.378'.
[   87.715818][ T6891] netlink: 28 bytes leftover after parsing attributes in process `syz.2.378'.
[   87.719437][ T6891] netlink: 40 bytes leftover after parsing attributes in process `syz.2.378'.
[   87.753149][ T6896] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0'
[   87.760879][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   87.775398][ T6898] netlink: 24 bytes leftover after parsing attributes in process `syz.2.381'.
[   87.840815][ T6898] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.381'.
[   87.870456][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   87.926842][ T6907] netlink: 8 bytes leftover after parsing attributes in process `syz.1.384'.
[   87.932205][ T6907] openvswitch: netlink: nsh attribute has 2338 unknown bytes.
[   87.935290][ T6907] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   87.994316][ T6911] netlink: 'syz.1.386': attribute type 5 has an invalid length.
[   88.010942][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   88.120095][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   88.230067][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   88.351077][ T5708] bond1: (slave macvlan2): failed to get link speed/duplex
[   88.442891][ T6935] netlink: 24 bytes leftover after parsing attributes in process `syz.1.390'.
[   89.558478][ T7018] netlink: 4 bytes leftover after parsing attributes in process `syz.1.411'.
[   90.027167][ T7050] syzkaller0: entered promiscuous mode
[   90.029528][ T7050] syzkaller0: entered allmulticast mode
[   91.224713][ T7063] veth0: entered promiscuous mode
[   91.227464][ T7065] netlink: 8 bytes leftover after parsing attributes in process `syz.1.431'.
[   91.238389][ T7065] netlink: 8 bytes leftover after parsing attributes in process `syz.1.431'.
[   91.387153][ T7060] netlink: 'syz.0.429': attribute type 16 has an invalid length.
[   91.425716][ T7060] netlink: 'syz.0.429': attribute type 17 has an invalid length.
[   91.616253][ T7063] veth0: left promiscuous mode
[   91.804534][ T7082] netlink: 84 bytes leftover after parsing attributes in process `syz.1.438'.
[   92.025761][ T7096] netlink: 32 bytes leftover after parsing attributes in process `syz.2.445'.
[   92.071682][ T7098] netlink: 104 bytes leftover after parsing attributes in process `syz.0.446'.
[   92.111859][ T7100] batadv2: entered promiscuous mode
[   92.114029][ T7100] batadv2: entered allmulticast mode
[   92.385685][ T7119] netlink: 24 bytes leftover after parsing attributes in process `syz.2.456'.
[   92.408395][ T7119] netlink: 16 bytes leftover after parsing attributes in process `syz.2.456'.
[   92.483565][ T5879] net_ratelimit: 24 callbacks suppressed
[   92.483582][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   92.613478][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   92.653431][ T7133] netlink: 24 bytes leftover after parsing attributes in process `syz.1.462'.
[   92.732075][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   92.792315][ T7141] netlink: 56 bytes leftover after parsing attributes in process `syz.1.466'.
[   92.840091][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   92.961773][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   93.074820][ T5879] bond1: (slave macvlan2): failed to get link speed/duplex
[   93.087831][ T7162] batadv_slave_0: entered promiscuous mode
[   93.092558][ T7162] batadv_slave_0: left promiscuous mode
[   93.280376][ T7165] block nbd0: server does not support multiple connections per device.
[   93.284247][ T7165] block nbd0: shutting down sockets
[   93.433748][ T7177] netlink: 'syz.1.482': attribute type 6 has an invalid length.
[   94.446668][ T7249] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode
[   94.453576][ T7249] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode
[   94.946756][ T7276] netlink: 'syz.0.530': attribute type 4 has an invalid length.
[   94.947300][ T7275] Driver unsupported XDP return value 0 on prog  (id 73) dev N/A, expect packet loss!
[   95.444025][ T7309] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[   95.452155][ T7309] team0: Mode changed to "activebackup"
[   95.534783][ T7315] syzkaller1: entered promiscuous mode
[   95.536884][ T7315] syzkaller1: entered allmulticast mode
[   95.575026][ T7319] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN
[   95.668769][ T7323] __nla_validate_parse: 4 callbacks suppressed
[   95.668789][ T7323] netlink: 24 bytes leftover after parsing attributes in process `syz.2.554'.
[   95.901173][ T7334] netlink: 20824 bytes leftover after parsing attributes in process `syz.0.559'.
[   95.926645][ T7334] netlink: 'syz.0.559': attribute type 10 has an invalid length.
[   95.940601][ T7334] bond0: (slave dummy0): Enslaving as an active interface with an up link
[   95.985735][ T7337] netlink: 28 bytes leftover after parsing attributes in process `syz.1.561'.
[   95.989487][ T7337] netlink: 8 bytes leftover after parsing attributes in process `syz.1.561'.
[   96.032200][ T7339] (unnamed net_device) (uninitialized): option arp_interval: invalid value (18446744073709551615)
[   96.036295][ T7339] (unnamed net_device) (uninitialized): option arp_interval: allowed values 0 - 2147483647
[   96.455006][ T7360] netlink: 360 bytes leftover after parsing attributes in process `syz.0.572'.
[   97.067407][ T7380] netlink: 12 bytes leftover after parsing attributes in process `syz.0.582'.
[   97.335362][ T7386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.585'.
[   98.601265][ T7456] netlink: 16 bytes leftover after parsing attributes in process `syz.2.614'.
[   98.663867][ T7460] netlink: 224 bytes leftover after parsing attributes in process `syz.1.619'.
[   98.683582][ T7464] netlink: 'syz.2.617': attribute type 1 has an invalid length.
[   98.687498][ T7464] netlink: 224 bytes leftover after parsing attributes in process `syz.2.617'.
[   98.766414][ T7472] netlink: 'syz.2.622': attribute type 2 has an invalid length.
[   98.769253][ T7471] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   98.872363][ T7479] tipc: Enabling of bearer <et:g> rejected, media not registered
[   98.929696][ T7481] netlink: 'syz.1.627': attribute type 1 has an invalid length.
[   99.009994][ T7478] netlink: 'syz.2.626': attribute type 2 has an invalid length.
[   99.074997][ T7489] syzkaller0: entered promiscuous mode
[   99.083912][ T7489] syzkaller0: entered allmulticast mode
[   99.373359][ T7500] netlink: 'syz.2.635': attribute type 1 has an invalid length.
[   99.634144][ T7527] macvtap1: entered allmulticast mode
[   99.636428][ T7527] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode
[   99.832885][ T7549] netlink: 'syz.0.659': attribute type 1 has an invalid length.
[   99.855159][ T7551] netlink: 'syz.1.660': attribute type 10 has an invalid length.
[   99.862732][ T7551] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   99.876148][ T7551] mac80211_hwsim hwsim6 wlan1: entered allmulticast mode
[  100.072475][ T7561] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  100.198876][ T7579] hsr_slave_0: left promiscuous mode
[  100.202503][ T7579] hsr_slave_1: left promiscuous mode
[  100.362329][ T7591] tipc: New replicast peer: 0.0.0.0
[  100.364917][ T7591] tipc: Enabled bearer <udp:syz2>, priority 10
[  100.367942][ T7591] tipc: New replicast peer: 255.255.255.255
[  100.683653][ T7611] __nla_validate_parse: 7 callbacks suppressed
[  100.683669][ T7611] netlink: 16 bytes leftover after parsing attributes in process `syz.2.685'.
[  100.757913][ T7614] bond0: entered promiscuous mode
[  100.827324][ T7616] tipc: Started in network mode
[  100.829341][ T7616] tipc: Node identity 96fe74a7ca76, cluster identity 4711
[  100.836127][ T7616] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  100.840019][ T7616] syzkaller0: entered promiscuous mode
[  100.842259][ T7616] syzkaller0: entered allmulticast mode
[  100.858700][ T7616] tipc: Resetting bearer <eth:syzkaller0>
[  100.863807][ T7615] tipc: Resetting bearer <eth:syzkaller0>
[  100.872960][ T7615] tipc: Disabling bearer <eth:syzkaller0>
[  100.953497][ T7622] netlink: 'syz.1.690': attribute type 1 has an invalid length.
[  100.956978][ T7622] netlink: 5624 bytes leftover after parsing attributes in process `syz.1.690'.
[  101.060496][ T7631] netlink: 64 bytes leftover after parsing attributes in process `syz.1.693'.
[  101.327713][ T7637] netlink: 'syz.2.697': attribute type 4 has an invalid length.
[  101.491615][ T5900] tipc: Node number set to 69208205
[  101.918199][ T7650] netlink: 13 bytes leftover after parsing attributes in process `syz.1.702'.
[  102.503875][ T7672] netlink: 8 bytes leftover after parsing attributes in process `syz.2.713'.
[  102.605127][ T7682] netlink: 248 bytes leftover after parsing attributes in process `syz.0.717'.
[  102.990099][ T7703] bridge0: entered promiscuous mode
[  103.013836][ T7705] netlink: 8 bytes leftover after parsing attributes in process `syz.1.722'.
[  103.026156][ T7705] openvswitch: netlink: nsh attr 0 has unexpected len 33788 expected 0
[  103.035218][ T7705] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  103.329535][ T7724] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond.
[  103.334632][ T7724] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address
[  103.339454][ T7724] bond0: (slave ipvlan2): Error -95 calling set_mac_address
[  103.487041][ T7732] netlink: 'syz.2.729': attribute type 29 has an invalid length.
[  103.498079][ T7732] netlink: 500 bytes leftover after parsing attributes in process `syz.2.729'.
[  103.502252][ T7732] unsupported nla_type 58
[  103.753651][ T7747] validate_nla: 1 callbacks suppressed
[  103.753678][ T7747] netlink: 'syz.2.736': attribute type 10 has an invalid length.
[  103.758881][ T7747] netlink: 12 bytes leftover after parsing attributes in process `syz.2.736'.
[  103.763194][ T7747] netlink: 68 bytes leftover after parsing attributes in process `syz.2.736'.
[  104.145555][ T7786] netlink: 'syz.2.753': attribute type 21 has an invalid length.
[  104.222702][ T7792] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144
[  105.011773][ T7818] netlink: 'syz.0.767': attribute type 3 has an invalid length.
[  105.074706][ T7825] batadv_slave_1: entered promiscuous mode
[  105.080952][ T7824] batadv_slave_1: left promiscuous mode
[  105.222487][ T7843] netlink: 'syz.0.779': attribute type 7 has an invalid length.
[  105.225513][ T7843] netlink: 'syz.0.779': attribute type 8 has an invalid length.
[  105.488739][ T5860] block nbd64: NBD_DISCONNECT
[  106.186280][ T7876] __nla_validate_parse: 7 callbacks suppressed
[  106.186291][ T7876] netlink: 4 bytes leftover after parsing attributes in process `syz.1.791'.
[  106.194999][ T7876] netlink: 4 bytes leftover after parsing attributes in process `syz.1.791'.
[  106.878122][ T7881] netlink: 32 bytes leftover after parsing attributes in process `syz.2.793'.
[  106.934413][ T7889] netlink: 20 bytes leftover after parsing attributes in process `syz.2.797'.
[  107.026872][ T7896] netlink: 4 bytes leftover after parsing attributes in process `syz.1.800'.
[  107.089584][ T7899] pim6reg: entered allmulticast mode
[  107.107109][ T7899] pim6reg: left allmulticast mode
[  107.139116][ T7903] sctp: [Deprecated]: syz.0.801 (pid 7903) Use of struct sctp_assoc_value in delayed_ack socket option.
[  107.139116][ T7903] Use struct sctp_sack_info instead
[  107.916613][ T7935] netlink: 'syz.1.807': attribute type 30 has an invalid length.
[  108.003742][ T7941] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.809'.
[  108.930903][ T7968] netlink: 4 bytes leftover after parsing attributes in process `syz.2.819'.
[  109.015979][ T7976] netlink: 44 bytes leftover after parsing attributes in process `syz.2.823'.
[  109.122028][ T7984] macsec1: entered promiscuous mode
[  109.123928][ T7984] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode
[  109.128434][ T7984] mac80211_hwsim hwsim7 wlan1: left promiscuous mode
[  109.176803][ T7988] tipc: Enabling of bearer <dp:s> rejected, media not registered
[  109.257162][ T7994] netlink: 104 bytes leftover after parsing attributes in process `syz.1.832'.
[  109.568720][ T8017] netlink: 'syz.2.843': attribute type 1 has an invalid length.
[  109.854769][ T8034] macsec1: entered promiscuous mode
[  109.856458][ T8034] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[  109.858666][ T8034] macsec1: entered allmulticast mode
[  109.863620][ T8034] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode
[  109.880901][ T8040] vxlan0: entered promiscuous mode
[  109.882735][ T8040] vxlan0: entered allmulticast mode
[  109.885008][ T5879] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  109.900303][ T5879] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  109.909669][ T5879] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  109.923027][ T5879] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  110.242681][ T8074] syzkaller1: entered promiscuous mode
[  110.245061][ T8074] syzkaller1: entered allmulticast mode
[  110.857835][ T8120] bridge1: entered allmulticast mode
[  110.993720][ T8131] netlink: 9280 bytes leftover after parsing attributes in process `syz.1.891'.
[  111.025169][ T8133] tipc: New replicast peer: 0.0.0.0
[  111.027102][ T8133] tipc: Enabled bearer <udp:syz2>, priority 10
[  111.031451][ T8133] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00aa
[  111.431146][ T8166] netlink: 'syz.2.908': attribute type 9 has an invalid length.
[  111.434610][ T8166] netlink: 211988 bytes leftover after parsing attributes in process `syz.2.908'.
[  111.734701][ T8194] netlink: 32 bytes leftover after parsing attributes in process `syz.0.921'.
[  111.742934][ T8194] netlink: 'syz.0.921': attribute type 1 has an invalid length.
[  111.766674][ T8196] netlink: 8 bytes leftover after parsing attributes in process `syz.1.922'.
[  111.878164][ T8209] netlink: 8 bytes leftover after parsing attributes in process `syz.1.928'.
[  112.027439][ T8221] netlink: 7 bytes leftover after parsing attributes in process `syz.1.934'.
[  112.150377][   T51] tipc: Node number set to 1552446631
[  112.245762][ T5236] Bluetooth: hci2: link tx timeout
[  112.248824][ T5236] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  112.293905][ T8244] netlink: 48 bytes leftover after parsing attributes in process `syz.1.944'.
[  112.325723][ T8247] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  112.328556][ T8247] tipc: Resetting bearer <eth:syzkaller0>
[  112.374959][ T8247] tipc: Resetting bearer <eth:syzkaller0>
[  112.428301][ T8251] netlink: 8 bytes leftover after parsing attributes in process `syz.1.947'.
[  112.804495][ T5236] Bluetooth: hci2: link tx timeout
[  112.806019][ T5236] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  112.901210][ T8294] netlink: 24 bytes leftover after parsing attributes in process `syz.1.968'.
[  112.929279][ T8294] netlink: 68 bytes leftover after parsing attributes in process `syz.1.968'.
[  113.000983][   T51] hid-generic 0005:15C2:5505.0001: unknown main item tag 0x0
[  113.004055][   T51] hid-generic 0005:15C2:5505.0001: unknown main item tag 0x0
[  113.017586][   T51] hid-generic 0005:15C2:5505.0001: reserved main item tag 0xe
[  113.034302][   T51] hid-generic 0005:15C2:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  113.065555][ T5236] Bluetooth: hci2: link tx timeout
[  113.067206][ T5236] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  113.128794][ T8315] netlink: 8 bytes leftover after parsing attributes in process `syz.2.978'.
[  113.351013][   T10] tipc: Node number set to 2494442597
[  113.360110][ T8335] netlink: 'syz.0.985': attribute type 1 has an invalid length.
[  113.418913][ T8335] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address
[  113.426154][ T8335] bond3: (slave vxcan3): Error -95 calling set_mac_address
[  113.487955][ T8346] netlink: 'syz.1.988': attribute type 7 has an invalid length.
[  113.498194][ T8346] netlink: 'syz.1.988': attribute type 8 has an invalid length.
[  113.542555][ T8344] bond3: (slave bridge1): Enslaving as an active interface with a down link
[  113.579236][ T8335] macvlan3: entered promiscuous mode
[  113.581602][ T8335] macvlan3: entered allmulticast mode
[  113.584461][ T8335] bond3: entered promiscuous mode
[  113.587175][ T8335] 8021q: adding VLAN 0 to HW filter on device macvlan3
[  113.606548][ T8335] bond3: left promiscuous mode
[  114.321083][ T5236] Bluetooth: hci2: command 0x0406 tx timeout
[  115.679776][ T8467] 8021q: adding VLAN 0 to HW filter on device bond0
[  115.685132][ T8467] 8021q: adding VLAN 0 to HW filter on device team0
[  115.691023][ T8467] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  115.751777][ T8472] (unnamed net_device) (uninitialized): Unable to set peer notification delay as MII monitoring is disabled
[  117.237618][ T8599] __nla_validate_parse: 10 callbacks suppressed
[  117.237635][ T8599] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1088'.
[  117.244175][ T8599] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1088'.
[  117.478932][ T8612] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1092'.
[  118.072211][ T8635] syzkaller1: entered promiscuous mode
[  118.074541][ T8635] syzkaller1: entered allmulticast mode
[  118.214810][ T8640] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1108'.
[  118.368072][ T8651] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  118.563348][ T8669] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1119'.
[  118.566504][ T8667] bridge2: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms)
[  118.621741][ T8674] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1121'.
[  119.566783][ T8707] lo: entered promiscuous mode
[  119.568901][ T8707] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  119.596345][ T8710] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0
[  119.600897][ T8709] IPVS: stopping backup sync thread 8710 ...
[  119.704300][ T8716] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1139'.
[  119.720559][ T8718] netlink: zone id is out of range
[  119.726362][ T8718] netlink: zone id is out of range
[  119.728451][ T8718] netlink: set zone limit has 4 unknown bytes
[  119.941333][ T8732] netlink: 'syz.2.1147': attribute type 1 has an invalid length.
[  119.944399][ T8732] netlink: 'syz.2.1147': attribute type 6 has an invalid length.
[  119.988747][ T8737] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1149'.
[  119.992974][ T8732] netlink: 'syz.2.1147': attribute type 3 has an invalid length.
[  120.128267][ T8744] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1152'.
[  121.158663][ T8779] lo speed is unknown, defaulting to 1000
[  121.161495][ T8779] lo speed is unknown, defaulting to 1000
[  121.163902][ T8779] lo speed is unknown, defaulting to 1000
[  121.186911][ T8779] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  121.242320][ T8779] lo speed is unknown, defaulting to 1000
[  121.246215][ T8779] lo speed is unknown, defaulting to 1000
[  121.253752][ T8779] lo speed is unknown, defaulting to 1000
[  121.277075][ T8784] netlink: 'syz.1.1166': attribute type 4 has an invalid length.
[  121.391642][ T8797] netlink: 'syz.0.1174': attribute type 1 has an invalid length.
[  121.394366][ T8797] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1174'.
[  121.412496][ T8800] bridge0: port 1(veth0_to_bridge) entered blocking state
[  121.415605][ T8800] bridge0: port 1(veth0_to_bridge) entered disabled state
[  121.421709][ T8800] veth0_to_bridge: entered allmulticast mode
[  121.427188][ T8800] veth0_to_bridge: entered promiscuous mode
[  121.718168][ T8823] netlink: 'syz.1.1184': attribute type 1 has an invalid length.
[  121.939470][ T8827] netlink: 'syz.0.1188': attribute type 303 has an invalid length.
[  121.954422][ T8827] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  121.958144][ T8827] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  122.373826][ T8859] __nla_validate_parse: 7 callbacks suppressed
[  122.373846][ T8859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1203'.
[  122.432401][ T8861] tipc: Enabled bearer <eth:macvtap0>, priority 10
[  122.615408][ T8868] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1207'.
[  122.688038][ T8868] netlink: 'syz.1.1207': attribute type 1 has an invalid length.
[  122.692114][ T8868] netlink: 5624 bytes leftover after parsing attributes in process `syz.1.1207'.
[  122.802718][ T8880] ip6gre1: entered allmulticast mode
[  122.812410][ T8882] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1211'.
[  122.856029][ T8882] netlink: 'syz.0.1211': attribute type 4 has an invalid length.
[  122.870489][ T8882] netlink: 'syz.0.1211': attribute type 4 has an invalid length.
[  123.264062][ T8917] netlink: 65051 bytes leftover after parsing attributes in process `syz.2.1229'.
[  123.384409][ T8930] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1235'.
[  123.487448][ T8936] ==================================================================
[  123.490676][ T8936] BUG: KASAN: slab-use-after-free in xfrm_state_find+0x2cf2/0x5400
[  123.493805][ T8936] Read of size 1 at addr ffff888110a14c30 by task syz.1.1234/8936
[  123.497999][ T8936] 
[  123.499016][ T8936] CPU: 1 UID: 0 PID: 8936 Comm: syz.1.1234 Not tainted syzkaller #0 PREEMPT(full) 
[  123.499035][ T8936] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  123.499045][ T8936] Call Trace:
[  123.499052][ T8936]  <TASK>
[  123.499061][ T8936]  dump_stack_lvl+0x189/0x250
[  123.499095][ T8936]  ? __kasan_check_byte+0x12/0x40
[  123.499118][ T8936]  ? __pfx_dump_stack_lvl+0x10/0x10
[  123.499136][ T8936]  ? lock_release+0x4b/0x3e0
[  123.499155][ T8936]  ? __virt_addr_valid+0x4a5/0x5c0
[  123.499179][ T8936]  print_report+0xca/0x240
[  123.499192][ T8936]  ? xfrm_state_find+0x2cf2/0x5400
[  123.499212][ T8936]  kasan_report+0x118/0x150
[  123.499234][ T8936]  ? xfrm_state_find+0x2cf2/0x5400
[  123.499253][ T8936]  xfrm_state_find+0x2cf2/0x5400
[  123.499270][ T8936]  ? __lock_acquire+0xab9/0xd20
[  123.499292][ T8936]  ? xfrm_state_find+0x1da/0x5400
[  123.499312][ T8936]  ? __pfx_xfrm_state_find+0x10/0x10
[  123.499332][ T8936]  ? __lock_acquire+0xab9/0xd20
[  123.499354][ T8936]  xfrm_resolve_and_create_bundle+0x768/0x2f80
[  123.499378][ T8936]  ? stack_depot_save_flags+0x40/0x860
[  123.499401][ T8936]  ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10
[  123.499416][ T8936]  ? __lock_acquire+0xab9/0xd20
[  123.499442][ T8936]  ? xfrm_sk_policy_lookup+0x9d/0x750
[  123.499458][ T8936]  ? rt_set_nexthop+0x693/0xa80
[  123.499486][ T8936]  ? xfrm_sk_policy_lookup+0x9d/0x750
[  123.499504][ T8936]  ? xfrm_expand_policies+0x41f/0x6a0
[  123.499522][ T8936]  xfrm_lookup_with_ifid+0x2a7/0x1a70
[  123.499542][ T8936]  ? __pfx_xfrm_lookup_with_ifid+0x10/0x10
[  123.499561][ T8936]  xfrm_lookup_route+0x3c/0x1c0
[  123.499576][ T8936]  udp_sendmsg+0x142e/0x2170
[  123.499596][ T8936]  ? __pfx_ip_generic_getfrag+0x10/0x10
[  123.499618][ T8936]  ? __pfx_udp_sendmsg+0x10/0x10
[  123.499632][ T8936]  ? count_memcg_event_mm+0x21/0x260
[  123.499652][ T8936]  ? count_memcg_event_mm+0x21/0x260
[  123.499673][ T8936]  ? __pfx_aa_sk_perm+0x10/0x10
[  123.499693][ T8936]  ? tomoyo_socket_sendmsg_permission+0x1e1/0x300
[  123.499711][ T8936]  ? sock_rps_record_flow+0x19/0x410
[  123.499725][ T8936]  ? inet_sendmsg+0x29c/0x370
[  123.499737][ T8936]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  123.499756][ T8936]  __sock_sendmsg+0x19c/0x270
[  123.499774][ T8936]  ____sys_sendmsg+0x52d/0x830
[  123.499798][ T8936]  ? __pfx_____sys_sendmsg+0x10/0x10
[  123.499821][ T8936]  ? import_iovec+0x74/0xa0
[  123.499869][ T8936]  ___sys_sendmsg+0x21f/0x2a0
[  123.499891][ T8936]  ? __pfx____sys_sendmsg+0x10/0x10
[  123.499919][ T8936]  ? __fget_files+0x2a/0x420
[  123.499933][ T8936]  ? __fget_files+0x3a0/0x420
[  123.499948][ T8936]  __sys_sendmmsg+0x227/0x430
[  123.499970][ T8936]  ? __pfx___sys_sendmmsg+0x10/0x10
[  123.499990][ T8936]  ? do_futex+0x333/0x420
[  123.500017][ T8936]  ? rcu_is_watching+0x15/0xb0
[  123.500032][ T8936]  __x64_sys_sendmmsg+0xa0/0xc0
[  123.500048][ T8936]  do_syscall_64+0xfa/0x3b0
[  123.500064][ T8936]  ? lockdep_hardirqs_on+0x9c/0x150
[  123.500077][ T8936]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  123.500093][ T8936]  ? exc_page_fault+0x9f/0xf0
[  123.500107][ T8936]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  123.500121][ T8936] RIP: 0033:0x7fda0518ec29
[  123.500135][ T8936] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  123.500148][ T8936] RSP: 002b:00007fda06046038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  123.500165][ T8936] RAX: ffffffffffffffda RBX: 00007fda053d6180 RCX: 00007fda0518ec29
[  123.500177][ T8936] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000004
[  123.500188][ T8936] RBP: 00007fda05211e41 R08: 0000000000000000 R09: 0000000000000000
[  123.500198][ T8936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  123.500207][ T8936] R13: 00007fda053d6218 R14: 00007fda053d6180 R15: 00007ffeaf95b758
[  123.500223][ T8936]  </TASK>
[  123.500230][ T8936] 
[  123.637768][ T8936] Allocated by task 7082:
[  123.639175][ T8936]  kasan_save_track+0x3e/0x80
[  123.641042][ T8936]  __kasan_slab_alloc+0x6c/0x80
[  123.643013][ T8936]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  123.644699][ T8936]  xfrm_state_alloc+0x24/0x2f0
[  123.646193][ T8936]  __find_acq_core+0x8a7/0x1c00
[  123.647716][ T8936]  xfrm_find_acq+0x78/0xa0
[  123.649097][ T8936]  xfrm_alloc_userspi+0x6b3/0xc90
[  123.650711][ T8936]  xfrm_user_rcv_msg+0x7a3/0xab0
[  123.652644][ T8936]  netlink_rcv_skb+0x208/0x470
[  123.654519][ T8936]  xfrm_netlink_rcv+0x79/0x90
[  123.656337][ T8936]  netlink_unicast+0x82f/0x9e0
[  123.658143][ T8936]  netlink_sendmsg+0x805/0xb30
[  123.659883][ T8936]  __sock_sendmsg+0x21c/0x270
[  123.661471][ T8936]  ____sys_sendmsg+0x505/0x830
[  123.663091][ T8936]  ___sys_sendmsg+0x21f/0x2a0
[  123.664661][ T8936]  __x64_sys_sendmsg+0x19b/0x260
[  123.666602][ T8936]  do_syscall_64+0xfa/0x3b0
[  123.668241][ T8936]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  123.670384][ T8936] 
[  123.671259][ T8936] Freed by task 51:
[  123.672503][ T8936]  kasan_save_track+0x3e/0x80
[  123.674333][ T8936]  kasan_save_free_info+0x46/0x50
[  123.676135][ T8936]  __kasan_slab_free+0x5b/0x80
[  123.677724][ T8936]  kmem_cache_free+0x18f/0x400
[  123.679679][ T8936]  xfrm_state_gc_task+0x52d/0x6b0
[  123.681756][ T8936]  process_scheduled_works+0xae1/0x17b0
[  123.684111][ T8936]  worker_thread+0x8a0/0xda0
[  123.686022][ T8936]  kthread+0x711/0x8a0
[  123.687757][ T8936]  ret_from_fork+0x439/0x7d0
[  123.689710][ T8936]  ret_from_fork_asm+0x1a/0x30
[  123.691732][ T8936] 
[  123.692740][ T8936] The buggy address belongs to the object at ffff888110a14900
[  123.692740][ T8936]  which belongs to the cache xfrm_state of size 928
[  123.698435][ T8936] The buggy address is located 816 bytes inside of
[  123.698435][ T8936]  freed 928-byte region [ffff888110a14900, ffff888110a14ca0)
[  123.703856][ T8936] 
[  123.704866][ T8936] The buggy address belongs to the physical page:
[  123.707433][ T8936] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888110a14480 pfn:0x110a14
[  123.711036][ T8936] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  123.714322][ T8936] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  123.717506][ T8936] page_type: f5(slab)
[  123.719245][ T8936] raw: 057ff00000000040 ffff88801bf0ab40 dead000000000122 0000000000000000
[  123.722815][ T8936] raw: ffff888110a14480 00000000800e000d 00000000f5000000 0000000000000000
[  123.726369][ T8936] head: 057ff00000000040 ffff88801bf0ab40 dead000000000122 0000000000000000
[  123.729894][ T8936] head: ffff888110a14480 00000000800e000d 00000000f5000000 0000000000000000
[  123.733475][ T8936] head: 057ff00000000002 ffffea0004428501 00000000ffffffff 00000000ffffffff
[  123.737066][ T8936] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  123.740709][ T8936] page dumped because: kasan: bad access detected
[  123.743430][ T8936] page_owner tracks the page as allocated
[  123.745771][ T8936] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5961, tgid 5955 (syz.0.17), ts 69048647269, free_ts 69023419170
[  123.752969][ T8936]  post_alloc_hook+0x240/0x2a0
[  123.754577][ T8936]  get_page_from_freelist+0x21e4/0x22c0
[  123.756885][ T8936]  __alloc_frozen_pages_noprof+0x181/0x370
[  123.758975][ T8936]  alloc_pages_mpol+0x232/0x4a0
[  123.760591][ T8936]  allocate_slab+0x8a/0x370
[  123.762124][ T8936]  ___slab_alloc+0xbeb/0x1420
[  123.763685][ T8936]  kmem_cache_alloc_noprof+0x283/0x3c0
[  123.765415][ T8936]  xfrm_state_alloc+0x24/0x2f0
[  123.766965][ T8936]  xfrm_state_find+0x37d4/0x5400
[  123.768611][ T8936]  xfrm_resolve_and_create_bundle+0x768/0x2f80
[  123.771093][ T8936]  xfrm_lookup_with_ifid+0x2a7/0x1a70
[  123.773318][ T8936]  xfrm_lookup_route+0x3c/0x1c0
[  123.775328][ T8936]  __ip4_datagram_connect+0x9a5/0x1270
[  123.777605][ T8936]  __ip6_datagram_connect+0x9f0/0x1150
[  123.779768][ T8936]  ip6_datagram_connect_v6_only+0x63/0xa0
[  123.781916][ T8936]  __sys_connect+0x316/0x440
[  123.783451][ T8936] page last free pid 5958 tgid 5958 stack trace:
[  123.785634][ T8936]  __free_frozen_pages+0xbc4/0xd30
[  123.787597][ T8936]  __slab_free+0x303/0x3c0
[  123.789323][ T8936]  qlist_free_all+0x97/0x140
[  123.791035][ T8936]  kasan_quarantine_reduce+0x148/0x160
[  123.792850][ T8936]  __kasan_slab_alloc+0x22/0x80
[  123.794480][ T8936]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  123.796351][ T8936]  getname_flags+0xb8/0x540
[  123.797997][ T8936]  do_sys_openat2+0xbc/0x1c0
[  123.799541][ T8936]  __x64_sys_openat+0x138/0x170
[  123.801231][ T8936]  do_syscall_64+0xfa/0x3b0
[  123.802748][ T8936]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  123.804718][ T8936] 
[  123.805537][ T8936] Memory state around the buggy address:
[  123.807669][ T8936]  ffff888110a14b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  123.810575][ T8936]  ffff888110a14b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  123.813340][ T8936] >ffff888110a14c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  123.816075][ T8936]                                      ^
[  123.818125][ T8936]  ffff888110a14c80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[  123.820868][ T8936]  ffff888110a14d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  123.823683][ T8936] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  123.853260][ T8936] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  123.855771][ T8936] CPU: 1 UID: 0 PID: 8936 Comm: syz.1.1234 Not tainted syzkaller #0 PREEMPT(full) 
[  123.858943][ T8936] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  123.862686][ T8936] Call Trace:
[  123.864042][ T8936]  <TASK>
[  123.865116][ T8936]  dump_stack_lvl+0x99/0x250
[  123.866706][ T8936]  ? __asan_memcpy+0x40/0x70
[  123.868682][ T8936]  ? __pfx_dump_stack_lvl+0x10/0x10
[  123.870600][ T8936]  ? __pfx__printk+0x10/0x10
[  123.872109][ T8936]  vpanic+0x281/0x750
[  123.873426][ T8936]  ? preempt_schedule+0xae/0xc0
[  123.875089][ T8936]  ? __pfx_vpanic+0x10/0x10
[  123.876968][ T8936]  ? preempt_schedule_common+0x83/0xd0
[  123.878904][ T8936]  ? preempt_schedule+0xae/0xc0
[  123.880712][ T8936]  ? __pfx_preempt_schedule+0x10/0x10
[  123.882702][ T8936]  panic+0xb9/0xc0
[  123.884065][ T8936]  ? __pfx_panic+0x10/0x10
[  123.885632][ T8936]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[  123.887532][ T8936]  ? xfrm_state_find+0x2cf2/0x5400
[  123.889183][ T8936]  check_panic_on_warn+0x89/0xb0
[  123.890919][ T8936]  ? xfrm_state_find+0x2cf2/0x5400
[  123.893155][ T8936]  end_report+0x78/0x160
[  123.895017][ T8936]  kasan_report+0x129/0x150
[  123.896656][ T8936]  ? xfrm_state_find+0x2cf2/0x5400
[  123.898787][ T8936]  xfrm_state_find+0x2cf2/0x5400
[  123.900860][ T8936]  ? __lock_acquire+0xab9/0xd20
[  123.902937][ T8936]  ? xfrm_state_find+0x1da/0x5400
[  123.905061][ T8936]  ? __pfx_xfrm_state_find+0x10/0x10
[  123.907278][ T8936]  ? __lock_acquire+0xab9/0xd20
[  123.909336][ T8936]  xfrm_resolve_and_create_bundle+0x768/0x2f80
[  123.911679][ T8936]  ? stack_depot_save_flags+0x40/0x860
[  123.913748][ T8936]  ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10
[  123.916129][ T8936]  ? __lock_acquire+0xab9/0xd20
[  123.917769][ T8936]  ? xfrm_sk_policy_lookup+0x9d/0x750
[  123.919872][ T8936]  ? rt_set_nexthop+0x693/0xa80
[  123.921894][ T8936]  ? xfrm_sk_policy_lookup+0x9d/0x750
[  123.924208][ T8936]  ? xfrm_expand_policies+0x41f/0x6a0
[  123.926490][ T8936]  xfrm_lookup_with_ifid+0x2a7/0x1a70
[  123.928741][ T8936]  ? __pfx_xfrm_lookup_with_ifid+0x10/0x10
[  123.931196][ T8936]  xfrm_lookup_route+0x3c/0x1c0
[  123.933217][ T8936]  udp_sendmsg+0x142e/0x2170
[  123.935159][ T8936]  ? __pfx_ip_generic_getfrag+0x10/0x10
[  123.937460][ T8936]  ? __pfx_udp_sendmsg+0x10/0x10
[  123.939535][ T8936]  ? count_memcg_event_mm+0x21/0x260
[  123.941844][ T8936]  ? count_memcg_event_mm+0x21/0x260
[  123.944113][ T8936]  ? __pfx_aa_sk_perm+0x10/0x10
[  123.946205][ T8936]  ? tomoyo_socket_sendmsg_permission+0x1e1/0x300
[  123.948889][ T8936]  ? sock_rps_record_flow+0x19/0x410
[  123.951191][ T8936]  ? inet_sendmsg+0x29c/0x370
[  123.953295][ T8936]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  123.955599][ T8936]  __sock_sendmsg+0x19c/0x270
[  123.957595][ T8936]  ____sys_sendmsg+0x52d/0x830
[  123.959651][ T8936]  ? __pfx_____sys_sendmsg+0x10/0x10
[  123.961850][ T8936]  ? import_iovec+0x74/0xa0
[  123.963844][ T8936]  ___sys_sendmsg+0x21f/0x2a0
[  123.965871][ T8936]  ? __pfx____sys_sendmsg+0x10/0x10
[  123.968072][ T8936]  ? __fget_files+0x2a/0x420
[  123.970070][ T8936]  ? __fget_files+0x3a0/0x420
[  123.972076][ T8936]  __sys_sendmmsg+0x227/0x430
[  123.974164][ T8936]  ? __pfx___sys_sendmmsg+0x10/0x10
[  123.976416][ T8936]  ? do_futex+0x333/0x420
[  123.978294][ T8936]  ? rcu_is_watching+0x15/0xb0
[  123.980340][ T8936]  __x64_sys_sendmmsg+0xa0/0xc0
[  123.982476][ T8936]  do_syscall_64+0xfa/0x3b0
[  123.984484][ T8936]  ? lockdep_hardirqs_on+0x9c/0x150
[  123.986662][ T8936]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  123.989196][ T8936]  ? exc_page_fault+0x9f/0xf0
[  123.991188][ T8936]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  123.993734][ T8936] RIP: 0033:0x7fda0518ec29
[  123.995683][ T8936] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  124.003992][ T8936] RSP: 002b:00007fda06046038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  124.007582][ T8936] RAX: ffffffffffffffda RBX: 00007fda053d6180 RCX: 00007fda0518ec29
[  124.010903][ T8936] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000004
[  124.014161][ T8936] RBP: 00007fda05211e41 R08: 0000000000000000 R09: 0000000000000000
[  124.017511][ T8936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  124.020986][ T8936] R13: 00007fda053d6218 R14: 00007fda053d6180 R15: 00007ffeaf95b758
[  124.024336][ T8936]  </TASK>
[  124.026369][ T8936] Kernel Offset: disabled
[  124.028295][ T8936] Rebooting in 86400 seconds..

VM DIAGNOSIS:
12:42:21  Registers:
info registers vcpu 0

CPU#0
RAX=a668b25b3e2d9000 RBX=0000000000000202 RCX=a668b25b3e2d9000 RDX=0000000000000001
RSI=ffffffff8dba9ba6 RDI=ffffffff8be33f00 RBP=ffff888020246158 RSP=ffffc900036df450
R8 =ffffc900036df5d8 R9 =0000000000000000 R10=ffffc900036df638 R11=fffff520006dbec9
R12=0000000000000001 R13=0000000000000001 R14=ffffffff8e13a0e0 R15=ffff888020245640
RIP=ffffffff819d7115 RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8612000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00005614c2dcaa48 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f XMM01=0000000000000000 0000000000000000
XMM02=ffffffffffffffff ffffffffffffff00 XMM03=00000000000000ff 000000000000ff00
XMM04=0000000000ff0000 0000ff0000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000038 RBX=0000000000000038 RCX=0000000000000000 RDX=00000000000003f8
RSI=00000000000012cb RDI=00000000000012cc RBP=00000000000003f8 RSP=ffffc90003b4e7b0
R8 =ffff888021360237 R9 =1ffff1100426c046 R10=dffffc0000000000 R11=ffffffff854fac30
R12=dffffc0000000000 R13=ffffffff99b03913 R14=ffffffff99df8480 R15=0000000000000000
RIP=ffffffff854facac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fda060466c0 ffffffff 00c00000
GS =0000 ffff8881a3c12000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000007fc0 CR3=00000001241f0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=ffffffffffffffff ff00000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=ffffffffffffffff ffffffffffffffff XMM03=ffffffffffffffff ffffffffffffffff
XMM04=00007fda05f0d100 00007fda053a7460 XMM05=00007fda053a7478 00007fda053a74c0
XMM06=00007fda053a74b8 00007fda053a74b0 XMM07=00007fda053a74a8 00007fda053a74a0
XMM08=000c070000000000 0000010002000000 XMM09=0000000000000000 00007fda05212fed
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
