last executing test programs:

2.393244825s ago: executing program 0 (id=33):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r1, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="1200000004000000040000001200000000000000c6fefc3543a396382dfc4a13b096d3a07f0016272461f2ec4f7debe594084d6236a515aef6b58aaaaa3837f7c6cfa0b1b2fe9fd391e35b63a70ff0c32c1fe74aa1b17397cf8cfa4b4fb7d7c9cdc7e13457581c9ed59d3225e0a7e4b2c90475c4db26b829ea8bf36513361701ba24afff6e26", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r2, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r1}, 0x20)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=@bloom_filter={0x1e, 0x5, 0x8, 0x4, 0x20808, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x3, 0xf}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xf, 0x19, &(0x7f0000000780)=@raw=[@ringbuf_query, @exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}}, @tail_call, @cb_func={0x18, 0x2, 0x4, 0x0, 0x8}], &(0x7f00000012c0)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @cgroup_device, 0xffffffffffffffff, 0x8, &(0x7f0000001300)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000001340)={0x5, 0xd, 0x3, 0xff}, 0x10, 0x0, r0, 0x1, &(0x7f00000014c0)=[0x1, 0xffffffffffffffff, r3, r2, r2, 0xffffffffffffffff, r3], &(0x7f0000001500)=[{0x4, 0x2, 0x10, 0x8}], 0x10, 0x5}, 0x94)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)={0x14, 0x3, 0x1, 0x301, 0x0, 0x0, {0xa}}, 0x14}, 0x1, 0x0, 0x0, 0xc014}, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000200)=@newtaction={0x5c, 0x32, 0x12f, 0x0, 0x25dfdbff, {}, [{0x48, 0x1, [@m_police={0x44, 0x1d, 0x0, 0x0, {{0xb}, {0x4}, {0x15, 0x6, "a9972b1cad205dfdcf3b732a9359d8df71"}, {0xc, 0xb}, {0xc, 0xa, {0x3}}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x2000000}, 0x10040000)
sendmsg$NFT_MSG_GETRULE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)={0x28, 0x7, 0xa, 0x600, 0x0, 0x0, {0x1, 0x0, 0x8009}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0xe2}, 0x4804)
bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x12, 0xc, 0x0, 0x0, 0xfffffffb, 0x0, 0x0, 0x40e00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x34}, 0x94)
r7 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r7, &(0x7f0000000140)={0x28, 0x0, 0x0, @my=0x1}, 0x10)
r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r8}, 0x18)
setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r7, 0x28, 0x1, &(0x7f0000000100)=0xfffffffffffffffe, 0x112)
sendmsg$NFNL_MSG_COMPAT_GET(r4, &(0x7f0000001100)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000010c0)={&(0x7f0000001040)={0x48, 0x0, 0xb, 0x401, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_COMPAT_TYPE={0x8}, @NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_NAME={0x12, 0x1, './cgroup/syz1\x00'}, @NFTA_COMPAT_TYPE={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x20040040}, 0xc0)
write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600)
bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYRES16=r6], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, r6, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0)={0x1}, 0x10}, 0x94)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r6, 0xffffd000)
getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x31, 0x0, &(0x7f0000001840))
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, 0x0, &(0x7f0000000100))

2.254009781s ago: executing program 0 (id=34):
r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x38, 0x3, 0x8, 0x101, 0x0, 0x0, {0x1}, [@CTA_TIMEOUT_DATA={0x1c, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_LAST_ACK={0x8}, @CTA_TIMEOUT_TCP_CLOSE={0x8}, @CTA_TIMEOUT_TCP_TIME_WAIT={0x8}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x38}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="01006cbd70100400000005000000"], 0x14}}, 0x20) (async)
sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="01006cbd70100400000005000000"], 0x14}}, 0x20)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe2, 0x1}, 0x48)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3, <r4=>0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)}, 0x20)
r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r2)
sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000880)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000a40)=ANY=[@ANYBLOB="d4020000", @ANYRES16=r5, @ANYBLOB="000127bd7000fbdbdf25160000004c0002802400038008000100800000000800010008000000080001000100000008000100b6000000140003800800020005000000080001009f000000080002000400000008000200000000005c000180110001006574683a70696d36726567310000000044000400200001000a004e240000000400000000000000000000ffff0000000000000080200002000a004e2000000009fc0000000000000000000000000000000c060000140001800d0001007564703a73797a310000000074000180080003008100000008000300020000002c000280080004009807000008000400fe00000008000400dfef000008000300ffff0000080003000001000008000300070000002c0004001400010002004e20e000000100000000000000001400020002004e23ac1414bb0000000000000000100004800900010073797a31000000001400098008000100850200000800020000000000f4000480540007800800030000800000080004000800000008000200010000000800020000020000080002008b0000000800020000000000080002000503000008000200e50500000800030007000000080004000000000044000780080004000000000008000400080000000800020003000000080002000400000008000100140000000800030006000000080003000300000008000100060000003c00078008000300040000000800030002000000080001001b00000008000200ffffffff0800030001000000080003000200000008000200f7ffffff1c0007800800010008000000080003000400000008000200ff030000340007800c0004000300000000000000080002000400000008000100040000000c0004000400000000000000080002000000000044000980080001006e070000080001003bb800000800020003000000080002000002000008000100100000000800010007000000080002000500000008000100f1050000ea8de92c6d7508d6b2f63ae4f2d42a0f7a2161497fce068ee35669"], 0x2d4}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async)
sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000880)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000a40)=ANY=[@ANYBLOB="d4020000", @ANYRES16=r5, @ANYBLOB="000127bd7000fbdbdf25160000004c0002802400038008000100800000000800010008000000080001000100000008000100b6000000140003800800020005000000080001009f000000080002000400000008000200000000005c000180110001006574683a70696d36726567310000000044000400200001000a004e240000000400000000000000000000ffff0000000000000080200002000a004e2000000009fc0000000000000000000000000000000c060000140001800d0001007564703a73797a310000000074000180080003008100000008000300020000002c000280080004009807000008000400fe00000008000400dfef000008000300ffff0000080003000001000008000300070000002c0004001400010002004e20e000000100000000000000001400020002004e23ac1414bb0000000000000000100004800900010073797a31000000001400098008000100850200000800020000000000f4000480540007800800030000800000080004000800000008000200010000000800020000020000080002008b0000000800020000000000080002000503000008000200e50500000800030007000000080004000000000044000780080004000000000008000400080000000800020003000000080002000400000008000100140000000800030006000000080003000300000008000100060000003c00078008000300040000000800030002000000080001001b00000008000200ffffffff0800030001000000080003000200000008000200f7ffffff1c0007800800010008000000080003000400000008000200ff030000340007800c0004000300000000000000080002000400000008000100040000000c0004000400000000000000080002000000000044000980080001006e070000080001003bb800000800020003000000080002000002000008000100100000000800010007000000080002000500000008000100f1050000ea8de92c6d7508d6b2f63ae4f2d42a0f7a2161497fce068ee35669"], 0x2d4}, 0x1, 0x0, 0x0, 0x800}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f00000004c0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r6}, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x2, 0x2, 0x4}, 0x50)
connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000140)={0x1f, 0x8, @any, 0x4}, 0xe) (async)
connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000140)={0x1f, 0x8, @any, 0x4}, 0xe)
ioctl$sock_ifreq(r1, 0x8915, &(0x7f0000000300)={'veth1_to_bond\x00', @ifru_data=&(0x7f00000002c0)="0e46c62b369f51cf713c0362c4461dd74608088f049c6d4b7ba8abec54d4ef0b"})
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, 0x0, 0x0)
socket(0x28, 0x5, 0x0) (async)
r7 = socket(0x28, 0x5, 0x0)
bind$vsock_stream(r7, &(0x7f0000000040), 0x10) (async)
bind$vsock_stream(r7, &(0x7f0000000040), 0x10)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00', <r9=>0x0})
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)={0x48, r8, 0x1, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_TX_RATES={0x2c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x28, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x60, 0x60, 0x24, 0x30, 0x9, 0x1b, 0x5, 0x2, 0x6, 0x36, 0x9, 0x36, 0x9, 0x60, 0x973ea4cc4cb6d4ec, 0x2, 0x12, 0x9, 0xc, 0x17, 0x48, 0x12]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}]}]}, 0x48}}, 0x4000) (async)
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)={0x48, r8, 0x1, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_TX_RATES={0x2c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x28, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x60, 0x60, 0x24, 0x30, 0x9, 0x1b, 0x5, 0x2, 0x6, 0x36, 0x9, 0x36, 0x9, 0x60, 0x973ea4cc4cb6d4ec, 0x2, 0x12, 0x9, 0xc, 0x17, 0x48, 0x12]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}]}]}, 0x48}}, 0x4000)
sendmsg$NL80211_CMD_START_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x14, r8, 0x2, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x0)
listen(r7, 0x0)
r10 = socket(0x28, 0x5, 0x0)
connect$vsock_stream(r10, &(0x7f0000000080), 0x10)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000009c0))
accept4$unix(r7, 0x0, 0x0, 0x0) (async)
r11 = accept4$unix(r7, 0x0, 0x0, 0x0)
recvfrom$unix(r11, &(0x7f0000000140)=""/263, 0x107, 0x0, 0x0, 0x0)
close(0x4)
sendmsg$NL80211_CMD_DEL_PMKSA(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x60, 0x0, 0x2, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x6, 0x5a}}}}, [@NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x13}, @NL80211_ATTR_PMK={0x14, 0xfe, "9eb9928080f68b7c02574ca91ac2d4b6"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x2}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x2}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x1f}]}, 0xfffffffffffffe6c}, 0x1, 0x0, 0x0, 0x8000}, 0x4891)

1.321537608s ago: executing program 0 (id=36):
r0 = socket(0x10, 0x3, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={0x0, 0x0, 0x52}, 0x28)
socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockopt$sock_buf(r1, 0x1, 0x30, 0x0, &(0x7f0000000000))
r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
sendmmsg(r2, &(0x7f0000008540), 0x0, 0x40)
socket$key(0xf, 0x3, 0x2)
r3 = socket$inet(0x2, 0x2, 0x0)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200), 0x4)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b04, &(0x7f0000000000)={'wlan1\x00'})
r4 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a09040000000000000000020000070900010073797a30000000000900020073797a320000000048000480440001800c0001007061796c6f61640034000280080004400000000008000740000000020800024000000002080005400000000008000340000000000800064000000001140000001100010000da04000000000020"], 0x9c}}, 0x0)
setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000300), 0x4)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000002d00010026bd7000fcdbdf2504"], 0x2c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20008010)
r7 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e1406ca000000000e000a000f000000028000001294", 0x2e}, {&(0x7f00000000c0)}], 0x2}, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000001c0)={0x5813}, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x2, 0xfffffffe, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x3, 0xffe0}, {0x8, 0x7}, {0x14, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x44}, 0x40004)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}}, 0x4000000)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001e008d2a0000170000000000890020"], 0x30}, 0x1, 0x0, 0x0, 0x10008000}, 0x14048010)

984.368318ms ago: executing program 0 (id=39):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50)
r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000100)=ANY=[@ANYRES32=r0, @ANYRESHEX=r0, @ANYRESOCT, @ANYRES8=r0, @ANYRES16=r0], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000300000000000000c29c18120000", @ANYRES32=r1], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async)
bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0}, 0x94) (async)
socket$packet(0x11, 0x3, 0x300)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r4=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r4, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async)
r5 = socket$tipc(0x1e, 0x5, 0x0) (async)
socket$alg(0x26, 0x5, 0x0)
r6 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@ipv4={'\x00', '\xff\xff', @local}, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {}, {0x7}, 0x0, 0x0, 0x0, 0x0, 0x1}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x2b}, 0x0, @in=@multicast2, 0x0, 0x3}}, 0xe8)
r7 = socket$key(0xf, 0x3, 0x2)
setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f00000001c0), 0x4) (async)
sendmsg$key(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0)
sendmsg$key(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x4040)
r8 = socket$inet6(0xa, 0x3, 0x5)
setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000280)={{{@in=@private=0xa010101, @in=@multicast2, 0x0, 0x966, 0x0, 0xfffc, 0xa}, {0x1, 0x4, 0x0, 0x80000000, 0x6, 0x9, 0x0, 0x40000000000000}, {0x0, 0x9, 0x53e5, 0x23}, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1}, {{@in6=@mcast1, 0x0, 0x32}, 0x2, @in=@multicast1, 0x1502, 0x4, 0x0, 0x0, 0x4, 0xfffffffd, 0x1}}, 0xe8)
r9 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000000000000000000a30a000000000000f8ffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000eaf753d6636731c682b0acf9ac4799163f7505a1a2ad530e2a39ad7c11fe82e80c2a7fd82580eb6df61aaabaed4484bf9a5db34fbf02d74847dba88577077a8d399e59cb2af3f53a2d3c33a2"], 0xb8}}, 0x0) (async)
bind$tipc(r5, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x2, {0x1, 0x1001, 0x1}}, 0x10) (async)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) (async)
r10 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r10, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r11=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'sit0\x00', <r12=>0x0}) (async)
setsockopt$XDP_UMEM_FILL_RING(r10, 0x11b, 0x5, &(0x7f0000000240)=0x4000, 0x4)
bind$xdp(r10, &(0x7f0000000140)={0x2c, 0x2, r12, 0x16}, 0x10)

964.863967ms ago: executing program 2 (id=40):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000200)=@raw=[@call={0x85, 0x0, 0x0, 0xbf}, @exit], &(0x7f00000000c0)='GPL\x00', 0xb, 0x0, 0x0, 0x41000, 0x13}, 0x94)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'gretap0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000001c0)={'\x00', 0x2000})
syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) (async)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0)
close(r4) (async)
close(r4)
r5 = socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x5, 0x0) (async)
r6 = socket$unix(0x1, 0x5, 0x0)
r7 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000280)={0x29e9c934, 0x3, 0x0, 0x4}, 0x10) (async)
setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000280)={0x29e9c934, 0x3, 0x0, 0x4}, 0x10)
sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001600010a00000000000000000a0000000c00008008"], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0)
r8 = socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0) (async)
r9 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x18, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x25dfdbff, {0xa, 0x0, 0x3}}, 0x18}}, 0x0) (async)
sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x18, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x25dfdbff, {0xa, 0x0, 0x3}}, 0x18}}, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r10=>0x0})
sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) (async)
sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r11=>0x0})
socket$inet_sctp(0x2, 0x5, 0x84)
sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdc01, {0x0, 0x0, 0x0, r11, {0x0, 0xe}, {0x2, 0xb}, {0xd, 0xb}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000)
ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})

863.737079ms ago: executing program 1 (id=41):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0xfffffffffffffeba, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x4040000)
r1 = socket$packet(0x11, 0x2, 0x300)
getsockopt$sock_buf(r1, 0x1, 0x4c, 0x0, &(0x7f0000000380))
r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r3=>0xffffffffffffffff})
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14)
bind$bt_hci(r3, &(0x7f00000000c0)={0x27, 0x20, 0x2}, 0x67)
r4 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$sock_bt_bnep_BNEPCONNADD(r4, 0x400442c8, &(0x7f00000001c0)=ANY=[@ANYRES32=r5, @ANYBLOB="090000000800c955af478838b6ae929ea0c24b1f3594939f57110ded1a11a11bbe95f1641f821ea430a402bd21c3c457999333d883cd19dbdd93f20500000039a8b3ff2763b5bc61da9a3ec42bdd2eaf6b6e5f292cb9e083940bb23e0f556b473f691100877871ca77940de10e043581459506fe7fe3802fdeed9797667ebc66ac8ba2b07258d9f4139792b23c13b01dccf545300fca36610d39934b8ec67430888760604288a772d2339e1b9b6de688cc3d9aaf5fd8490c3143b69a01a13e586308465c694d670c0e620da580d57e6f3a3e43914eb21ffb7f97db8a56fccdb4eed9e499960c91c0d8146341649a32e6be2edaa4b6f1e914493f3dc4869b04b309c9b4565e125d66da9e2f5b37ba1c4d959acc8f227b9e4ec095f44345cf0b9d48cf9184859969f1159d441903313551d58ec9e92240ccd0d65dc44553b4ca89b236561ebf46eb188fa047b03f50c53b0dde9932018a8bd55ead01b7bea8a32b5f0fd928a3da1951a938bb6095325531e8f7665ddfd030ed241a2b8b9c4684d611697af20e732e9df8d3b27e5e3801bebe53e877f1a6922fa70757e4817b88a7c412bffe7febf86b6b307d512b4b43f58a835222f3871b423f959f28bd1a0c9c8bf5808b1908a2bf1d1875416d2a686f0df1"])
listen(r2, 0x3)
close(0x4)

862.457115ms ago: executing program 0 (id=42):
unshare(0x22020600)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000680), r0)
syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaabb81002100080045000018fffe0000a02f90787f000001e00000012001880b00029078fddc606e6597bced93fa56f4865efb45a2e3a231b7e0565cf59718074c479f86eb89c02913feb3360f30ab79286dbd80d65c736315f3154426ed17adc0f1754bebac9f4248a4df5ad7aee3c0368f8bcfdb7f824c4fec2454e7699dcf6ec0fe5ecbb2b25cf3746f5977f86d6e09768e64762226417b61c8679b6a02e027e66273b3ebb365849bcb1c0747218fac98bcf1579b0429e25a8245b75bc0beba526fbe5aedfacbc36ce805468635a6bf4150a6d8592e10c4f1ad55b01eff50dca7c900a4081384f916165b1fac4838ff2f8a04df2f4e26f34bb9ba39e944e31d63029828c0e4ee09b478b2af94b060edfad5c5c58cf1fc12e73623fc9736"], 0x0) (async)
sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000180)={0x3c, r1, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_ENABLED={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x9}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4c0d0) (async, rerun: 64)
r2 = socket(0x2, 0x2, 0x0) (rerun: 64)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84) (async)
r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r4, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) (async)
write(r4, &(0x7f0000000000)="2a000200010078", 0x7) (async)
shutdown(r3, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000700)=ANY=[@ANYBLOB="5c0000001800030727bd7000fddbdf2502142004fd02ff"], 0x5c}, 0x1, 0x0, 0x0, 0x4001}, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={<r6=>0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
socket$inet_udp(0x2, 0x2, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x6, 0x5, 0x2, 0x2, 0x5}, 0x50) (async, rerun: 64)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (rerun: 64)
socket$inet_sctp(0x2, 0x1, 0x84)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0)
write$tun(r7, &(0x7f0000000000)=ANY=[], 0x38) (async)
r8 = socket(0x40000000015, 0x805, 0x0)
getsockopt(r8, 0x114, 0x271b, 0x0, &(0x7f00000000c0)) (async)
r9 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$TIPC_CMD_RESET_LINK_STATS(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r10, 0x1, 0x0, 0x25dfdbfc, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}}, 0x30}}, 0x0) (async, rerun: 32)
r11 = socket$kcm(0x10, 0x2, 0x0) (rerun: 32)
sendmsg$inet(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b", 0x5b}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async, rerun: 64)
sendmsg$inet(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x24000000) (async, rerun: 64)
connect$pppoe(r8, &(0x7f00000003c0)={0x18, 0x0, {0x1, @broadcast, 'nicvf0\x00'}}, 0x1e)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000000)={r6, 0x101, 0x9}, &(0x7f00000000c0)=0x8)

754.195931ms ago: executing program 2 (id=43):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000003c0)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-512-generic\x00'}, 0x58)

753.614766ms ago: executing program 1 (id=44):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x2}, 0x50)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="84010000100013070000000000000000ffffffff000000000000000000000000fe8000000000000000000000000000bb00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000040000000000000000000bb0000000032000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000a00000000000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d61632861657329"], 0x184}}, 0x0)

674.011577ms ago: executing program 2 (id=45):
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="300000001d000100000000000000000007000000", @ANYRES32=r1, @ANYBLOB="000096000a000200aaaaaaaaaa0c00000600050001"], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1}, 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r3}, 0x38)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[], 0x10448)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000009, 0x12, r4, 0x0)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x23}, 0x38)
r5 = socket$rds(0x15, 0x5, 0x0)
ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r5, 0x8010661b, &(0x7f0000000280))
r6 = socket$l2tp(0x2, 0x2, 0x73)
sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r2, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x2}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x28}}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp=r6}]}, 0x50}}, 0x40c4000)

672.223003ms ago: executing program 0 (id=46):
r0 = socket$inet6(0xa, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x5, 0x8, 0x9}, 0x50)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000240), &(0x7f00000000c0)=@udp6=r0}, 0x20)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) (async)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c)
pselect6(0x40, &(0x7f0000000100), &(0x7f0000000000)={0x1f}, 0x0, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x8100, 0x0) (async)
openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x8100, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000840)={0x34, r3, 0x1, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x10)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async)
r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10)
pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x48)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r6) (async)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r6)
sendmsg$DEVLINK_CMD_RATE_NEW(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r7, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) (async)
sendmsg$DEVLINK_CMD_RATE_NEW(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r7, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0)

553.97017ms ago: executing program 2 (id=47):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(cast6)\x00'}, 0x7a)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18)
r2 = accept4(r1, 0x0, 0x0, 0x800)
sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000200)}, 0x0)
r3 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0)
r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
connect$802154_dgram(r4, &(0x7f0000000200)={0x2, @long}, 0x8)
r5 = accept4$x25(0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000001c0)=0x12, 0x800)
bind$x25(r5, &(0x7f0000000240)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x3}}, 0x12)
sendmmsg$inet6(r2, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x1, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000000580)=[{&(0x7f00000002c0)="0e2bb73a997cf0f617eb73f111ebb08731f5604340166b31fa15ed0ded427b223b4a7b82ee12fb9b3f", 0x1}], 0x10000069}}], 0x1, 0x0)
sendmmsg$inet6(r0, &(0x7f00000071c0)=[{{&(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c, &(0x7f0000000140)}}], 0x1, 0x0)

494.032895ms ago: executing program 1 (id=48):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r0, &(0x7f0000006880)=[{{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x103}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000007c0)=""/242, 0xf2}, {&(0x7f00000001c0)=""/47, 0x2f}, {&(0x7f00000029c0)=""/4118, 0x1016}, {&(0x7f0000000500)=""/185, 0xb9}, {&(0x7f00000000c0)=""/237, 0xed}], 0x5, 0x0, 0x0, 0x4100}, 0x80000000}], 0x4, 0x4022, 0x0)

443.389948ms ago: executing program 1 (id=49):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4, 0x80000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xffe0}, {0x0, 0x1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0x12000000}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x400}]}}]}, 0x44}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0)
r0 = socket$inet6(0x2d, 0x2, 0x0)
setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840)
r1 = socket$netlink(0x10, 0x3, 0x0)
getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f00000001c0)=""/98, &(0x7f0000000000)=0x62)
sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0)

314.114807ms ago: executing program 1 (id=50):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newae={0x70, 0x1e, 0x301, 0x70bd2a, 0x25dfdbfa, {{@in=@rand_addr=0x64010100, 0x4d6, 0x2, 0x2b}, @in=@private=0xa010101, 0x0, 0x3500}, [@mark={0xc, 0x15, {0x35075b, 0x6}}, @lifetime_val={0x24, 0x9, {0x1, 0xe9, 0x1, 0x4}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40004}, 0x0) (async)
sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newae={0x70, 0x1e, 0x301, 0x70bd2a, 0x25dfdbfa, {{@in=@rand_addr=0x64010100, 0x4d6, 0x2, 0x2b}, @in=@private=0xa010101, 0x0, 0x3500}, [@mark={0xc, 0x15, {0x35075b, 0x6}}, @lifetime_val={0x24, 0x9, {0x1, 0xe9, 0x1, 0x4}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40004}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x70, 0x30, 0xb, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x3}, @TCA_SKBEDIT_PTYPE={0x6, 0x4}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xfffffffe}}]}, {0x4}, {0xc, 0xa}, {0xc, 0x9, {0xf5}}}}]}]}, 0x70}}, 0x0)

220.77155ms ago: executing program 1 (id=51):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
bind$x25(r2, &(0x7f0000000040)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) (async)
bind$x25(r2, &(0x7f0000000040)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)
r3 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f00000001c0)=0x200000, 0x4)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x58, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}]}, 0x58}}, 0x0)
getsockopt$XDP_STATISTICS(r3, 0x11b, 0x7, &(0x7f00000002c0), &(0x7f0000000300)=0x30)
syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140), r1)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000240)=[@mss, @window={0x3, 0x0, 0x1}, @mss={0x2, 0x1}, @mss={0x2, 0x1}, @window, @timestamp, @window={0x3, 0xfff5, 0x8}, @timestamp], 0x8) (async)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000240)=[@mss, @window={0x3, 0x0, 0x1}, @mss={0x2, 0x1}, @mss={0x2, 0x1}, @window, @timestamp, @window={0x3, 0xfff5, 0x8}, @timestamp], 0x8)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='scalable\x00', 0x9)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0xc7) (async)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0xc7)
sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11)
recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25)
shutdown(r0, 0x1) (async)
shutdown(r0, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
unshare(0x62040200)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) (async)
sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getneightbl={0x14, 0x42, 0x4, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) (async)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={<r6=>0xffffffffffffffff})
r7 = getpid()
ioctl$sock_SIOCSPGRP(r6, 0x8902, &(0x7f0000000180)=r7)
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)

219.443251ms ago: executing program 2 (id=52):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', <r5=>0x0})
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000004a80)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010328bd7000fbdbdf251c0000002000018008000100", @ANYRES32=r5, @ANYBLOB="140002"], 0x34}}, 0x2404c816)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r7=>0x0})
r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x48)
r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r8}, &(0x7f0000000000), &(0x7f0000000040)=r9}, 0x20)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r9, r7}, 0x14)
r10 = socket$unix(0x1, 0x1, 0x0)
r11 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r12=>0x0})
sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r12, {0x0, 0x6}, {0x2, 0xb}, {0xffe0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0xf, 0x0, 0x4}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2404c0f1}, 0x4008000)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'team_slave_0\x00', <r13=>0x0})
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000100)={'syztnl0\x00', <r14=>0x0, 0x29, 0x8, 0x4, 0x401, 0x40, @private1, @mcast2, 0x700, 0x20, 0x0, 0x80000000}})
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', <r15=>0x0})
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'ip6gre0\x00', &(0x7f00000001c0)={'syztnl0\x00', <r16=>0x0, 0x29, 0x1, 0x7f, 0x8, 0x32, @loopback, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8, 0x7800, 0x4, 0x7fffffff}})
sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r1, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000380)={0x144, r3, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}]}, @HEADER={0x4}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x8000}, 0x1)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="50000000090601020000000000000000030000000900020073797a3100000000050001"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4)
socket$inet6_udplite(0xa, 0x2, 0x88)

0s ago: executing program 2 (id=53):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0xc101})
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940))
close(0x4)
unshare(0x24020400)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x3, 0x1, 0x1, 0x4, 0x9, 0xa4, 0x5, 0x7, 0xb69, 0xc1, 0x0, 0x1, 0x8, 0x1, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x401, 0x6, 0x9, 0x81, 0x7, 0x8, 0xfffffffb, 0x762, 0x3, 0x429f, 0xe, 0x2b12, 0x100, 0x6, 0x1c00, 0xb, 0x40, 0xbed4, 0x8, 0x8000100, 0x3, 0x8, 0x11000, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x102, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0xd6f, 0x4007, 0x8c, 0x5, 0x2af, 0xf7, 0x5, 0x1, 0x6, 0x6, 0x4, 0x7, 0x4009, 0x800000, 0x204, 0x1, 0x8, 0x8000, 0x400000, 0x20000003, 0x0, 0x10001, 0x4e7b3717, 0xffffffff, 0x6, 0x1, 0x9, 0x80000000, 0xfdffffff, 0x2, 0xfffffffe, 0xfffffff7, 0x100, 0x6, 0x5b, 0x81, 0x33b, 0x8, 0x7, 0x5, 0x2, 0x6, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x7, 0x2, 0x40, 0x8, 0x4, 0x3, 0x401, 0x66cd, 0x7, 0x8, 0x1, 0xfffffffe, 0xc5c, 0xffffffff]}})
poll(&(0x7f0000000000), 0x20000000000000b5, 0x9)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0)
r3 = socket$inet6(0xa, 0x3, 0x4)
setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x16f}, 0x8)
close(r3)
close(r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r4)
sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01400010000600000000067400062c00070073797352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000e6ff05000700263a3a0914000600626f6e64300000000000000001000000080003"], 0x78}, 0x1, 0xffffffff00000003}, 0x4)
sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r5, @ANYBLOB="10002bbd7000fbdbdf250600000008000400e00000020500010000000000050001000100000008000400e000000214000300fc00000000000000000000000000000114000200000000000000000000000000000000000800040000000000140006006261746164763000000000000000000014000200fc020000000000000000000000000000b31729a4edb4fe4196ab8d47646aeae510457401bc368c8412dd247d3715a27fa766d1ff74a2207b35054b9991e3d638143b49b99078f12fbe7e78d171d0d24ef6682238e91d61952a7dd4d244d2ada573062155ec7b7a9a87f9ddd9bbaec00ff31471f51e407018913647e7c1b9b94778b1b8bcd00c90883a8565f77a2d719f056c592ca028e0b6a5ec3d355b3da843"], 0x8c}, 0x1, 0x0, 0x0, 0x4000}, 0x40810)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"})
setsockopt$sock_linger(r6, 0x1, 0xd, &(0x7f0000000040)={0x0, 0x3}, 0x8)
r7 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r7)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
r9 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000007c0)=ANY=[@ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000fbfffffffffffffffdffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000100000000"], 0xb8}}, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
r10 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b8000000150001002dbd7000fc020000e0000002000000000000000000000000000000004e2000100a000080000000007d3aa1dda7841e825358e4d20c49b377942cb2b4e4ab5135dc8c5f69e37ac4f1363f385430ea864d9cccf426d87f07008dbeceaefed0d9000088b3f5de239e70274af53208eed3518dd967", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000200"/112], 0xb8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}})

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:27945' (ED25519) to the list of known hosts.
syzkaller login: [   56.240287][ T5834] cgroup: Unknown subsys name 'net'
[   56.340278][ T5834] cgroup: Unknown subsys name 'cpuset'
[   56.344528][ T5834] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.538555][ T5834] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   64.862573][ T5851] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   64.865209][ T5851] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   64.868717][ T5851] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   64.871194][ T5851] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   64.874319][ T5851] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   64.876947][ T5851] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   64.885527][ T5855] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   64.888077][ T5855] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   64.897500][ T5861] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   64.921894][ T5857] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   64.929198][ T5855] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   64.932388][   T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   64.936442][   T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   64.942325][ T5239] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   64.945970][ T5239] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   65.291134][ T5858] chnl_net:caif_netlink_parms(): no params data found
[   65.316120][ T5848] chnl_net:caif_netlink_parms(): no params data found
[   65.361625][ T5849] chnl_net:caif_netlink_parms(): no params data found
[   65.422409][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.425741][ T5858] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.428635][ T5858] bridge_slave_0: entered allmulticast mode
[   65.432125][ T5858] bridge_slave_0: entered promiscuous mode
[   65.454272][ T5858] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.457274][ T5858] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.460368][ T5858] bridge_slave_1: entered allmulticast mode
[   65.464343][ T5858] bridge_slave_1: entered promiscuous mode
[   65.548289][ T5858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.555689][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.558693][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.561048][ T5848] bridge_slave_0: entered allmulticast mode
[   65.563866][ T5848] bridge_slave_0: entered promiscuous mode
[   65.569922][ T5858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.582437][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.585297][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.588677][ T5848] bridge_slave_1: entered allmulticast mode
[   65.592087][ T5848] bridge_slave_1: entered promiscuous mode
[   65.645698][ T5858] team0: Port device team_slave_0 added
[   65.651334][ T5858] team0: Port device team_slave_1 added
[   65.653995][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.656314][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.659450][ T5849] bridge_slave_0: entered allmulticast mode
[   65.663202][ T5849] bridge_slave_0: entered promiscuous mode
[   65.668421][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.671061][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.673515][ T5849] bridge_slave_1: entered allmulticast mode
[   65.676461][ T5849] bridge_slave_1: entered promiscuous mode
[   65.735755][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.741531][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.743865][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.752416][ T5858] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.760617][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   65.765083][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.767513][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.775977][ T5858] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.782892][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.789559][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.847257][ T5848] team0: Port device team_slave_0 added
[   65.852404][ T5849] team0: Port device team_slave_0 added
[   65.857003][ T5848] team0: Port device team_slave_1 added
[   65.860333][ T5849] team0: Port device team_slave_1 added
[   65.926080][ T5858] hsr_slave_0: entered promiscuous mode
[   65.929053][ T5858] hsr_slave_1: entered promiscuous mode
[   65.948124][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.950850][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.961414][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.969395][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.972288][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   65.982892][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.989008][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.991750][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   66.001182][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   66.034097][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1
[   66.036899][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   66.045787][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   66.120967][ T5848] hsr_slave_0: entered promiscuous mode
[   66.123549][ T5848] hsr_slave_1: entered promiscuous mode
[   66.126053][ T5848] debugfs: 'hsr0' already exists in 'hsr'
[   66.128624][ T5848] Cannot create hsr debugfs directory
[   66.152230][ T5849] hsr_slave_0: entered promiscuous mode
[   66.154571][ T5849] hsr_slave_1: entered promiscuous mode
[   66.157762][ T5849] debugfs: 'hsr0' already exists in 'hsr'
[   66.159471][ T5849] Cannot create hsr debugfs directory
[   66.425982][ T5858] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   66.435771][ T5858] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   66.457527][ T5858] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   66.474692][ T5858] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   66.509672][ T5848] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   66.529471][ T5848] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   66.535240][ T5848] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   66.549905][ T5848] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   66.624836][ T5849] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   66.632982][ T5849] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   66.645867][ T5849] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   66.653775][ T5849] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   66.731207][ T5858] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.761400][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.772514][ T5858] 8021q: adding VLAN 0 to HW filter on device team0
[   66.784548][   T35] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.787111][   T35] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.802527][   T35] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.804940][   T35] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.828527][ T5848] 8021q: adding VLAN 0 to HW filter on device team0
[   66.852302][  T358] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.855196][  T358] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.873527][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.881467][  T358] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.883770][  T358] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.910570][ T5849] 8021q: adding VLAN 0 to HW filter on device team0
[   66.925931][ T5848] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   66.931602][ T5848] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   66.937496][ T5851] Bluetooth: hci1: command tx timeout
[   66.955742][ T3614] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.958303][ T3614] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.966100][ T3614] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.968460][ T3614] bridge0: port 2(bridge_slave_1) entered forwarding state
[   67.020085][ T5851] Bluetooth: hci2: command tx timeout
[   67.022771][ T5239] Bluetooth: hci0: command tx timeout
[   67.146314][ T5858] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.153666][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.211223][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0
[   67.239562][ T5858] veth0_vlan: entered promiscuous mode
[   67.255291][ T5858] veth1_vlan: entered promiscuous mode
[   67.261982][ T5848] veth0_vlan: entered promiscuous mode
[   67.285264][ T5848] veth1_vlan: entered promiscuous mode
[   67.298750][ T5849] veth0_vlan: entered promiscuous mode
[   67.320276][ T5858] veth0_macvtap: entered promiscuous mode
[   67.328515][ T5858] veth1_macvtap: entered promiscuous mode
[   67.333110][ T5849] veth1_vlan: entered promiscuous mode
[   67.371395][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.380579][ T5848] veth0_macvtap: entered promiscuous mode
[   67.387665][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.398721][ T5848] veth1_macvtap: entered promiscuous mode
[   67.431502][ T5881] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.438287][ T5849] veth0_macvtap: entered promiscuous mode
[   67.444210][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.448099][ T5881] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.460328][ T5881] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.463060][ T5881] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.475179][ T5849] veth1_macvtap: entered promiscuous mode
[   67.482992][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.503336][ T5881] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.509138][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.520291][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.551991][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.562796][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0
[   67.589025][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.609623][   T32] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.612913][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.620985][   T32] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.630889][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.645376][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.652920][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.677380][ T3552] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.680350][ T3552] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.721220][ T3614] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.724278][ T3614] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.791765][ T3614] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.794301][ T5858] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   67.794765][ T3614] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.858927][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.861926][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.941743][ T1090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.944945][ T1090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.953563][ T5918] bridge_slave_0: left allmulticast mode
[   67.955774][ T5918] bridge_slave_0: left promiscuous mode
[   67.959998][ T5918] bridge0: port 1(bridge_slave_0) entered disabled state
[   67.978704][ T5918] bridge_slave_1: left allmulticast mode
[   67.983250][ T5918] bridge_slave_1: left promiscuous mode
[   67.985564][ T5918] bridge0: port 2(bridge_slave_1) entered disabled state
[   67.998549][ T5918] bond0: (slave bond_slave_0): Releasing backup interface
[   68.010569][ T5918] bond0: (slave bond_slave_1): Releasing backup interface
[   68.022825][ T5918] team0: Port device team_slave_0 removed
[   68.031097][ T5918] team0: Port device team_slave_1 removed
[   68.034243][ T5918] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   68.037748][ T5918] batman_adv: batadv0: Removing interface: batadv_slave_0
[   68.042693][ T5918] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   68.045618][ T5918] batman_adv: batadv0: Removing interface: batadv_slave_1
[   68.066049][ T5918] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check.
[   68.135681][ T5918] ieee802154 phy0 wpan0: encryption failed: -22
[   68.137612][ T5917] syz.2.3 uses obsolete (PF_INET,SOCK_PACKET)
[   68.442429][ T5936] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6'.
[   68.641918][ T5938] netlink: 60 bytes leftover after parsing attributes in process `syz.1.7'.
[   68.673771][ T5948] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8'.
[   68.758518][ T5959] netlink: 36 bytes leftover after parsing attributes in process `syz.0.10'.
[   68.762399][ T5959] 8021q: VLANs not supported on ipvlan1
[   68.772984][ T5959] macsec1: entered promiscuous mode
[   68.774919][ T5959] macsec1: entered allmulticast mode
[   68.794510][ T5959] Zero length message leads to an empty skb
[   68.798436][ T5959] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   69.017323][ T5851] Bluetooth: hci1: command tx timeout
[   69.038992][   T33] audit: type=1800 audit(1758319470.699:2): pid=5963 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.11" name="memory.events" dev="tmpfs" ino=33 res=0 errno=0
[   69.097631][ T5851] Bluetooth: hci2: command tx timeout
[   69.099862][ T5239] Bluetooth: hci0: command tx timeout
[   69.739402][ T5980] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16'.
[   69.762417][ T5981] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15'.
[   69.859081][ T5981] netlink: 76 bytes leftover after parsing attributes in process `syz.1.15'.
[   70.046505][ T5986] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18'.
[   70.052749][ T5986] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18'.
[   70.077929][ T5986] netlink: 4 bytes leftover after parsing attributes in process `syz.0.18'.
[   70.084024][ T5986] hsr_slave_0: left promiscuous mode
[   70.086347][ T5986] hsr_slave_1: left promiscuous mode
[   70.480920][ T6001] netlink: 'syz.1.22': attribute type 13 has an invalid length.
[   70.483751][ T6001] netlink: 'syz.1.22': attribute type 17 has an invalid length.
[   70.525744][ T6001] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   70.647069][ T6001] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   70.729281][    C1] vcan0: j1939_tp_rxtimer: 0xffff88810eb24400: rx timeout, send abort
[   70.733876][    C1] vcan0: j1939_tp_rxtimer: 0xffff888037960000: rx timeout, send abort
[   70.737429][    C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88810eb24400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
[   70.743932][    C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888037960000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
[   71.015710][ T6022] bridge_slave_1: left allmulticast mode
[   71.019189][ T6022] bridge_slave_1: left promiscuous mode
[   71.036991][ T6022] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.059306][ T6022] bridge_slave_0: left allmulticast mode
[   71.061358][ T6022] bridge_slave_0: left promiscuous mode
[   71.063378][ T6022] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.105433][ T5851] Bluetooth: hci1: command tx timeout
[   71.108781][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   71.111378][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   71.176908][ T5239] Bluetooth: hci0: command tx timeout
[   71.179319][ T5851] Bluetooth: hci2: command tx timeout
[   71.385051][ T6035] tipc: Started in network mode
[   71.391139][ T6035] tipc: Node identity 163cd6bb8c54, cluster identity 4711
[   71.394402][ T6035] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   71.399348][ T6035] syzkaller0: entered promiscuous mode
[   71.401679][ T6035] syzkaller0: entered allmulticast mode
[   71.427749][ T6035] tipc: Resetting bearer <eth:syzkaller0>
[   71.447540][ T6034] tipc: Resetting bearer <eth:syzkaller0>
[   71.494245][ T6034] tipc: Disabling bearer <eth:syzkaller0>
[   71.860369][ T6040] tipc: Started in network mode
[   71.862133][ T6040] tipc: Node identity d2399684f134, cluster identity 4711
[   71.864609][ T6040] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   71.917281][ T6040] syzkaller0: entered promiscuous mode
[   71.920700][ T6040] syzkaller0: entered allmulticast mode
[   71.926393][ T6040] tipc: Resetting bearer <eth:syzkaller0>
[   71.929894][ T6050] tc_dump_action: action bad kind
[   71.954602][ T6039] tipc: Resetting bearer <eth:syzkaller0>
[   72.947756][ T5913] tipc: Node number set to 588093060
[   73.048696][ T6064] netlink: 'syz.0.36': attribute type 10 has an invalid length.
[   73.095529][ T6039] tipc: Disabling bearer <eth:syzkaller0>
[   73.104117][ T6059] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   73.105667][ T6065] openvswitch: netlink: IPv6 tunnel dst address is zero
[   73.113319][ T6062] warning: `syz.0.36' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   73.151841][ T6064] bond0: (slave netdevsim0): Enslaving as an active interface with a down link
[   73.180078][ T5239] Bluetooth: hci1: command tx timeout
[   73.264677][ T5239] Bluetooth: hci0: command tx timeout
[   73.267484][ T5239] Bluetooth: hci2: command tx timeout
[   73.473397][ T6092] __nla_validate_parse: 6 callbacks suppressed
[   73.473440][ T6092] netlink: 64 bytes leftover after parsing attributes in process `syz.0.42'.
[   73.760466][ T6109] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   73.765082][ T6123] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.47'.
[   73.843097][ T6109] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   73.861730][ T6128] netlink: 4 bytes leftover after parsing attributes in process `syz.1.49'.
[   73.878364][   T12] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   73.878517][ T6128] netlink: 4 bytes leftover after parsing attributes in process `syz.1.49'.
[   73.881339][   T12] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   73.881377][   T12] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   73.881428][   T12] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   73.941424][ T6109] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   74.027539][ T6109] bond0: (slave netdevsim0): Releasing backup interface
[   74.045151][ T6109] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   74.148248][ T6144] netlink: 40 bytes leftover after parsing attributes in process `syz.2.52'.
[   74.156510][ T6144] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   74.181519][   T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   74.198953][   T12] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   74.213958][   T12] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   74.262092][   T12] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   74.276245][ T6119] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   74.295535][   T12] ==================================================================
[   74.298626][   T12] BUG: KASAN: slab-use-after-free in __mutex_lock+0x147/0x1350
[   74.301588][   T12] Read of size 8 at addr ffff8880271c94b0 by task kworker/u8:0/12
[   74.305744][   T12] 
[   74.306713][   T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) 
[   74.306731][   T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   74.306741][   T12] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work
[   74.306769][   T12] Call Trace:
[   74.306775][   T12]  <TASK>
[   74.306782][   T12]  dump_stack_lvl+0x189/0x250
[   74.306810][   T12]  ? __kasan_check_byte+0x12/0x40
[   74.306830][   T12]  ? __pfx_dump_stack_lvl+0x10/0x10
[   74.306844][   T12]  ? lock_release+0x4b/0x3e0
[   74.306864][   T12]  ? __virt_addr_valid+0x4a5/0x5c0
[   74.306883][   T12]  print_report+0xca/0x240
[   74.306896][   T12]  ? __mutex_lock+0x147/0x1350
[   74.306909][   T12]  kasan_report+0x118/0x150
[   74.306924][   T12]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   74.306936][   T12]  ? __mutex_lock+0x147/0x1350
[   74.306952][   T12]  __mutex_lock+0x147/0x1350
[   74.306968][   T12]  ? __mutex_lock+0x5bb/0x1350
[   74.306981][   T12]  ? udp_tunnel_nic_device_sync_work+0x39/0xa50
[   74.306997][   T12]  ? __pfx___mutex_lock+0x10/0x10
[   74.307011][   T12]  ? __lock_acquire+0xab9/0xd20
[   74.307032][   T12]  udp_tunnel_nic_device_sync_work+0x39/0xa50
[   74.307050][   T12]  ? process_scheduled_works+0x9ef/0x17b0
[   74.307063][   T12]  ? process_scheduled_works+0x9ef/0x17b0
[   74.307074][   T12]  process_scheduled_works+0xae1/0x17b0
[   74.307096][   T12]  ? __pfx_process_scheduled_works+0x10/0x10
[   74.307111][   T12]  worker_thread+0x8a0/0xda0
[   74.307133][   T12]  kthread+0x711/0x8a0
[   74.307150][   T12]  ? __pfx_worker_thread+0x10/0x10
[   74.307162][   T12]  ? __pfx_kthread+0x10/0x10
[   74.307177][   T12]  ? _raw_spin_unlock_irq+0x23/0x50
[   74.307188][   T12]  ? lockdep_hardirqs_on+0x9c/0x150
[   74.307202][   T12]  ? __pfx_kthread+0x10/0x10
[   74.307216][   T12]  ret_from_fork+0x439/0x7d0
[   74.307230][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[   74.307245][   T12]  ? __switch_to_asm+0x39/0x70
[   74.307261][   T12]  ? __switch_to_asm+0x33/0x70
[   74.307275][   T12]  ? __pfx_kthread+0x10/0x10
[   74.307290][   T12]  ret_from_fork_asm+0x1a/0x30
[   74.307310][   T12]  </TASK>
[   74.307315][   T12] 
[   74.391896][   T12] Allocated by task 6109:
[   74.393594][   T12]  kasan_save_track+0x3e/0x80
[   74.395422][   T12]  __kasan_kmalloc+0x93/0xb0
[   74.397195][   T12]  __kmalloc_noprof+0x27a/0x4f0
[   74.399071][   T12]  udp_tunnel_nic_netdevice_event+0x4c3/0x1810
[   74.401472][   T12]  notifier_call_chain+0x1b6/0x3e0
[   74.403420][   T12]  register_netdevice+0x1608/0x1ae0
[   74.405429][   T12]  nsim_create+0xae8/0xf10
[   74.407169][   T12]  __nsim_dev_port_add+0x6b6/0xb10
[   74.409119][   T12]  nsim_dev_port_add_all+0x37/0xf0
[   74.411097][   T12]  nsim_dev_reload_up+0x451/0x780
[   74.413033][   T12]  devlink_reload+0x4ec/0x8d0
[   74.414861][   T12]  devlink_nl_reload_doit+0xb35/0xd50
[   74.416946][   T12]  genl_family_rcv_msg_doit+0x215/0x300
[   74.419103][   T12]  genl_rcv_msg+0x60e/0x790
[   74.420946][   T12]  netlink_rcv_skb+0x208/0x470
[   74.422794][   T12]  genl_rcv+0x28/0x40
[   74.424317][   T12]  netlink_unicast+0x82f/0x9e0
[   74.426171][   T12]  netlink_sendmsg+0x805/0xb30
[   74.428008][   T12]  __sock_sendmsg+0x21c/0x270
[   74.429835][   T12]  ____sys_sendmsg+0x505/0x830
[   74.431688][   T12]  ___sys_sendmsg+0x21f/0x2a0
[   74.433475][   T12]  __x64_sys_sendmsg+0x19b/0x260
[   74.435324][   T12]  do_syscall_64+0xfa/0x3b0
[   74.437094][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.439380][   T12] 
[   74.440304][   T12] Freed by task 6119:
[   74.441854][   T12]  kasan_save_track+0x3e/0x80
[   74.443614][   T12]  kasan_save_free_info+0x46/0x50
[   74.445585][   T12]  __kasan_slab_free+0x5b/0x80
[   74.447434][   T12]  kfree+0x18e/0x440
[   74.448959][   T12]  udp_tunnel_nic_netdevice_event+0x11ab/0x1810
[   74.451379][   T12]  notifier_call_chain+0x1b6/0x3e0
[   74.453330][   T12]  unregister_netdevice_many_notify+0x14d7/0x1ff0
[   74.455800][   T12]  unregister_netdevice_queue+0x33c/0x380
[   74.457988][   T12]  nsim_destroy+0x1dd/0x670
[   74.459752][   T12]  __nsim_dev_port_del+0x14d/0x1b0
[   74.461780][   T12]  nsim_dev_reload_destroy+0x288/0x490
[   74.463917][   T12]  nsim_dev_reload_down+0x8a/0xc0
[   74.465288][ T6151] netlink: 12 bytes leftover after parsing attributes in process `syz.2.53'.
[   74.465891][   T12]  devlink_reload+0x1b6/0x8d0
[   74.471181][   T12]  devlink_nl_reload_doit+0xb35/0xd50
[   74.473278][   T12]  genl_family_rcv_msg_doit+0x215/0x300
[   74.475445][   T12]  genl_rcv_msg+0x60e/0x790
[   74.477179][   T12]  netlink_rcv_skb+0x208/0x470
[   74.479058][   T12]  genl_rcv+0x28/0x40
[   74.480638][   T12]  netlink_unicast+0x82f/0x9e0
[   74.482658][   T12]  netlink_sendmsg+0x805/0xb30
[   74.484545][   T12]  __sock_sendmsg+0x21c/0x270
[   74.486402][   T12]  ____sys_sendmsg+0x505/0x830
[   74.488282][   T12]  ___sys_sendmsg+0x21f/0x2a0
[   74.490164][   T12]  __x64_sys_sendmsg+0x19b/0x260
[   74.492086][   T12]  do_syscall_64+0xfa/0x3b0
[   74.493873][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.496184][   T12] 
[   74.497115][   T12] Last potentially related work creation:
[   74.499311][   T12]  kasan_save_stack+0x3e/0x60
[   74.501417][   T12]  kasan_record_aux_stack+0xbd/0xd0
[   74.503433][   T12]  insert_work+0x3d/0x330
[   74.505125][   T12]  __queue_work+0xbaf/0xfb0
[   74.506899][   T12]  queue_work_on+0x181/0x270
[   74.508694][   T12]  __udp_tunnel_nic_add_port+0xb71/0xd60
[   74.510860][   T12]  udp_tunnel_push_rx_port+0x180/0x200
[   74.512936][   T12]  geneve_offload_rx_ports+0xd7/0x160
[   74.515007][   T12]  geneve_netdevice_event+0x6a/0x80
[   74.516939][   T12]  notifier_call_chain+0x1b6/0x3e0
[   74.518820][   T12]  call_netdevice_notifiers+0x88/0xc0
[   74.520818][   T12]  udp_tunnel_nic_netdevice_event+0xdff/0x1810
[   74.523076][   T12]  notifier_call_chain+0x1b6/0x3e0
[   74.524947][   T12]  register_netdevice+0x1608/0x1ae0
[   74.526849][   T12]  nsim_create+0xae8/0xf10
[   74.528516][   T12]  __nsim_dev_port_add+0x6b6/0xb10
[   74.530408][   T12]  nsim_dev_port_add_all+0x37/0xf0
[   74.532284][   T12]  nsim_dev_reload_up+0x451/0x780
[   74.533935][ T6154] netlink: 104 bytes leftover after parsing attributes in process `syz.2.53'.
[   74.534167][   T12]  devlink_reload+0x4ec/0x8d0
[   74.534185][   T12]  devlink_nl_reload_doit+0xb35/0xd50
[   74.544391][   T12]  genl_family_rcv_msg_doit+0x215/0x300
[   74.546493][   T12]  genl_rcv_msg+0x60e/0x790
[   74.548198][   T12]  netlink_rcv_skb+0x208/0x470
[   74.549965][   T12]  genl_rcv+0x28/0x40
[   74.551458][   T12]  netlink_unicast+0x82f/0x9e0
[   74.553214][   T12]  netlink_sendmsg+0x805/0xb30
[   74.555001][   T12]  __sock_sendmsg+0x21c/0x270
[   74.556735][   T12]  ____sys_sendmsg+0x505/0x830
[   74.558524][   T12]  ___sys_sendmsg+0x21f/0x2a0
[   74.560261][   T12]  __x64_sys_sendmsg+0x19b/0x260
[   74.562138][   T12]  do_syscall_64+0xfa/0x3b0
[   74.563833][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.566017][   T12] 
[   74.566923][   T12] Second to last potentially related work creation:
[   74.569284][   T12]  kasan_save_stack+0x3e/0x60
[   74.571038][   T12]  kasan_record_aux_stack+0xbd/0xd0
[   74.572974][   T12]  insert_work+0x3d/0x330
[   74.574604][   T12]  __queue_work+0xcd2/0xfb0
[   74.576278][   T12]  queue_work_on+0x181/0x270
[   74.577983][   T12]  __udp_tunnel_nic_add_port+0xb71/0xd60
[   74.584824][   T12]  udp_tunnel_push_rx_port+0x180/0x200
[   74.586695][   T12]  geneve_offload_rx_ports+0xd7/0x160
[   74.588534][   T12]  geneve_netdevice_event+0x6a/0x80
[   74.590323][   T12]  notifier_call_chain+0x1b6/0x3e0
[   74.592293][   T12]  call_netdevice_notifiers+0x88/0xc0
[   74.594294][   T12]  udp_tunnel_nic_netdevice_event+0xdff/0x1810
[   74.596666][   T12]  notifier_call_chain+0x1b6/0x3e0
[   74.598656][   T12]  register_netdevice+0x1608/0x1ae0
[   74.600718][   T12]  nsim_create+0xae8/0xf10
[   74.602460][   T12]  __nsim_dev_port_add+0x6b6/0xb10
[   74.604386][   T12]  nsim_dev_port_add_all+0x37/0xf0
[   74.606393][   T12]  nsim_dev_reload_up+0x451/0x780
[   74.608361][   T12]  devlink_reload+0x4ec/0x8d0
[   74.610370][   T12]  devlink_nl_reload_doit+0xb35/0xd50
[   74.612507][   T12]  genl_family_rcv_msg_doit+0x215/0x300
[   74.614624][   T12]  genl_rcv_msg+0x60e/0x790
[   74.616426][   T12]  netlink_rcv_skb+0x208/0x470
[   74.618288][   T12]  genl_rcv+0x28/0x40
[   74.619882][   T12]  netlink_unicast+0x82f/0x9e0
[   74.621815][   T12]  netlink_sendmsg+0x805/0xb30
[   74.623741][   T12]  __sock_sendmsg+0x21c/0x270
[   74.625586][   T12]  ____sys_sendmsg+0x505/0x830
[   74.627508][   T12]  ___sys_sendmsg+0x21f/0x2a0
[   74.629367][   T12]  __x64_sys_sendmsg+0x19b/0x260
[   74.631280][   T12]  do_syscall_64+0xfa/0x3b0
[   74.633070][   T12]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.635432][   T12] 
[   74.636413][   T12] The buggy address belongs to the object at ffff8880271c9400
[   74.636413][   T12]  which belongs to the cache kmalloc-256 of size 256
[   74.641760][   T12] The buggy address is located 176 bytes inside of
[   74.641760][   T12]  freed 256-byte region [ffff8880271c9400, ffff8880271c9500)
[   74.646982][   T12] 
[   74.647964][   T12] The buggy address belongs to the physical page:
[   74.650435][   T12] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x271c8
[   74.653777][   T12] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   74.657014][   T12] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   74.660032][   T12] page_type: f5(slab)
[   74.661646][   T12] raw: 00fff00000000040 ffff88801a441b40 ffffea00009f9f80 dead000000000003
[   74.664920][   T12] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   74.668207][   T12] head: 00fff00000000040 ffff88801a441b40 ffffea00009f9f80 dead000000000003
[   74.671484][   T12] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   74.674835][   T12] head: 00fff00000000001 ffffea00009c7201 00000000ffffffff 00000000ffffffff
[   74.678211][   T12] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   74.681637][   T12] page dumped because: kasan: bad access detected
[   74.684146][   T12] page_owner tracks the page as allocated
[   74.686376][   T12] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5848, tgid 5848 (syz-executor), ts 66984946057, free_ts 66384102027
[   74.694428][   T12]  post_alloc_hook+0x240/0x2a0
[   74.696304][   T12]  get_page_from_freelist+0x21e4/0x22c0
[   74.698479][   T12]  __alloc_frozen_pages_noprof+0x181/0x370
[   74.700744][   T12]  alloc_pages_mpol+0x232/0x4a0
[   74.702716][   T12]  allocate_slab+0x8a/0x370
[   74.704488][   T12]  ___slab_alloc+0xbeb/0x1420
[   74.706315][   T12]  __kmalloc_cache_noprof+0x296/0x3d0
[   74.708488][   T12]  ____ip_mc_inc_group+0x528/0xde0
[   74.710542][   T12]  ip_mc_up+0x125/0x300
[   74.712217][   T12]  inetdev_event+0xfb3/0x15b0
[   74.714183][   T12]  notifier_call_chain+0x1b6/0x3e0
[   74.716251][   T12]  __dev_notify_flags+0x18d/0x2e0
[   74.718297][   T12]  netif_change_flags+0xe8/0x1a0
[   74.720320][   T12]  do_setlink+0xc55/0x41c0
[   74.722180][   T12]  rtnl_newlink+0x160b/0x1c70
[   74.724097][   T12]  rtnetlink_rcv_msg+0x7cf/0xb70
[   74.726087][   T12] page last free pid 5848 tgid 5848 stack trace:
[   74.728609][   T12]  __free_frozen_pages+0xbc4/0xd30
[   74.730630][   T12]  __slab_free+0x303/0x3c0
[   74.732423][   T12]  qlist_free_all+0x97/0x140
[   74.734239][   T12]  kasan_quarantine_reduce+0x148/0x160
[   74.736426][   T12]  __kasan_slab_alloc+0x22/0x80
[   74.738381][   T12]  __kmalloc_cache_noprof+0x1be/0x3d0
[   74.740490][   T12]  ref_tracker_alloc+0x133/0x460
[   74.742484][   T12]  register_netdevice+0x14a3/0x1ae0
[   74.744524][   T12]  geneve_configure+0x611/0xa30
[   74.746484][   T12]  geneve_newlink+0x1a1/0x240
[   74.748276][   T12]  rtnl_newlink_create+0x310/0xb00
[   74.750288][   T12]  rtnl_newlink+0x16d6/0x1c70
[   74.752131][   T12]  rtnetlink_rcv_msg+0x7cf/0xb70
[   74.754080][   T12]  netlink_rcv_skb+0x208/0x470
[   74.755983][   T12]  netlink_unicast+0x82f/0x9e0
[   74.757858][   T12]  netlink_sendmsg+0x805/0xb30
[   74.759741][   T12] 
[   74.760730][   T12] Memory state around the buggy address:
[   74.762895][   T12]  ffff8880271c9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   74.766072][   T12]  ffff8880271c9400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.769190][   T12] >ffff8880271c9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.772264][   T12]                                      ^
[   74.774459][   T12]  ffff8880271c9500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   74.777545][   T12]  ffff8880271c9580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   74.780663][   T12] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   74.810261][   T12] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   74.813145][   T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) 
[   74.816728][   T12] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   74.820695][   T12] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work
[   74.823541][   T12] Call Trace:
[   74.824869][   T12]  <TASK>
[   74.826072][   T12]  dump_stack_lvl+0x99/0x250
[   74.827935][   T12]  ? __asan_memcpy+0x40/0x70
[   74.829748][   T12]  ? __pfx_dump_stack_lvl+0x10/0x10
[   74.831807][   T12]  ? __pfx__printk+0x10/0x10
[   74.833679][   T12]  vpanic+0x281/0x750
[   74.835271][   T12]  ? preempt_schedule+0xae/0xc0
[   74.837200][   T12]  ? __pfx_vpanic+0x10/0x10
[   74.838993][   T12]  ? preempt_schedule_common+0x83/0xd0
[   74.841163][   T12]  ? preempt_schedule+0xae/0xc0
[   74.843090][   T12]  ? __pfx_preempt_schedule+0x10/0x10
[   74.845241][   T12]  panic+0xb9/0xc0
[   74.846778][   T12]  ? __pfx_panic+0x10/0x10
[   74.848538][   T12]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[   74.850833][   T12]  ? __mutex_lock+0x147/0x1350
[   74.852723][   T12]  check_panic_on_warn+0x89/0xb0
[   74.854681][   T12]  ? __mutex_lock+0x147/0x1350
[   74.856581][   T12]  end_report+0x78/0x160
[   74.858245][   T12]  kasan_report+0x129/0x150
[   74.860050][   T12]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   74.862397][   T12]  ? __mutex_lock+0x147/0x1350
[   74.864307][   T12]  __mutex_lock+0x147/0x1350
[   74.866117][   T12]  ? __mutex_lock+0x5bb/0x1350
[   74.868006][   T12]  ? udp_tunnel_nic_device_sync_work+0x39/0xa50
[   74.870427][   T12]  ? __pfx___mutex_lock+0x10/0x10
[   74.872406][   T12]  ? __lock_acquire+0xab9/0xd20
[   74.874349][   T12]  udp_tunnel_nic_device_sync_work+0x39/0xa50
[   74.876809][   T12]  ? process_scheduled_works+0x9ef/0x17b0
[   74.879088][   T12]  ? process_scheduled_works+0x9ef/0x17b0
[   74.881356][   T12]  process_scheduled_works+0xae1/0x17b0
[   74.883507][   T12]  ? __pfx_process_scheduled_works+0x10/0x10
[   74.885849][   T12]  worker_thread+0x8a0/0xda0
[   74.887666][   T12]  kthread+0x711/0x8a0
[   74.889297][   T12]  ? __pfx_worker_thread+0x10/0x10
[   74.891334][   T12]  ? __pfx_kthread+0x10/0x10
[   74.893197][   T12]  ? _raw_spin_unlock_irq+0x23/0x50
[   74.895260][   T12]  ? lockdep_hardirqs_on+0x9c/0x150
[   74.897339][   T12]  ? __pfx_kthread+0x10/0x10
[   74.899167][   T12]  ret_from_fork+0x439/0x7d0
[   74.900999][   T12]  ? __pfx_ret_from_fork+0x10/0x10
[   74.902996][   T12]  ? __switch_to_asm+0x39/0x70
[   74.904726][   T12]  ? __switch_to_asm+0x33/0x70
[   74.906174][   T12]  ? __pfx_kthread+0x10/0x10
[   74.907603][   T12]  ret_from_fork_asm+0x1a/0x30
[   74.909122][   T12]  </TASK>
[   74.910798][   T12] Kernel Offset: disabled
[   74.912122][   T12] Rebooting in 86400 seconds..

VM DIAGNOSIS:
22:04:36  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000032 RBX=0000000000000032 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900000f7130
R8 =ffff888020570237 R9 =1ffff110040ae046 R10=dffffc0000000000 R11=ffffffff854fac30
R12=dffffc0000000000 R13=ffffffff99b028f7 R14=ffffffff99df7480 R15=0000000000000000
RIP=ffffffff854facac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8613000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f001a7d7dac CR3=000000010dbb0000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fe383da7498 00007fe383da7470 XMM03=00007fe383da74a8 00007fe383da74a0
XMM04=00007fe38490d100 00007fe383da7460 XMM05=00007fe383da7478 00007fe383da74c0
XMM06=00007fe383da74b8 00007fe383da74b0 XMM07=00007fe383da74a8 00007fe383da74a0
XMM08=0000000000000000 00007fe383c12ee7 XMM09=0000000000000000 00007fe383c12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=00000000000001b4 RBX=0000000000000001 RCX=0000000039e8cf4c RDX=000000001f189bc1
RSI=000000009ec4d742 RDI=ffff88801e8c5640 RBP=0000000000000000 RSP=ffffc9000493efa8
R8 =0000000000000000 R9 =ffffffff8172c195 R10=ffffc9000493f1f8 R11=ffffffff81ac3b00
R12=00000000ebe9cac3 R13=ffff88801e8c6130 R14=ffff88801e8c6158 R15=1090781739e8cf4c
RIP=ffffffff819d69c3 RFL=00000007 [-----PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f4499dc96c0 ffffffff 00c00000
GS =0000 ffff8881a3c13000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000001480 CR3=0000000028120000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000003072 656c6c616b7a7973
XMM02=00007f001a7a7498 00007f001a7a7470 XMM03=00007f001a7a74a8 00007f001a7a74a0
XMM04=00007f001b30d100 00007f001a7a7460 XMM05=00007f001a7a7478 00007f001a7a74c0
XMM06=00007f001a7a74b8 00007f001a7a74b0 XMM07=00007f001a7a74a8 00007f001a7a74a0
XMM08=0000000000000000 00007f001a612ee7 XMM09=0000000000000000 00007f001a612fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
