last executing test programs:

2.240521591s ago: executing program 0 (id=3911):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xd, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bb000000180100002020702500000000002020207b1af8ff00000000bfa1000000000000070100"], 0x0, 0x2, 0x0, 0x0, 0x41000, 0x44, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94)
r4 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04", 0x13}], 0x1}, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x10)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33)
write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0xfe33)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000740)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(r0, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x28030}, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={0x0, @vsock={0x28, 0x0, 0x2710, @hyper}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @vsock={0x28, 0x0, 0x2711, @my=0x1}, 0x3, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000300)='pim6reg0\x00', 0xe, 0x5, 0x9})
sendmsg$NL80211_CMD_REGISTER_FRAME(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r6, @ANYBLOB="05005b"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r2, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)

2.089905742s ago: executing program 0 (id=3913):
r0 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
r2 = socket$qrtr(0x2a, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'wlan1\x00'}) (async, rerun: 32)
r3 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32)
r4 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x10) (async)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, 0x0, &(0x7f00000002c0)='syzkaller\x00'}, 0x94) (async)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x28, r1, 0x5, 0x3, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) (async)
r8 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) (async, rerun: 64)
r9 = socket$pppoe(0x18, 0x1, 0x0) (rerun: 64)
connect$pppoe(r9, &(0x7f0000000040)={0x18, 0x0, {0x3, @random="00ff00", 'bond0\x00'}}, 0x1e) (async)
sendmmsg(r9, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) (async)
r10 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64)
r11 = socket$alg(0x26, 0x5, 0x0) (rerun: 64)
bind$alg(r11, &(0x7f00000018c0)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64\x00'}, 0x58) (async)
r12 = accept$alg(r11, 0x0, 0x0)
sendmmsg$sock(r12, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)="ff", 0x1}], 0x1}}], 0x1, 0x4c015) (async)
r13 = accept(r12, 0x0, 0x0)
sendmsg$inet_sctp(r13, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x804c040}, 0x1)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000180)={'wlan1\x00', <r14=>0x0})
sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x48, 0x0, r14, 0x21eae}}, 0x20}}, 0x0)

2.089345327s ago: executing program 0 (id=3914):
syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async)
sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)='a', 0x34000}], 0xc, &(0x7f0000000000)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0xc}}], 0x30}], 0x1, 0x0) (async)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000001c00), 0x400000000000159, 0x40840)
sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0)
socket(0x10, 0x3, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1982f80cdecd07f8908a983a7c9fb81c2ba7f7e87c991f30e50d1b3bbe4cf2a2f5d4571b6568ada51bc121c9139d2a8e0638c84066b1759081802"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r1}, 0x10)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002fc0)=[{{&(0x7f0000000340)={0xa, 0x4e23, 0xfffffff9, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c, &(0x7f00000004c0)}}, {{0x0, 0x0, &(0x7f0000000b00)}}], 0x2, 0x24000045)
bind$alg(0xffffffffffffffff, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) (async)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f0000000680)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x53, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000d80), 0x0, 0x10, 0x5}, 0x94) (async, rerun: 32)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) (async)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) (async)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r4) (async)
ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000080)={'wpan0\x00', <r6=>0x0})
sendmsg$NL802154_CMD_SET_SEC_PARAMS(r4, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000680)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010025bd7000fedbdf251500000008002c000400000014002b800500020002000000080001000200000008002a000100000008000300", @ANYRES32=r6], 0x6c}, 0x1, 0x0, 0x0, 0x20000001}, 0x10) (async)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x18, r8, 0x1, 0x0, 0x2000040, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4008000}, 0x1) (async)
r9 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r9, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x7d) (async, rerun: 32)
recvfrom$inet6(r9, 0x0, 0x0, 0x0, &(0x7f00000017c0)={0xa, 0x4e29, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x1c) (rerun: 32)
r10 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000040)={0x5c, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x6, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x11}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}}, 0x0) (async, rerun: 64)
sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x60, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x0}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0xfffffffc}]}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x60}}, 0x20000000) (rerun: 64)
unshare(0x62040200)

1.357667769s ago: executing program 2 (id=3920):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000080)={0x7, {{0xa, 0x4e20, 0xe0, @mcast2, 0x138e}}, {{0xa, 0x4e21, 0x9, @private2, 0x4}}}, 0x108) (async)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000080)={0x7, {{0xa, 0x4e20, 0xe0, @mcast2, 0x138e}}, {{0xa, 0x4e21, 0x9, @private2, 0x4}}}, 0x108)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000002d00)={0x9, {{0xa, 0x4e23, 0x1000, @mcast2, 0x3}}, {{0xa, 0x4e22, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}, 0xb0}}}, 0x108)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f00000005c0)={0x8, {{0xa, 0x4e24, 0x5, @mcast2, 0x6d00}}, {{0xa, 0x4620, 0xfffffff8, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8000}}}, 0x108)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) (async)
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
listen(r3, 0x2) (async)
listen(r3, 0x2)
r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
getsockopt$sock_buf(r5, 0x1, 0x39, 0xffffffffffffffff, &(0x7f0000000100)) (async)
getsockopt$sock_buf(r5, 0x1, 0x39, 0xffffffffffffffff, &(0x7f0000000100))
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r6}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x18)
ppoll(&(0x7f0000000500)=[{r4}], 0x1, 0x0, 0x0, 0x0) (async)
ppoll(&(0x7f0000000500)=[{r4}], 0x1, 0x0, 0x0, 0x0)
pselect6(0x40, &(0x7f00000001c0)={0x800000000000, 0x1, 0x3, 0xfffffffffffffffd, 0x14, 0x8, 0x1, 0x40000000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x8, 0x9, 0x0, 0x4, 0x7fffffff, 0x3}, 0x0, 0x0)
r8 = syz_genetlink_get_family_id$mptcp(&(0x7f00000003c0), 0xffffffffffffffff)
getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000400)={<r9=>0x0, @local, @multicast2}, &(0x7f0000000440)=0xc)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000480)={'batadv0\x00', <r10=>0x0})
sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0xd871021}, 0xc, &(0x7f00000004c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="d0000000", @ANYRES16=r8, @ANYBLOB="040027bd7000fddbdf25020000f827000180060001000200000014e8412c3dd53fefb1a000040020010000000000000000000000000001050017ede7009f7c0200030000005000068014000400fc0200000000000084ffd909e469384e663e900236ae37000000000000000114000400fe8000000000000000000000000000aa0500020001000000140004", @ANYRES32=r9, @ANYBLOB="2800068014000400ff0200000000010601010002000000060005004e2100000c00068008000700", @ANYRES32=r10, @ANYRESDEC=r4, @ANYRES16, @ANYRESDEC=r9, @ANYRESOCT=r9], 0xd0}, 0x1, 0x0, 0x0, 0x4000}, 0x4028000)
bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async)
bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x37, 0x800000, 0x8, 0x9, 0x8000})
write$bt_hci(r2, &(0x7f0000000080)=ANY=[], 0x6)
clock_gettime(0x0, &(0x7f0000000200))
socket$inet_sctp(0x2, 0x1, 0x84) (async)
socket$inet_sctp(0x2, 0x1, 0x84)
ppoll(&(0x7f00000001c0)=[{r1, 0x200}], 0x1, 0x0, 0x0, 0x0) (async)
ppoll(&(0x7f00000001c0)=[{r1, 0x200}], 0x1, 0x0, 0x0, 0x0)
write$rfkill(r1, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) (async)
write$rfkill(r1, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8)
write$rfkill(r1, &(0x7f0000000340)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8)

1.227030714s ago: executing program 2 (id=3922):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r0}, 0x10)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x300, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, 0x20, 0x9, 0x2, 0x25dfdbff, {0x2}, [@typed={0x8, 0x8, 0x0, 0x0, @fd=r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r3 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendmsg$rds(r3, &(0x7f0000000740)={&(0x7f0000000040)={0x2, 0x0, @dev}, 0x10, 0x0, 0x0, &(0x7f0000004680)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000002bc0)=[{&(0x7f0000001900)=""/135, 0x87}, {0xfffffffffffffffe, 0x2}], 0x2}}], 0x48}, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x4, 0x1, 0x4}, 0x48)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='rss_stat\x00', r6}, 0x18)
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x5, @loopback, 0xa}}, 0x0, 0x0, 0x22, 0x0, "bb353738cb473fc7c9f1cf53b6a7b4e23602a3c364ca41d6e5615445244740bd4c0b42a21d7214bf92594925208a0e2f964e654dc534a6324d4993fcf19b2df3ee818a118a7c49462189316d556d2ccd"}, 0xd8)
sendto$inet6(r4, &(0x7f00000000c0)="e9", 0x1, 0x20008045, &(0x7f00000001c0)={0xa, 0x2, 0x1000, @empty}, 0x1c)
r7 = socket$inet6(0xa, 0x800000000000002, 0x0)
setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000040), 0x4)
socket$inet6_sctp(0xa, 0x1, 0x84)
sendto$inet6(r7, 0x0, 0x0, 0x2400ed80, &(0x7f0000000080)={0xa, 0x4621, 0x0, @local}, 0x1c)
writev(r7, &(0x7f0000001180)=[{&(0x7f0000001240)="06367d6d", 0x4}], 0x1)

1.22566571s ago: executing program 2 (id=3923):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000980)=ANY=[@ANYBLOB="380100001000130700000000ffdbdf21ac1414bb000000000000000000000000ac1414bb00000000000000000000000000008000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f000001000000000000000000000000000000003c000000ac1414aa000000000000000000000000010100000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000001000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000002000000290000000000000048000300"], 0x138}}, 0x0)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async)
r3 = socket$qrtr(0x2a, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000000)={'wlan1\x00'}) (async)
r4 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f00000000c0)=<r7=>0x0) (async)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r8)
sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r9, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}]}, 0x1c}}, 0x0)
write$nci(r6, &(0x7f0000000900)=ANY=[@ANYBLOB="7f3d010661"], 0x5) (async, rerun: 32)
r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 32)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r11=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="050000000000000000000008000340000000", @ANYRES32=r11, @ANYBLOB="0800050007000000"], 0x24}}, 0x10) (async, rerun: 64)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0}, 0x94) (async, rerun: 64)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, 0x0, &(0x7f00000002c0)='syzkaller\x00'}, 0x94) (async, rerun: 64)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r12=>0x0}) (rerun: 64)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x28, r2, 0x5, 0x3, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0)
r13 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r13, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0)
sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x3000200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0xbc, 0x1, 0x2, 0x5, 0x0, 0x0, {0x2, 0x0, 0x9}, [@CTA_EXPECT_HELP_NAME={0xa, 0x6, 'H.245\x00'}, @CTA_EXPECT_ID={0x8}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @local}}}]}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x10}, @CTA_EXPECT_HELP_NAME={0xa, 0x6, 'Q.931\x00'}, @CTA_EXPECT_MASK={0x44, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @local}}}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x800}, 0x4008011) (async)
r14 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r14, &(0x7f0000000040)={0x18, 0x0, {0x3, @random="00ff00", 'bond0\x00'}}, 0x1e) (async)
sendmmsg(r14, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) (async)
r15 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000180)={'wlan1\x00', <r16=>0x0})
sendmsg$nl_route(r15, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x48, 0x0, r16, 0x21eae}}, 0x20}}, 0x0)

1.169933619s ago: executing program 0 (id=3924):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1982f80cdecd07f8908a983a7c9fb81c2ba7f7e87c991f30e50d1b3bbe4cf2a2f5d4571b6568ada51bc121c9139d2a8e0638c84066b1759081802"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) (async)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
shutdown(r1, 0x1) (async)
getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000700)={0x0, 0x81, 0x10}, &(0x7f0000000040)=0xc)
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) (async)
r3 = socket$packet(0x11, 0x3, 0x300)
r4 = bpf$MAP_CREATE(0x0, 0x0, 0x48) (async)
setsockopt$packet_int(r3, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4)
recvmmsg(r3, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0)
r5 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {}, {0xe, 0xd}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) (async)
r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1d, 0xa, &(0x7f0000000800)=ANY=[], &(0x7f0000000680)='GPL\x00', 0x9, 0x11, &(0x7f00000007c0)=""/17, 0x40f00, 0x53, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000940)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000a40)={0x5, 0x9, 0x5, 0x4}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000d80)=[r4, r4, 0xffffffffffffffff], &(0x7f0000000dc0)=[{0x5, 0x5, 0x9, 0x1}, {0x3, 0x2, 0x7, 0x2}, {0x5, 0x4, 0x4, 0x7}, {0x3, 0x4, 0x0, 0x4}], 0x10, 0x5}, 0x94)
bpf$PROG_BIND_MAP(0x1c, &(0x7f0000000140)={r6, 0xffffffffffffffff, 0x24}, 0xc)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="0800d90700000000000000bd5656", 0xe) (async)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="58000000100001002dbd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1843010000000000140003007866726d30000000000000000000000024001a8020000a8014000700fe80000000000000000000000000002c0500080002"], 0x58}, 0x1, 0x0, 0x0, 0x4000884}, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) (async)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0)
unshare(0x62040200)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r10, @ANYBLOB="8000000000000000"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="050000000900000000002e00000008000300", @ANYRES32=r10, @ANYBLOB="0a00340002020202020200000a00060008021100000000000800350000000000"], 0x3c}}, 0x0) (async)
syz_80211_inject_frame(&(0x7f00000002c0)=@broadcast, &(0x7f0000000280)=ANY=[@ANYBLOB="500000000802119dcafa1cefbff3575b5fa07e950000010802110000000802110000000000000000000000000064000100010882848b960c1026"], 0x2e) (async)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) (async)
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {0xc}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, 0x0)

1.080840463s ago: executing program 2 (id=3925):
r0 = socket$netlink(0x10, 0x3, 0x7)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'dummy0\x00'})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x313400, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r4 = socket$igmp(0x2, 0x3, 0x2)
r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYRESHEX=r0, @ANYRES32=0x0, @ANYRESOCT=r4, @ANYRES8=r3], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000001000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007000000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000c500000095"], &(0x7f0000000640)='GPL\x00', 0x2, 0x7f, &(0x7f0000000680)=""/127}, 0x94)
setsockopt$inet_group_source_req(r4, 0x0, 0x2b, 0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x6, 0x6, 0x4, 0x0, 0x4, r5, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x800001, 0x0, 0x1}, 0x50)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000140000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$kcm(0xf, 0x3, 0x2)
openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000840)='io.pressure\x00', 0x2, 0x0)
sendmsg$inet(r3, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="0213020902000000", 0x8}, {&(0x7f0000000780)="a100000000109737", 0x8}], 0x2}, 0x400c010)
r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000000014fdc638b3d00000000a86aa100"/32, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0xf, &(0x7f00000003c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800}, 0x94)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r8=>0xffffffffffffffff, <r9=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4)
sendmsg$unix(r9, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0)
r10 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10)
sendmsg$NFT_BATCH(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0x8bf}, @NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_HASH_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}, 0x1, 0x0, 0x0, 0x20014}, 0x0)
r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
openat$cgroup_devices(r11, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0)

849.033378ms ago: executing program 2 (id=3927):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000600)=@framed={{}, [@printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x83000000}, {0x85, 0x0, 0x0, 0x71}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00', <r3=>0x0})
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000580)="d800000018008105e00212ba0d8105040a020200020f100b067c55a1bc000900b80006990200000015000500fc038178a80015000338004002000c0901ac040000d67f6f947a7100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f27260e970300000000000000000000000000000000000000008dc5fb510162", 0xd8}], 0x1}, 0x10)
r6 = socket(0x10, 0x803, 0x0)
bind$netlink(r6, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r7, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="440000001900010d0000000020000000021800000002fd010000000008000100ac1414000800050064010100100016800c0001000308010802000000290015d7896700d08800003d205f35957dcc443dea33527e74194869b7e98ac59aa1b69011f998093cdb7431e9637409619085f01cd3814756fb026e720d7e7ec004000000000000237fb5581f28d7ea102dee3890a524ef28fdd54311b43145d3934f5d9e6b70a0b01c61fb5b63213109b8dcf84e56278cf8e85a5b4e76a588692295e12b211b83d436eb2c04b714704578e6bc830f4dc580c10dce93abed5e4d79c1648a80dcd0a50d1728badcfac900700cb0e6e55d97fd892eee538518e15358b28287996524def1ef2c1296c9b13a9abca2df3f93e089ed9ee00e4901edb374392ce70bd2cbba553f02baf027a3faddfd39c87f1132e54a8a634dd30f795f52a81da832855aab03f7cb66c529faf8ddbb40e919efdda14ea0"], 0x44}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="280000002b000bf9dc0adc317e6f48250900000008000200040001000c0001"], 0x28}}, 0x0)
r11 = socket(0x1, 0x803, 0x0)
r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r13 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$NLBL_UNLABEL_C_STATICADD(r12, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xb4, r13, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}, @NLBL_UNLABEL_A_SECCTX={0x29, 0x7, 'system_u:object_r:policy_config_t:s0\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'dvmrp0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast2}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'ip6erspan0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}]}, 0xb4}, 0x1, 0x0, 0x0, 0x90}, 0x800)
r14 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r14, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c)
sendmmsg$sock(r14, &(0x7f0000000740)=[{{&(0x7f0000000080)=@phonet={0x23, 0x0, 0x0, 0x7}, 0x14, 0x0, 0x0, &(0x7f0000000240)=[@timestamping={{0x14, 0x1, 0x25, 0x10000}}], 0x18}}], 0x1, 0x0)
getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, <r15=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_MASTER={0x8, 0xa, r15}]}, 0x44}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44800)
sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x70bd2b, 0x0, {}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8, 0x1b, 0xfffffffc}]}, 0x30}}, 0x0)

698.605801ms ago: executing program 2 (id=3928):
syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
setsockopt$packet_int(r0, 0x107, 0xc, &(0x7f0000000000), 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0)
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r1)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200))
socket$netlink(0x10, 0x3, 0x0)
r2 = socket$kcm(0x10, 0x3, 0x10)
clock_gettime(0x2, &(0x7f00000001c0))
sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xf, &(0x7f00000000c0)=[{&(0x7f0000000100)="1400000016000b63d25a80648c2594f90224fc60", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0)
socket$key(0xf, 0x3, 0x2)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc4d4}, 0x8)
sendto$inet6(r3, &(0x7f0000000580)="81", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000800)={0x5, 0x3, 0x4, 0xb, 0x3, 0x3ff, 0xc1, 0x7}, 0x20)
syz_80211_join_ibss(&(0x7f0000000240)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0)
bind$bt_hci(0xffffffffffffffff, 0x0, 0x0)
socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=@ipv6_getnexthop={0x18, 0x6a, 0x1, 0x70bd2a, 0x25dfdbfd}, 0x18}, 0x1, 0x0, 0x0, 0x4010}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff)
ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0)
syz_emit_ethernet(0x168, &(0x7f00000005c0)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x20, 0x15a, 0x0, 0x0, 0x0, 0x6, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@lsrr={0x83, 0x7, 0xd2, [@loopback]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x4, 0xb3}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, {[@fastopen={0x22, 0x2}]}}, {"6cd774474d3ed636cdf7b6e6932beb60e704a2d9a10a70f48a85692fd69906f8adda81dc00438674a571f1f7d5a1301ee2547e6337cde9846f34053e0dd557eefe82fe4bad9dd64010c3d654268e155f82e0fb148be30b3f872a94ffef6e7a6f65bf9aa9ab5c3fc2d08d01590cf8a42629957e048345653a98b7fb84537342a733516031bc2317639eab45f5e098802c7b93b5ddbaa0effff4e75d6738e7c0d2875c05bc46880657064aef92bbb28d097b122dc85bf16fe27e2be84b933d4a605cb76d0f874d3cc76a8d01945f9497040225d489df4d926543fbc24c107397fd75bb34e49ab94ee2359052c12039ec3a807b4e7eb06d341250e03f29a2fe0ba168dc5642dc0ac0b7b7af7e5990f1290663e1d78084f6a6eee5d6ebf38487"}}}}}}, 0x0)

580.098932ms ago: executing program 1 (id=3930):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x4, 0xfa, &(0x7f00000007c0)=""/250}, 0x90) (async)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000011c0)=@newchain={0x44, 0x64, 0x1, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x6, 0xf}, {0xffe0, 0xfff3}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x9}, @TCA_CHAIN={0x8, 0xb, 0xb}, @TCA_CHAIN={0x8, 0xb, 0x77}, @TCA_RATE={0x6}]}, 0x44}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, 0x0) (async)
r1 = socket$inet_udp(0x2, 0x2, 0x0) (async)
r2 = socket$nl_route(0x10, 0x3, 0x0)
pselect6(0x40, &(0x7f0000000140)={0x5, 0x6, 0x8, 0x8, 0x0, 0x2, 0x0, 0x8}, &(0x7f0000000180)={0x9, 0x2, 0x7fff, 0x22c, 0x5, 0x0, 0xa9e, 0x7}, &(0x7f00000001c0)={0x7fffffff, 0x9, 0x81, 0xa1, 0x3, 0xff, 0x1, 0xffff}, &(0x7f0000000200)={0x77359400}, &(0x7f00000004c0)={&(0x7f0000000240)={[0xc6]}, 0x8})
sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8000}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10) (async)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe8000"], 0xfdef) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) (async, rerun: 32)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001e80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) (async, rerun: 32)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x23, &(0x7f00000000c0)={0x0, 0xe1}, 0x8) (async)
r4 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r4, &(0x7f0000000000), 0x10) (async)
sendmsg$can_bcm(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x5, 0x0, 0x0, {}, {0x0, 0x2710}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5b979e01d2038d84"}}, 0x48}}, 0x0) (async)
sendmsg$can_bcm(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000008c0)=ANY=[@ANYBLOB="050000000300"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000009dfc47318ccc34550896937ded64288c9f7c6aec2cc6c9419e9ad9cd5881804db51a859c9b09012c2b4d418a0412b31bad3f37a44ccfd62dc7f6b2db88442ce77e07dd0d968d18fd8e"], 0x48}}, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4c00000002060108000034e400000000000000020500010006000000050004000000fe000900020073797a3100000000050005000200000012000300686173683a6e65742c706f7274000000ff5b3b87675a"], 0x4c}}, 0x2)
r7 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r7, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) (async, rerun: 64)
setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) (async, rerun: 64)
setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000000)="6a0e6435f82b96e120e95ef657c67f3804ab3fd20f854380e05a23b6758439b1bcc2af4612a9ffbedef954ca796197b2ad54eb4aa5e40f7e0679b02c55444cd757567b124e1c78808a05eac11e93d4de32", 0x51) (async)
sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="54000000090601080000000000000000050000000900020073797a310000000005000100070000002c000780060004404e21000005000700e30000000c00018008000140850101010c00028008000140"], 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x3d0, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x200, 0x230, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x430) (async)
sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0xf00)

578.193767ms ago: executing program 0 (id=3931):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000d, 0x4008031, 0xffffffffffffffff, 0x0)
r5 = socket$can_j1939(0x1d, 0x2, 0x7)
bind$can_j1939(r5, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18)
r6 = bpf$MAP_CREATE(0x0, 0x0, 0x17)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r6, &(0x7f0000000140), 0x0}, 0x20)
bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000740)={'wlan1\x00', <r7=>0x0})
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r10=>0x0})
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0)
r12 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r12, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r7, @ANYBLOB="05005b"], 0x24}}, 0x0)
r13 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r13, &(0x7f000000c2c0)={0x0, 0xfffffffffffffe01, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r13, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0x10, 0x1, 'CONNSECMARK\x00'}, @NFTA_TARGET_INFO={0x5, 0x3, "ef"}, @NFTA_TARGET_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x29}]}]}], {0x14}}, 0xa0}}, 0x0)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r2, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)

440.837463ms ago: executing program 1 (id=3932):
socket$nl_generic(0x10, 0x3, 0x10) (async)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', 0x0, 0x0, 0x2)
r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000000000000000000000002000000000000"], 0x0, 0x26, 0xffffffffffffff94, 0x3}, 0x20)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x6, 0x6, &(0x7f0000000bc0)=@framed={{}, [@exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000740)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x2, &(0x7f0000000940), 0x10}, 0x94) (async)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x6, 0x6, &(0x7f0000000bc0)=@framed={{}, [@exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000740)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x2, &(0x7f0000000940), 0x10}, 0x94)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan0\x00', <r3=>0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="01002bbd7000fbdbdf252100000008000300", @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x24004084}, 0x40000)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'})
r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x6}, 0x50) (async)
r7 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x6}, 0x50)
r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r8}, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0d00000004000000040000000000010000000000", @ANYRES32=r7, @ANYBLOB='\x00\x00\x00;\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000300"/28], 0x48)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'veth1\x00'})
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', <r9=>0x0})
socket(0x10, 0x3, 0x0) (async)
r10 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'veth0_to_batadv\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'veth0_to_batadv\x00', <r11=>0x0})
sendmsg$nl_route_sched(r10, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@newqdisc={0x48, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r11, {0x0, 0x2}, {0xffff, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x18, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x10001, 0x5, 0x2, 0x7, 0x1d, 0xf, 0x2}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40001d4}, 0x8840)
socket(0x400000000010, 0x3, 0x0) (async)
r12 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r13=>0x0})
sendmsg$nl_route_sched(r12, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x4}}}]}, 0x3c}}, 0x0) (async)
sendmsg$nl_route_sched(r12, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x4}}}]}, 0x3c}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="200000006800e97800000000ffdbdf250a0000000000000008000500", @ANYRES32=r9, @ANYBLOB="2023e2ab8efa47cb1092caa085f4f7dd26565eca917278ded418673b0a0b6f340363414bebcbb102385ef60fcb4a4fe5e10efec6dc3c2f11c740768c22f85714b5ec133c6465b2e44d1416aa"], 0x20}}, 0x0)
r14 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r14, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newnexthop={0x48, 0x68, 0x1, 0x70bd25, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0x1c, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_UNBALANCED_TIMER={0x8, 0x3, 0x80}, @NHA_RES_GROUP_UNBALANCED_TIMER={0x8, 0x3, 0x5}, @NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x9}]}, @NHA_GROUP_TYPE={0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080)
bind(r5, 0x0, 0x0) (async)
bind(r5, 0x0, 0x0)

250.608077ms ago: executing program 1 (id=3933):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = openat$cgroup_ro(r2, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0)
read$rfkill(r3, &(0x7f0000000140), 0x8)
r4 = socket$qrtr(0x2a, 0x2, 0x0)
r5 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r5, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(md5)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r5, 0x117, 0x37, 0x0, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000000)={'wlan1\x00'})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r9=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x24, r8, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, 0x0, &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x28, r1, 0x5, 0x3, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0)
r11 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r11, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0)
r12 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r12, &(0x7f0000000040)={0x18, 0x0, {0x3, @random="00ff00", 'bond0\x00'}}, 0x1e)
sendmmsg(r12, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0)
r13 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000180)={'wlan1\x00', <r14=>0x0})
sendmsg$nl_route(r13, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x48, 0x0, r14, 0x61ebe}}, 0x20}}, 0x0)

128.426832ms ago: executing program 0 (id=3934):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000001000010400000000000000000047e700", @ANYRES32=0x0, @ANYBLOB="ae1e020000000000"], 0x20}}, 0x0) (async)
r1 = socket$kcm(0x10, 0x3, 0x10) (async)
r2 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0x0, 0xfff}, 0x8) (async)
sendto$inet6(r2, &(0x7f0000000380)='\x00', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x0, 0xffffffff, @private1={0xfc, 0x1, '\x00', 0x1}, 0xa}, 0x1c) (async)
getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, 0x0, &(0x7f0000000200))
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="1400000022000b0fd25a806c8c6f94f90124fc60", 0x14}], 0x1}, 0x4000010) (async)
r3 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0)
close(r5)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r5, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="060000000010"}) (async)
sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001000010000003a194618d96d6d2e8553", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) (async)
r7 = socket$kcm(0x10, 0x2, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={<r8=>0xffffffffffffffff})
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="cec00000", @ANYRES16=r9, @ANYBLOB="00042abd7000fcdbdf251300000008000300", @ANYRES32=0x0, @ANYBLOB="06003600cfff000020001300800b83b00486b69092c47d6c0b6c719624ec0b82098210480c1236060600ab000f000000"], 0x4c}, 0x1, 0x0, 0x0, 0x8080}, 0x4000)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000300)={'wlan0\x00', <r10=>0x0}) (async)
recvfrom$ax25(r5, &(0x7f0000000140)=""/29, 0x1d, 0x10000, &(0x7f00000001c0)={{0x3, @bcast, 0x1}, [@null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_NEW_STATION(r11, &(0x7f0000007380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D \x00\x00', @ANYRES16=r9, @ANYBLOB="f1e6ffffffff000000001300000008000300", @ANYRES32=r10, @ANYBLOB="04001300060012000400000006001000fa0000000a000600ffffffffffff00000500130100000000"], 0x44}, 0x1, 0x0, 0x0, 0x200000d0}, 0x8050) (async)
sendmsg$kcm(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) (async)
socket$unix(0x1, 0x2, 0x0)
r12 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000580)={'wlan1\x00', <r13=>0x0})
sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010028b6296be141526b7e00000008000300", @ANYRES32=r13, @ANYBLOB="0c009900ff070000700000001400040073797a6b616c6c6572300000000000000800050006000000"], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) (async)
connect$inet6(r5, &(0x7f0000000340)={0xa, 0x4e21, 0xf14, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8}, 0x1c)

70.428477ms ago: executing program 1 (id=3935):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, 0x0)
r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x80080, 0x0)
ioctl$RFKILL_IOCTL_NOINPUT(r3, 0x5201)
r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000001d80), 0x80800, 0x0)
ioctl$RFKILL_IOCTL_NOINPUT(r4, 0x5201)
close(0x3)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r5=>0x0})
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f00000014c0)=ANY=[@ANYBLOB="050000000000000069115a00000000008510000002000000850000000b00000095000000000000009500c4050000000077d8f3b423cdac8d80000000000000102be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f68a7d06d756751dfb265a0e3ccae669e173a649c1cfd6587d452d6453559c3421eed73d5661cfe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff050011bbecc2f4e6779af2551ce935b0f327cb3f011a7d0660d1a13ed38ae89d24e1cebfba2f87925bfacba83109751fe6c0541cd027edd68149ee99eebc677d6dd4aed4af7500d7900a63278f4e92895614cd50cbe43a1ed2526814bcf11887d8dc91dd6f469f9740bf3a73b100000000000009d27d753a3066a096e9e086cea20e0000b6670c3df2660900000000000000447c106a08893ed20fa7a050fbbef9e326e827e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada127414d0b2877ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000000000000000000000000000000000000000000000000000000000000000000005233226ee7b4de17ff24000c52f4ebf1c893bb97734a83584898eccb26f3b789cfc4cd985fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4e48f35530a0af4aac9d07713f05de969c38331973d55a17690b6f7f9ccbe44b138efc20a546d3d5227e23b03f2a834391ad24fe7d9b20cfde6c25a3836978d2efa286a87f7a32417f1b825a16857aa54a859989d893ad4bf9180ca85ed3ee19843e13f642af0c90f8fca010812ccb3758ec9afe9f8db501b4061f60f06e8410c96edd9701a64657d5b3983c4ac41b154eebfe64d2c2ef1816cb11565679eb6640b32a49fd991811dfb258713624a757a6cc4fff48a27dab16ebbd8405a1abd85e0e946b9fe8e1dfa80eddb3ed496aa46b5eea7c7119f09e2d9d48a1d7367611d7c68cd1cd02074d6e38074230417d2d4424de5897bd110e6294bcfe98000bfa6e9919b956fa369d5e652e6cbe58d52990e65c6b7aac9553ca7d273d7a43e536be2f212f8788c2d1b3929f466c1ef408b2a8e71029a65f2a2f21f710acfd1b9f9ce56114a69e6f9e2861a8a56d9d604a56e2dbcd2fbe9cb4db180a145785f94b27a380dffa612eee33056cd0824374f1bf2f89de1bb4fa70d6c8000000001342faa8040807c0276b5ac9647e7491c1e21cd5bfdce4ddcc1b7f50a4a51d87fb0000000000000000000000000050b5d4375adcef4b0365e0a910a1d3ff536f18efaa6d163fbeb8c92072153d8d10f30884b8b15bf441a42935eaaef2d9a277a83fb74c00a041d97fb2f23223cc784be3f11f9992225ab0edbe92b25c5c41905583108a4b68984338a916d3ea05ecca45f99beecf56341075ed4387159b563501166f7a8abcbcd38c5852ef7f624ca8a2f91a17304a92919f66bc72534c0e197679796a667d987abea7a09d263988539b0d89bef76cac0f3d3ea4a139e108a4bdc148695a7518e425dba2b8acaa1ef7c736c88cea7c93bbc366ec3d8a5897a5e40442772784ffe1808e6335edb6fe1125c548698fcd02c74945ab7dffa618ff39fb89b633b74b5572d41dbac30051f5b263ed9a5a590d45c6eb37a059f9117a9923b4f8e78bba39b6801d2a57bea49bfe546c765d8a52a6bec46a26c022f7508ddd6c7e6161ba51408ba085fb506fd53173d1bf33d3a633568888bfc657f524a156dd54bcb16355c9a4200a7afcadff35f7e97ce8f63aa4f5686dbfab1d13128cde60a40a5721b281ee2d8f4e81c2673e159dd4d8cc11211865a9063b85dab4dc66898ff30b1116aed68403133e79abfbb29cdda78328755c282ff47ce9cbbae753da77a38a5b931cee09c8ebf7974862266f6ee2c3e19833869ba4ef05a99d851aa52d721ee9166e11e50da5ca162823d0c8f89cadac1b1d8bf9134408383104f4a20279fc249b1bfdab79878013773945056304a93179d0d3d6425eede4762b417c1ee8029af2d0b81f6aa2df229dcdaca1e97b184e267690ddd5b90999ef19b5b41d72afdd704c926d9c4a72f2886f73a9e71e5df7403ef6d965e60c938b856edfab81af093f650341de767e3b53fd000000002f764fd240d9fb6eaf864db2b58069eded19fcc4a229c72ee14d424f3d388e3c9d5af2e49f374f7915ee31a3e6c5a0ecfc4e8468d0f2955726d30eedaafc0a251335961796c1e9c2d674509c9eb1062cbe6f68a0323330edbd5224ad7b003e91d8b89e2552cb35c39d2b81addf19be15f455d592dc67f8eb0c631ca7b24d972f5fbb462367738832b7b19663f8cc2ca56e49bad4bd791a8277dfe2261265679b383ab4455fcd02d4686c4fa30d05a53b8e3a228947a16e9329bc9ce25659ad305b1f849128a573aa6fc639de8245067893278df9e1e60a5acdfea4d60415a1beafc4476bd5eaf3d55f05279b63fff168419ad0415bcc3c94f36a9ad19c8bad110eae5dac5bbd9ff33a2e0fb32b9ed37f6193fccb131d45e244479cb123140e0a3ddc39b5546f1e9534133894d95b5de60dbbbcd2936a56a8d42c275385319d11ad49ffd786d187c63a1b2f32d216655ab774d07092044fa526bbd9e7d810421d186e985edcdcd39ec406fb21f94abe57fbdd63d223778a0fd81c17ac2249eb17f1b6e81688e205b657140a77519bcc5f5e7934b724b6f80d065eaa55d017f5b4900c038cd9adbf0ed8e2b05ee372be51147728438c9f980f38293cbb470f722a2b303f9f5ca59ec778733b77a07c97f700000000200000007649cc4b6ab82e9d1cd2e0834b05b51679d5081504038ca0ef0ff01dc554548f86cd1e3eeaee4564f9345d1112ae364ed7ad4511a82fb82b0e9569ca901337058c534f891bcdc81f8756306f9223f5560000000000000000000000000000dae4f25530803f1d21b41f57b89084010334a66351d546380d71fc788a732aec27bbb888f1aee49ab7d418489d5caff0560ef4398cc005c49642366d7004a10093bf46c4d953ae9f13508e42df39e3082511f336a49423a6dfe3861cb476f7c6e0bf65b853ee2a913462ffc50fde069ae009663be77de752f2e5de736d101811d0e876d4de9485b91fd2e3950357c71766a2d663c4869ebd7c60c5aa92f44aae89cf5e4b2da7d372cb9fc486271379207f4a70d41b64d304b71fbf56a0007e2bb2807b2dcd36ad55c115d5e551dd7782f2ae7b7eebd975ce65504ea4897292fd44ae7b1262404276a5c689a8baec8148e39677719309ac73dee5679b9c49286919381caec61bed27b428cb4c861980c15637d667010b88b7fc0cd945f3d9f871e87c0d92da12e46ee2456b42fedfd4f0a4000000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x40000)

70.135808ms ago: executing program 1 (id=3936):
r0 = socket$kcm(0x11, 0x200000000000002, 0x300)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000002c0)=ANY=[@ANYRES16=r0], &(0x7f0000000140)='GPL\x00', 0x40000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94)
socket$packet(0x11, 0x3, 0x300) (async)
r1 = socket$packet(0x11, 0x3, 0x300)
socket$alg(0x26, 0x5, 0x0) (async)
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) (async)
bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18)
r3 = accept4(r2, 0x0, 0x0, 0x800)
sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3", 0xffffffe4}], 0x3}], 0x1, 0x40800) (async)
sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3", 0xffffffe4}], 0x3}], 0x1, 0x40800)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f00000022c0)=ANY=[@ANYBLOB="b702000000000090bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000009000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989425f5d0b79f6584d0416d7c4bb9f547b328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f01000000010000006e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b98d2de10c21d3ea02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d000000200008000000000000001abc11c800000000000000000000000928ee53595a779d243a48cea769470424d20a04c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005472b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92fe8bad99ca332af00f191b66b6a6f732a91f0e2e9190e4b448da7de018c58e950767f9b320be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c52573d9308a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e495f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e4a48dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f00000021f8547d393dabe616fbbde21c90be00b5a22671395c7a69c6dd4d022ffc97ddb6aa025131652d409da1d8cfc3d219d4b1c1b7b8170d7c33d91db2b73f7ae02485a209a2474b5d0790d05c01bec623056e4d3f4d3149373a28b26a15a1fcce73d57e6eaf7e6f315fe275ebc9ef7aeca277dde01dde724f419803a2172a7833ceab38d21ca4f1dea5e1f4d8824167b21dd289dd4e6ecfba9e163bdbc48e1e758ecde05c10809c9edfa6d77c652fd742e6dad13d2a397bebe3ea8bc087d3720e2202f36c7719ae34f042e19dc08a3323a3d94098a7ec171469352bab1662c3e4d4803c565cfcce32dad628fade43a4844abb230ce608726fd87e93c405a96cf638c41510f26e9da5f316"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r4, 0x0, 0x62, 0xfe, &(0x7f0000000140)="cb74445b7d4c0b24676c6c71ae37efcedaf40242309766deb4e793f90000000000000000dbc856cbc664650634231454ca2d8034c4ca29e0d99c3b6615e91835a600c08f989af45438a54981be310aad92ae545b1c961e5f3762a51fe4c736edec6f", &(0x7f0000000440)=""/254, 0x2f00, 0x0, 0xff, 0x194, &(0x7f0000000980)="ffc4438e5c3081d0e133e812196ec0ed923733aa8b5aba32c8650e7a66d6136853773dfbc6226be13039e230d511f1ac50cc7811aac0400e4c833fedf842ae2918e6fddb550729246fcf4c0a01bc64989ea3985fb362751a83991bd56e761379caa64f6148893ff25f38d5cd6dd695bbf9ca709a9960e0e6b054d5e2239bcb7c0fb2ac66dc4c8f534e439ff20ccaf0d48a98c19c92a3b437a699350f49606d21a403f8c112c46fea5486bf367a854b0f6c1e563b656e4794f6793a08bb3656c391643f6df71d0255054368a938d38503d064da82d5dbf395ad47ed3932669168d324ed0f6de8360d499042ddc7d02b6c0772128257702bfe6d0971f00fea85da062cdc", &(0x7f00000007c0)="4c87fe555ceb79157b1e507ff4d3cc053321e42ae89f596427188b4877ab8f1776c0685784f1174c6401ecc1dd6e2a77bc79238f87ad9215a92ff203a30099e77c543e702b4a4438d358616381745f24f74e585498af129c4b173b242f445b08135f7fa40eb7ba78160ff4f0c80e1b324d0c234cb7f43a3ff9e9535dc16000c797113a039f4508a09144090000009f38a90a24f173b3e68377e4272950a80cfcd3aa6850e917bc7e57370060f5e6db941d67fc98a1e98103830b821657438325578d2af822dd4fc13ea7a7eef8d9be4e715aec8fd6cadc41c8da5ce9da2b9e1559d92a1936fc2b3a00000000000000000072200e10ba6269b634f10f7098c65ba67ba65c0e2687637e131fb8d5ba6c12c09c8356853c434a44ff0878e496dcf9a4f5ca02c293279948f37ebb28843f92c87c057a3b410e04418557d5deda7ddd3bd1d384d64ec980187e8b64a0696571a49e847db79349c9b3c3fab5f1f977bde4d802d9026ae0c11744eb1525c5195fd215d7a432497f35c2f2cfcd2b6336b26dfef0cb968c910ea2af5cdd4d58cc08535d5514", 0x2, 0x0, 0x10000}, 0x24)
setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) (async)
setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4)
setsockopt$packet_int(r1, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={<r5=>0xffffffffffffffff})
getsockopt$sock_cred(r5, 0x1, 0x11, 0x0, &(0x7f00000005c0)=0xfe)
bind$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfd, 0x808b9027}, 0xc)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TLS_TX(r6, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, '\x00', "5193bb672965593497c186a80e00", '\x00\x00=*', "1202000000040030"}, 0x38)
setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e2c, 0x8, @loopback}}, 0x0, 0x0, 0x41, 0x0, "b208405cce4456e4fc8f2dabd194ff3763f799f91cf7e5e8260998f956ec57c24451db07550335ebf4a3d0168ccaa268e928f39cd7494c2b19ebef230a3373685fbacfcf3b6e9633bd997a9bfcf08f67"}, 0xd8) (async)
setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e2c, 0x8, @loopback}}, 0x0, 0x0, 0x41, 0x0, "b208405cce4456e4fc8f2dabd194ff3763f799f91cf7e5e8260998f956ec57c24451db07550335ebf4a3d0168ccaa268e928f39cd7494c2b19ebef230a3373685fbacfcf3b6e9633bd997a9bfcf08f67"}, 0xd8)
setsockopt$inet6_tcp_int(r6, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) (async)
setsockopt$inet6_tcp_int(r6, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r7}, 0x10) (async)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r7}, 0x10)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000008c0)=@bpf_tracing={0x1a, 0x1, &(0x7f0000000680)=ANY=[@ANYBLOB="b13a010008000000"], &(0x7f0000000700)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x38db, r7}, 0x94)
connect$inet6(r6, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
bind$netlink(0xffffffffffffffff, 0x0, 0x0)
r8 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFDSTADDR(r8, 0x8918, &(0x7f0000000180)={'ipvlan1\x00', {0x2, 0x4e1f, @broadcast}})

0s ago: executing program 1 (id=3937):
pipe(&(0x7f0000000600)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x13)
bind(r3, &(0x7f00000003c0)=@un=@file={0x0, './file0\x00'}, 0x80)
close(r2)
splice(r0, 0x0, r2, 0x0, 0x1100000000f336, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000002000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a32000000008c000000060a010400000000080000000100000008000b400000000064000480340001800b000100657874686472000024000280080001400000000c0800034000000000080004400000002205000200070000002c0001800b0001007470726f787900001c0002800800024000000011080003400000001108000140000000020900010073797a30"], 0x100}}, 0x0)
r5 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={<r6=>0x0}, &(0x7f00000004c0)=0x8)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r5, 0x4018f50b, &(0x7f0000000080)={0x1, 0x1, 0x9})
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f00000001c0)={r6, 0xc, 0x10}, 0x8)
r7 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10)
r8 = socket$inet6_sctp(0xa, 0x5, 0x84)
r9 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r9, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={<r10=>0x0}, &(0x7f00000010c0)=0x8)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x84, &(0x7f0000000180)={r10, @in={{0x2, 0x4e20, @empty}}, 0x7, 0x4002}, 0x90)
getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14)
sendmsg$nl_route(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80405c00}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=@ipv6_newaddrlabel={0x24, 0x48, 0x300, 0x70bd2c, 0x25dfdbfe, {0xa, 0x0, 0x40, 0x0, r11, 0x9}, [@IFAL_LABEL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x10)
getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000080)={r6}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, 0x0, &(0x7f0000000140))
r12 = socket$nl_generic(0x10, 0x3, 0x10)
r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r12)
ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r14=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)={0x24, r13, 0x1, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r14}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0)
syz_80211_join_ibss(&(0x7f0000000280)='wlan0\x00', &(0x7f0000000340)=@random='\r', 0x1, 0x0)
bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYBLOB="000000000000000000000000000084a005670000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000200"/28], 0x50)

kernel console output (not intermixed with test programs):

c80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  280.591604][T18096] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  281.794769][ T1094] wlan0: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID
[  281.910788][T18220] tipc: Resetting bearer <eth:team0>
[  281.914295][T18220] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  281.938806][T18220] xfrm0: entered promiscuous mode
[  281.941032][T18220] xfrm0: entered allmulticast mode
[  282.044831][T18231] 8021q: adding VLAN 0 to HW filter on device bond36
[  282.099367][T18231] bond36: (slave veth39): Enslaving as an active interface with a down link
[  282.112963][T18232] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  282.131256][T18231] macvlan7: entered promiscuous mode
[  282.133474][T18231] macvlan7: entered allmulticast mode
[  282.136934][T18231] bond36: entered promiscuous mode
[  282.139990][T18231] 8021q: adding VLAN 0 to HW filter on device macvlan7
[  282.143558][T18231] bond36: (slave macvlan7): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  282.151190][T18231] bond36: left promiscuous mode
[  282.224806][T18220] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  282.367906][T18246] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0)
[  282.710467][T18258] __nla_validate_parse: 43 callbacks suppressed
[  282.710478][T18258] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2675'.
[  282.784920][T18262] validate_nla: 5 callbacks suppressed
[  282.784932][T18262] netlink: 'syz.2.2677': attribute type 1 has an invalid length.
[  282.825031][T18262] 8021q: adding VLAN 0 to HW filter on device bond37
[  282.838581][T18265] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2678'.
[  282.848892][T18262] bond37: (slave veth41): Enslaving as an active interface with a down link
[  282.864230][T18262] macvlan7: entered promiscuous mode
[  282.867007][T18262] macvlan7: entered allmulticast mode
[  282.870460][T18262] bond37: entered promiscuous mode
[  282.873129][T18262] 8021q: adding VLAN 0 to HW filter on device macvlan7
[  282.876773][T18262] bond37: (slave macvlan7): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  282.884129][T18262] bond37: left promiscuous mode
[  282.962572][T18267] netlink: 136 bytes leftover after parsing attributes in process `syz.0.2678'.
[  282.968679][T18267] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2678'.
[  283.063203][T18276] netlink: 'syz.2.2679': attribute type 1 has an invalid length.
[  283.103594][T18276] 8021q: adding VLAN 0 to HW filter on device bond38
[  283.215834][T18283] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2681'.
[  283.590429][T18302] netlink: 'syz.1.2686': attribute type 13 has an invalid length.
[  283.593711][T18302] netlink: 'syz.1.2686': attribute type 17 has an invalid length.
[  283.601626][T18302] tipc: Resetting bearer <eth:team0>
[  283.604901][T18302] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  283.945332][T18314] 8021q: adding VLAN 0 to HW filter on device bond2
[  283.962781][T18313] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  283.968894][T18313] bond2: (slave macvlan8): Enslaving as a backup interface with a down link
[  283.980938][T18314] bond2: (slave macvlan9): Error -98 calling set_mac_address
[  284.014705][T18313] : (slave 0!): Releasing backup interface
[  284.023606][T18313] bond27: (slave veth29): Releasing active interface
[  284.029394][T18313] bond28: (slave veth31): Releasing active interface
[  284.035865][T18313] bond30: (slave veth33): Releasing active interface
[  284.050698][T18313] bond0: (slave bond32): Releasing active interface
[  284.063054][T18313] bond2: (slave macvlan8): Releasing backup interface
[  284.121704][T18325] netlink: 'syz.0.2692': attribute type 10 has an invalid length.
[  284.191201][T18333] netlink: 'syz.1.2693': attribute type 1 has an invalid length.
[  284.240796][T18333] 8021q: adding VLAN 0 to HW filter on device bond34
[  284.261807][T18337] bond34: (slave veth31): Enslaving as an active interface with a down link
[  284.263836][T18339] netlink: 'syz.2.2694': attribute type 13 has an invalid length.
[  284.271194][T18339] netlink: 'syz.2.2694': attribute type 17 has an invalid length.
[  284.291135][T18333] macvlan8: entered promiscuous mode
[  284.293660][T18333] macvlan8: entered allmulticast mode
[  284.298114][T18333] bond34: entered promiscuous mode
[  284.300842][T18333] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  284.303559][T18333] bond34: (slave macvlan8): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  284.310191][T18333] bond34: left promiscuous mode
[  284.338671][T18339] 8021q: adding VLAN 0 to HW filter on device bond0
[  284.341625][T18339] 8021q: adding VLAN 0 to HW filter on device team0
[  284.344171][T18339] tipc: Resetting bearer <eth:team0>
[  284.348249][T18339] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  284.480623][T18353] netlink: 20824 bytes leftover after parsing attributes in process `syz.2.2698'.
[  284.499703][T18353] netlink: 'syz.2.2698': attribute type 10 has an invalid length.
[  284.527773][T18363] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2701'.
[  284.637260][T18362] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2700'.
[  284.650052][T18363] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  284.701987][T18377] netlink: 'syz.1.2704': attribute type 9 has an invalid length.
[  284.704573][T18377] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2704'.
[  284.727916][T18378] tipc: Resetting bearer <eth:team0>
[  284.730691][T18378] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  284.788661][T18373] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  285.053604][T18395] 8021q: adding VLAN 0 to HW filter on device bond2
[  285.066079][T18395] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  285.071245][T18395] bond2: (slave macvlan8): Enslaving as a backup interface with a down link
[  285.081185][T18395] tipc: Resetting bearer <eth:team0>
[  285.085427][T18395] bond34: (slave veth31): Releasing active interface
[  285.092396][T18395] bond2: (slave macvlan8): Releasing backup interface
[  285.209102][T18406] tipc: Resetting bearer <eth:team0>
[  285.245276][T18406] team0: Mode "bro`dcast" not found
[  285.250123][T18406] vlan0: entered promiscuous mode
[  285.252516][T18406] tipc: Enabling of bearer <eth:team0> rejected, already enabled
[  285.523963][T18429] delete_channel: no stack
[  285.525556][T18429] delete_channel: no stack
[  285.583865][T18449] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0)
[  285.649205][T18457] tipc: Resetting bearer <eth:team0>
[  285.664654][T18457] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  285.819311][T18457] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  285.873922][T18457] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  286.138801][T18481] xfrm0: left promiscuous mode
[  286.140617][T18481] xfrm0: left allmulticast mode
[  286.180326][T18481] vlan1: left promiscuous mode
[  286.182569][T18481] bond31: left promiscuous mode
[  286.184736][T18481] vlan1: left allmulticast mode
[  286.190097][T18481] bond31: left allmulticast mode
[  286.372276][T18486] mac80211_hwsim hwsim38 wlan0: entered promiscuous mode
[  286.375078][T18486] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  286.493640][T18493] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2732'.
[  286.521860][   T13] tipc: Subscription rejected, illegal request
[  287.025641][T18545] tipc: Resetting bearer <eth:team0>
[  287.037932][T18545] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  287.223294][T18545] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  287.332262][T18567] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  287.723796][T18598] mac80211_hwsim hwsim38 wlan0: left promiscuous mode
[  287.855158][T18605] validate_nla: 13 callbacks suppressed
[  287.855173][T18605] netlink: 'syz.0.2757': attribute type 1 has an invalid length.
[  287.881839][T18608] __nla_validate_parse: 3 callbacks suppressed
[  287.881851][T18608] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2758'.
[  287.885669][T18605] 8021q: adding VLAN 0 to HW filter on device bond33
[  287.908439][T18605] bond33: (slave wlan0): Opening slave failed
[  287.951255][T18603] netlink: 'syz.2.2756': attribute type 26 has an invalid length.
[  288.016186][T18620] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2761'.
[  288.302213][T18638] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0)
[  288.649297][T18664] netlink: 'syz.1.2772': attribute type 1 has an invalid length.
[  288.682366][T18664] 8021q: adding VLAN 0 to HW filter on device bond35
[  288.992060][T18677] netlink: 'syz.1.2775': attribute type 13 has an invalid length.
[  288.994714][T18677] netlink: 'syz.1.2775': attribute type 17 has an invalid length.
[  289.003729][T18677] tipc: Resetting bearer <eth:team0>
[  289.007428][T18677] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  289.144864][T18678] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  289.215162][T18677] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  289.248001][T18685] RDS: rds_bind could not find a transport for fe88::3, load rds_tcp or rds_rdma?
[  289.529959][T18707] netlink: 'syz.0.2781': attribute type 13 has an invalid length.
[  289.532965][T18707] netlink: 'syz.0.2781': attribute type 17 has an invalid length.
[  289.558719][T18707] 8021q: adding VLAN 0 to HW filter on device 
[  289.562802][T18707] 8021q: adding VLAN 0 to HW filter on device team0
[  289.571354][T18707] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  289.703842][T18703] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  289.769927][T18717] openvswitch: netlink: Key 6 has unexpected len 4096 expected 2
[  290.169957][T18736] netlink: 'syz.2.2786': attribute type 26 has an invalid length.
[  290.332848][T18749] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2790'.
[  290.403924][T18756] netlink: 'syz.2.2793': attribute type 10 has an invalid length.
[  290.488502][T18753] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2792'.
[  290.492341][T18753] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2792'.
[  290.770221][T18764] netlink: 'syz.2.2795': attribute type 13 has an invalid length.
[  290.774123][T18764] tipc: Resetting bearer <eth:team0>
[  290.787963][T18764] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  291.070615][T18786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  291.422759][T18800] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2801'.
[  291.426471][T18801] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2801'.
[  291.502340][T18804] tipc: Enabling of bearer <udp:syz1> rejected, failed to enable media
[  291.513818][T18801] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  291.517413][T18800] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  291.599192][T18812] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2804'.
[  291.780112][T18819] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2806'.
[  291.903508][T18828] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2808'.
[  292.729837][T18910] tipc: Resetting bearer <eth:team0>
[  292.734420][T18910] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  292.877091][T18910] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  292.936191][T18915] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  293.052878][T18914] __nla_validate_parse: 7 callbacks suppressed
[  293.052891][T18914] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2827'.
[  293.075183][T18933] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2829'.
[  293.112267][T18938] validate_nla: 9 callbacks suppressed
[  293.112276][T18938] netlink: 'syz.2.2830': attribute type 9 has an invalid length.
[  293.119137][T18938] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2830'.
[  293.181830][ T1117] block nbd0: Possible stuck request ffff888021c08000: control (read@0,1024B). Runtime 90 seconds
[  293.186144][ T1117] block nbd0: Possible stuck request ffff888021c08200: control (read@1024,1024B). Runtime 90 seconds
[  293.190878][ T1117] block nbd0: Possible stuck request ffff888021c08400: control (read@2048,1024B). Runtime 90 seconds
[  293.195600][ T1117] block nbd0: Possible stuck request ffff888021c08600: control (read@3072,1024B). Runtime 90 seconds
[  293.333080][T18948] netlink: 'syz.2.2833': attribute type 1 has an invalid length.
[  293.348861][T18948] 8021q: adding VLAN 0 to HW filter on device bond39
[  293.364916][T18948] bond39: (slave veth43): Enslaving as an active interface with a down link
[  293.374716][T18948] macvlan7: entered promiscuous mode
[  293.377005][T18948] macvlan7: entered allmulticast mode
[  293.379187][T18948] bond39: entered promiscuous mode
[  293.381251][T18948] 8021q: adding VLAN 0 to HW filter on device macvlan7
[  293.383875][T18948] bond39: (slave macvlan7): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  293.391404][T18948] bond39: left promiscuous mode
[  293.472617][T18951] netlink: 'syz.2.2834': attribute type 10 has an invalid length.
[  293.515404][T18951] sctp: [Deprecated]: syz.2.2834 (pid 18951) Use of struct sctp_assoc_value in delayed_ack socket option.
[  293.515404][T18951] Use struct sctp_sack_info instead
[  293.869542][T18965] tipc: Resetting bearer <eth:team0>
[  293.873005][T18965] bond35: (slave veth37): Releasing active interface
[  293.878782][T18965] bond36: (slave veth39): Releasing active interface
[  293.885209][T18965] bond37: (slave veth41): Releasing active interface
[  293.889880][T18965] bond39: (slave veth43): Releasing active interface
[  293.983971][T18970] netlink: 'syz.2.2837': attribute type 10 has an invalid length.
[  294.044944][T18974] netlink: 'syz.1.2838': attribute type 9 has an invalid length.
[  294.059866][T18974] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2838'.
[  294.066936][T18970] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  294.070836][T18970] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  294.177757][T18984] netlink: 'syz.1.2842': attribute type 10 has an invalid length.
[  294.181443][T18983] netlink: 'syz.1.2842': attribute type 10 has an invalid length.
[  294.301661][T18996] netlink: 'syz.0.2843': attribute type 26 has an invalid length.
[  294.382073][T19001] netlink: 'syz.0.2845': attribute type 4 has an invalid length.
[  294.385498][T19001] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2845'.
[  294.395619][T19003] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2846'.
[  294.446292][T19007] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2848'.
[  294.450779][T19009] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2848'.
[  294.484799][T19015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2849'.
[  294.490592][T19015] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2849'.
[  294.503829][T19015] geneve2: entered promiscuous mode
[  294.506168][T19015] geneve2: entered allmulticast mode
[  294.511290][ T5864] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  294.516512][ T5864] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  294.520918][ T5864] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  294.524073][ T5864] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  294.579877][T19020] tipc: Resetting bearer <eth:team0>
[  294.584362][T19020] xfrm0: left promiscuous mode
[  294.585994][T19020] xfrm0: left allmulticast mode
[  294.588208][T19020] vlan0: left promiscuous mode
[  294.605745][T19020] geneve2: left promiscuous mode
[  294.608248][T19020] geneve2: left allmulticast mode
[  294.612235][ T5864] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0
[  294.615686][ T5864] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  294.623078][ T5864] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0
[  294.628158][ T5864] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  294.631770][ T5864] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0
[  294.636120][ T5864] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  294.642929][ T5864] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0
[  294.647221][ T5864] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  294.770887][T19027] syzkaller0: entered promiscuous mode
[  294.772767][T19027] syzkaller0: entered allmulticast mode
[  294.775620][T19029] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  296.011031][T19040] tipc: Resetting bearer <eth:team0>
[  296.109780][T19055] netlink: 'syz.2.2856': attribute type 10 has an invalid length.
[  296.148822][T19055] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  296.158500][T19055] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  296.930081][T19072] 8021q: adding VLAN 0 to HW filter on device bond36
[  297.061391][T19094] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[  297.120300][T19105] IPVS: set_ctl: invalid protocol: 255 10.1.1.0:20004
[  297.123057][T19104] IPVS: set_ctl: invalid protocol: 255 10.1.1.0:20004
[  297.660568][T19149] _Z`Ԁ@: entered promiscuous mode
[  298.314289][T19193] validate_nla: 3 callbacks suppressed
[  298.314298][T19193] netlink: 'syz.2.2885': attribute type 13 has an invalid length.
[  298.321876][T19193] netlink: 'syz.2.2885': attribute type 17 has an invalid length.
[  298.327646][T19193] tipc: Resetting bearer <eth:team0>
[  298.329955][T19193] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  298.423142][T19193] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  298.464610][T19201] netlink: 'syz.1.2887': attribute type 13 has an invalid length.
[  298.468135][T19201] netlink: 'syz.1.2887': attribute type 17 has an invalid length.
[  298.482562][T19193] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  298.492950][T19201] 8021q: adding VLAN 0 to HW filter on device bond0
[  298.496276][T19201] 8021q: adding VLAN 0 to HW filter on device team0
[  298.499569][T19201] tipc: Resetting bearer <eth:team0>
[  298.501447][T19201] tipc: Resetting bearer <eth:team0>
[  298.505237][T19201] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  298.514863][T19201] xfrm0: entered promiscuous mode
[  298.517654][T19201] xfrm0: entered allmulticast mode
[  298.562814][T19198] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  298.923890][T19204] netlink: 'syz.0.2888': attribute type 26 has an invalid length.
[  299.013690][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  299.016224][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  299.061563][T19217] __nla_validate_parse: 7 callbacks suppressed
[  299.061576][T19217] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2891'.
[  299.279296][T19228] netlink: 'syz.1.2894': attribute type 9 has an invalid length.
[  299.281913][T19228] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2894'.
[  299.659264][T19255] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2899'.
[  299.734343][T19262] netlink: 'syz.1.2901': attribute type 10 has an invalid length.
[  299.739269][T19263] netlink: 'syz.2.2900': attribute type 1 has an invalid length.
[  299.754975][T19263] 8021q: adding VLAN 0 to HW filter on device bond40
[  299.779887][T19263] bond40: (slave veth45): Enslaving as an active interface with a down link
[  299.794037][T19263] macvlan7: entered promiscuous mode
[  299.796283][T19263] macvlan7: entered allmulticast mode
[  299.801101][T19263] bond40: entered promiscuous mode
[  299.804061][T19263] 8021q: adding VLAN 0 to HW filter on device macvlan7
[  299.811046][T19263] bond40: (slave macvlan7): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  299.819391][T19263] bond40: left promiscuous mode
[  299.914445][T19269] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2902'.
[  300.028184][T19281] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  300.149185][T19298] team0: Mode changed to "broadcast"
[  300.152153][T19298] vlan0: entered promiscuous mode
[  300.154277][T19298] ip6gretap0: entered promiscuous mode
[  300.163196][T19298] tipc: Enabled bearer <eth:team0>, priority 0
[  300.176173][T19300] netlink: 'syz.2.2909': attribute type 1 has an invalid length.
[  300.199864][T19300] 8021q: adding VLAN 0 to HW filter on device bond41
[  300.223458][T19300] bond41: (slave veth47): Enslaving as an active interface with a down link
[  300.236546][T19300] macvlan7: entered promiscuous mode
[  300.238805][T19300] macvlan7: entered allmulticast mode
[  300.241591][T19300] bond41: entered promiscuous mode
[  300.244310][T19300] 8021q: adding VLAN 0 to HW filter on device macvlan7
[  300.250206][T19300] bond41: (slave macvlan7): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  300.257597][T19300] bond41: left promiscuous mode
[  300.561318][T19315] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2913'.
[  300.669812][T19328] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2915'.
[  300.694770][T19317] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2914'.
[  300.816976][T19342] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2918'.
[  300.818932][T19337] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  300.914534][T19347] tipc: Resetting bearer <eth:team0>
[  300.999387][T19358] netlink: 'syz.2.2922': attribute type 13 has an invalid length.
[  301.004582][T19358] tipc: Resetting bearer <eth:team0>
[  301.007528][T19358] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  301.075800][T19362] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  301.095371][T19362] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  301.161882][T19358] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2922'.
[  301.167530][T19358] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  301.225434][T19366] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  302.037502][T19402] tipc: Resetting bearer <eth:team0>
[  302.043574][T19402] xfrm0: left promiscuous mode
[  302.045206][T19402] xfrm0: left allmulticast mode
[  302.084513][T19407] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2934'.
[  302.479959][T19412] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  302.735532][T19433] 8021q: adding VLAN 0 to HW filter on device bond34
[  302.743827][T19433] bond34: (slave wlan0): Opening slave failed
[  303.010591][T19450] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  303.200900][T19453] tipc: Resetting bearer <eth:team0>
[  303.209456][T19453] xfrm0: left promiscuous mode
[  303.212458][T19453] xfrm0: left allmulticast mode
[  303.220330][T19453] vlan0: left promiscuous mode
[  303.274025][T19462] 8021q: adding VLAN 0 to HW filter on device bond0
[  303.279021][T19462] 8021q: adding VLAN 0 to HW filter on device team0
[  303.287275][T19462] tipc: Resetting bearer <eth:team0>
[  303.289630][T19462] tipc: Resetting bearer <eth:team0>
[  303.294798][T19462] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  303.499520][T19469] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  303.555467][T19469] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  303.725870][T19486] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0)
[  303.807131][T19491] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  304.250336][T19500] __nla_validate_parse: 4 callbacks suppressed
[  304.250352][T19500] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2955'.
[  304.308615][T19503] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2956'.
[  304.338344][T19500] atomic_op ffff88803b92a198 conn xmit_atomic 0000000000000000
[  304.339735][T19507] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  304.373687][T19512] validate_nla: 6 callbacks suppressed
[  304.373699][T19512] netlink: 'syz.1.2959': attribute type 1 has an invalid length.
[  304.404654][T19512] 8021q: adding VLAN 0 to HW filter on device bond37
[  304.432233][T19512] bond37: (slave veth33): Enslaving as an active interface with a down link
[  304.451659][T19512] macvlan9: entered promiscuous mode
[  304.453911][T19512] macvlan9: entered allmulticast mode
[  304.457260][T19512] bond37: entered promiscuous mode
[  304.459855][T19512] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  304.463204][T19512] bond37: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  304.470505][T19512] bond37: left promiscuous mode
[  304.613431][T19522] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2961'.
[  304.619337][T19522] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2961'.
[  304.883251][T19541] netlink: 'syz.1.2964': attribute type 1 has an invalid length.
[  304.897072][T19541] 8021q: adding VLAN 0 to HW filter on device bond38
[  304.924092][T19541] bond38: (slave veth35): Enslaving as an active interface with a down link
[  304.940680][T19541] macvlan9: entered promiscuous mode
[  304.943023][T19541] macvlan9: entered allmulticast mode
[  304.945862][T19541] bond38: entered promiscuous mode
[  304.949042][T19541] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  304.952525][T19541] bond38: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  304.960999][T19541] bond38: left promiscuous mode
[  305.254512][T19549] netlink: 'syz.1.2967': attribute type 1 has an invalid length.
[  305.297603][T19549] 8021q: adding VLAN 0 to HW filter on device bond39
[  305.300887][T19557] mac80211_hwsim hwsim38 wlan0: entered promiscuous mode
[  305.352096][T19561] netlink: 'syz.1.2970': attribute type 9 has an invalid length.
[  305.355354][T19561] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2970'.
[  305.355706][T19563] netlink: 'syz.0.2971': attribute type 7 has an invalid length.
[  305.368184][T19563] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2971'.
[  305.400110][T19565] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  305.484958][T19573] tipc: Resetting bearer <eth:team0>
[  305.491280][T19573] bond37: (slave veth33): Releasing active interface
[  305.496904][T19573] bond38: (slave veth35): Releasing active interface
[  305.787862][T19596] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2978'.
[  305.826516][T19596] tipc: Resetting bearer <eth:team0>
[  305.869511][T19602] netlink: 'syz.0.2980': attribute type 9 has an invalid length.
[  305.872673][T19602] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2980'.
[  305.914734][T19604] netlink: 'syz.0.2981': attribute type 7 has an invalid length.
[  305.918318][T19604] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2981'.
[  306.133350][T19614] netlink: 'syz.2.2983': attribute type 10 has an invalid length.
[  306.148414][T19624] netlink: 'syz.0.2986': attribute type 1 has an invalid length.
[  306.189901][T19624] 8021q: adding VLAN 0 to HW filter on device bond35
[  306.214273][T19624] bond35: (slave veth35): Enslaving as an active interface with a down link
[  306.229968][T19624] macvlan9: entered promiscuous mode
[  306.232148][T19624] macvlan9: entered allmulticast mode
[  306.234853][T19624] bond35: entered promiscuous mode
[  306.238462][T19624] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  306.247549][T19624] bond35: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  306.254020][T19624] bond35: left promiscuous mode
[  306.353499][T19634] netlink: 'syz.0.2988': attribute type 13 has an invalid length.
[  306.360080][T19634] tipc: Resetting bearer <eth:team0>
[  306.363844][T19634] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  306.414716][T19635] syz.2.2989: vmalloc error: size 16781312, failed to allocated page array size 32776, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  306.426059][T19635] CPU: 1 UID: 0 PID: 19635 Comm: syz.2.2989 Not tainted syzkaller #0 PREEMPT(full) 
[  306.426070][T19635] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  306.426075][T19635] Call Trace:
[  306.426078][T19635]  <TASK>
[  306.426082][T19635]  dump_stack_lvl+0x189/0x250
[  306.426095][T19635]  ? __pfx_dump_stack_lvl+0x10/0x10
[  306.426104][T19635]  ? __pfx__printk+0x10/0x10
[  306.426113][T19635]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  306.426143][T19635]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  306.426154][T19635]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  306.426162][T19635]  warn_alloc+0x214/0x310
[  306.426175][T19635]  ? __pfx_warn_alloc+0x10/0x10
[  306.426189][T19635]  ? __get_vm_area_node+0x28f/0x300
[  306.426198][T19635]  ? xskq_create+0xbf/0x170
[  306.426210][T19635]  __vmalloc_node_range_noprof+0x67e/0x12f0
[  306.426231][T19635]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  306.426242][T19635]  ? __kasan_kmalloc+0x93/0xb0
[  306.426253][T19635]  vmalloc_user_noprof+0xad/0xf0
[  306.426262][T19635]  ? xskq_create+0xbf/0x170
[  306.426271][T19635]  xskq_create+0xbf/0x170
[  306.426281][T19635]  xsk_init_queue+0xb0/0x110
[  306.426291][T19635]  xsk_setsockopt+0x57b/0x8d0
[  306.426318][T19635]  ? __pfx_xsk_setsockopt+0x10/0x10
[  306.426327][T19635]  ? __pfx_aa_sk_perm+0x10/0x10
[  306.426338][T19635]  ? __se_sys_futex+0x36f/0x400
[  306.426346][T19635]  ? aa_sock_opt_perm+0xff/0x1b0
[  306.426354][T19635]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  306.426361][T19635]  ? __pfx_xsk_setsockopt+0x10/0x10
[  306.426370][T19635]  do_sock_setsockopt+0x17c/0x1b0
[  306.426380][T19635]  __x64_sys_setsockopt+0x13f/0x1b0
[  306.426389][T19635]  do_syscall_64+0xfa/0x3b0
[  306.426396][T19635]  ? lockdep_hardirqs_on+0x9c/0x150
[  306.426405][T19635]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  306.426411][T19635]  ? exc_page_fault+0x9f/0xf0
[  306.426421][T19635]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  306.426428][T19635] RIP: 0033:0x7f6a7b98ebe9
[  306.426435][T19635] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  306.426441][T19635] RSP: 002b:00007f6a7c761038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  306.426450][T19635] RAX: ffffffffffffffda RBX: 00007f6a7bbc5fa0 RCX: 00007f6a7b98ebe9
[  306.426455][T19635] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000006
[  306.426459][T19635] RBP: 00007f6a7ba11e19 R08: 0000000000000004 R09: 0000000000000000
[  306.426463][T19635] R10: 0000200000001780 R11: 0000000000000246 R12: 0000000000000000
[  306.426468][T19635] R13: 00007f6a7bbc6038 R14: 00007f6a7bbc5fa0 R15: 00007fffa9566128
[  306.426479][T19635]  </TASK>
[  306.528365][T19642] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  306.536779][T19635] Mem-Info:
[  306.538198][T19635] active_anon:5705 inactive_anon:0 isolated_anon:0
[  306.538198][T19635]  active_file:1564 inactive_file:38326 isolated_file:0
[  306.538198][T19635]  unevictable:1768 dirty:126 writeback:0
[  306.538198][T19635]  slab_reclaimable:10142 slab_unreclaimable:110789
[  306.538198][T19635]  mapped:18551 shmem:2414 pagetables:1070
[  306.538198][T19635]  sec_pagetables:0 bounce:0
[  306.538198][T19635]  kernel_misc_reclaimable:0
[  306.538198][T19635]  free:236399 free_pcp:13553 free_cma:0
[  306.541265][T19634] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  306.568041][T19635] Node 0 active_anon:11932kB inactive_anon:0kB active_file:5452kB inactive_file:10316kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:30644kB dirty:424kB writeback:0kB shmem:4848kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5660kB pagetables:2408kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  306.581930][T19635] Node 1 active_anon:10888kB inactive_anon:0kB active_file:804kB inactive_file:142988kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:43560kB dirty:80kB writeback:0kB shmem:4808kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:10036kB pagetables:1872kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  306.595174][T19635] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  306.608994][T19635] lowmem_reserve[]: 0 811 811 811 811
[  306.611271][T19635] Node 0 DMA32 free:264396kB boost:0kB min:33660kB low:42072kB high:50484kB reserved_highatomic:0KB free_highatomic:0KB active_anon:11864kB inactive_anon:0kB active_file:5452kB inactive_file:10316kB unevictable:3536kB writepending:424kB present:1556484kB managed:830928kB mlocked:0kB bounce:0kB free_pcp:18684kB local_pcp:13364kB free_cma:0kB
[  306.624987][T19635] lowmem_reserve[]: 0 0 0 0 0
[  306.632600][T19635] Node 1 DMA32 free:458616kB boost:0kB min:19192kB low:23988kB high:28784kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  306.644921][T19635] lowmem_reserve[]: 0 0 854 854 854
[  306.649441][T19635] Node 1 Normal free:207224kB boost:0kB min:36612kB low:45764kB high:54916kB reserved_highatomic:0KB free_highatomic:0KB active_anon:10824kB inactive_anon:0kB active_file:804kB inactive_file:142988kB unevictable:3536kB writepending:80kB present:1048576kB managed:874952kB mlocked:0kB bounce:0kB free_pcp:35256kB local_pcp:17940kB free_cma:0kB
[  306.660776][T19635] lowmem_reserve[]: 0 0 0 0 0
[  306.662763][T19635] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  306.669295][T19635] Node 0 DMA32: 465*4kB (M) 723*8kB (UME) 309*16kB (UME) 81*32kB (UME) 155*64kB (UM) 143*128kB (UME) 41*256kB (UM) 5*512kB (UME) 3*1024kB (UM) 2*2048kB (UM) 49*4096kB (M) = 264332kB
[  306.676865][T19635] Node 1 DMA32: 2*4kB (M) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 1*128kB (M) 2*256kB (M) 2*512kB (M) 2*1024kB (M) 2*2048kB (M) 110*4096kB (M) = 458616kB
[  306.683252][T19635] Node 1 Normal: 1100*4kB (UM) 663*8kB (UME) 215*16kB (UME) 655*32kB (UME) 223*64kB (UME) 59*128kB (UME) 17*256kB (UM) 11*512kB (UME) 2*1024kB (ME) 6*2048kB (UM) 31*4096kB (UM) = 207224kB
[  306.692580][T19635] Node 0 hugepages_total=6 hugepages_free=0 hugepages_surp=4 hugepages_size=2048kB
[  306.695807][T19635] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  306.700474][T19635] 42289 total pagecache pages
[  306.702385][T19635] 0 pages in swap cache
[  306.704228][T19635] Free swap  = 124996kB
[  306.705925][T19635] Total swap = 124996kB
[  306.707877][T19635] 786301 pages RAM
[  306.709145][T19635] 0 pages HighMem/MovableOnly
[  306.710672][T19635] 241337 pages reserved
[  306.711986][T19635] 0 pages cma reserved
[  306.751110][T19650] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2991'.
[  306.810529][T19654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  307.223099][T19679] tipc: Resetting bearer <eth:team0>
[  307.233001][T19679] mac80211_hwsim hwsim38 wlan0: left promiscuous mode
[  307.237082][T19679] vlan0: left promiscuous mode
[  307.239096][T19679] ip6gretap0: left promiscuous mode
[  307.368546][T19688] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.
[  308.028698][T19744] bond40: (slave veth45): Releasing active interface
[  308.031784][T19744] bond41: (slave veth47): Releasing active interface
[  308.183985][T19757] 8021q: adding VLAN 0 to HW filter on device bond0
[  308.187646][T19757] 8021q: adding VLAN 0 to HW filter on device team0
[  308.190076][T19757] tipc: Resetting bearer <eth:team0>
[  308.191868][T19757] tipc: Resetting bearer <eth:team0>
[  308.194422][T19757] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  308.330072][T19766] 8021q: adding VLAN 0 to HW filter on device bond42
[  308.688503][T19794] batadv1: entered promiscuous mode
[  308.690635][T19794] batadv1: entered allmulticast mode
[  308.730971][T19800] batman_adv: batadv0: Adding interface: ipvlan2
[  308.733792][T19800] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  308.751183][T19800] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active
[  309.473503][T19827] validate_nla: 12 callbacks suppressed
[  309.473518][T19827] netlink: 'syz.0.3030': attribute type 1 has an invalid length.
[  309.504066][T19827] 8021q: adding VLAN 0 to HW filter on device bond36
[  309.528584][T19827] bond36: (slave veth37): Enslaving as an active interface with a down link
[  309.540590][T19827] macvlan9: entered promiscuous mode
[  309.542795][T19827] macvlan9: entered allmulticast mode
[  309.545710][T19827] bond36: entered promiscuous mode
[  309.549404][T19827] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  309.552849][T19827] bond36: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  309.560933][T19827] bond36: left promiscuous mode
[  309.654565][T19830] __nla_validate_parse: 83 callbacks suppressed
[  309.654577][T19830] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3029'.
[  309.673755][T19838] netlink: 'syz.0.3031': attribute type 13 has an invalid length.
[  309.677892][T19838] netlink: 'syz.0.3031': attribute type 17 has an invalid length.
[  309.711816][T19838] 8021q: adding VLAN 0 to HW filter on device 
[  309.715642][T19838] 8021q: adding VLAN 0 to HW filter on device team0
[  309.722626][T19838] tipc: Resetting bearer <eth:team0>
[  309.725404][T19842] netlink: 'syz.1.3032': attribute type 13 has an invalid length.
[  309.731107][T19838] tipc: Resetting bearer <eth:team0>
[  309.736234][T19842] netlink: 'syz.1.3032': attribute type 17 has an invalid length.
[  309.741503][T19838] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  309.782559][T19842] 8021q: adding VLAN 0 to HW filter on device bond0
[  309.786266][T19842] 8021q: adding VLAN 0 to HW filter on device team0
[  309.790744][T19842] tipc: Resetting bearer <eth:team0>
[  309.793246][T19842] tipc: Resetting bearer <eth:team0>
[  309.800731][T19842] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  309.903893][T19857] tun0: tun_chr_ioctl cmd 1074025698
[  309.946942][T19862] netlink: 'syz.2.3037': attribute type 1 has an invalid length.
[  309.962946][T19863] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3035'.
[  309.973444][T19862] 8021q: adding VLAN 0 to HW filter on device bond43
[  309.999121][T19862] bond43: (slave veth49): Enslaving as an active interface with a down link
[  310.011018][T19862] macvlan7: entered promiscuous mode
[  310.013378][T19862] macvlan7: entered allmulticast mode
[  310.016297][T19862] bond43: entered promiscuous mode
[  310.020751][T19862] 8021q: adding VLAN 0 to HW filter on device macvlan7
[  310.024406][T19862] bond43: (slave macvlan7): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  310.032563][T19862] bond43: left promiscuous mode
[  310.079690][T19867] tun0: tun_chr_ioctl cmd 2148045848
[  310.308048][T19877] tipc: Resetting bearer <eth:team0>
[  310.312185][T19877] bond43: (slave veth49): Releasing active interface
[  310.410912][T19877] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3039'.
[  310.414912][T19877] netlink: 'syz.2.3039': attribute type 10 has an invalid length.
[  310.453824][T19877] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  310.459706][T19877] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  310.798197][T19885] netlink: 'syz.1.3040': attribute type 1 has an invalid length.
[  310.820178][T19895] netlink: 'syz.0.3041': attribute type 13 has an invalid length.
[  310.823145][T19895] netlink: 'syz.0.3041': attribute type 17 has an invalid length.
[  310.824086][T19885] 8021q: adding VLAN 0 to HW filter on device bond41
[  310.832411][T19895] tipc: Resetting bearer <eth:team0>
[  310.834759][T19895] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  310.940281][T19904] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0)
[  311.322615][T19923] tipc: Resetting bearer <eth:team0>
[  311.326223][T19923] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  311.346831][T19923] xfrm0: entered promiscuous mode
[  311.349664][T19923] xfrm0: entered allmulticast mode
[  311.443342][T19931] netlink: 3 bytes leftover after parsing attributes in process `syz.0.3049'.
[  311.453505][T19931] batadv1: entered promiscuous mode
[  311.455682][T19931] batadv1: entered allmulticast mode
[  311.505993][T19928] tipc: Resetting bearer <eth:team0>
[  311.570997][T19939] 8021q: adding VLAN 0 to HW filter on device bond44
[  311.588354][T19939] bond44: (slave veth51): Enslaving as an active interface with a down link
[  311.596265][T19939] macvlan7: entered promiscuous mode
[  311.600104][T19939] macvlan7: entered allmulticast mode
[  311.602393][T19939] bond44: entered promiscuous mode
[  311.604510][T19939] 8021q: adding VLAN 0 to HW filter on device macvlan7
[  311.607737][T19939] bond44: (slave macvlan7): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  311.614990][T19939] bond44: left promiscuous mode
[  311.755165][T19946] tun0: tun_chr_ioctl cmd 2148045848
[  311.761136][T19946] tun0: tun_chr_ioctl cmd 21731
[  311.849018][T19948] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3053'.
[  311.849386][T19950] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3053'.
[  311.858341][T19950] 8021q: adding VLAN 0 to HW filter on device bond3
[  311.946753][T19962] netlink: 216 bytes leftover after parsing attributes in process `syz.2.3055'.
[  311.949936][T19962] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3055'.
[  311.952937][T19962] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3055'.
[  312.346006][T19987] IPVS: set_ctl: invalid protocol: 41 100.1.1.1:20003
[  312.638780][T20024] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3065'.
[  312.673244][T20024] vlan0: entered promiscuous mode
[  313.024076][T20043] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  313.027717][T20043] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  313.460436][T20079] bond0: entered promiscuous mode
[  313.649089][T20084] 8021q: adding VLAN 0 to HW filter on device macvlan7
[  313.652834][T20084] bond3: (slave macvlan7): Enslaving as a backup interface with a down link
[  313.835613][T20100] 8021q: adding VLAN 0 to HW filter on device bond37
[  313.859413][T20100] bond37: (slave veth39): Enslaving as an active interface with a down link
[  313.874190][T20100] macvlan9: entered promiscuous mode
[  313.876267][T20100] macvlan9: entered allmulticast mode
[  313.880594][T20100] bond37: entered promiscuous mode
[  313.883228][T20100] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  313.887157][T20100] bond37: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  313.893464][T20100] bond37: left promiscuous mode
[  314.774509][T20166] __nla_validate_parse: 5 callbacks suppressed
[  314.774522][T20166] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3091'.
[  314.831740][T20172] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms
[  314.836116][T20172] (unnamed net_device) (uninitialized): option use_carrier: invalid value (5)
[  314.925624][T20182] validate_nla: 14 callbacks suppressed
[  314.925634][T20182] netlink: 'syz.1.3096': attribute type 7 has an invalid length.
[  314.931025][T20182] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3096'.
[  315.129313][T20197] netlink: 'syz.2.3099': attribute type 10 has an invalid length.
[  315.191834][T20210] netlink: 'syz.1.3103': attribute type 13 has an invalid length.
[  315.195107][T20210] netlink: 'syz.1.3103': attribute type 17 has an invalid length.
[  315.199539][T20197] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  315.203517][T20197] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  315.214871][T20210] tipc: Resetting bearer <eth:team0>
[  315.218858][T20210] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  315.335556][T20210] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  315.349913][T20217] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3105'.
[  315.384187][T20217] pim6reg1: entered promiscuous mode
[  315.387210][T20217] pim6reg1: entered allmulticast mode
[  315.392061][T20210] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  315.930266][T20219] netlink: 'syz.2.3106': attribute type 4 has an invalid length.
[  316.354830][T20241] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3110'.
[  316.723066][T20249] bond0: left promiscuous mode
[  316.725464][T20249] vlan0: left promiscuous mode
[  316.795557][T20257] netlink: 'syz.2.3114': attribute type 1 has an invalid length.
[  316.823418][T20257] 8021q: adding VLAN 0 to HW filter on device bond45
[  316.854708][T20257] bond45: (slave veth53): Enslaving as an active interface with a down link
[  316.879681][T20257] macvlan8: entered promiscuous mode
[  316.882109][T20257] macvlan8: entered allmulticast mode
[  316.884930][T20257] bond45: entered promiscuous mode
[  316.888875][T20257] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  316.892471][T20257] bond45: (slave macvlan8): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  316.900040][T20257] bond45: left promiscuous mode
[  317.368101][T20271] netlink: 'syz.0.3118': attribute type 10 has an invalid length.
[  317.478295][T20282] netlink: 'syz.1.3121': attribute type 1 has an invalid length.
[  317.504106][T20282] 8021q: adding VLAN 0 to HW filter on device bond42
[  317.529116][T20282] bond42: (slave veth37): Enslaving as an active interface with a down link
[  317.543281][T20282] macvlan9: entered promiscuous mode
[  317.545715][T20282] macvlan9: entered allmulticast mode
[  317.549558][T20282] bond42: entered promiscuous mode
[  317.552521][T20282] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  317.556082][T20282] bond42: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  317.565263][T20282] bond42: left promiscuous mode
[  317.770022][T20290] netlink: 'syz.1.3122': attribute type 10 has an invalid length.
[  317.932479][T20308] netlink: 'syz.0.3124': attribute type 13 has an invalid length.
[  317.938270][T20308] tipc: Resetting bearer <eth:team0>
[  317.942865][T20308] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  318.004834][T20315] 8021q: adding VLAN 0 to HW filter on device bond46
[  318.098752][T20315] bond46: (slave veth55): Enslaving as an active interface with a down link
[  318.112009][T20319] tipc: Resetting bearer <eth:team0>
[  318.118164][T20319] batman_adv: batadv0: Removing interface: ipvlan2
[  318.122618][T20319] bond42: (slave veth37): Releasing active interface
[  318.131713][T20321] macvlan8: entered promiscuous mode
[  318.133857][T20321] macvlan8: entered allmulticast mode
[  318.137736][T20321] bond46: entered promiscuous mode
[  318.140285][T20321] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  318.143249][T20321] bond46: (slave macvlan8): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  318.151550][T20321] bond46: left promiscuous mode
[  318.175482][T20313] team0: Unable to change to the same mode the team is in
[  318.179822][T20317] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  318.193713][T20319] vlan0: entered promiscuous mode
[  318.258354][T20308] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  318.562896][T20343] 8021q: adding VLAN 0 to HW filter on device bond43
[  318.891960][T20372] 8021q: adding VLAN 0 to HW filter on device bond44
[  318.910045][T20372] bond44: (slave veth39): Enslaving as an active interface with a down link
[  318.920211][T20372] macvlan9: entered promiscuous mode
[  318.922280][T20372] macvlan9: entered allmulticast mode
[  318.924834][T20372] bond44: entered promiscuous mode
[  318.927847][T20372] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  318.931101][T20372] bond44: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  318.939770][T20372] bond44: left promiscuous mode
[  319.174900][T20378] netlink: 1596 bytes leftover after parsing attributes in process `syz.2.3141'.
[  320.007214][T20401] validate_nla: 3 callbacks suppressed
[  320.007227][T20401] netlink: 'syz.1.3146': attribute type 1 has an invalid length.
[  320.030767][T20401] 8021q: adding VLAN 0 to HW filter on device bond45
[  320.051542][T20401] bond45: (slave veth41): Enslaving as an active interface with a down link
[  320.064142][T20401] macvlan9: entered promiscuous mode
[  320.066428][T20401] macvlan9: entered allmulticast mode
[  320.069311][T20401] bond45: entered promiscuous mode
[  320.071998][T20401] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  320.075369][T20401] bond45: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  320.082960][T20401] bond45: left promiscuous mode
[  320.168814][T20411] netlink: 'syz.2.3149': attribute type 9 has an invalid length.
[  320.182149][T20411] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3149'.
[  320.206948][T20414] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3150'.
[  320.217831][T20414] netlink: 'syz.1.3150': attribute type 10 has an invalid length.
[  320.507988][T20423] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3153'.
[  320.592273][T20442] tipc: Resetting bearer <eth:team0>
[  320.598976][T20442] bond44: (slave veth39): Releasing active interface
[  320.603545][T20442] bond45: (slave veth41): Releasing active interface
[  320.653876][T20446] netlink: 'syz.2.3156': attribute type 1 has an invalid length.
[  320.681596][T20446] 8021q: adding VLAN 0 to HW filter on device bond47
[  320.696056][T20446] bond47: (slave veth57): Enslaving as an active interface with a down link
[  320.708557][T20446] macvlan8: entered promiscuous mode
[  320.710488][T20446] macvlan8: entered allmulticast mode
[  320.712688][T20446] bond47: entered promiscuous mode
[  320.714829][T20446] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  320.719234][T20446] bond47: (slave macvlan8): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  320.725614][T20446] bond47: left promiscuous mode
[  320.769585][T20442] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  320.774534][T20442] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  320.850212][T20457] netlink: 'syz.2.3158': attribute type 9 has an invalid length.
[  320.852967][T20457] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3158'.
[  321.121328][T20474] netlink: 20824 bytes leftover after parsing attributes in process `syz.2.3161'.
[  321.184263][T20481] netlink: 'syz.2.3163': attribute type 1 has an invalid length.
[  321.205741][T20481] 8021q: adding VLAN 0 to HW filter on device bond48
[  321.212534][T20478] netlink: 'syz.0.3162': attribute type 10 has an invalid length.
[  321.230500][T20481] bond48: (slave veth59): Enslaving as an active interface with a down link
[  321.254149][T20481] macvlan8: entered promiscuous mode
[  321.257763][T20481] macvlan8: entered allmulticast mode
[  321.262049][T20481] bond48: entered promiscuous mode
[  321.264643][T20481] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  321.269590][T20481] bond48: (slave macvlan8): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  321.278183][T20481] bond48: left promiscuous mode
[  321.403687][T20493] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3165'.
[  321.407613][T20493] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3165'.
[  321.415733][T20493] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3
[  321.423265][T20493] gretap3: entered promiscuous mode
[  321.426764][T20493] gretap3: entered allmulticast mode
[  321.430380][T20493] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3165'.
[  321.433703][T20493] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3165'.
[  321.559348][T20505] netlink: 'syz.0.3168': attribute type 13 has an invalid length.
[  321.562586][T20505] netlink: 'syz.0.3168': attribute type 17 has an invalid length.
[  321.576844][T20505] tipc: Resetting bearer <eth:team0>
[  321.580374][T20505] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  321.820922][T20505] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  321.838808][T20533] tipc: Resetting bearer <eth:team0>
[  321.860245][T20533] team0: Unable to change to the same mode the team is in
[  321.864364][T20533] tipc: Enabling of bearer <eth:team0> rejected, already enabled
[  321.877948][T20505] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  321.972887][T20545] netlink: 'syz.1.3175': attribute type 13 has an invalid length.
[  321.989060][T20545] tipc: Resetting bearer <eth:team0>
[  321.992470][T20545] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  322.083241][T20536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  322.087404][T20536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  322.122107][T20554] 8021q: adding VLAN 0 to HW filter on device bond0
[  322.125313][T20554] 8021q: adding VLAN 0 to HW filter on device team0
[  322.128738][T20554] tipc: Resetting bearer <eth:team0>
[  322.130604][T20554] tipc: Resetting bearer <eth:team0>
[  322.133588][T20554] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  322.147157][T20554] xfrm0: entered promiscuous mode
[  322.149364][T20554] xfrm0: entered allmulticast mode
[  322.541843][T20558] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  322.545583][T20558] syzkaller0: entered promiscuous mode
[  322.548259][T20558] syzkaller0: entered allmulticast mode
[  322.636282][T20560] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3180'.
[  322.880293][T20551] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  323.035614][T20577] 8021q: adding VLAN 0 to HW filter on device bond46
[  323.110536][T20583] tun0: tun_chr_ioctl cmd 2147767520
[  323.259576][ T1117] block nbd0: Possible stuck request ffff888021c08000: control (read@0,1024B). Runtime 120 seconds
[  323.264452][ T1117] block nbd0: Possible stuck request ffff888021c08200: control (read@1024,1024B). Runtime 120 seconds
[  323.268701][ T1117] block nbd0: Possible stuck request ffff888021c08400: control (read@2048,1024B). Runtime 120 seconds
[  323.272328][ T1117] block nbd0: Possible stuck request ffff888021c08600: control (read@3072,1024B). Runtime 120 seconds
[  323.619696][T20630] tipc: Resetting bearer <eth:team0>
[  323.624368][T20630] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  323.750086][T20630] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  323.819260][T20637] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  323.858113][T20648] tipc: Resetting bearer <eth:team0>
[  323.861069][T20648] bond44: (slave veth51): Releasing active interface
[  323.864967][T20648] bond3: (slave macvlan7): Releasing backup interface
[  323.870692][T20648] bond45: (slave veth53): Releasing active interface
[  323.875075][T20648] bond46: (slave veth55): Releasing active interface
[  323.880518][T20648] bond47: (slave veth57): Releasing active interface
[  323.884675][T20648] bond48: (slave veth59): Releasing active interface
[  324.862043][T20685] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  324.872580][T20685] tipc: Enabling of bearer <udp:syz0> rejected, max 3 bearers permitted
[  325.461999][T20706] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  325.487168][T20709] validate_nla: 10 callbacks suppressed
[  325.487179][T20709] netlink: 'syz.2.3218': attribute type 7 has an invalid length.
[  325.491591][T20709] __nla_validate_parse: 13 callbacks suppressed
[  325.491598][T20709] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3218'.
[  325.766051][T20716] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3221'.
[  325.834332][T20726] netlink: 'syz.2.3223': attribute type 9 has an invalid length.
[  325.838987][T20724] netlink: 'syz.0.3222': attribute type 13 has an invalid length.
[  325.843582][T20724] netlink: 'syz.0.3222': attribute type 17 has an invalid length.
[  325.849653][T20726] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3223'.
[  325.961171][T20730] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  326.120217][T20736] netlink: 'syz.1.3226': attribute type 1 has an invalid length.
[  326.137689][T20736] 8021q: adding VLAN 0 to HW filter on device bond0
[  326.340853][ T5913] bond0 (unregistering): Released all slaves
[  326.401854][T20750] netlink: 27 bytes leftover after parsing attributes in process `syz.1.3229'.
[  326.505920][T20755] tipc: Resetting bearer <eth:team0>
[  326.517000][T20755] bond35: (slave veth35): Releasing active interface
[  326.534681][T20755] bond36: (slave veth37): Releasing active interface
[  326.544408][T20755] bond37: (slave veth39): Releasing active interface
[  326.709293][T20774] netlink: 'syz.0.3233': attribute type 9 has an invalid length.
[  326.712577][T20774] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3233'.
[  326.932082][T20800] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3234'.
[  327.067519][T20815] netlink: 'syz.0.3240': attribute type 9 has an invalid length.
[  327.070176][T20815] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3240'.
[  327.273619][T20817] netlink: 'syz.0.3241': attribute type 10 has an invalid length.
[  327.404380][T20848] netlink: 'syz.0.3246': attribute type 15 has an invalid length.
[  327.445093][T20848] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3246'.
[  327.553565][T20871] rdma_op ffff888028b7d1f0 conn xmit_rdma 0000000000000000
[  327.577563][T20867] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3251'.
[  327.618619][T20883] netlink: 'syz.1.3250': attribute type 10 has an invalid length.
[  327.671968][T20886] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3254'.
[  327.844870][T20898] tipc: Resetting bearer <eth:team0>
[  327.851389][T20898] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  327.987691][T20894] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  328.049793][T20898] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  328.407837][T20939] tipc: Enabling of bearer <udp:syz1> rejected, failed to enable media
[  328.519992][T20943] xfrm0: entered promiscuous mode
[  328.522178][T20943] xfrm0: entered allmulticast mode
[  328.825647][T20984] tipc: Resetting bearer <eth:team0>
[  328.829597][T20984] tipc: Resetting bearer <eth:team0>
[  328.833364][T20984] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  328.862752][T20984] veth0_to_team: entered promiscuous mode
[  328.865052][T20984] veth0_to_team: entered allmulticast mode
[  329.197056][T21032] 8021q: adding VLAN 0 to HW filter on device bond49
[  329.251727][T21032] bond49: (slave veth63): Enslaving as an active interface with a down link
[  329.291864][T21032] macvlan8: entered promiscuous mode
[  329.294417][T21032] macvlan8: entered allmulticast mode
[  329.303136][T21032] bond49: entered promiscuous mode
[  329.307520][T21032] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  329.312816][T21032] bond49: (slave macvlan8): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  329.328739][T21032] bond49: left promiscuous mode
[  329.461108][T21060] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  329.465099][T21060] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  329.536007][T21064] 8021q: adding VLAN 0 to HW filter on device bond38
[  329.580091][T21064] bond38: (slave veth43): Enslaving as an active interface with a down link
[  329.595024][T21064] macvlan9: entered promiscuous mode
[  329.597535][T21064] macvlan9: entered allmulticast mode
[  329.600409][T21064] bond38: entered promiscuous mode
[  329.602824][T21064] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  329.605421][T21064] bond38: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  329.614874][T21064] bond38: left promiscuous mode
[  330.127510][T21107] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  330.183369][T21107] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  330.699638][T21147] validate_nla: 16 callbacks suppressed
[  330.699651][T21147] netlink: 'syz.2.3304': attribute type 1 has an invalid length.
[  330.722959][T21147] 8021q: adding VLAN 0 to HW filter on device bond50
[  331.000121][T21163] __nla_validate_parse: 9 callbacks suppressed
[  331.000130][T21163] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3309'.
[  331.180722][T21181] netlink: 'syz.2.3312': attribute type 1 has an invalid length.
[  331.205140][T21181] 8021q: adding VLAN 0 to HW filter on device bond51
[  331.231166][T21181] bond51: (slave veth65): Enslaving as an active interface with a down link
[  331.240633][T21181] macvlan8: entered promiscuous mode
[  331.242473][T21181] macvlan8: entered allmulticast mode
[  331.245346][T21181] bond51: entered promiscuous mode
[  331.248095][T21181] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  331.251252][T21181] bond51: (slave macvlan8): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  331.261829][T21181] bond51: left promiscuous mode
[  331.458127][T21195] netlink: 'syz.2.3314': attribute type 9 has an invalid length.
[  331.460697][T21195] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3314'.
[  332.360002][T21260] netlink: 'syz.1.3326': attribute type 13 has an invalid length.
[  332.363371][T21260] netlink: 'syz.1.3326': attribute type 17 has an invalid length.
[  332.374023][T21260] tipc: Resetting bearer <eth:team0>
[  332.378555][T21259] netlink: 'syz.2.3327': attribute type 13 has an invalid length.
[  332.381116][T21259] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3327'.
[  332.385128][T21260] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  332.443928][T21265] netlink: 'syz.2.3328': attribute type 13 has an invalid length.
[  332.447286][T21265] netlink: 'syz.2.3328': attribute type 17 has an invalid length.
[  332.451613][T21265] tipc: Resetting bearer <eth:team0>
[  332.454316][T21265] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  332.528163][T21260] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  332.553887][T21264] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  332.583810][T21260] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  332.610697][T21273] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3329'.
[  332.613833][T21273] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3329'.
[  332.617667][T21273] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3329'.
[  332.638327][T21260] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  332.835570][T21294] netlink: 'syz.0.3335': attribute type 1 has an invalid length.
[  332.852918][T21294] 8021q: adding VLAN 0 to HW filter on device bond39
[  332.869553][T21294] bond39: (slave veth45): Enslaving as an active interface with a down link
[  332.879224][T21294] macvlan9: entered promiscuous mode
[  332.881107][T21294] macvlan9: entered allmulticast mode
[  332.883778][T21294] bond39: entered promiscuous mode
[  332.885946][T21294] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  332.889361][T21294] bond39: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  332.895412][T21294] bond39: left promiscuous mode
[  333.094673][T21304] sit0: entered promiscuous mode
[  333.109324][T21304] netlink: 'syz.0.3337': attribute type 1 has an invalid length.
[  333.112750][T21304] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3337'.
[  333.475041][T21324] tipc: Resetting bearer <eth:team0>
[  333.479031][T21324] bond49: (slave veth63): Releasing active interface
[  333.483854][T21324] bond51: (slave veth65): Releasing active interface
[  333.492944][T21324] team0: Unable to change to the same mode the team is in
[  333.498341][T21324] vlan0: entered promiscuous mode
[  333.501104][T21324] tipc: Enabling of bearer <eth:team0> rejected, already enabled
[  333.672909][T21335] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3344'.
[  333.763756][T21326] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3343'.
[  333.780842][T21326] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3343'.
[  334.101747][T21369] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  334.403877][T21398] mac80211_hwsim hwsim38 wlan0: entered promiscuous mode
[  334.622622][T21428] tipc: Resetting bearer <eth:team0>
[  334.654593][T21428] xfrm0: left promiscuous mode
[  334.666679][T21428] xfrm0: left allmulticast mode
[  334.669828][T21428] vlan0: left promiscuous mode
[  334.773202][T21437] sit0: left promiscuous mode
[  334.794326][T21437] tipc: Resetting bearer <eth:team0>
[  334.798122][T21437] tipc: Resetting bearer <eth:team0>
[  334.801787][T21437] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  334.809348][T21444] 8021q: adding VLAN 0 to HW filter on device bond3
[  334.825771][T21444] 8021q: adding VLAN 0 to HW filter on device macvlan8
[  334.839332][T21444] bond3: (slave macvlan8): Enslaving as a backup interface with a down link
[  334.863334][T21444] tipc: Resetting bearer <eth:team0>
[  334.871755][T21444] bond3: (slave macvlan8): Releasing backup interface
[  335.034284][T21464] 8021q: adding VLAN 0 to HW filter on device bond40
[  335.068114][T21464] bond40: (slave veth47): Enslaving as an active interface with a down link
[  335.091634][T21464] macvlan9: entered promiscuous mode
[  335.093979][T21464] macvlan9: entered allmulticast mode
[  335.097488][T21464] bond40: entered promiscuous mode
[  335.100558][T21464] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  335.103981][T21464] bond40: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  335.118655][T21464] bond40: left promiscuous mode
[  335.883067][T21533] tipc: Enabling of bearer <udp:s> rejected, failed to enable media
[  335.885634][T21539] validate_nla: 7 callbacks suppressed
[  335.885648][T21539] netlink: 'syz.2.3386': attribute type 9 has an invalid length.
[  335.925005][T21533] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  335.948310][T21543] trusted_key: syz.2.3389 sent an empty control message without MSG_MORE.
[  336.058529][T21554] netlink: 'syz.2.3392': attribute type 13 has an invalid length.
[  336.065764][T21554] netlink: 'syz.2.3392': attribute type 17 has an invalid length.
[  336.075470][T21554] tipc: Resetting bearer <eth:team0>
[  336.078750][T21554] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  336.178942][T21568] netlink: 'syz.1.3394': attribute type 13 has an invalid length.
[  336.181875][T21568] netlink: 'syz.1.3394': attribute type 17 has an invalid length.
[  336.208901][T21568] 8021q: adding VLAN 0 to HW filter on device bond0
[  336.212317][T21568] 8021q: adding VLAN 0 to HW filter on device team0
[  336.215307][T21568] tipc: Resetting bearer <eth:team0>
[  336.218701][T21554] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  336.220658][T21568] tipc: Resetting bearer <eth:team0>
[  336.229772][T21568] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  336.242713][T21568] xfrm0: entered promiscuous mode
[  336.244416][T21568] xfrm0: entered allmulticast mode
[  336.300966][T21571] __nla_validate_parse: 12 callbacks suppressed
[  336.300981][T21571] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3396'.
[  336.307614][T21571] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3396'.
[  336.489212][T21559] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  336.572980][T21584] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3399'.
[  336.777986][T21597] netlink: 'syz.2.3401': attribute type 1 has an invalid length.
[  336.803868][T21597] 8021q: adding VLAN 0 to HW filter on device bond52
[  336.848187][T21597] bond52: (slave veth67): Enslaving as an active interface with a down link
[  336.951787][T21597] macvlan9: entered promiscuous mode
[  336.954045][T21597] macvlan9: entered allmulticast mode
[  336.958067][T21597] bond52: entered promiscuous mode
[  336.960765][T21597] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  336.963950][T21597] bond52: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  336.972192][T21597] bond52: left promiscuous mode
[  337.345354][T21608] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3402'.
[  337.406195][T21604] netlink: 'syz.2.3402': attribute type 10 has an invalid length.
[  337.419039][T21612] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3404'.
[  337.444490][T21612] netlink: 'syz.1.3404': attribute type 10 has an invalid length.
[  337.509245][T21616] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  337.516005][T21616] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  337.662813][T21618] tipc: Resetting bearer <eth:team0>
[  337.671235][T21618] xfrm0: left promiscuous mode
[  337.672884][T21618] xfrm0: left allmulticast mode
[  337.687490][T21621] openvswitch: netlink: Flow key attribute not present in set flow.
[  337.691074][T21621] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3406'.
[  337.728991][T21618] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3405'.
[  337.794211][T21636] netlink: 'syz.0.3408': attribute type 1 has an invalid length.
[  337.826957][T21636] 8021q: adding VLAN 0 to HW filter on device bond41
[  337.852370][T21636] bond41: (slave veth49): Enslaving as an active interface with a down link
[  337.865484][T21636] macvlan9: entered promiscuous mode
[  337.868839][T21636] macvlan9: entered allmulticast mode
[  337.872816][T21636] bond41: entered promiscuous mode
[  337.875571][T21636] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  337.880554][T21636] bond41: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  337.888681][T21636] bond41: left promiscuous mode
[  337.891455][T21641] netlink: 'syz.1.3410': attribute type 1 has an invalid length.
[  337.923807][T21641] 8021q: adding VLAN 0 to HW filter on device bond47
[  337.949290][T21641] bond47: (slave veth43): Enslaving as an active interface with a down link
[  337.957902][T21641] macvlan9: entered promiscuous mode
[  337.959749][T21641] macvlan9: entered allmulticast mode
[  337.961949][T21641] bond47: entered promiscuous mode
[  337.974870][T21641] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  337.978454][T21641] bond47: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  337.984858][T21641] bond47: left promiscuous mode
[  338.193082][T21664] tipc: Resetting bearer <eth:team0>
[  338.203065][T21664] xfrm0: left promiscuous mode
[  338.205195][T21664] xfrm0: left allmulticast mode
[  338.210836][T21664] vlan0: left promiscuous mode
[  338.335197][T21679] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3416'.
[  338.472554][T21695] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3417'.
[  338.581792][T21715] tipc: New replicast peer: 255.255.255.255
[  338.585239][T21715] tipc: Enabled bearer <udp:syz2>, priority 10
[  338.642386][T21721] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0)
[  338.687207][T21725] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3425'.
[  338.912744][T21740] 8021q: adding VLAN 0 to HW filter on device bond42
[  338.953247][T21740] bond42: (slave veth51): Enslaving as an active interface with a down link
[  338.971143][T21740] macvlan9: entered promiscuous mode
[  338.973434][T21740] macvlan9: entered allmulticast mode
[  338.976788][T21740] bond42: entered promiscuous mode
[  338.979619][T21740] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  339.000467][T21740] bond42: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  339.008826][T21740] bond42: left promiscuous mode
[  339.058716][T21747] bond52: (slave veth67): Releasing active interface
[  339.330500][T21781] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  340.868319][T21916] 8021q: adding VLAN 0 to HW filter on device bond0
[  340.872774][T21916] 8021q: adding VLAN 0 to HW filter on device team0
[  340.875887][T21916] tipc: Resetting bearer <eth:team0>
[  340.880825][T21916] tipc: Resetting bearer <eth:team0>
[  340.885916][T21916] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  341.157237][T21923] validate_nla: 18 callbacks suppressed
[  341.157250][T21923] netlink: 'syz.0.3467': attribute type 1 has an invalid length.
[  341.163547][T21923] tipc: Bearer <udp:syz1>: already 2 bearers with priority 10
[  341.168500][T21923] tipc: Bearer <udp:syz1>: trying with adjusted priority
[  341.172237][T21923] tipc: Enabling of bearer <udp:syz1> rejected, max 3 bearers permitted
[  341.185035][T21930] netlink: 'syz.2.3470': attribute type 13 has an invalid length.
[  341.190348][T21930] netlink: 'syz.2.3470': attribute type 17 has an invalid length.
[  341.222617][T21930] 8021q: adding VLAN 0 to HW filter on device bond0
[  341.225762][T21932] netlink: 'syz.1.3473': attribute type 9 has an invalid length.
[  341.228349][T21930] 8021q: adding VLAN 0 to HW filter on device team0
[  341.228512][T21930] tipc: Resetting bearer <eth:team0>
[  341.228641][T21930] tipc: Resetting bearer <eth:team0>
[  341.244965][T21930] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  341.254651][T21935] xfrm0: entered promiscuous mode
[  341.259029][T21935] xfrm0: entered allmulticast mode
[  341.393616][T21949] netlink: 'syz.1.3474': attribute type 3 has an invalid length.
[  341.404055][T21949] netlink: 'syz.1.3474': attribute type 1 has an invalid length.
[  341.407710][T21949] __nla_validate_parse: 13 callbacks suppressed
[  341.407717][T21949] netlink: 220 bytes leftover after parsing attributes in process `syz.1.3474'.
[  341.414001][T21930] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  341.468678][T21944] netlink: 'syz.0.3475': attribute type 1 has an invalid length.
[  341.487110][T21944] 8021q: adding VLAN 0 to HW filter on device bond43
[  341.503022][T21927] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  342.033270][T21970] tipc: Resetting bearer <eth:team0>
[  342.155013][T21976] netlink: 'syz.2.3480': attribute type 10 has an invalid length.
[  343.129335][T21998] netlink: 'syz.2.3485': attribute type 13 has an invalid length.
[  343.133495][T21998] netlink: 'syz.2.3485': attribute type 17 has an invalid length.
[  343.139374][T22003] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  343.148271][T21998] tipc: Resetting bearer <eth:team0>
[  343.151286][T21998] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  343.323941][T22019] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3490'.
[  343.474147][T22029] tipc: Enabling of bearer <eth:syzkaller0> rejected, max 3 bearers permitted
[  343.480279][T22029] syzkaller0: entered promiscuous mode
[  343.482632][T22029] syzkaller0: entered allmulticast mode
[  343.618022][T22035] tipc: Resetting bearer <eth:team0>
[  343.620853][T22035] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  343.625869][T22036] delete_channel: no stack
[  343.661385][T22039] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3497'.
[  343.724150][T22035] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  343.782700][T22035] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  343.851115][T22065] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3502'.
[  343.951788][T22069] 8021q: adding VLAN 0 to HW filter on device bond44
[  343.977206][T22069] bond44: (slave veth53): Enslaving as an active interface with a down link
[  343.993260][T22069] macvlan9: entered promiscuous mode
[  343.995580][T22069] macvlan9: entered allmulticast mode
[  344.004308][T22069] bond44: entered promiscuous mode
[  344.008000][T22069] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  344.011491][T22069] bond44: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  344.019466][T22069] bond44: left promiscuous mode
[  344.123485][T22083] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.3506'.
[  344.478732][T22113] 8021q: adding VLAN 0 to HW filter on device bond45
[  344.508581][T22113] bond45: (slave veth55): Enslaving as an active interface with a down link
[  344.522904][T22113] macvlan9: entered promiscuous mode
[  344.525206][T22113] macvlan9: entered allmulticast mode
[  344.529108][T22113] bond45: entered promiscuous mode
[  344.532979][T22113] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  344.535827][T22113] bond45: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  344.545362][T22113] bond45: left promiscuous mode
[  344.719076][T22128] tipc: Resetting bearer <eth:team0>
[  344.721757][T22128] tipc: Resetting bearer <eth:team0>
[  344.725569][T22128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  344.814855][T22126] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  345.181995][T22146] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3519'.
[  345.362995][T22167] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3522'.
[  345.366058][T22167] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3522'.
[  345.501901][T22187] 8021q: adding VLAN 0 to HW filter on device bond46
[  345.540486][T22187] bond46: (slave veth57): Enslaving as an active interface with a down link
[  345.569482][T22186] block nbd1: NBD_DISCONNECT
[  345.571611][T22187] macvlan9: entered promiscuous mode
[  345.573867][T22187] macvlan9: entered allmulticast mode
[  345.589856][T22187] bond46: entered promiscuous mode
[  345.592730][T22187] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  345.596144][T22187] bond46: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  345.605608][T22187] bond46: left promiscuous mode
[  346.385284][T22240] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3537'.
[  346.485386][T22243] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  346.818395][T22274] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3545'.
[  346.853553][T22274] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3545'.
[  346.880591][T22274] netlink: 65 bytes leftover after parsing attributes in process `syz.1.3545'.
[  346.884767][T22274] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3545'.
[  346.890388][T22274] openvswitch: netlink: Flow key attr not present in new flow.
[  346.895329][T22274] netlink: 208128 bytes leftover after parsing attributes in process `syz.1.3545'.
[  346.901675][T22274] openvswitch: netlink: Message has 4 unknown bytes.
[  346.934804][T22275] validate_nla: 10 callbacks suppressed
[  346.934814][T22275] netlink: 'syz.0.3544': attribute type 1 has an invalid length.
[  346.970021][T22275] 8021q: adding VLAN 0 to HW filter on device bond47
[  346.985089][T22285] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.3546'.
[  347.143069][T22293] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3550'.
[  347.206209][T22296] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3551'.
[  347.330654][T22310] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue
[  347.370889][T22295] netlink: 'syz.1.3548': attribute type 10 has an invalid length.
[  347.424879][T22325] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  347.560855][T22340] netlink: 'syz.0.3557': attribute type 9 has an invalid length.
[  347.564021][T22340] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3557'.
[  348.123702][T22348] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3559'.
[  348.806004][T22371] netlink: 'syz.0.3565': attribute type 4 has an invalid length.
[  348.910738][T22374] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  348.946428][T22374] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  348.984687][T22381] netlink: 'syz.0.3565': attribute type 10 has an invalid length.
[  349.003438][T22390] netlink: 'syz.2.3567': attribute type 1 has an invalid length.
[  349.051349][T22390] 8021q: adding VLAN 0 to HW filter on device bond53
[  349.065642][T22380] bond53: (slave wlan0): Opening slave failed
[  349.257583][T22404] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  349.501937][T22426] netlink: 'syz.0.3574': attribute type 10 has an invalid length.
[  349.508182][T22426] : (slave 0!): Enslaving as an active interface with an up link
[  349.578314][T22431] bond47: (slave veth43): Releasing active interface
[  349.674561][T22431] team0: Mode changed to "loadbalance"
[  349.822530][T22444] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  349.912584][T22451] netlink: 'syz.1.3577': attribute type 10 has an invalid length.
[  350.312134][T22461] netlink: 'syz.2.3581': attribute type 10 has an invalid length.
[  351.278900][T22495] netlink: 'syz.1.3588': attribute type 10 has an invalid length.
[  351.611563][T22553] 8021q: adding VLAN 0 to HW filter on device bond48
[  351.671070][T22553] bond48: (slave veth59): Enslaving as an active interface with a down link
[  351.704027][T22553] macvlan9: entered promiscuous mode
[  351.707338][T22553] macvlan9: entered allmulticast mode
[  351.710243][T22553] bond48: entered promiscuous mode
[  351.713068][T22553] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  351.721115][T22553] bond48: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  351.739215][T22553] bond48: left promiscuous mode
[  351.773248][T22568] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  352.074983][T22589] __nla_validate_parse: 75 callbacks suppressed
[  352.074993][T22589] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3609'.
[  352.081928][T22589] netlink: 240 bytes leftover after parsing attributes in process `syz.2.3609'.
[  352.091133][   T82] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  352.093866][   T82] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  352.100571][T22589] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  352.104113][T22589] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  352.354384][T22597] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  352.410638][T22597] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  352.460026][T22606] validate_nla: 3 callbacks suppressed
[  352.460035][T22606] netlink: 'syz.1.3611': attribute type 13 has an invalid length.
[  352.465360][T22606] netlink: 'syz.1.3611': attribute type 17 has an invalid length.
[  352.500142][T22606] 8021q: adding VLAN 0 to HW filter on device bond0
[  352.503992][T22606] 8021q: adding VLAN 0 to HW filter on device team0
[  352.508348][T22606] tipc: Resetting bearer <eth:team0>
[  352.510848][T22606] tipc: Resetting bearer <eth:team0>
[  352.516137][T22606] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  352.586191][T22605] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  353.107257][T22618] netlink: 'syz.0.3613': attribute type 12 has an invalid length.
[  353.218985][T22626] netlink: 20824 bytes leftover after parsing attributes in process `syz.1.3614'.
[  353.249376][T22626] netlink: 'syz.1.3614': attribute type 10 has an invalid length.
[  353.264331][T22626] bond0: (slave dummy0): Enslaving as an active interface with an up link
[  353.339718][ T1117] block nbd0: Possible stuck request ffff888021c08000: control (read@0,1024B). Runtime 150 seconds
[  353.343784][ T1117] block nbd0: Possible stuck request ffff888021c08200: control (read@1024,1024B). Runtime 150 seconds
[  353.348290][ T1117] block nbd0: Possible stuck request ffff888021c08400: control (read@2048,1024B). Runtime 150 seconds
[  353.352483][ T1117] block nbd0: Possible stuck request ffff888021c08600: control (read@3072,1024B). Runtime 150 seconds
[  353.393322][T22637] netlink: 'syz.0.3619': attribute type 1 has an invalid length.
[  353.429027][T22637] 8021q: adding VLAN 0 to HW filter on device bond49
[  353.449377][T22637] bond49: (slave veth61): Enslaving as an active interface with a down link
[  353.483871][T22637] macvlan9: entered promiscuous mode
[  353.486072][T22637] macvlan9: entered allmulticast mode
[  353.491608][T22637] bond49: entered promiscuous mode
[  353.494375][T22637] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  353.500041][T22637] bond49: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  353.514454][T22637] bond49: left promiscuous mode
[  353.633710][T22648] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  353.776127][T22660] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3624'.
[  353.820662][T22663] netlink: 17 bytes leftover after parsing attributes in process `syz.0.3625'.
[  353.834520][T22660] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3624'.
[  354.125186][T22675] netlink: 'syz.2.3628': attribute type 10 has an invalid length.
[  354.293612][T22701] netlink: 'syz.2.3632': attribute type 1 has an invalid length.
[  354.326769][T22697] netlink: 'syz.0.3631': attribute type 9 has an invalid length.
[  354.369148][T22697] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3631'.
[  354.392154][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  354.395493][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  354.433344][T22719] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3636'.
[  354.574075][T22719] netlink: 'syz.2.3636': attribute type 10 has an invalid length.
[  354.678964][T22738] netlink: 'syz.0.3638': attribute type 13 has an invalid length.
[  354.693545][T22738] 8021q: adding VLAN 0 to HW filter on device 
[  354.697630][T22738] tipc: Resetting bearer <eth:team0>
[  354.700065][T22738] tipc: Resetting bearer <eth:team0>
[  354.703630][T22738] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  354.720923][T22742] tipc: Resetting bearer <eth:team0>
[  354.727204][T22742] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  354.869272][T22742] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  354.924701][T22742] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  355.897309][T22789] tipc: Resetting bearer <eth:team0>
[  355.900462][T22789] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  355.986001][T22800] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3651'.
[  356.009020][T22800] openvswitch: netlink: nsh attribute has 2338 unknown bytes.
[  356.011600][T22800] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  356.246173][T22815] tipc: Resetting bearer <eth:team0>
[  356.251451][T22815] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  356.599866][T22828] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0)
[  356.887574][T22836] tipc: Resetting bearer <eth:team0>
[  356.904082][T22836] xfrm0: left promiscuous mode
[  356.906100][T22836] xfrm0: left allmulticast mode
[  357.067876][T22849] 8021q: adding VLAN 0 to HW filter on device bond54
[  357.098860][T22849] bond54: (slave veth69): Enslaving as an active interface with a down link
[  357.108641][T22849] macvlan9: entered promiscuous mode
[  357.110897][T22849] macvlan9: entered allmulticast mode
[  357.114377][T22849] bond54: entered promiscuous mode
[  357.119584][T22849] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  357.124215][T22849] bond54: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  357.131383][T22849] bond54: left promiscuous mode
[  357.214743][T22862] bond54: (slave veth69): Releasing active interface
[  357.226720][T22862] team0: Unable to change to the same mode the team is in
[  357.229642][T22862] vlan0: entered promiscuous mode
[  357.233036][T22862] tipc: Enabling of bearer <eth:team0> rejected, already enabled
[  357.500015][T22879] validate_nla: 11 callbacks suppressed
[  357.500030][T22879] netlink: 'syz.0.3670': attribute type 21 has an invalid length.
[  357.504916][T22879] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3670'.
[  357.551888][T22891] netlink: 'syz.1.3671': attribute type 13 has an invalid length.
[  357.555193][T22891] netlink: 'syz.1.3671': attribute type 17 has an invalid length.
[  357.588127][T22891] tipc: Resetting bearer <eth:team0>
[  357.598104][T22891] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  357.609775][T22894] netlink: 'syz.0.3673': attribute type 1 has an invalid length.
[  357.644875][T22897] netlink: 'syz.2.3672': attribute type 10 has an invalid length.
[  357.660947][T22894] 8021q: adding VLAN 0 to HW filter on device bond50
[  357.754197][T22898] bond50: (slave veth63): Enslaving as an active interface with a down link
[  357.814356][T22906] netlink: 'syz.1.3671': attribute type 3 has an invalid length.
[  357.834887][T22894] macvlan9: entered promiscuous mode
[  357.837016][T22906] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3671'.
[  357.848869][T22894] macvlan9: entered allmulticast mode
[  357.855332][T22894] bond50: entered promiscuous mode
[  357.860613][T22891] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  357.865290][T22894] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  357.871518][T22894] bond50: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  357.881628][T22894] bond50: left promiscuous mode
[  357.931713][T22891] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  357.992098][T22891] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  358.147991][T22916] tipc: Resetting bearer <eth:team0>
[  358.150485][T22916] : (slave 0!): Releasing backup interface
[  358.157605][T22916] bond38: (slave veth43): Releasing active interface
[  358.163353][T22916] bond39: (slave veth45): Releasing active interface
[  358.170628][T22916] bond40: (slave veth47): Releasing active interface
[  358.176180][T22916] bond41: (slave veth49): Releasing active interface
[  358.183654][T22916] bond42: (slave veth51): Releasing active interface
[  358.191630][T22916] bond44: (slave veth53): Releasing active interface
[  358.198545][T22916] bond45: (slave veth55): Releasing active interface
[  358.203889][T22916] bond46: (slave veth57): Releasing active interface
[  358.210416][T22916] bond48: (slave veth59): Releasing active interface
[  358.215146][T22916] bond49: (slave veth61): Releasing active interface
[  358.223101][T22916] bond50: (slave veth63): Releasing active interface
[  358.258156][T22921] netlink: 'syz.0.3676': attribute type 9 has an invalid length.
[  358.261124][T22921] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3676'.
[  358.439697][T22932] netlink: 'syz.2.3678': attribute type 1 has an invalid length.
[  358.445860][T22932] workqueue: Failed to create a rescuer kthread for wq "bond55": -EINTR
[  358.672632][T22949] bond0: (slave veth0_to_hsr): Device is not bonding slave
[  358.679248][T22949] bond0: option active_slave: invalid value (veth0_to_hsr)
[  358.967790][T22971] tipc: Bearer <udp:syz1>: already 2 bearers with priority 10
[  358.970406][T22971] tipc: Bearer <udp:syz1>: trying with adjusted priority
[  358.973201][T22971] tipc: Enabling of bearer <udp:syz1> rejected, max 3 bearers permitted
[  359.041089][T22978] netlink: 'syz.1.3688': attribute type 13 has an invalid length.
[  359.044547][T22978] netlink: 'syz.1.3688': attribute type 17 has an invalid length.
[  359.050532][T22978] tipc: Resetting bearer <eth:team0>
[  359.053605][T22978] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  359.063346][T22979] xfrm0: entered promiscuous mode
[  359.065094][T22979] xfrm0: entered allmulticast mode
[  359.167179][T22979] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3688'.
[  359.199379][T22993] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3689'.
[  359.276020][T22993] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3689'.
[  359.327254][T22981] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3689'.
[  359.352634][T23000] 8021q: adding VLAN 0 to HW filter on device bond48
[  359.382100][T23000] bond48: (slave veth45): Enslaving as an active interface with a down link
[  359.388273][T22992] syzkaller1: entered promiscuous mode
[  359.390131][T22992] syzkaller1: entered allmulticast mode
[  359.414986][T23000] macvlan9: entered promiscuous mode
[  359.418251][T23000] macvlan9: entered allmulticast mode
[  359.422370][T23000] bond48: entered promiscuous mode
[  359.424887][T23000] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  359.428379][T23000] bond48: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  359.437645][T23000] bond48: left promiscuous mode
[  359.538148][T23012] tipc: Resetting bearer <eth:team0>
[  359.541862][T23012] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  359.705578][T23030] tipc: Resetting bearer <eth:team0>
[  359.747802][T23030] team0: Unable to change to the same mode the team is in
[  359.752280][T23030] tipc: Enabling of bearer <eth:team0> rejected, already enabled
[  359.909789][T23043] 8021q: adding VLAN 0 to HW filter on device bond55
[  359.923128][T23038] pim6reg1: entered promiscuous mode
[  359.925345][T23038] pim6reg1: entered allmulticast mode
[  359.928180][T23046] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3704'.
[  359.934188][T23038] bond55: (slave wlan0): Enslaving as an active interface with a down link
[  360.134404][T23057] 8021q: adding VLAN 0 to HW filter on device bond56
[  360.148485][T23057] bond56: (slave veth71): Enslaving as an active interface with a down link
[  360.158505][T23059] tipc: Resetting bearer <eth:team0>
[  360.160926][T23059] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  360.174661][T23057] macvlan9: entered promiscuous mode
[  360.177232][T23057] macvlan9: entered allmulticast mode
[  360.179783][T23057] bond56: entered promiscuous mode
[  360.182571][T23057] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  360.185650][T23057] bond56: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  360.193270][T23057] bond56: left promiscuous mode
[  360.334729][T23055] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3707'.
[  360.342872][T23055] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  360.400557][T23059] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  360.498067][T23069] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3711'.
[  361.569999][T23128] bond55: (slave wlan0): Releasing active interface
[  361.711540][T23150] tipc: Resetting bearer <eth:team0>
[  361.767930][T23150] team0: Mode changed to "loadbalance"
[  362.962709][T23160] __nla_validate_parse: 3 callbacks suppressed
[  362.962724][T23160] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3727'.
[  362.970509][T23167] workqueue: Failed to create a rescuer kthread for wq "bond51": -EINTR
[  363.062882][T23181] validate_nla: 10 callbacks suppressed
[  363.062897][T23181] netlink: 'syz.1.3734': attribute type 7 has an invalid length.
[  363.073483][T23181] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3734'.
[  363.172155][T23201] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3737'.
[  363.188190][T23183] netlink: 'syz.2.3733': attribute type 1 has an invalid length.
[  363.252744][T23183] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3733'.
[  363.334879][T23211] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3738'.
[  363.432328][T23211] netlink: 'syz.1.3738': attribute type 10 has an invalid length.
[  363.618921][T23243] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3741'.
[  363.623236][T23233] netlink: 'syz.1.3740': attribute type 1 has an invalid length.
[  363.670365][T23233] 8021q: adding VLAN 0 to HW filter on device bond49
[  363.725863][T23239] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3741'.
[  363.741575][T23237] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3741'.
[  363.804791][T23251] netlink: 'syz.1.3742': attribute type 13 has an invalid length.
[  363.810845][T23251] netlink: 'syz.1.3742': attribute type 17 has an invalid length.
[  363.819751][T23251] tipc: Resetting bearer <eth:team0>
[  363.822971][T23251] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  363.951923][T23251] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  364.006295][T23251] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  364.147110][T23274] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3744'.
[  364.150914][T23274] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3744'.
[  364.271226][T23282] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  364.284925][T23282] netlink: 'syz.0.3747': attribute type 9 has an invalid length.
[  364.335194][T23289] netlink: 'syz.2.3749': attribute type 1 has an invalid length.
[  364.351089][T23289] 8021q: adding VLAN 0 to HW filter on device bond57
[  364.435454][T23291] tipc: Resetting bearer <eth:team0>
[  364.548385][T23289] bond57: (slave veth73): Enslaving as an active interface with a down link
[  364.559559][T23297] macvlan9: entered promiscuous mode
[  364.561840][T23297] macvlan9: entered allmulticast mode
[  364.564627][T23297] bond57: entered promiscuous mode
[  364.568560][T23297] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  364.571916][T23297] bond57: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  364.578493][T23297] bond57: left promiscuous mode
[  364.598627][T23299] netlink: 'syz.0.3750': attribute type 13 has an invalid length.
[  364.601354][T23299] netlink: 'syz.0.3750': attribute type 17 has an invalid length.
[  364.623722][T23299] 8021q: adding VLAN 0 to HW filter on device 
[  364.627555][T23299] 8021q: adding VLAN 0 to HW filter on device team0
[  364.630365][T23299] tipc: Resetting bearer <eth:team0>
[  364.635557][T23299] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  364.740402][T23298] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  365.506124][T23332] tipc: Resetting bearer <eth:team0>
[  365.523135][T23332] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  365.582942][T23338] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[  365.735666][T23349] 8021q: adding VLAN 0 to HW filter on device bond51
[  365.758032][T23349] bond51: (slave veth65): Enslaving as an active interface with a down link
[  365.774109][T23349] macvlan9: entered promiscuous mode
[  365.778280][T23349] macvlan9: entered allmulticast mode
[  365.780446][T23349] bond51: entered promiscuous mode
[  365.785773][T23349] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  365.791201][T23349] bond51: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  365.800125][T23349] bond51: left promiscuous mode
[  365.858429][T23354] tipc: Resetting bearer <eth:team0>
[  365.878355][T23354] xfrm0: left promiscuous mode
[  365.880242][T23354] xfrm0: left allmulticast mode
[  366.124059][T23370] 8021q: adding VLAN 0 to HW filter on device bond50
[  366.312268][T23403] 8021q: adding VLAN 0 to HW filter on device bond52
[  366.345620][T23403] bond52: (slave veth67): Enslaving as an active interface with a down link
[  366.356169][T23403] macvlan9: entered promiscuous mode
[  366.359600][T23403] macvlan9: entered allmulticast mode
[  366.361834][T23403] bond52: entered promiscuous mode
[  366.363979][T23403] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  366.367768][T23403] bond52: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  366.374773][T23403] bond52: left promiscuous mode
[  367.051521][T23473] tipc: Resetting bearer <eth:team0>
[  367.064489][T23473] veth0_to_team: left promiscuous mode
[  367.067787][T23473] veth0_to_team: left allmulticast mode
[  367.073426][T23473] xfrm0: left promiscuous mode
[  367.075475][T23473] xfrm0: left allmulticast mode
[  367.082662][T23473] pim6reg1: left promiscuous mode
[  367.084441][T23473] pim6reg1: left allmulticast mode
[  367.090170][T23473] gretap3: left promiscuous mode
[  367.092984][T23473] gretap3: left allmulticast mode
[  367.351808][T23499] 8021q: adding VLAN 0 to HW filter on device bond0
[  367.355305][T23499] 8021q: adding VLAN 0 to HW filter on device team0
[  367.358673][T23499] tipc: Resetting bearer <eth:team0>
[  367.361983][T23499] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  367.453458][T23503] 8021q: adding VLAN 0 to HW filter on device bond0
[  367.458443][T23503] 8021q: adding VLAN 0 to HW filter on device team0
[  367.461536][T23503] tipc: Resetting bearer <eth:team0>
[  367.463984][T23503] tipc: Resetting bearer <eth:team0>
[  367.469307][T23503] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  367.481635][T23507] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  367.495107][T23498] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  367.875135][T23524] tipc: Resetting bearer <eth:team0>
[  367.879425][T23524] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  368.097054][T23531] validate_nla: 16 callbacks suppressed
[  368.097065][T23531] netlink: 'syz.2.3795': attribute type 13 has an invalid length.
[  368.101591][T23531] netlink: 'syz.2.3795': attribute type 17 has an invalid length.
[  368.109898][T23531] tipc: Resetting bearer <eth:team0>
[  368.113654][T23531] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  368.146703][T23531] xfrm0: entered promiscuous mode
[  368.149095][T23531] xfrm0: entered allmulticast mode
[  368.159545][T23536] netlink: 'syz.1.3798': attribute type 13 has an invalid length.
[  368.163078][T23536] netlink: 'syz.1.3798': attribute type 17 has an invalid length.
[  368.171997][T23536] tipc: Resetting bearer <eth:team0>
[  368.178223][T23536] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  368.186221][T23536] xfrm0: entered promiscuous mode
[  368.193773][T23536] xfrm0: entered allmulticast mode
[  368.283384][T23544] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  368.319242][T23537] __nla_validate_parse: 5 callbacks suppressed
[  368.319252][T23537] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3797'.
[  368.350767][T23531] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  368.359668][T23533] netlink: 'syz.0.3797': attribute type 10 has an invalid length.
[  368.435934][T23529] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  368.488092][T23551] netlink: 'syz.0.3799': attribute type 1 has an invalid length.
[  368.502866][T23551] 8021q: adding VLAN 0 to HW filter on device bond53
[  368.520074][T23551] bond53: (slave veth69): Enslaving as an active interface with a down link
[  368.529087][T23551] macvlan9: entered promiscuous mode
[  368.530991][T23551] macvlan9: entered allmulticast mode
[  368.533492][T23551] bond53: entered promiscuous mode
[  368.535698][T23551] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  368.538885][T23551] bond53: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  368.546128][T23551] bond53: left promiscuous mode
[  368.642811][T23554] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3800'.
[  368.655207][T23554] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3800'.
[  368.855335][T23563] 8021q: VLANs not supported on xfrm0
[  369.977698][T23625] netlink: 'syz.2.3814': attribute type 1 has an invalid length.
[  369.992261][T23625] 8021q: adding VLAN 0 to HW filter on device bond58
[  369.999097][T23627] netlink: 4376 bytes leftover after parsing attributes in process `syz.1.3813'.
[  370.015647][T23625] bond58: (slave veth75): Enslaving as an active interface with a down link
[  370.034738][T23625] macvlan9: entered promiscuous mode
[  370.037467][T23625] macvlan9: entered allmulticast mode
[  370.040483][T23625] bond58: entered promiscuous mode
[  370.043345][T23625] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  370.049590][T23625] bond58: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  370.057487][T23623] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  370.061762][T23625] bond58: left promiscuous mode
[  370.158114][T23630] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  370.763830][T23646] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3819'.
[  370.808842][T23646] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3819'.
[  370.850850][T23657] netlink: 'syz.0.3822': attribute type 12 has an invalid length.
[  370.883973][T23666] netlink: 'syz.2.3821': attribute type 13 has an invalid length.
[  370.888942][T23666] netlink: 'syz.2.3821': attribute type 17 has an invalid length.
[  370.895665][T23666] tipc: Resetting bearer <eth:team0>
[  370.899915][T23666] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  371.060761][T23666] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  371.117372][T23666] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  371.465452][T23687] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3829'.
[  371.968825][T23720] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3834'.
[  372.035170][T23727] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3834'.
[  372.283181][T23743] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3838'.
[  372.304957][T23739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  372.357264][T23736] 8021q: adding VLAN 0 to HW filter on device bond51
[  372.397142][T23743] tipc: Resetting bearer <eth:team0>
[  373.047176][   T57] block nbd2: Receive control failed (result -32)
[  373.235787][T23767] validate_nla: 2 callbacks suppressed
[  373.235802][T23767] netlink: 'syz.0.3843': attribute type 1 has an invalid length.
[  373.253811][T23767] 8021q: adding VLAN 0 to HW filter on device bond54
[  373.492159][T23774] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  373.594578][T23783] __nla_validate_parse: 1 callbacks suppressed
[  373.594594][T23783] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3845'.
[  373.722560][T23799] syzkaller0: entered promiscuous mode
[  373.724355][T23799] syzkaller0: entered allmulticast mode
[  373.737445][T23801] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3846'.
[  373.741414][T23802] netlink: 'syz.2.3848': attribute type 13 has an invalid length.
[  373.746897][T23802] netlink: 'syz.2.3848': attribute type 17 has an invalid length.
[  373.772203][T23802] 8021q: adding VLAN 0 to HW filter on device bond0
[  373.778113][T23802] 8021q: adding VLAN 0 to HW filter on device team0
[  373.781023][T23802] tipc: Resetting bearer <eth:team0>
[  373.785415][T23802] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  373.804649][T23801] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3846'.
[  373.935932][T23807] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check.
[  373.956850][T23802] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  374.020002][T23802] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  374.449196][T23827] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3852'.
[  375.231197][T23836] netlink: 'syz.1.3853': attribute type 9 has an invalid length.
[  375.234266][T23836] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3853'.
[  375.356647][T23842] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3855'.
[  375.396473][   T33] audit: type=1800 audit(1757366911.702:3): pid=23840 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3854" name="memory.events" dev="tmpfs" ino=6638 res=0 errno=0
[  375.415234][T23846] bond51: (slave veth65): Releasing active interface
[  375.425864][T23846] bond52: (slave veth67): Releasing active interface
[  375.431856][T23846] bond53: (slave veth69): Releasing active interface
[  375.496704][T23842] netlink: 'syz.0.3855': attribute type 10 has an invalid length.
[  375.789080][T23867] netlink: 'syz.2.3860': attribute type 9 has an invalid length.
[  375.792974][T23867] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3860'.
[  375.843252][T23868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3858'.
[  375.852399][T23868] rdma_op ffff88803ae381f0 conn xmit_rdma 0000000000000000
[  375.890545][T23868] netlink: 'syz.1.3858': attribute type 10 has an invalid length.
[  375.947582][T23872] netlink: 'syz.2.3861': attribute type 1 has an invalid length.
[  376.073017][T23884] netlink: 'syz.2.3863': attribute type 13 has an invalid length.
[  376.076025][T23884] netlink: 'syz.2.3863': attribute type 17 has an invalid length.
[  376.186891][T23883] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  376.202274][T23891] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[  376.242037][T23883] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  376.533070][T23907] team0: Mode changed to "broadcast"
[  376.538130][T23907] tipc: Enabling of bearer <eth:team0> rejected, already enabled
[  376.623416][T23914] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3870'.
[  376.670124][T23911] openvswitch: netlink: Key type 16376 is out of range max 32
[  376.932062][T23927] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3874'.
[  377.099833][T23944] tipc: Resetting bearer <eth:team0>
[  377.104874][T23944] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  377.224543][T23944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  377.281092][T23944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  378.261705][T24016] validate_nla: 5 callbacks suppressed
[  378.261719][T24016] netlink: 'syz.2.3892': attribute type 10 has an invalid length.
[  378.605067][T24044] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  378.615863][T24044] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  378.624446][T24044] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  378.740443][T24055] netlink: 'syz.0.3897': attribute type 13 has an invalid length.
[  378.744128][T24055] netlink: 'syz.0.3897': attribute type 17 has an invalid length.
[  378.764859][T24055] 8021q: adding VLAN 0 to HW filter on device 
[  378.768060][T24055] 8021q: adding VLAN 0 to HW filter on device team0
[  378.770694][T24055] tipc: Resetting bearer <eth:team0>
[  378.775067][T24055] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  378.800301][T24050] xfrm0: entered promiscuous mode
[  378.802392][T24050] xfrm0: entered allmulticast mode
[  378.921544][T24050] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  378.979567][T24050] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  379.041045][T24073] netlink: 'syz.2.3900': attribute type 1 has an invalid length.
[  379.055087][T24073] 8021q: adding VLAN 0 to HW filter on device bond59
[  379.070786][T24073] bond59: (slave veth77): Enslaving as an active interface with a down link
[  379.079648][T24073] macvlan9: entered promiscuous mode
[  379.081506][T24073] macvlan9: entered allmulticast mode
[  379.083571][T24073] bond59: entered promiscuous mode
[  379.085856][T24073] 8021q: adding VLAN 0 to HW filter on device macvlan9
[  379.088613][T24073] bond59: (slave macvlan9): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  379.094362][T24073] bond59: left promiscuous mode
[  379.243308][T24083] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0)
[  379.324118][T24087] tipc: Resetting bearer <eth:team0>
[  379.338443][T24087] xfrm0: left promiscuous mode
[  379.340452][T24087] xfrm0: left allmulticast mode
[  379.402609][T24092] netlink: 'syz.1.3904': attribute type 4 has an invalid length.
[  379.412726][T24092] __nla_validate_parse: 3 callbacks suppressed
[  379.412739][T24092] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3904'.
[  379.438793][T24093] netlink: 'syz.1.3904': attribute type 4 has an invalid length.
[  379.493945][T24097] netlink: 'syz.1.3905': attribute type 7 has an invalid length.
[  379.498233][T24097] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3905'.
[  379.608038][T24099] netlink: 'syz.1.3906': attribute type 13 has an invalid length.
[  379.611435][T24099] netlink: 'syz.1.3906': attribute type 17 has an invalid length.
[  379.693748][T24099] 8021q: adding VLAN 0 to HW filter on device bond0
[  379.699743][T24104] netlink: 'syz.0.3907': attribute type 1 has an invalid length.
[  379.709601][T24099] 8021q: adding VLAN 0 to HW filter on device team0
[  379.713030][T24099] tipc: Resetting bearer <eth:team0>
[  379.715697][T24099] tipc: Resetting bearer <eth:team0>
[  379.723184][T24099] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  379.754814][T24101] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3907'.
[  379.765703][T24104] 8021q: adding VLAN 0 to HW filter on device bond55
[  379.854136][T24107] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  379.941804][T24110] 8021q: adding VLAN 0 to HW filter on device bond56
[  380.165976][T24129] IPVS: set_ctl: invalid protocol: 0 100.1.1.2:20002
[  380.189412][T24125] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.3911'.
[  380.201975][T24129] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  380.490167][T24147] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3915'.
[  381.299802][T24198] tipc: Resetting bearer <eth:team0>
[  381.302077][T24198] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  381.422479][T24199] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3924'.
[  381.577052][T24219] 8021q: adding VLAN 0 to HW filter on device bond3
[  381.594765][T24219] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3927'.
[  381.895843][T24239] tipc: Resetting bearer <eth:team0>
[  382.444846][T24289] ==================================================================
[  382.448169][T24289] BUG: KASAN: use-after-free in xfrm_alloc_spi+0x570/0xf30
[  382.451094][T24289] Read of size 4 at addr ffff888035d98e44 by task syz.0.3938/24289
[  382.455187][T24289] 
[  382.456030][T24289] CPU: 0 UID: 0 PID: 24289 Comm: syz.0.3938 Not tainted syzkaller #0 PREEMPT(full) 
[  382.456045][T24289] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  382.456052][T24289] Call Trace:
[  382.456057][T24289]  <TASK>
[  382.456062][T24289]  dump_stack_lvl+0x189/0x250
[  382.456079][T24289]  ? __kasan_check_byte+0x12/0x40
[  382.456093][T24289]  ? __pfx_dump_stack_lvl+0x10/0x10
[  382.456101][T24289]  ? lock_release+0x4b/0x3e0
[  382.456111][T24289]  ? __virt_addr_valid+0x4a5/0x5c0
[  382.456121][T24289]  print_report+0xca/0x240
[  382.456128][T24289]  ? xfrm_alloc_spi+0x570/0xf30
[  382.456136][T24289]  kasan_report+0x118/0x150
[  382.456145][T24289]  ? xfrm_alloc_spi+0x570/0xf30
[  382.456153][T24289]  xfrm_alloc_spi+0x570/0xf30
[  382.456161][T24289]  ? xfrm_alloc_spi+0x2a0/0xf30
[  382.456170][T24289]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  382.456178][T24289]  ? xfrm_find_acq+0x87/0xa0
[  382.456186][T24289]  xfrm_alloc_userspi+0x70b/0xc90
[  382.456197][T24289]  ? apparmor_capable+0x137/0x1b0
[  382.456205][T24289]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  382.456214][T24289]  ? __nla_parse+0x40/0x60
[  382.456224][T24289]  xfrm_user_rcv_msg+0x7a3/0xab0
[  382.456233][T24289]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  382.456247][T24289]  ? __pfx___mutex_trylock_common+0x10/0x10
[  382.456254][T24289]  ? rcu_is_watching+0x15/0xb0
[  382.456261][T24289]  ? trace_contention_end+0x39/0x120
[  382.456268][T24289]  ? __mutex_lock+0x335/0x1350
[  382.456276][T24289]  netlink_rcv_skb+0x208/0x470
[  382.456286][T24289]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  382.456294][T24289]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  382.456305][T24289]  ? netlink_deliver_tap+0x2e/0x1b0
[  382.456315][T24289]  ? netlink_deliver_tap+0x2e/0x1b0
[  382.456324][T24289]  xfrm_netlink_rcv+0x79/0x90
[  382.456332][T24289]  netlink_unicast+0x82f/0x9e0
[  382.456342][T24289]  ? __pfx_netlink_unicast+0x10/0x10
[  382.456350][T24289]  ? netlink_sendmsg+0x642/0xb30
[  382.456356][T24289]  ? skb_put+0x11b/0x210
[  382.456364][T24289]  netlink_sendmsg+0x805/0xb30
[  382.456372][T24289]  ? __pfx_netlink_sendmsg+0x10/0x10
[  382.456379][T24289]  ? aa_sock_msg_perm+0xf1/0x1d0
[  382.456385][T24289]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  382.456393][T24289]  ? __pfx_netlink_sendmsg+0x10/0x10
[  382.456399][T24289]  __sock_sendmsg+0x21c/0x270
[  382.456408][T24289]  ____sys_sendmsg+0x505/0x830
[  382.456416][T24289]  ? __pfx_____sys_sendmsg+0x10/0x10
[  382.456424][T24289]  ? import_iovec+0x74/0xa0
[  382.456432][T24289]  ___sys_sendmsg+0x21f/0x2a0
[  382.456439][T24289]  ? __pfx____sys_sendmsg+0x10/0x10
[  382.456446][T24289]  ? futex_wait+0x285/0x360
[  382.456460][T24289]  ? __lock_acquire+0xab9/0xd20
[  382.456470][T24289]  __x64_sys_sendmsg+0x19b/0x260
[  382.456478][T24289]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  382.456486][T24289]  ? rcu_is_watching+0x15/0xb0
[  382.456493][T24289]  ? do_syscall_64+0xbe/0x3b0
[  382.456499][T24289]  do_syscall_64+0xfa/0x3b0
[  382.456505][T24289]  ? lockdep_hardirqs_on+0x9c/0x150
[  382.456513][T24289]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  382.456520][T24289]  ? exc_page_fault+0x9f/0xf0
[  382.456529][T24289]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  382.456535][T24289] RIP: 0033:0x7f3fef58ebe9
[  382.456542][T24289] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  382.456549][T24289] RSP: 002b:00007f3ff0420038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  382.456557][T24289] RAX: ffffffffffffffda RBX: 00007f3fef7c5fa0 RCX: 00007f3fef58ebe9
[  382.456562][T24289] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007
[  382.456567][T24289] RBP: 00007f3fef611e19 R08: 0000000000000000 R09: 0000000000000000
[  382.456571][T24289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  382.456575][T24289] R13: 00007f3fef7c6038 R14: 00007f3fef7c5fa0 R15: 00007fff6183b238
[  382.456582][T24289]  </TASK>
[  382.456585][T24289] 
[  382.594128][T24289] The buggy address belongs to the physical page:
[  382.596509][T24289] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035d9bc00 pfn:0x35d98
[  382.600222][T24289] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  382.602516][T24289] page_type: f0(buddy)
[  382.603813][T24289] raw: 00fff00000000000 ffffea0000d8b708 ffffea00008a6408 0000000000000000
[  382.606494][T24289] raw: ffff888035d9bc00 0000000000000002 00000000f0000000 0000000000000000
[  382.609211][T24289] page dumped because: kasan: bad access detected
[  382.611444][T24289] page_owner tracks the page as freed
[  382.613200][T24289] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), pid 5846, tgid 5846 (syz-executor), ts 376768559950, free_ts 377037339541
[  382.619369][T24289]  post_alloc_hook+0x240/0x2a0
[  382.620891][T24289]  get_page_from_freelist+0x21e4/0x22c0
[  382.622755][T24289]  __alloc_frozen_pages_noprof+0x181/0x370
[  382.624692][T24289]  alloc_pages_mpol+0x232/0x4a0
[  382.626344][T24289]  alloc_pages_noprof+0xa9/0x190
[  382.628044][T24289]  pte_alloc_one+0x21/0x170
[  382.629662][T24289]  __pte_alloc+0x25/0x1a0
[  382.631222][T24289]  copy_pmd_range+0x6a91/0x71d0
[  382.632874][T24289]  copy_page_range+0xc14/0x1270
[  382.634455][T24289]  dup_mmap+0xf57/0x1ac0
[  382.635819][T24289]  copy_mm+0x13c/0x4b0
[  382.637216][T24289]  copy_process+0x1706/0x3c00
[  382.638834][T24289]  kernel_clone+0x21e/0x840
[  382.640708][T24289]  __x64_sys_clone+0x18b/0x1e0
[  382.642688][T24289]  do_syscall_64+0xfa/0x3b0
[  382.644518][T24289]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  382.646884][T24289] page last free pid 23938 tgid 23938 stack trace:
[  382.649491][T24289]  __free_frozen_pages+0xbc4/0xd30
[  382.651556][T24289]  __tlb_remove_table+0x2d2/0x3b0
[  382.653612][T24289]  tlb_remove_table_rcu+0x85/0x100
[  382.655759][T24289]  rcu_core+0xcab/0x1770
[  382.657508][T24289]  handle_softirqs+0x286/0x870
[  382.659510][T24289]  __irq_exit_rcu+0xca/0x1f0
[  382.661399][T24289]  irq_exit_rcu+0x9/0x30
[  382.663145][T24289]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  382.665445][T24289]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  382.667875][T24289] 
[  382.668869][T24289] Memory state around the buggy address:
[  382.671138][T24289]  ffff888035d98d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  382.674302][T24289]  ffff888035d98d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  382.677652][T24289] >ffff888035d98e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  382.680905][T24289]                                            ^
[  382.683460][T24289]  ffff888035d98e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  382.686725][T24289]  ffff888035d98f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  382.689980][T24289] ==================================================================
[  382.693368][T24289] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  382.696486][T24289] CPU: 0 UID: 0 PID: 24289 Comm: syz.0.3938 Not tainted syzkaller #0 PREEMPT(full) 
[  382.700232][T24289] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  382.704343][T24289] Call Trace:
[  382.705798][T24289]  <TASK>
[  382.707088][T24289]  dump_stack_lvl+0x99/0x250
[  382.709071][T24289]  ? __asan_memcpy+0x40/0x70
[  382.711034][T24289]  ? __pfx_dump_stack_lvl+0x10/0x10
[  382.712877][T24289]  ? __pfx__printk+0x10/0x10
[  382.714562][T24289]  vpanic+0x281/0x750
[  382.715884][T24289]  ? __pfx_vpanic+0x10/0x10
[  382.717404][T24289]  ? irqentry_exit+0x74/0x90
[  382.718966][T24289]  panic+0xb9/0xc0
[  382.720256][T24289]  ? __pfx_panic+0x10/0x10
[  382.721920][T24289]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  382.724315][T24289]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  382.726587][T24289]  ? xfrm_alloc_spi+0x570/0xf30
[  382.728536][T24289]  check_panic_on_warn+0x89/0xb0
[  382.730567][T24289]  ? xfrm_alloc_spi+0x570/0xf30
[  382.732568][T24289]  end_report+0x78/0x160
[  382.734406][T24289]  kasan_report+0x129/0x150
[  382.736409][T24289]  ? xfrm_alloc_spi+0x570/0xf30
[  382.738493][T24289]  xfrm_alloc_spi+0x570/0xf30
[  382.740449][T24289]  ? xfrm_alloc_spi+0x2a0/0xf30
[  382.742417][T24289]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  382.744578][T24289]  ? xfrm_find_acq+0x87/0xa0
[  382.746564][T24289]  xfrm_alloc_userspi+0x70b/0xc90
[  382.748730][T24289]  ? apparmor_capable+0x137/0x1b0
[  382.750830][T24289]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  382.753115][T24289]  ? __nla_parse+0x40/0x60
[  382.754981][T24289]  xfrm_user_rcv_msg+0x7a3/0xab0
[  382.757060][T24289]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  382.759347][T24289]  ? __pfx___mutex_trylock_common+0x10/0x10
[  382.761637][T24289]  ? rcu_is_watching+0x15/0xb0
[  382.763561][T24289]  ? trace_contention_end+0x39/0x120
[  382.765719][T24289]  ? __mutex_lock+0x335/0x1350
[  382.767699][T24289]  netlink_rcv_skb+0x208/0x470
[  382.769665][T24289]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  382.771861][T24289]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  382.774076][T24289]  ? netlink_deliver_tap+0x2e/0x1b0
[  382.776284][T24289]  ? netlink_deliver_tap+0x2e/0x1b0
[  382.778437][T24289]  xfrm_netlink_rcv+0x79/0x90
[  382.780255][T24289]  netlink_unicast+0x82f/0x9e0
[  382.782214][T24289]  ? __pfx_netlink_unicast+0x10/0x10
[  382.784399][T24289]  ? netlink_sendmsg+0x642/0xb30
[  382.786425][T24289]  ? skb_put+0x11b/0x210
[  382.788198][T24289]  netlink_sendmsg+0x805/0xb30
[  382.790247][T24289]  ? __pfx_netlink_sendmsg+0x10/0x10
[  382.792434][T24289]  ? aa_sock_msg_perm+0xf1/0x1d0
[  382.794502][T24289]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  382.796671][T24289]  ? __pfx_netlink_sendmsg+0x10/0x10
[  382.798830][T24289]  __sock_sendmsg+0x21c/0x270
[  382.800851][T24289]  ____sys_sendmsg+0x505/0x830
[  382.802912][T24289]  ? __pfx_____sys_sendmsg+0x10/0x10
[  382.805071][T24289]  ? import_iovec+0x74/0xa0
[  382.806874][T24289]  ___sys_sendmsg+0x21f/0x2a0
[  382.808842][T24289]  ? __pfx____sys_sendmsg+0x10/0x10
[  382.811035][T24289]  ? futex_wait+0x285/0x360
[  382.812982][T24289]  ? __lock_acquire+0xab9/0xd20
[  382.815013][T24289]  __x64_sys_sendmsg+0x19b/0x260
[  382.817092][T24289]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  382.819377][T24289]  ? rcu_is_watching+0x15/0xb0
[  382.821383][T24289]  ? do_syscall_64+0xbe/0x3b0
[  382.823335][T24289]  do_syscall_64+0xfa/0x3b0
[  382.825237][T24289]  ? lockdep_hardirqs_on+0x9c/0x150
[  382.827378][T24289]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  382.829849][T24289]  ? exc_page_fault+0x9f/0xf0
[  382.831839][T24289]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  382.834283][T24289] RIP: 0033:0x7f3fef58ebe9
[  382.836174][T24289] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  382.843988][T24289] RSP: 002b:00007f3ff0420038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  382.847438][T24289] RAX: ffffffffffffffda RBX: 00007f3fef7c5fa0 RCX: 00007f3fef58ebe9
[  382.850717][T24289] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007
[  382.854005][T24289] RBP: 00007f3fef611e19 R08: 0000000000000000 R09: 0000000000000000
[  382.857342][T24289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  382.860561][T24289] R13: 00007f3fef7c6038 R14: 00007f3fef7c5fa0 R15: 00007fff6183b238
[  382.863834][T24289]  </TASK>
[  382.865857][T24289] Kernel Offset: disabled
[  382.867651][T24289] Rebooting in 86400 seconds..

VM DIAGNOSIS:
21:28:38  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000066 RBX=0000000000000066 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000001152 RDI=0000000000001153 RBP=00000000000003f8 RSP=ffffc90006c469f0
R8 =ffff888020a40237 R9 =1ffff11004148046 R10=dffffc0000000000 R11=ffffffff854f3b00
R12=dffffc0000000000 R13=ffffffff99afd8f1 R14=ffffffff99df2420 R15=0000000000000000
RIP=ffffffff854f3b7c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f3ff04206c0 ffffffff 00c00000
GS =0000 ffff8880b8618000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b3251dff8 CR3=0000000030592000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f3fef797498 00007f3fef797470 XMM03=00007f3fef7974a8 00007f3fef7974a0
XMM04=00007f3ff02fd100 00007f3fef797460 XMM05=00007f3fef797478 00007f3fef7974c0
XMM06=00007f3fef7974b8 00007f3fef7974b0 XMM07=00007f3fef7974a8 00007f3fef7974a0
XMM08=0000000000000000 00007f3fef612ee7 XMM09=0000000000000000 00007f3fef612fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=f99cea7dd6708a00 RBX=ffffffff819683c8 RCX=f99cea7dd6708a00 RDX=0000000000000001
RSI=ffffffff8d9b8241 RDI=ffffffff8be33880 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f9b R9 =1ffff11026cc65f3 R10=dffffc0000000000 R11=ffffed1026cc65f4
R12=ffffffff8fa39030 R13=0000000000000001 R14=0000000000000001 R15=1ffff110200d0000
RIP=ffffffff8b79c3f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c18000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055efbde6dbc8 CR3=00000001096dc000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 00000000000001a4 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
