last executing test programs:

21.081696341s ago: executing program 0 (id=296):
syz_emit_ethernet(0x3b6, &(0x7f00000009c0)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa86dd6000000003803afffe800000000000000000000000000000ff02000000000000000000000000000186009078000000000000000000000000000aa741e54006598080a8030000004023493b87aafaff0500ffffffe723732472eefa45ad96579269748e254c1e4a948b580a9bc430d3be27df3e34060000ca0a5c15b37adac15084dbaf736b41e5af18020001000100000000001995319cff0318fe909393fe089393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75f655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978001d06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5c6186c0d3baa75af3aecbc47bda4695d072479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5acaa556b9f30dcab2b90aa235a670670ffc5dc49dfb58d89310000000000030bd47ae6e8805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becf1a9f51a948b5b303f4f0222140fcf98a102ec1876d4e6fa3b20519bbaa8a029cee00b8d3485e3b63ed09bdb581c9fe68a356f542b043059ff05932e740e077e1d16212fb00145e14f0e74d2d42cfb3f27fafb60845f90b6dfc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa76ffff9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4828288e62afbf03269f1f98aea6a58cf45d7c5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c258a6f0005d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02c226a6bce65f81ed"], 0x0)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x3d, &(0x7f0000000000)='cgroup\x00\x8d\f\xf3\xcd\xc6X$\x01n-Hg\x144-.\xe2\x053\xe2\xf4\xbf[\xe9\xdddU\x91\x9d,\t\x8d\xc3@\x86,\x7f\xe2Z\xe8L\x80\xdbe~c\xbc\x9b\xcf\x9b\x1cH\x95\xf3'}, 0x30)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000005c0)=ANY=[@ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="0200000002"], 0x10)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="02000000150d0000000000003f", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x10)
socket$inet6_mptcp(0xa, 0x1, 0x106)
bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
r5 = socket$inet6(0xa, 0x1, 0x5)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x3, 0x0, 0x0}, 0x94)
setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4)
connect$inet6(r4, &(0x7f0000000080)={0xa, 0x1, 0x9, @remote, 0x7}, 0x1c)
sendto$inet6(r4, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779", 0x83, 0x840, 0x0, 0x0)
r6 = openat$cgroup_ro(r0, &(0x7f0000000340)='freezer.state\x00', 0x275a, 0x0)
write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000300)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e23, 0x6, @dev={0xfe, 0x80, '\x00', 0x13}, 0x1}}, 0x0, 0x2000}, 0x0)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.self_freezing\x00', 0x275a, 0x0)
ioctl$FS_IOC_SETFLAGS(r7, 0xc0189436, &(0x7f0000000140))
epoll_create1(0x80000)
r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20)
r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000ed0759cb47cd90df41fa7a40c72a22dcc53a83731c39b01fceb7"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r8, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r9, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000001200)=[{}], 0x8, 0x0, 0x0, 0x0, 0x37, 0x0, 0x8, 0x0, 0x0}}, 0x10)

20.940507409s ago: executing program 0 (id=300):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r2, 0x65, 0x4, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'caif0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x8}, {0x6}}}, 0x24}}, 0x0)

20.766674852s ago: executing program 0 (id=308):
r0 = socket$nl_route(0x10, 0x3, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'erspan0\x00', <r2=>0x0}) (async)
r3 = socket$inet6_icmp(0xa, 0x2, 0x3a)
ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5, r2}) (async)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5000000010000100"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000300012800b00010065727370616e000020000280040012000500160002000000060018"], 0x50}}, 0x0)

15.830775392s ago: executing program 0 (id=308):
r0 = socket$nl_route(0x10, 0x3, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'erspan0\x00', <r2=>0x0}) (async)
r3 = socket$inet6_icmp(0xa, 0x2, 0x3a)
ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5, r2}) (async)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5000000010000100"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000300012800b00010065727370616e000020000280040012000500160002000000060018"], 0x50}}, 0x0)

10.029343142s ago: executing program 0 (id=308):
r0 = socket$nl_route(0x10, 0x3, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'erspan0\x00', <r2=>0x0}) (async)
r3 = socket$inet6_icmp(0xa, 0x2, 0x3a)
ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5, r2}) (async)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5000000010000100"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000300012800b00010065727370616e000020000280040012000500160002000000060018"], 0x50}}, 0x0)

4.276951696s ago: executing program 0 (id=308):
r0 = socket$nl_route(0x10, 0x3, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'erspan0\x00', <r2=>0x0}) (async)
r3 = socket$inet6_icmp(0xa, 0x2, 0x3a)
ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5, r2}) (async)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5000000010000100"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000300012800b00010065727370616e000020000280040012000500160002000000060018"], 0x50}}, 0x0)

2.099439747s ago: executing program 1 (id=522):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, 0x0, 0x0)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r1 = socket$inet6(0xa, 0x2, 0x3a)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x430, @local, 0x9}, 0x1c)
sendto$inet6(r1, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x0, 0x0, 0x0)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r2, 0x0, 0x3}, 0x18)
r4 = socket$packet(0x11, 0x3, 0x300)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000022c0000002400000002000000000000000000000b00000000000000000100000d0000000000000002030000000000000000000009030000000000"], 0x0, 0x46, 0x0, 0xa, 0xffffffff}, 0x28)
setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8000}, 0x4)
r5 = socket(0x2, 0x3, 0x6)
bind$inet(r5, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10)
setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f00000000c0)=0x6, 0x4)
socket$l2tp(0x2, 0x2, 0x73)
socket$l2tp(0x2, 0x2, 0x73)
sendto$inet(r5, 0x0, 0x0, 0x48800, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10)
sendto$inet(r5, &(0x7f00000023c0)="8ce2ad4d", 0x4, 0x0, &(0x7f0000002400)={0x2, 0x0, @multicast2}, 0x10)
socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x3, 0x0)
r7 = socket$inet6_icmp(0xa, 0x2, 0x3a)
setsockopt$inet6_buf(r7, 0x29, 0x6, &(0x7f0000000040)="91", 0x1)
connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="31acefd6424d501cff49b91257f1714a83f862f71c3dd3968ed2dcae42b3e0c00e3441d000c37662f6a8a4345086a7ea6eb1b6cc9135059dd6c2edfc5ecdeb250bf229fdfcbc34829da4201e3ee123dc2091c81d4a5873af1a36321ef2e5f581adf760d2eb3a2764f01d670ccb2d0c6dee2d4955d97fd63c678d9d92246be87f1772f700bb8b7edd6540a46ea91a6e03fdff508632c76412df9fb655b8e3841413f011aab7df5677c9e89cfe57a842344ea0e17ace9cb157fe59d7d08d1eb22fb501bad1e4e85342a5e7ad452dec31517279cec6804347f1f40a92561b870d3d80529d1ccea02ebfe5b8df9012c5ae857cd16cc122", @ANYRES64=r1, @ANYRES32=r0, @ANYRES32=r3, @ANYRES64=r6, @ANYBLOB="e91772ada7adafd4b2b2a1ccea477ca3552fefe1d667d168fecce9ab876f78c7b9f47b4e0d1b", @ANYBLOB="b096419a5dd53a87db10739564abc608a02000cb9da0aed5a3e4ba0ec52bb4327c647a8b7e12ff1c7bc759b950912bb2ae601db67cc26a7ad90bede0b959dfdb5d2d672613a2145ed10402258d4ce388fb6d305dea812be8db6fd5ee451b3a3916c7a954098322de8d01a817b21ab87dbe6d548f57f76297f00773355a58f321b9cb2a6f80292c45dbde61247202fa6cdc8948783693f3ac1feb2b98035b9b1c5ce42f9834e1090cd7362e37a853aa640b823a31ee338e248f10a0044eb57bc47c109da58c8f87b4fa837cf7055beb508cd50a632999b1389d30591566faf0653f2886", @ANYRESOCT=r6, @ANYRESDEC=r0], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r8, 0x400448c9, 0x0)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000020000000001a0000001c0000800400010200000800060000000000"], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x10)

1.919422247s ago: executing program 2 (id=524):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r5=>0x0})
sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000900)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000000000007a00000008000300", @ANYRES32=r5], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
ioctl$TUNSETOFFLOAD(r1, 0x400454c9, 0xba98575a95aeb70d)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
close(r6)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000))
r7 = socket$kcm(0x2, 0x200000000000001, 0x106)
setsockopt$kcm_KCM_RECV_DISABLE(r7, 0x119, 0x1, 0x0, 0x0)
socket$inet6_sctp(0xa, 0x1, 0x84)
ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local})
write$cgroup_devices(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd)

1.159822895s ago: executing program 1 (id=525):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f00000002c0)={0x0, 0x2d}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14)
r3 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vxcan1\x00', <r4=>0x0})
bind$can_j1939(r3, &(0x7f0000000080)={0x1d, r4, 0x400000000000}, 0x18)
connect$can_j1939(r3, &(0x7f0000000000)={0x1d, r2, 0xc, {0x2, 0xf0, 0x2}, 0xfd}, 0x18)
socket$igmp(0x2, 0x3, 0x2)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_QUANTUM={0x8, 0xf}]}}]}, 0x38}}, 0x0)
r8 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_RX_RING(r8, 0x11b, 0xc0000000, 0x0, 0x0)

306.958976ms ago: executing program 1 (id=526):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x4c, 0x10, 0x1, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2180}, [@IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}, @IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN={0x10, 0x2, {0xffffffff, 0xcd2, 0x3}}]}]}]}, 0x4c}}, 0x0)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00'}, 0x94)
syz_emit_ethernet(0x86, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x32, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x2, 0x4, "1264fbafb5ccccbabef3b01a75f92605c12199dc51532c004e26c6e035826277", "b2178e7de115d5a7c714ae55f40f3d74", {"d5b99c296869ad485c67f4fca93d8b5e", "a6fae989bd0adb8b73dcecd5e816e8f9"}}}}}}}, 0x0) (async)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x1f4, 0xd50, 0x6558, &(0x7f0000000000)="ff", 0x0, 0x6, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x69)

305.284384ms ago: executing program 2 (id=527):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000d40)=ANY=[@ANYBLOB="6000000010000104a0518fd50000000000000000", @ANYRES32=0x0, @ANYBLOB="096b0200000000002c00128009000100626f6e64000000001c00028006001900ff03000008000900010000f3080007000300000014003500626f6e6430"], 0x60}, 0x1, 0x0, 0x0, 0x20004040}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x9, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x14}]}, &(0x7f0000000080)='syzkaller\x00', 0x4}, 0x94)

261.218608ms ago: executing program 1 (id=528):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000400)=ANY=[@ANYBLOB="0039040000000700000000000003e4", @ANYRES32=0x0, @ANYBLOB="0161040042020100200012800b00010065727370616e0000100002800400120008001500e7940c00"], 0x40}}, 0x4004000)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r0)
sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x38, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x40}}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1f}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x8000)

260.617196ms ago: executing program 2 (id=529):
r0 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4008004)
getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x50, 0x10, 0x503, 0x0, 0x700, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @local}]}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0xc0b0)

198.969644ms ago: executing program 1 (id=530):
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x3, 0x0, &(0x7f0000000500))
writev(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000000200)="b772b60142dbfe647c4da5d54f6a7ffaec488ec8c0a1be5f902c9079634f", 0x1e}], 0x1)
r1 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10)
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000004a00010000000000000000000a000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x24}}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x80, r3, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @multicast2}}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x23}}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @remote}}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x2}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}]}, 0x80}, 0x1, 0x0, 0x0, 0x48801}, 0x3)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffff8}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)

151.030623ms ago: executing program 2 (id=531):
r0 = socket$nl_route(0x10, 0x3, 0x0) (async)
socket$inet6_sctp(0xa, 0x1, 0x84) (async)
socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64)
socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64)
r1 = socket$inet6_udp(0xa, 0x2, 0x0) (async)
r2 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000001a140100000000000000000008000300000000000800", @ANYRES64=r1], 0x20}, 0x1, 0x0, 0x0, 0x4000015}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000040)={0x6, &(0x7f0000000000)=[{0x3, 0x8, 0x7, 0xfffffff9}, {0x0, 0x9, 0x8, 0x7}, {0x4, 0x7f, 0x5, 0x1ff}, {0x5, 0xd, 0x5, 0xc}, {0x3, 0x81, 0x5, 0x1}, {0x2, 0x2, 0x0, 0x4}]}, 0x10)
sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0xc0, 0x30, 0x1, 0x0, 0x25dfdbfe, {}, [{0xac, 0x1, [@m_tunnel_key={0x60, 0x1, 0x0, 0x0, {{0xf}, {0x30, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x0, 0x0, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0xfffffffffffffe24, 0x2, {0x9, 0xb, 0x12, 0x6, 0x695}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0xc0}}, 0x0)

148.628927ms ago: executing program 1 (id=532):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r0, 0x0) (async)
shutdown(r0, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r2)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3) (async)
r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3)
sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async)
sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0)
close(r5) (async)
close(r5)
socket$unix(0x1, 0x1, 0x0) (async)
r6 = socket$unix(0x1, 0x1, 0x0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x10001}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000001}, 0x0)
ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"})
socket$inet6_sctp(0xa, 0x1, 0x84) (async)
r9 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) (async)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c)
sendto$inet6(r9, &(0x7f0000000000)='\x00', 0x1, 0x8015, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x7}, 0x1c)
recvmmsg(r9, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f00000000c0), 0x1, &(0x7f00000003c0)=""/21, 0x21}, 0x1ff}], 0x73d, 0x40000040, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0xfffffffffffffff9, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @mcast2, 0xa1c}]}, &(0x7f0000000440)=0x10) (async)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={<r10=>0x0, 0xfffffffffffffff9, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @mcast2, 0xa1c}]}, &(0x7f0000000440)=0x10)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x74, &(0x7f0000000240)={r10, 0x2, 0x30, 0xa5f}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000000c0)={<r11=>0x0, @in6={{0xa, 0x4e21, 0x3, @empty, 0x1ff}}, 0x400, 0x4, 0x9, 0xca, 0x4a, 0x7fff, 0xff}, &(0x7f0000000180)=0x9c)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r11}, &(0x7f0000000200)=0x8)
socket$inet6(0xa, 0x80002, 0x0) (async)
r12 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_mreq(r12, 0x29, 0x1b, 0x0, 0xff03)
recvmmsg$unix(r6, &(0x7f0000001140)=[{{&(0x7f0000000300)=@abs, 0x6e, &(0x7f0000000880)=[{&(0x7f0000000380)=""/127, 0x7f}, {&(0x7f0000000480)=""/198, 0xc6}, {&(0x7f00000006c0)=""/248, 0xf8}, {&(0x7f00000005c0)=""/42, 0x2a}, {&(0x7f0000000600)=""/81, 0x51}, {&(0x7f00000007c0)=""/183, 0xb7}], 0x6, &(0x7f0000000900)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000000980), 0x6e, &(0x7f0000000f00)=[{&(0x7f0000000a40)=""/40, 0x28}, {&(0x7f0000000a80)=""/181, 0xb5}, {&(0x7f0000000b40)=""/232, 0xe8}, {&(0x7f0000000c40)=""/150, 0x96}, {&(0x7f0000000d00)=""/254, 0xfe}, {&(0x7f0000000e00)=""/128, 0x80}, {&(0x7f0000000e80)=""/45, 0x2d}, {&(0x7f0000000ec0)=""/46, 0x2e}], 0x8, &(0x7f0000000f80)=[@cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0xf0}}, {{0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000001080)=""/96, 0x60}], 0x1}}], 0x3, 0x10103, 0x0)
socket$kcm(0x2d, 0x2, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000))

92.17141ms ago: executing program 2 (id=533):
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000500)="d8000000180081064e81f782db4cb904021e0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cf6efbca4158858e796834b25ae5a3048000a007a290457f01a7cee4090000001fb7913fd25a21ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703a90723f9000000008af26c", 0xd8}], 0x1}, 0x22040000)
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="000000ecff000000000000000400000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffff5}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @sk_reuseport, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f00000006c0)=ANY=[@ANYBLOB="b40800000000000073112000000000008510000002000000b7000000000000009500c2000000000095000012000000000e09b9445761db3ed82f7be4b9f1628b9a5c40384cb45e62e827e611f21a01a76f66f616553959b478ad3c46bb20e558783b21dd5307760617deec8b1b75c00853ee69e33ba2c01c28950365dd46fcc9f2ac6d20197fd68292e8445824f49b6fba41a316e13e462e31ca00d2622d56318d78e271d364329e7ae732bf8dade587bb30d67e23f78662621b74aabfd8eaf399893bab50fed33101f5a1085f991877907bd6117db675155932860499977f7384a8d94e810492c284fc7cc784ed942bf11d72897a7896f5f8c957984312e9d39eaa478a3065afd52404cb058b"], &(0x7f0000000080)='GPL\x00', 0x6, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94)
r2 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, 0x0, &(0x7f0000000800)=0x5e)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={<r3=>0x0, 0x6}, &(0x7f00000000c0)=0x8)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000100)={r3, @in6={{0xa, 0x4e22, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}, 0x4}}}, 0x84)

0s ago: executing program 2 (id=534):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000c10400000000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1000000}, 0x50)
unshare(0x6a040000)
socket$nl_generic(0x10, 0x3, 0x10)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000280)=[{0x20}, {0x6, 0x0, 0x0, 0xfffffffe}]}, 0x10)
r2 = epoll_create1(0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e)
r5 = socket$l2tp(0x2, 0x2, 0x73)
getsockname(r5, 0x0, &(0x7f0000000180))
sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0)
r6 = socket$inet(0x2, 0x4000000805, 0x0)
listen(r6, 0x5)
sendmmsg(r6, &(0x7f0000000180)=[{{&(0x7f0000000000)=@l2tp={0x2, 0x0, @local, 0x2}, 0x80, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x18}}], 0x2, 0x844)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r7 = epoll_create1(0x0)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000f80)={'caif0\x00', &(0x7f0000000540)=@ethtool_ringparam={0x11, 0x1, 0x0, 0xfffffffc, 0x3, 0x7, 0xfffffffa, 0x80000000, 0x7}})
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014})
epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r2, &(0x7f0000000000)={0xa0000001})
unshare(0x60600)
r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x9, 0x10001, 0x9, 0x1}, 0x48)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x4, r9}, 0x38)
ppoll(&(0x7f0000000200)=[{r7, 0x1}], 0x1, 0x0, 0x0, 0x3)
socket$inet6_sctp(0xa, 0x1, 0x84)
socket(0x10, 0x803, 0x0)
r10 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r10, 0x0, 0x0)
sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="11380000001000390400000080004eefa0777c10c8", @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100677265000c000280060010004e240000"], 0x38}, 0x1, 0x0, 0x0, 0x40080d5}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:39281' (ED25519) to the list of known hosts.
syzkaller login: [   47.576291][ T5819] cgroup: Unknown subsys name 'net'
[   47.684479][ T5819] cgroup: Unknown subsys name 'cpuset'
[   47.689490][ T5819] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   49.601638][ T5819] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   53.523703][ T5829] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   53.526656][ T5829] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   53.529170][ T5829] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   53.532786][ T5829] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   53.535432][ T5829] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   53.572484][   T54] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   53.575082][   T54] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   53.580748][   T54] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   53.583974][   T54] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   53.603208][ T5836] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   53.605509][ T5838] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   53.608156][ T5836] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   53.621154][ T5836] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   53.629442][ T5836] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   53.633572][ T5836] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   53.763548][ T5827] chnl_net:caif_netlink_parms(): no params data found
[   53.901792][ T5834] chnl_net:caif_netlink_parms(): no params data found
[   53.945136][ T5827] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.947367][ T5827] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.949689][ T5827] bridge_slave_0: entered allmulticast mode
[   53.953046][ T5827] bridge_slave_0: entered promiscuous mode
[   53.957232][ T5827] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.959374][ T5827] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.962433][ T5827] bridge_slave_1: entered allmulticast mode
[   53.965209][ T5827] bridge_slave_1: entered promiscuous mode
[   54.040989][ T5827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.053891][ T5827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.068637][ T5831] chnl_net:caif_netlink_parms(): no params data found
[   54.082711][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.084918][ T5834] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.087103][ T5834] bridge_slave_0: entered allmulticast mode
[   54.089775][ T5834] bridge_slave_0: entered promiscuous mode
[   54.094056][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.096378][ T5834] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.098519][ T5834] bridge_slave_1: entered allmulticast mode
[   54.101371][ T5834] bridge_slave_1: entered promiscuous mode
[   54.114253][ T5827] team0: Port device team_slave_0 added
[   54.140205][ T5827] team0: Port device team_slave_1 added
[   54.145023][ T5834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.164790][ T5834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.205944][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.208035][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.216490][ T5827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.229308][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.232009][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.234183][ T5831] bridge_slave_0: entered allmulticast mode
[   54.236837][ T5831] bridge_slave_0: entered promiscuous mode
[   54.239772][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.242068][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.249652][ T5827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.255060][ T5834] team0: Port device team_slave_0 added
[   54.257265][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.259825][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.262465][ T5831] bridge_slave_1: entered allmulticast mode
[   54.265178][ T5831] bridge_slave_1: entered promiscuous mode
[   54.274975][ T5834] team0: Port device team_slave_1 added
[   54.322119][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.335787][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.338863][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.341698][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.349124][ T5834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.356025][ T5827] hsr_slave_0: entered promiscuous mode
[   54.358843][ T5827] hsr_slave_1: entered promiscuous mode
[   54.372590][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.374681][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.382152][ T5834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.422320][ T5831] team0: Port device team_slave_0 added
[   54.434291][ T5831] team0: Port device team_slave_1 added
[   54.493797][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.495884][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.504011][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.511041][ T5834] hsr_slave_0: entered promiscuous mode
[   54.513332][ T5834] hsr_slave_1: entered promiscuous mode
[   54.515378][ T5834] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   54.517732][ T5834] Cannot create hsr debugfs directory
[   54.525308][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.527398][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.535492][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.615551][ T5831] hsr_slave_0: entered promiscuous mode
[   54.617866][ T5831] hsr_slave_1: entered promiscuous mode
[   54.619942][ T5831] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   54.622546][ T5831] Cannot create hsr debugfs directory
[   54.685233][ T5827] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   54.715141][ T5827] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   54.726989][ T5827] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   54.750017][ T5827] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   54.882541][ T5834] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   54.892605][ T5834] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   54.899005][ T5834] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   54.906882][ T5834] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   54.979315][ T5831] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   54.985579][ T5831] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   54.998578][ T5831] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   55.003543][ T5831] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   55.024604][ T5827] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.052160][ T5827] 8021q: adding VLAN 0 to HW filter on device team0
[   55.072546][ T1090] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.074907][ T1090] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.087981][ T1090] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.090226][ T1090] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.105938][ T5834] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.138427][ T5834] 8021q: adding VLAN 0 to HW filter on device team0
[   55.149070][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.165970][ T1090] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.168404][ T1090] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.174743][ T1090] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.177074][ T1090] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.196339][ T5831] 8021q: adding VLAN 0 to HW filter on device team0
[   55.214960][  T183] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.217134][  T183] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.225199][  T183] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.227820][  T183] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.268078][ T5834] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   55.295257][ T5831] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   55.329420][ T5827] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.397985][ T5827] veth0_vlan: entered promiscuous mode
[   55.408098][ T5827] veth1_vlan: entered promiscuous mode
[   55.437701][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.466483][ T5834] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.476567][ T5831] veth0_vlan: entered promiscuous mode
[   55.482569][ T5827] veth0_macvtap: entered promiscuous mode
[   55.487814][ T5831] veth1_vlan: entered promiscuous mode
[   55.501685][ T5827] veth1_macvtap: entered promiscuous mode
[   55.526018][ T5831] veth0_macvtap: entered promiscuous mode
[   55.534700][ T5831] veth1_macvtap: entered promiscuous mode
[   55.540042][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.552308][ T5834] veth0_vlan: entered promiscuous mode
[   55.556001][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.562313][ T5838] Bluetooth: hci0: command tx timeout
[   55.571998][ T5834] veth1_vlan: entered promiscuous mode
[   55.579652][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.587290][ T5827] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.591555][ T5827] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.594211][ T5827] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.596853][ T5827] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.607225][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.621973][ T5831] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.624586][ T5831] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.627119][ T5831] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.629614][ T5831] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.656251][ T5834] veth0_macvtap: entered promiscuous mode
[   55.662721][ T5834] veth1_macvtap: entered promiscuous mode
[   55.696493][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.721494][ T5838] Bluetooth: hci1: command tx timeout
[   55.721552][ T5829] Bluetooth: hci2: command tx timeout
[   55.736223][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.751057][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.757185][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.762724][ T5834] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.766331][ T5834] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.769123][ T5834] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.772478][ T5834] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.798307][   T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.804246][   T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.841661][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.844776][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.867912][  T183] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.873348][  T183] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.902079][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.904723][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.938420][ T5831] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   55.949903][ T1088] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.953532][ T1088] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.036556][ T5898] netlink: 720 bytes leftover after parsing attributes in process `syz.2.3'.
[   56.046816][ T5898] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (5001287)
[   56.049770][ T5898] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535
[   56.241284][ T5916] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6'.
[   56.259668][ T5916] bridge0: entered promiscuous mode
[   56.268623][ T5916] bridge0: left promiscuous mode
[   56.303567][ T5926] Zero length message leads to an empty skb
[   56.591116][ T5944] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   56.960027][ T5968] IPVS: set_ctl: invalid protocol: 51 224.0.0.2:0
[   57.146665][ T5975] 8021q: VLANs not supported on wg1
[   57.160079][ T5976] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   57.175138][ T5976] IPVS: set_ctl: invalid protocol: 58 172.20.20.187:20001
[   57.326890][ T5989] netlink: 4 bytes leftover after parsing attributes in process `syz.0.21'.
[   57.344027][ T5989] netlink: 4 bytes leftover after parsing attributes in process `syz.0.21'.
[   57.353162][ T5995] netlink: 28 bytes leftover after parsing attributes in process `syz.2.22'.
[   57.523211][ T6012] netlink: 'syz.2.27': attribute type 11 has an invalid length.
[   57.640847][ T5829] Bluetooth: hci0: command tx timeout
[   57.762557][ T6033] netlink: 32 bytes leftover after parsing attributes in process `syz.2.30'.
[   57.801352][ T5829] Bluetooth: hci2: command tx timeout
[   57.810979][ T5829] Bluetooth: hci1: command tx timeout
[   57.874677][ T6042] IPv6: addrconf: prefix option has invalid lifetime
[   58.193641][ T6074] warning: `syz.2.42' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   58.336707][ T6089] smc: net device bond0 applied user defined pnetid SYZ2
[   58.536166][ T6110] team0: Device gtp0 is of different type
[   58.658855][ T6120] bond8 (uninitialized): Unable to set up delay as MII monitoring is disabled
[   58.665027][ T6118] netlink: 'syz.1.55': attribute type 4 has an invalid length.
[   58.724211][ T6123] netlink: 8 bytes leftover after parsing attributes in process `syz.1.57'.
[   58.769205][ T6132] xt_time: invalid argument - start or stop time greater than 23:59:59
[   58.836165][ T6139] netlink: 4 bytes leftover after parsing attributes in process `syz.1.61'.
[   58.866879][ T6143] team0: Device gtp0 is of different type
[   59.011184][ T6149] netlink: 72 bytes leftover after parsing attributes in process `syz.1.64'.
[   59.086569][ T6155] netlink: 'syz.0.68': attribute type 15 has an invalid length.
[   59.086692][ T6153] bridge1: entered promiscuous mode
[   59.089030][ T6155] netlink: 24 bytes leftover after parsing attributes in process `syz.0.68'.
[   59.125135][ T6157] team0: Device gtp0 is of different type
[   59.184827][   T33] audit: type=1804 audit(1752411426.379:2): pid=6160 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.70" name="/newroot/26/cgroup.controllers" dev="tmpfs" ino=150 res=1 errno=0
[   59.192901][   T33] audit: type=1800 audit(1752411426.379:3): pid=6160 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.70" name="cgroup.controllers" dev="tmpfs" ino=150 res=0 errno=0
[   59.496304][ T6172] netlink: 'syz.1.74': attribute type 13 has an invalid length.
[   59.684119][ T6187] netlink: 'syz.1.80': attribute type 39 has an invalid length.
[   59.722317][ T5829] Bluetooth: hci0: command tx timeout
[   59.881639][ T5829] Bluetooth: hci1: command tx timeout
[   59.882358][ T5838] Bluetooth: hci2: command tx timeout
[   59.943835][ T6206] 8021q: adding VLAN 0 to HW filter on device batadv1
[   59.947364][ T6206] team0: Port device batadv1 added
[   59.998043][ T6210] tipc: Started in network mode
[   59.999705][ T6210] tipc: Node identity d21d7bf2292b, cluster identity 4711
[   60.002348][ T6210] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   60.006379][ T6210] tipc: Resetting bearer <eth:syzkaller0>
[   60.015655][ T6209] tipc: Disabling bearer <eth:syzkaller0>
[   60.027275][ T6211] pimreg: entered allmulticast mode
[   60.109391][ T6213] ip6gretap1: entered promiscuous mode
[   60.116563][ T6213] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes.
[   60.694348][ T6254] team0: Device gtp0 is of different type
[   60.803439][ T6258] netlink: 'syz.0.101': attribute type 1 has an invalid length.
[   60.823130][ T6260] xt_hashlimit: max too large, truncated to 1048576
[   60.825290][ T6260] xt_hashlimit: Unknown mode mask 2000, kernel too old?
[   61.122114][ T6280] nbd: must specify an index to disconnect
[   61.167102][ T6282] netlink: 'syz.0.108': attribute type 1 has an invalid length.
[   61.323945][ T6301] atomic_op ffff88803af93198 conn xmit_atomic 0000000000000000
[   61.354402][ T6303] raw_sendmsg: syz.1.113 forgot to set AF_INET. Fix it!
[   61.424219][ T6309] __nla_validate_parse: 10 callbacks suppressed
[   61.424230][ T6309] netlink: 12 bytes leftover after parsing attributes in process `syz.0.116'.
[   61.442302][ T6309] netlink: 12 bytes leftover after parsing attributes in process `syz.0.116'.
[   61.583308][ T6327] netlink: 44 bytes leftover after parsing attributes in process `syz.2.119'.
[   61.603988][ T6329] netlink: 36 bytes leftover after parsing attributes in process `syz.1.120'.
[   61.674306][ T6321] Bluetooth: MGMT ver 1.23
[   61.692785][ T6333] netlink: 152356 bytes leftover after parsing attributes in process `syz.1.121'.
[   61.800626][ T5838] Bluetooth: hci0: command tx timeout
[   61.867242][ T6349] netdevsim netdevsim0: Direct firmware load for 2Q failed with error -2
[   61.876887][ T6349] netdevsim netdevsim0: Falling back to sysfs fallback for: 2Q
[   61.962010][ T5838] Bluetooth: hci2: command tx timeout
[   61.963001][ T5829] Bluetooth: hci1: command tx timeout
[   61.977268][ T6366] netlink: 8 bytes leftover after parsing attributes in process `syz.2.130'.
[   61.981881][ T6366] netlink: 32 bytes leftover after parsing attributes in process `syz.2.130'.
[   62.019254][ T6369] netlink: 12 bytes leftover after parsing attributes in process `syz.2.131'.
[   62.027956][ T6369] xfrm1: entered promiscuous mode
[   62.029578][ T6369] xfrm1: entered allmulticast mode
[   62.149921][ T6381] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check.
[   62.217264][ T6387] netlink: 'syz.1.135': attribute type 1 has an invalid length.
[   62.352849][ T5279] udevd[5279]: worker [5840] terminated by signal 33 (Unknown signal 33)
[   62.403416][ T6399] netlink: 'syz.2.138': attribute type 12 has an invalid length.
[   62.479326][ T6407] netlink: 4 bytes leftover after parsing attributes in process `syz.2.140'.
[   62.536686][ T6414] netlink: 12 bytes leftover after parsing attributes in process `syz.1.142'.
[   62.546667][ T6414] netlink: 'syz.1.142': attribute type 2 has an invalid length.
[   62.597860][ T6419] netlink: 'syz.1.144': attribute type 1 has an invalid length.
[   62.653905][ T6423] xt_connbytes: Forcing CT accounting to be enabled
[   62.657255][ T6423] x_tables: ip6_tables: SNPT target: used from hooks OUTPUT, but only usable from INPUT/POSTROUTING
[   62.793045][ T6438] veth0: entered promiscuous mode
[   62.889539][ T6450] syz.2.155 uses obsolete (PF_INET,SOCK_PACKET)
[   63.043245][ T6463] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   63.137361][ T6437] veth0: left promiscuous mode
[   63.238814][ T6486] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048)
[   63.289628][ T6493] ieee802154 phy0 wpan0: encryption failed: -22
[   63.292328][ T6493] ieee802154 phy0 wpan0: encryption failed: -22
[   63.360582][ T6500] bond1: entered promiscuous mode
[   63.362564][ T6500] 8021q: adding VLAN 0 to HW filter on device bond1
[   63.370142][ T6505] openvswitch: netlink: Either Ethernet header or EtherType is required.
[   63.381965][ T6500] 8021q: adding VLAN 0 to HW filter on device bond1
[   63.384287][ T6500] bond1: (slave vcan1): The slave device specified does not support setting the MAC address
[   63.390917][ T6500] bond1: (slave vcan1): Setting fail_over_mac to active for active-backup mode
[   63.399803][ T6500] bond1: (slave vcan1): making interface the new active one
[   63.402548][ T6500] vcan1: entered promiscuous mode
[   63.405155][ T6500] bond1: (slave vcan1): Enslaving as an active interface with an up link
[   64.040565][ T5829] Bluetooth: hci2: command tx timeout
[   64.046266][ T6526] validate_nla: 6 callbacks suppressed
[   64.046298][ T6526] netlink: 'syz.0.174': attribute type 1 has an invalid length.
[   64.208257][ T6540] team0: Device gtp0 is of different type
[   64.337741][ T6548] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component
[   64.546677][ T6570] netlink: 'syz.1.190': attribute type 5 has an invalid length.
[   64.729417][ T6592] bond0: Unable to set up delay as MII monitoring is disabled
[   64.798576][ T6596] x_tables: unsorted entry at hook 3
[   64.974140][ T6606] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.977724][ T6606] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.033717][ T6608] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[   65.037435][ T6608] xt_CHECKSUM: unsupported CHECKSUM operation 68
[   65.066716][ T6606] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   65.074301][ T6606] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   65.128585][ T6606] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   65.131862][ T6606] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   65.135250][ T6606] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   65.138661][ T6606] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   65.294427][ T6613] netlink: 'syz.2.206': attribute type 10 has an invalid length.
[   65.299616][ T6613] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   65.404621][ T6620] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies.
[   65.834037][ T6653] netlink: 'syz.0.221': attribute type 1 has an invalid length.
[   65.998886][ T6666] ip6t_srh: unknown srh match flags  5294
[   66.066767][ T6611] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   66.146920][ T6674] netlink: 'syz.0.228': attribute type 6 has an invalid length.
[   66.615016][ T6706] netlink: 'syz.2.238': attribute type 1 has an invalid length.
[   66.899218][ T6720] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   66.907389][ T6720] batadv_slave_0: entered promiscuous mode
[   66.927593][ T6719] IPVS: set_ctl: invalid protocol: 94 127.0.0.1:20002
[   67.009305][ T6728] netlink: 'syz.2.246': attribute type 2 has an invalid length.
[   67.080581][ T5838] Bluetooth: hci2: command 0x0405 tx timeout
[   67.192782][ T6739] netlink: 'syz.1.248': attribute type 5 has an invalid length.
[   67.202192][ T6739] netlink: 'syz.1.248': attribute type 5 has an invalid length.
[   67.304419][ T6749] __nla_validate_parse: 72 callbacks suppressed
[   67.304431][ T6749] netlink: 52 bytes leftover after parsing attributes in process `syz.2.251'.
[   67.818046][ T6776] team0: Device gtp0 is of different type
[   67.936801][ T6791] netlink: 'syz.2.262': attribute type 1 has an invalid length.
[   68.014373][ T6800] netlink: 4 bytes leftover after parsing attributes in process `syz.2.264'.
[   68.099886][ T6804] netlink: 80 bytes leftover after parsing attributes in process `syz.1.266'.
[   68.136238][ T6810] xt_hashlimit: max too large, truncated to 1048576
[   68.139045][ T6810] Cannot find add_set index 3 as target
[   68.325895][ T6820] netlink: 12 bytes leftover after parsing attributes in process `syz.1.270'.
[   68.343409][ T6820] 8021q: adding VLAN 0 to HW filter on device bond2
[   68.349928][ T6820] netlink: 8 bytes leftover after parsing attributes in process `syz.1.270'.
[   68.456743][ T6826] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   68.632096][ T6840] tipc: Started in network mode
[   68.633837][ T6840] tipc: Node identity 96720863d469, cluster identity 4711
[   68.636122][ T6840] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   68.671888][ T6839] syzkaller0: entered promiscuous mode
[   68.674540][ T6839] syzkaller0: entered allmulticast mode
[   68.676888][ T6839] tipc: Resetting bearer <eth:syzkaller0>
[   68.702157][ T6840] tipc: Resetting bearer <eth:syzkaller0>
[   69.676501][ T6840] tipc: Disabling bearer <eth:syzkaller0>
[   69.718340][ T6859] af_packet: tpacket_rcv: packet too big, clamped from 44 to 4294967272. macoff=96
[   69.721756][ T6859] netlink: 20 bytes leftover after parsing attributes in process `syz.0.280'.
[   69.728460][ T6859] netlink: 'syz.0.280': attribute type 11 has an invalid length.
[   69.732813][ T6859] netlink: 'syz.0.280': attribute type 11 has an invalid length.
[   69.735523][ T6859] netlink: 224 bytes leftover after parsing attributes in process `syz.0.280'.
[   69.762103][ T6862] x_tables: duplicate underflow at hook 2
[   70.661463][ T6889] netlink: 'syz.1.287': attribute type 1 has an invalid length.
[   70.673011][ T6891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.288'.
[   70.677281][ T6891] netlink: 4 bytes leftover after parsing attributes in process `syz.0.288'.
[   70.680951][ T6891] netlink: 10 bytes leftover after parsing attributes in process `syz.0.288'.
[   70.684563][ T6891] nbd: socks must be embedded in a SOCK_ITEM attr
[   70.843787][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   70.845733][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   71.027272][ T6923] xt_HMARK: proto mask must be zero with L3 mode
[   71.137518][ T6932] team0: Device gtp0 is of different type
[   71.279445][ T6940] netlink: 'syz.2.306': attribute type 180 has an invalid length.
[   71.284258][ T6942] tipc: Enabling of bearer <udp:syz1> rejected, failed to enable media
[   71.336533][ T5878] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.428039][ T5878] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.512707][ T6949] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.515259][ T6949] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.625772][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   71.628733][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   71.632343][ T5838] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   71.635287][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   71.638026][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   71.651523][ T6949] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   71.673602][ T6949] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   71.785907][ T6949] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   71.788674][ T6949] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   71.796109][ T6949] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   71.798875][ T6949] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   71.867991][ T5878] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.937360][ T5878] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   72.015448][ T6961] team0: Device gtp0 is of different type
[   72.107372][ T6955] chnl_net:caif_netlink_parms(): no params data found
[   72.117613][ T5878] bridge_slave_1: left allmulticast mode
[   72.119514][ T5878] bridge_slave_1: left promiscuous mode
[   72.137033][ T5878] bridge0: port 2(bridge_slave_1) entered disabled state
[   72.153420][ T5878] bridge_slave_0: left allmulticast mode
[   72.155272][ T5878] bridge_slave_0: left promiscuous mode
[   72.157155][ T5878] bridge0: port 1(bridge_slave_0) entered disabled state
[   72.465606][ T5878] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   72.470122][ T5878] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   72.474497][ T5878] bond0 (unregistering): Released all slaves
[   72.482367][ T5878] bond1 (unregistering): Released all slaves
[   72.493563][ T6976] netlink: 'syz.2.315': attribute type 1 has an invalid length.
[   72.509370][ T6976] 8021q: adding VLAN 0 to HW filter on device bond1
[   72.526783][ T6976] veth5: entered promiscuous mode
[   72.569417][ T5878] tipc: Left network mode
[   72.647024][ T6955] bridge0: port 1(bridge_slave_0) entered blocking state
[   72.649552][ T6955] bridge0: port 1(bridge_slave_0) entered disabled state
[   72.653057][ T6955] bridge_slave_0: entered allmulticast mode
[   72.655816][ T6955] bridge_slave_0: entered promiscuous mode
[   72.659510][ T6955] bridge0: port 2(bridge_slave_1) entered blocking state
[   72.661885][ T6955] bridge0: port 2(bridge_slave_1) entered disabled state
[   72.664217][ T6955] bridge_slave_1: entered allmulticast mode
[   72.666966][ T6955] bridge_slave_1: entered promiscuous mode
[   72.708224][ T6955] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   72.711570][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   72.716371][ T6955] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   72.719396][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   72.735230][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   72.753780][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   72.759036][ T6955] team0: Port device team_slave_0 added
[   72.765094][ T5878] hsr_slave_0: left promiscuous mode
[   72.767292][ T5878] hsr_slave_1: left promiscuous mode
[   72.769480][ T5878] batman_adv: batadv0: Removing interface: batadv_slave_0
[   72.772941][ T5878] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   72.775325][ T5878] batman_adv: batadv0: Removing interface: batadv_slave_1
[   72.789144][ T5878] veth1_macvtap: left promiscuous mode
[   72.791448][ T5878] veth0_macvtap: left promiscuous mode
[   72.793303][ T5878] veth1_vlan: left promiscuous mode
[   72.795119][ T5878] veth0_vlan: left promiscuous mode
[   72.872702][ T5878] team0 (unregistering): Port device batadv1 removed
[   73.109862][ T5878] team0 (unregistering): Port device team_slave_1 removed
[   73.134888][ T5878] team0 (unregistering): Port device team_slave_0 removed
[   73.393876][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   73.397972][ T6955] team0: Port device team_slave_1 added
[   73.407903][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   73.430110][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   73.434908][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   73.438155][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   73.454437][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   73.457797][ T6955] batman_adv: batadv0: Adding interface: batadv_slave_0
[   73.460092][ T6955] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   73.462927][ T6995] __nla_validate_parse: 14 callbacks suppressed
[   73.462937][ T6995] netlink: 12 bytes leftover after parsing attributes in process `syz.1.320'.
[   73.470489][ T6955] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   73.472324][ T6995] netlink: 12 bytes leftover after parsing attributes in process `syz.1.320'.
[   73.478550][ T6955] batman_adv: batadv0: Adding interface: batadv_slave_1
[   73.490424][ T6955] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   73.502630][ T6955] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   73.510854][ T6988] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[   73.577285][ T6955] hsr_slave_0: entered promiscuous mode
[   73.579574][ T6955] hsr_slave_1: entered promiscuous mode
[   73.604495][ T7000] netlink: 'syz.2.322': attribute type 4 has an invalid length.
[   73.608236][ T7000] netlink: 4 bytes leftover after parsing attributes in process `syz.2.322'.
[   73.617551][ T7002] netlink: 4 bytes leftover after parsing attributes in process `syz.1.323'.
[   73.642512][ T7002] macsec1: entered allmulticast mode
[   73.644196][ T7002] dummy0: entered allmulticast mode
[   73.649837][ T7002] dummy0: left allmulticast mode
[   73.658537][ T7004] netlink: 80 bytes leftover after parsing attributes in process `syz.2.324'.
[   73.676472][ T7004] netlink: 248 bytes leftover after parsing attributes in process `syz.2.324'.
[   73.731422][ T5829] Bluetooth: hci0: command tx timeout
[   73.988959][ T7030] trusted_key: syz.2.332 sent an empty control message without MSG_MORE.
[   74.023375][ T6955] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   74.028233][ T6955] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   74.039736][ T6955] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   74.044899][ T6955] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   74.109891][ T6955] 8021q: adding VLAN 0 to HW filter on device bond0
[   74.137500][ T6955] 8021q: adding VLAN 0 to HW filter on device team0
[   74.143276][  T193] bridge0: port 1(bridge_slave_0) entered blocking state
[   74.145502][  T193] bridge0: port 1(bridge_slave_0) entered forwarding state
[   74.159503][  T193] bridge0: port 2(bridge_slave_1) entered blocking state
[   74.161860][  T193] bridge0: port 2(bridge_slave_1) entered forwarding state
[   74.274539][ T6955] 8021q: adding VLAN 0 to HW filter on device batadv0
[   74.305643][ T6955] veth0_vlan: entered promiscuous mode
[   74.312765][ T6955] veth1_vlan: entered promiscuous mode
[   74.334410][ T6955] veth0_macvtap: entered promiscuous mode
[   74.340282][ T6955] veth1_macvtap: entered promiscuous mode
[   74.356882][ T6955] batman_adv: batadv0: Interface activated: batadv_slave_0
[   74.371318][ T6955] batman_adv: batadv0: Interface activated: batadv_slave_1
[   74.376657][ T6955] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   74.379367][ T6955] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   74.383492][ T6955] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   74.386500][ T6955] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   74.434092][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   74.437037][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   74.453545][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   74.456043][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   74.748480][ T7069] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.342'.
[   75.298330][ T7086] xt_CT: No such helper "syz0"
[   75.845226][ T7129] netlink: 4 bytes leftover after parsing attributes in process `syz.2.359'.
[   75.859094][ T7129] 8021q: adding VLAN 0 to HW filter on device team1
[   75.896480][ T7131] team0: Device gtp0 is of different type
[   75.967366][ T7133] netlink: 8 bytes leftover after parsing attributes in process `syz.2.361'.
[   76.044759][ T7140] netlink: 8 bytes leftover after parsing attributes in process `syz.2.363'.
[   76.295756][ T5697] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   76.553897][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   76.556905][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   76.559989][ T5838] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   76.563907][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   76.567185][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   76.675564][ T7145] chnl_net:caif_netlink_parms(): no params data found
[   76.732464][ T7145] bridge0: port 1(bridge_slave_0) entered blocking state
[   76.734954][ T7145] bridge0: port 1(bridge_slave_0) entered disabled state
[   76.737589][ T7145] bridge_slave_0: entered allmulticast mode
[   76.741141][ T7145] bridge_slave_0: entered promiscuous mode
[   76.744658][ T7145] bridge0: port 2(bridge_slave_1) entered blocking state
[   76.747009][ T7145] bridge0: port 2(bridge_slave_1) entered disabled state
[   76.749351][ T7145] bridge_slave_1: entered allmulticast mode
[   76.752376][ T7145] bridge_slave_1: entered promiscuous mode
[   76.773224][ T7145] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   76.777903][ T7145] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   76.798856][ T7145] team0: Port device team_slave_0 added
[   76.802437][ T7145] team0: Port device team_slave_1 added
[   76.821133][ T7145] batman_adv: batadv0: Adding interface: batadv_slave_0
[   76.823354][ T7145] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   76.831267][ T7145] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   76.836136][ T7145] batman_adv: batadv0: Adding interface: batadv_slave_1
[   76.838306][ T7145] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   76.846213][ T7145] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   76.873268][ T7145] hsr_slave_0: entered promiscuous mode
[   76.875566][ T7145] hsr_slave_1: entered promiscuous mode
[   76.878076][ T7145] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   76.881052][ T7145] Cannot create hsr debugfs directory
[   77.171377][ T7179] team0: Device gtp0 is of different type
[   77.311375][ T7184] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-alb(6)
[   77.319874][ T7184] netlink: 'syz.2.374': attribute type 39 has an invalid length.
[   77.883682][ T5697] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   77.940824][ T5697] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.003834][ T5697] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   78.066888][ T5697] bridge_slave_1: left allmulticast mode
[   78.068789][ T5697] bridge_slave_1: left promiscuous mode
[   78.071995][ T5697] bridge0: port 2(bridge_slave_1) entered disabled state
[   78.076004][ T5697] bridge_slave_0: left allmulticast mode
[   78.077744][ T5697] bridge_slave_0: left promiscuous mode
[   78.079628][ T5697] bridge0: port 1(bridge_slave_0) entered disabled state
[   78.332458][ T5697] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   78.336456][ T5697] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   78.339988][ T5697] bond0 (unregistering): Released all slaves
[   78.402890][ T7194] sch_fq: defrate 0 ignored.
[   78.473737][ T7196] sctp: [Deprecated]: syz.2.378 (pid 7196) Use of int in maxseg socket option.
[   78.473737][ T7196] Use struct sctp_assoc_value instead
[   78.538725][ T7202] openvswitch: netlink: Flow get message rejected, Key attribute missing.
[   78.587528][ T5697] hsr_slave_0: left promiscuous mode
[   78.589704][ T5697] hsr_slave_1: left promiscuous mode
[   78.592809][ T5697] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   78.595540][ T5697] batman_adv: batadv0: Removing interface: batadv_slave_0
[   78.598276][ T5697] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   78.600988][ T5829] Bluetooth: hci0: command tx timeout
[   78.604257][ T5697] batman_adv: batadv0: Removing interface: batadv_slave_1
[   78.617243][ T5697] veth1_macvtap: left promiscuous mode
[   78.618983][ T5697] veth0_macvtap: left promiscuous mode
[   78.622066][ T5697] veth1_vlan: left promiscuous mode
[   78.623883][ T5697] veth0_vlan: left promiscuous mode
[   78.927889][ T5697] team0 (unregistering): Port device team_slave_1 removed
[   78.949670][ T5697] team0 (unregistering): Port device team_slave_0 removed
[   79.243183][ T7210] batadv_slave_0: entered promiscuous mode
[   79.248538][ T7209] batadv_slave_0: left promiscuous mode
[   79.298902][ T7212] netlink: 48 bytes leftover after parsing attributes in process `syz.2.383'.
[   79.405030][ T7145] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   79.416166][ T7145] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   79.422250][ T7145] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   79.428109][ T7145] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   79.456044][ T7217] team0: Device gtp0 is of different type
[   79.515160][ T7145] 8021q: adding VLAN 0 to HW filter on device bond0
[   79.525671][ T7145] 8021q: adding VLAN 0 to HW filter on device team0
[   79.533140][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   79.535364][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   79.554744][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   79.557130][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   79.580605][ T7229] netlink: 40 bytes leftover after parsing attributes in process `syz.2.388'.
[   79.580917][ T7145] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   79.673784][ T7240] IPVS: length: 138 != 24
[   79.695874][ T7145] 8021q: adding VLAN 0 to HW filter on device batadv0
[   79.737060][ T7246] netlink: 24 bytes leftover after parsing attributes in process `syz.1.392'.
[   79.739953][ T7246] netlink: 24 bytes leftover after parsing attributes in process `syz.1.392'.
[   79.745196][ T7145] veth0_vlan: entered promiscuous mode
[   79.747194][ T7247] netlink: 724 bytes leftover after parsing attributes in process `syz.2.393'.
[   79.751915][ T7247] netlink: 83 bytes leftover after parsing attributes in process `syz.2.393'.
[   79.756844][ T7246] veth0_to_team: entered promiscuous mode
[   79.759111][ T7246] veth0_to_team: entered allmulticast mode
[   79.761547][ T7246] netlink: 40 bytes leftover after parsing attributes in process `syz.1.392'.
[   79.770025][ T7145] veth1_vlan: entered promiscuous mode
[   79.788718][ T7145] veth0_macvtap: entered promiscuous mode
[   79.794127][ T7145] veth1_macvtap: entered promiscuous mode
[   79.803317][ T7145] batman_adv: batadv0: Interface activated: batadv_slave_0
[   79.810186][ T7145] batman_adv: batadv0: Interface activated: batadv_slave_1
[   79.824653][ T7145] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   79.827274][ T7145] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   79.829790][ T7145] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   79.834657][ T7145] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   79.893580][ T7257] netlink: 4 bytes leftover after parsing attributes in process `syz.1.397'.
[   79.895580][ T1088] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   79.896385][ T7257] netlink: 4 bytes leftover after parsing attributes in process `syz.1.397'.
[   79.898599][ T1088] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   79.905516][ T7257] netlink: 8 bytes leftover after parsing attributes in process `syz.1.397'.
[   79.918260][ T1088] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   79.926161][ T1088] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   79.955473][ T7260] 8021q: adding VLAN 0 to HW filter on device bond0
[   79.958681][ T7260] 8021q: adding VLAN 0 to HW filter on device team0
[   79.964810][ T7260] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   80.012401][ T7266] IPVS: length: 178 != 24
[   80.204959][ T7279] lo speed is unknown, defaulting to 1000
[   80.208490][ T7279] lo speed is unknown, defaulting to 1000
[   80.213043][ T7279] lo speed is unknown, defaulting to 1000
[   80.223313][ T7280] Illegal XDP return value 16128 on prog  (id 112) dev syz_tun, expect packet loss!
[   80.322300][ T7279] infiniband syz0: set down
[   80.325081][  T791] lo speed is unknown, defaulting to 1000
[   80.325872][ T7279] infiniband syz0: added lo
[   80.354301][ T7279] RDS/IB: syz0: added
[   80.356147][ T7279] smc: adding ib device syz0 with port count 1
[   80.358245][ T7279] smc:    ib device syz0 port 1 has pnetid 
[   80.364417][ T7279] lo speed is unknown, defaulting to 1000
[   80.371909][ T5894] lo speed is unknown, defaulting to 1000
[   80.479747][ T7279] lo speed is unknown, defaulting to 1000
[   80.590361][ T7279] lo speed is unknown, defaulting to 1000
[   80.998043][ T7296] team0: Device gtp0 is of different type
[   81.081297][  T974] cfg80211: failed to load regulatory.db
[   81.312958][ T7312] lo speed is unknown, defaulting to 1000
[   81.558195][ T7322] team0: Device gtp0 is of different type
[   81.859741][ T7339] No such timeout policy "syz0"
[   81.891809][ T7342] team0: Device gtp0 is of different type
[   81.947357][ T7344] tipc: Started in network mode
[   81.948908][ T7344] tipc: Node identity 4, cluster identity 4711
[   81.951120][ T7344] tipc: Node number set to 4
[   82.060137][ T5697] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.087645][ T7348] netlink: 'syz.2.426': attribute type 10 has an invalid length.
[   82.101983][ T7348] team0: Cannot enslave team device to itself
[   82.290640][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   82.294228][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   82.297268][ T5838] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   82.300376][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   82.303054][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   82.303937][ T7359] delete_channel: no stack
[   82.333674][ T7356] lo speed is unknown, defaulting to 1000
[   82.403140][ T7366] team0: Device gtp0 is of different type
[   82.576783][ T7356] chnl_net:caif_netlink_parms(): no params data found
[   82.651476][ T7356] bridge0: port 1(bridge_slave_0) entered blocking state
[   82.653963][ T7356] bridge0: port 1(bridge_slave_0) entered disabled state
[   82.656340][ T7356] bridge_slave_0: entered allmulticast mode
[   82.659497][ T7356] bridge_slave_0: entered promiscuous mode
[   82.663189][ T7356] bridge0: port 2(bridge_slave_1) entered blocking state
[   82.665578][ T7356] bridge0: port 2(bridge_slave_1) entered disabled state
[   82.668288][ T7356] bridge_slave_1: entered allmulticast mode
[   82.671184][ T7356] bridge_slave_1: entered promiscuous mode
[   82.700693][ T7356] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   82.705621][ T7356] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   82.737124][ T7356] team0: Port device team_slave_0 added
[   82.741075][ T7356] team0: Port device team_slave_1 added
[   82.765287][ T7356] batman_adv: batadv0: Adding interface: batadv_slave_0
[   82.767690][ T7356] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.776168][ T7356] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   82.781121][ T7356] batman_adv: batadv0: Adding interface: batadv_slave_1
[   82.783406][ T7356] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.791865][ T7356] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   82.848322][ T7356] hsr_slave_0: entered promiscuous mode
[   82.854068][ T7356] hsr_slave_1: entered promiscuous mode
[   82.979408][ T7408] Bluetooth: MGMT ver 1.23
[   83.336622][ T7421] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048)
[   83.453253][ T5878] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x4
[   83.457445][ T7431] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0)
[   83.786395][ T7435] ipt_ECN: cannot use operation on non-tcp rule
[   83.902503][ T7437] lo speed is unknown, defaulting to 1000
[   83.954845][ T5697] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.001723][ T5697] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.068048][ T5697] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   84.137863][ T5697] bridge_slave_1: left allmulticast mode
[   84.139633][ T5697] bridge_slave_1: left promiscuous mode
[   84.142651][ T5697] bridge0: port 2(bridge_slave_1) entered disabled state
[   84.146887][ T5697] bridge_slave_0: left allmulticast mode
[   84.148692][ T5697] bridge_slave_0: left promiscuous mode
[   84.153372][ T5697] bridge0: port 1(bridge_slave_0) entered disabled state
[   84.344681][ T7449] __nla_validate_parse: 41 callbacks suppressed
[   84.344691][ T7449] netlink: 8 bytes leftover after parsing attributes in process `syz.1.454'.
[   84.370543][ T5829] Bluetooth: hci0: command tx timeout
[   84.431677][ T5697] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   84.436206][ T5697] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   84.440770][ T5697] bond0 (unregistering): Released all slaves
[   84.453201][ T7446] team0: Device gtp0 is of different type
[   84.709159][ T7469] sit1: entered promiscuous mode
[   84.732825][ T7469] netlink: 24 bytes leftover after parsing attributes in process `syz.2.459'.
[   84.818225][ T5697] hsr_slave_0: left promiscuous mode
[   84.827323][ T5697] hsr_slave_1: left promiscuous mode
[   84.829363][ T5697] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   84.834023][ T5697] batman_adv: batadv0: Removing interface: batadv_slave_0
[   84.839758][ T5697] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   84.842591][ T5697] batman_adv: batadv0: Removing interface: batadv_slave_1
[   84.853107][ T5697] veth1_macvtap: left promiscuous mode
[   84.854834][ T5697] veth0_macvtap: left promiscuous mode
[   84.857298][ T5697] veth1_vlan: left promiscuous mode
[   84.858939][ T5697] veth0_vlan: left promiscuous mode
[   85.134803][ T5697] team0 (unregistering): Port device team_slave_1 removed
[   85.158224][ T5697] team0 (unregistering): Port device team_slave_0 removed
[   85.430699][ T7477] 8021q: adding VLAN 0 to HW filter on device bond0
[   85.435846][ T7477] bond0: (slave rose0): Enslaving as an active interface with an up link
[   85.451890][ T7485] syzkaller1: entered promiscuous mode
[   85.453880][ T7485] syzkaller1: entered allmulticast mode
[   85.524303][ T7356] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   85.533094][ T7356] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   85.543268][ T7356] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   85.553011][ T7356] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   85.675271][ T7356] 8021q: adding VLAN 0 to HW filter on device bond0
[   85.713614][ T7356] 8021q: adding VLAN 0 to HW filter on device team0
[   85.737053][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   85.739326][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   85.745359][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   85.747657][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   85.777020][ T7514] netlink: 48 bytes leftover after parsing attributes in process `syz.1.467'.
[   85.785695][ T7356] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   85.977220][ T7531] netlink: 48 bytes leftover after parsing attributes in process `syz.1.469'.
[   85.998595][ T7356] 8021q: adding VLAN 0 to HW filter on device batadv0
[   86.047501][ T7536] netlink: 164 bytes leftover after parsing attributes in process `syz.1.470'.
[   86.062762][ T7536] netlink: 164 bytes leftover after parsing attributes in process `syz.1.470'.
[   86.066508][ T7536] netlink: 60 bytes leftover after parsing attributes in process `syz.1.470'.
[   86.079751][ T7356] veth0_vlan: entered promiscuous mode
[   86.093988][ T7536] netlink: 164 bytes leftover after parsing attributes in process `syz.1.470'.
[   86.097230][ T7536] netlink: 164 bytes leftover after parsing attributes in process `syz.1.470'.
[   86.100077][ T7536] netlink: 60 bytes leftover after parsing attributes in process `syz.1.470'.
[   86.127801][ T7356] veth1_vlan: entered promiscuous mode
[   86.169258][ T7356] veth0_macvtap: entered promiscuous mode
[   86.176189][ T7356] veth1_macvtap: entered promiscuous mode
[   86.197069][ T7356] batman_adv: batadv0: Interface activated: batadv_slave_0
[   86.208765][ T7356] batman_adv: batadv0: Interface activated: batadv_slave_1
[   86.215973][ T7356] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   86.218614][ T7356] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   86.222653][ T7356] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   86.225280][ T7356] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   86.289849][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.297209][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.313765][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.316165][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.366991][ T7540] openvswitch: netlink: Missing key (keys=40, expected=100)
[   86.493334][ T7544] vlan2: entered promiscuous mode
[   86.495119][ T7544] bridge0: entered promiscuous mode
[   86.496840][ T7544] vlan2: entered allmulticast mode
[   86.498575][ T7544] bridge0: entered allmulticast mode
[   86.541148][ T7545] bridge_slave_0: left promiscuous mode
[   86.543048][ T7545] bridge0: port 1(bridge_slave_0) entered disabled state
[   86.546923][ T7545] bridge_slave_1: left allmulticast mode
[   86.548705][ T7545] bridge_slave_1: left promiscuous mode
[   86.551113][ T7545] bridge0: port 2(bridge_slave_1) entered disabled state
[   86.555549][ T7545] bond0: (slave bond_slave_0): Releasing backup interface
[   86.561427][ T7545] bond0: (slave bond_slave_1): Releasing backup interface
[   86.580519][ T7545] team0: Port device team_slave_0 removed
[   86.584624][ T7545] team0: Port device team_slave_1 removed
[   86.586568][ T7545] batman_adv: batadv0: Removing interface: batadv_slave_0
[   86.589567][ T7545] batman_adv: batadv0: Removing interface: batadv_slave_1
[   86.595676][ T7545] bond1: (slave vcan1): Releasing backup interface
[   86.597766][ T7545] vcan1: left promiscuous mode
[   86.717281][ T7556] netlink: 'syz.1.478': attribute type 13 has an invalid length.
[   86.719786][ T7556] netlink: 'syz.1.478': attribute type 11 has an invalid length.
[   87.515771][ T7582] team0: Device gtp0 is of different type
[   87.599028][ T7585] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[   87.657536][ T7591] netlink: 'syz.2.489': attribute type 1 has an invalid length.
[   87.675854][ T7591] 8021q: adding VLAN 0 to HW filter on device bond3
[   87.686224][ T7591] ipvlan2: entered allmulticast mode
[   87.687865][ T7591] bond3: entered allmulticast mode
[   87.698053][ T7591] bond3: (slave gretap1): making interface the new active one
[   87.700482][ T7591] gretap1: entered allmulticast mode
[   87.703148][ T7591] bond3: (slave gretap1): Enslaving as an active interface with an up link
[   87.821168][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   88.431522][ T7617] netlink: 'syz.1.494': attribute type 21 has an invalid length.
[   88.510786][ T7631] veth0: entered promiscuous mode
[   88.515935][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   88.524871][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   88.527887][ T5838] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   88.535201][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   88.537709][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   88.542499][ T7631] veth0 (unregistering): left promiscuous mode
[   88.588888][ T7630] lo speed is unknown, defaulting to 1000
[   88.631577][ T7639] netlink: 'syz.1.501': attribute type 1 has an invalid length.
[   88.754560][ T7648] netlink: 'syz.1.505': attribute type 10 has an invalid length.
[   88.835990][ T7655] sctp: [Deprecated]: syz.1.507 (pid 7655) Use of int in max_burst socket option deprecated.
[   88.835990][ T7655] Use struct sctp_assoc_value instead
[   88.836225][ T7630] chnl_net:caif_netlink_parms(): no params data found
[   88.902738][ T7660] syzkaller1: entered promiscuous mode
[   88.905842][ T7660] syzkaller1: entered allmulticast mode
[   88.908624][ T7630] bridge0: port 1(bridge_slave_0) entered blocking state
[   88.911714][ T7630] bridge0: port 1(bridge_slave_0) entered disabled state
[   88.914500][ T7630] bridge_slave_0: entered allmulticast mode
[   88.918341][ T7630] bridge_slave_0: entered promiscuous mode
[   88.933918][ T7630] bridge0: port 2(bridge_slave_1) entered blocking state
[   88.936782][ T7630] bridge0: port 2(bridge_slave_1) entered disabled state
[   88.939629][ T7630] bridge_slave_1: entered allmulticast mode
[   88.944753][ T7630] bridge_slave_1: entered promiscuous mode
[   88.975841][ T7630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   88.982306][ T7630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   89.005188][ T7630] team0: Port device team_slave_0 added
[   89.008960][ T7630] team0: Port device team_slave_1 added
[   89.029373][ T7630] batman_adv: batadv0: Adding interface: batadv_slave_0
[   89.032323][ T7630] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   89.040622][ T7630] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   89.044790][ T7630] batman_adv: batadv0: Adding interface: batadv_slave_1
[   89.046807][ T7630] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   89.054685][ T7630] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   89.111955][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.123085][ T7630] hsr_slave_0: entered promiscuous mode
[   89.125336][ T7630] hsr_slave_1: entered promiscuous mode
[   89.127428][ T7630] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   89.129741][ T7630] Cannot create hsr debugfs directory
[   89.319173][   T24] IPVS: starting estimator thread 0...
[   89.335320][   T24] hid-generic 0005:04F3:8002.0001: collection stack underflow
[   89.338351][   T24] hid-generic 0005:04F3:8002.0001: item 0 0 0 12 parsing failed
[   89.347945][   T24] hid-generic 0005:04F3:8002.0001: probe with driver hid-generic failed with error -22
[   89.404018][ T7681] pimreg: left allmulticast mode
[   89.411884][ T7675] IPVS: using max 62 ests per chain, 148800 per kthread
[   89.459819][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.472049][ T7681] dvmrp1: entered allmulticast mode
[   89.527001][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.604196][ T7693] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check.
[   89.616112][ T7693] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check.
[   89.640740][ T7696] __nla_validate_parse: 201 callbacks suppressed
[   89.640752][ T7696] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.517'.
[   89.648359][   T13] bridge_slave_1: left allmulticast mode
[   89.650788][   T13] bridge_slave_1: left promiscuous mode
[   89.650881][ T5894] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[   89.652821][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   89.663370][   T13] bridge_slave_0: left allmulticast mode
[   89.665202][   T13] bridge_slave_0: left promiscuous mode
[   89.667004][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   89.674491][ T7698] Dead loop on virtual device ip6_vti0, fix it urgently!
[   89.891807][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   89.895925][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   89.899535][   T13] bond0 (unregistering): Released all slaves
[   89.923146][ T7689] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.517'.
[   89.929219][ T7701] tap0: tun_chr_ioctl cmd 1074025677
[   89.932140][ T7701] tap0: linktype set to 823
[   90.019995][ T7709] netlink: 256 bytes leftover after parsing attributes in process `syz.2.521'.
[   90.181134][ T7720] netlink: 4 bytes leftover after parsing attributes in process `syz.2.524'.
[   90.238521][ T7720] syzkaller0: create flow: hash 2217067714 index 1
[   90.254086][ T5878] syzkaller0: tun_net_xmit 76
[   90.259100][ T5878] syzkaller0: tun_net_xmit 48
[   90.292315][   T10] syzkaller0: tun_net_xmit 76
[   90.297558][   T13] hsr_slave_0: left promiscuous mode
[   90.299767][   T13] hsr_slave_1: left promiscuous mode
[   90.301941][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   90.304201][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   90.306819][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   90.309189][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   90.320593][   T24] syzkaller0: tun_net_xmit 76
[   90.322402][   T13] veth1_macvtap: left promiscuous mode
[   90.324263][   T13] veth0_macvtap: left promiscuous mode
[   90.326111][   T13] veth1_vlan: left promiscuous mode
[   90.327801][   T13] veth0_vlan: left promiscuous mode
[   90.598503][   T13] team0 (unregistering): Port device team_slave_1 removed
[   90.610364][ T5838] Bluetooth: hci0: command tx timeout
[   90.624925][   T13] team0 (unregistering): Port device team_slave_0 removed
[   90.691790][   T24] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!
[   90.889128][ T7719] syzkaller0: delete flow: hash 2217067714 index 1
[   91.723505][ T7723] netlink: 'syz.1.525': attribute type 15 has an invalid length.
[   91.759091][ T7728] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[   91.783379][ T7630] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   91.796752][ T7630] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   91.802634][ T7731] bond0: option arp_validate: invalid value (18446744073491447809)
[   91.805059][ T7630] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   91.807551][ T5858] bond0: (slave bond_slave_0): interface is now down
[   91.811120][ T5858] bond0: (slave bond_slave_1): interface is now down
[   91.813074][ T5858] bond0: (slave wlan1): interface is now down
[   91.822794][ T7630] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   91.838621][ T7732] bond0: (slave bond_slave_0): interface is now down
[   91.842834][ T7732] bond0: (slave bond_slave_1): interface is now down
[   91.844816][ T7732] bond0: (slave wlan1): interface is now down
[   91.862877][ T7732] bond0: (slave bond_slave_0): interface is now down
[   91.864743][ T7740] netlink: 8 bytes leftover after parsing attributes in process `syz.1.530'.
[   91.867379][ T7732] bond0: (slave bond_slave_1): interface is now down
[   91.870883][ T7732] bond0: (slave wlan1): interface is now down
[   91.890690][ T5858] bond0: (slave bond_slave_0): interface is now down
[   91.894615][ T5858] bond0: (slave bond_slave_1): interface is now down
[   91.898059][ T5858] bond0: (slave wlan1): interface is now down
[   91.919926][ T5858] bond0: (slave bond_slave_0): interface is now down
[   91.923205][ T5858] bond0: (slave bond_slave_1): interface is now down
[   91.925308][ T5858] bond0: (slave wlan1): interface is now down
[   91.938308][ T5858] bond0: now running without any active interface!
[   91.954661][ T7753] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   91.956867][ T7751] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[   91.969133][ T7751] syzkaller0: entered promiscuous mode
[   91.971791][ T7751] syzkaller0: entered allmulticast mode
[   91.980191][ T7755] netlink: 'syz.2.533': attribute type 11 has an invalid length.
[   91.986637][ T7630] 8021q: adding VLAN 0 to HW filter on device bond0
[   92.002879][ T7749] tipc: Resetting bearer <eth:syzkaller0>
[   92.006167][ T7630] 8021q: adding VLAN 0 to HW filter on device team0
[   92.012058][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   92.014285][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   92.034263][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   92.036436][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   92.050506][ T7630] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   92.053736][ T7630] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   92.094569][ T7760] lo speed is unknown, defaulting to 1000
[   92.160196][ T7630] 8021q: adding VLAN 0 to HW filter on device batadv0
[   92.189918][ T7630] veth0_vlan: entered promiscuous mode
[   92.198682][ T7630] veth1_vlan: entered promiscuous mode
[   92.233873][ T7630] veth0_macvtap: entered promiscuous mode
[   92.238222][ T7630] veth1_macvtap: entered promiscuous mode
[   92.251526][ T7630] batman_adv: batadv0: Interface activated: batadv_slave_0
[   92.257677][ T7630] batman_adv: batadv0: Interface activated: batadv_slave_1
[   92.264621][ T7630] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   92.267406][ T7630] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   92.270061][ T7630] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   92.273301][ T7630] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   92.427072][  T183] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   92.429404][  T183] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   92.461401][  T183] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   92.464447][  T183] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   92.545689][ T7677] ==================================================================
[   92.548149][ T7677] BUG: KASAN: slab-use-after-free in __mutex_lock+0x738/0xe80
[   92.550513][ T7677] Read of size 8 at addr ffff8881174b00a0 by task khidpd_04f38002/7677
[   92.553888][ T7677] 
[   92.554818][ T7677] CPU: 0 UID: 0 PID: 7677 Comm: khidpd_04f38002 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   92.554837][ T7677] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   92.554845][ T7677] Call Trace:
[   92.554851][ T7677]  <TASK>
[   92.554855][ T7677]  dump_stack_lvl+0x189/0x250
[   92.554868][ T7677]  ? __virt_addr_valid+0x1c8/0x5c0
[   92.554878][ T7677]  ? rcu_is_watching+0x15/0xb0
[   92.554888][ T7677]  ? __kasan_check_byte+0x12/0x40
[   92.554898][ T7677]  ? __pfx_dump_stack_lvl+0x10/0x10
[   92.554906][ T7677]  ? rcu_is_watching+0x15/0xb0
[   92.554914][ T7677]  ? lock_release+0x4b/0x3e0
[   92.554923][ T7677]  ? __virt_addr_valid+0x1c8/0x5c0
[   92.554932][ T7677]  ? __virt_addr_valid+0x4a5/0x5c0
[   92.554942][ T7677]  print_report+0xd2/0x2b0
[   92.554949][ T7677]  ? __mutex_lock+0x738/0xe80
[   92.554956][ T7677]  kasan_report+0x118/0x150
[   92.554966][ T7677]  ? __mutex_lock+0x738/0xe80
[   92.554974][ T7677]  __mutex_lock+0x738/0xe80
[   92.554981][ T7677]  ? __mutex_lock+0x51b/0xe80
[   92.554989][ T7677]  ? l2cap_unregister_user+0x6a/0x1b0
[   92.555002][ T7677]  ? __pfx___mutex_lock+0x10/0x10
[   92.555010][ T7677]  ? __pfx___timer_delete_sync+0x10/0x10
[   92.555023][ T7677]  l2cap_unregister_user+0x6a/0x1b0
[   92.555034][ T7677]  hidp_session_thread+0x3c9/0x410
[   92.555043][ T7677]  ? __pfx_hidp_session_thread+0x10/0x10
[   92.555050][ T7677]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   92.555060][ T7677]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   92.555069][ T7677]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   92.555076][ T7677]  ? __kthread_parkme+0x7b/0x200
[   92.555086][ T7677]  ? __kthread_parkme+0x1a1/0x200
[   92.555095][ T7677]  kthread+0x711/0x8a0
[   92.555106][ T7677]  ? __pfx_hidp_session_thread+0x10/0x10
[   92.555113][ T7677]  ? __pfx_kthread+0x10/0x10
[   92.555123][ T7677]  ? _raw_spin_unlock_irq+0x23/0x50
[   92.555133][ T7677]  ? lockdep_hardirqs_on+0x9c/0x150
[   92.555144][ T7677]  ? __pfx_kthread+0x10/0x10
[   92.555154][ T7677]  ret_from_fork+0x3fc/0x770
[   92.555163][ T7677]  ? __pfx_ret_from_fork+0x10/0x10
[   92.555171][ T7677]  ? __switch_to_asm+0x39/0x70
[   92.555180][ T7677]  ? __switch_to_asm+0x33/0x70
[   92.555189][ T7677]  ? __pfx_kthread+0x10/0x10
[   92.555198][ T7677]  ret_from_fork_asm+0x1a/0x30
[   92.555211][ T7677]  </TASK>
[   92.555214][ T7677] 
[   92.623581][ T7677] Allocated by task 7630:
[   92.624897][ T7677]  kasan_save_track+0x3e/0x80
[   92.626339][ T7677]  __kasan_kmalloc+0x93/0xb0
[   92.627742][ T7677]  __kmalloc_noprof+0x27a/0x4f0
[   92.629221][ T7677]  hci_alloc_dev_priv+0x28/0x2040
[   92.630740][ T7677]  vhci_create_device+0x120/0x6e0
[   92.632256][ T7677]  vhci_write+0x3ce/0x4a0
[   92.633550][ T7677]  vfs_write+0x54b/0xa90
[   92.634843][ T7677]  ksys_write+0x145/0x250
[   92.636158][ T7677]  do_syscall_64+0xfa/0x3b0
[   92.637525][ T7677]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   92.639316][ T7677] 
[   92.640069][ T7677] Freed by task 7630:
[   92.641274][ T7677]  kasan_save_track+0x3e/0x80
[   92.642709][ T7677]  kasan_save_free_info+0x46/0x50
[   92.644233][ T7677]  __kasan_slab_free+0x62/0x70
[   92.645719][ T7677]  kfree+0x18e/0x440
[   92.646922][ T7677]  bt_host_release+0x82/0x90
[   92.648331][ T7677]  device_release+0x9c/0x1c0
[   92.649734][ T7677]  kobject_put+0x22b/0x480
[   92.651100][ T7677]  vhci_release+0x88/0xd0
[   92.652365][ T7677]  __fput+0x44c/0xa70
[   92.653567][ T7677]  task_work_run+0x1d4/0x260
[   92.654986][ T7677]  do_exit+0x6b5/0x22e0
[   92.656260][ T7677]  do_group_exit+0x21c/0x2d0
[   92.657672][ T7677]  __x64_sys_exit_group+0x3f/0x40
[   92.659221][ T7677]  x64_sys_call+0x21ba/0x21c0
[   92.660666][ T7677]  do_syscall_64+0xfa/0x3b0
[   92.662074][ T7677]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   92.663841][ T7677] 
[   92.664544][ T7677] Last potentially related work creation:
[   92.666257][ T7677]  kasan_save_stack+0x3e/0x60
[   92.667660][ T7677]  kasan_record_aux_stack+0xbd/0xd0
[   92.669213][ T7677]  insert_work+0x3d/0x330
[   92.670468][ T7677]  __queue_work+0xbd9/0xfe0
[   92.671785][ T7677]  queue_work_on+0x181/0x270
[   92.673193][ T7677]  process_scheduled_works+0xae1/0x17b0
[   92.674951][ T7677]  worker_thread+0x8a0/0xda0
[   92.676337][ T7677]  kthread+0x711/0x8a0
[   92.677562][ T7677]  ret_from_fork+0x3fc/0x770
[   92.678933][ T7677]  ret_from_fork_asm+0x1a/0x30
[   92.680298][ T7677] 
[   92.681012][ T7677] Second to last potentially related work creation:
[   92.682925][ T7677]  kasan_save_stack+0x3e/0x60
[   92.684279][ T7677]  kasan_record_aux_stack+0xbd/0xd0
[   92.685804][ T7677]  insert_work+0x3d/0x330
[   92.687064][ T7677]  __queue_work+0xcfc/0xfe0
[   92.688409][ T7677]  call_timer_fn+0x17e/0x5f0
[   92.689785][ T7677]  __run_timer_base+0x646/0x860
[   92.691239][ T7677]  run_timer_softirq+0xb7/0x180
[   92.692718][ T7677]  handle_softirqs+0x286/0x870
[   92.694174][ T7677]  __irq_exit_rcu+0xca/0x1f0
[   92.695589][ T7677]  irq_exit_rcu+0x9/0x30
[   92.696896][ T7677]  sysvec_apic_timer_interrupt+0xa6/0xc0
[   92.698605][ T7677]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   92.700378][ T7677] 
[   92.701102][ T7677] The buggy address belongs to the object at ffff8881174b0000
[   92.701102][ T7677]  which belongs to the cache kmalloc-8k of size 8192
[   92.705132][ T7677] The buggy address is located 160 bytes inside of
[   92.705132][ T7677]  freed 8192-byte region [ffff8881174b0000, ffff8881174b2000)
[   92.709258][ T7677] 
[   92.709978][ T7677] The buggy address belongs to the physical page:
[   92.711858][ T7677] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1174b0
[   92.714464][ T7677] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   92.716990][ T7677] ksm flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   92.719278][ T7677] page_type: f5(slab)
[   92.720461][ T7677] raw: 057ff00000000040 ffff88801a442280 ffffea00008e6600 0000000000000003
[   92.722926][ T7677] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   92.725368][ T7677] head: 057ff00000000040 ffff88801a442280 ffffea00008e6600 0000000000000003
[   92.727903][ T7677] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[   92.730335][ T7677] head: 057ff00000000003 ffffea00045d2c01 00000000ffffffff 00000000ffffffff
[   92.732901][ T7677] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   92.735462][ T7677] page dumped because: kasan: bad access detected
[   92.737338][ T7677] page_owner tracks the page as allocated
[   92.738990][ T7677] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 7145, tgid 7145 (syz-executor), ts 79509231323, free_ts 79488479650
[   92.744733][ T7677]  post_alloc_hook+0x240/0x2a0
[   92.746205][ T7677]  get_page_from_freelist+0x21e4/0x22c0
[   92.747822][ T7677]  __alloc_frozen_pages_noprof+0x181/0x370
[   92.749603][ T7677]  alloc_pages_mpol+0x232/0x4a0
[   92.751097][ T7677]  allocate_slab+0x8a/0x3b0
[   92.752442][ T7677]  ___slab_alloc+0xbfc/0x1480
[   92.753848][ T7677]  __kvmalloc_node_noprof+0x429/0x5f0
[   92.755433][ T7677]  pfifo_fast_init+0x238/0x6b0
[   92.756897][ T7677]  qdisc_create_dflt+0x13b/0x4e0
[   92.758330][ T7677]  dev_activate+0x378/0x1150
[   92.759742][ T7677]  __dev_open+0x69c/0x880
[   92.761081][ T7677]  __dev_change_flags+0x1ea/0x6d0
[   92.762643][ T7677]  netif_change_flags+0x88/0x1a0
[   92.764168][ T7677]  do_setlink+0xc55/0x41c0
[   92.765544][ T7677]  rtnl_newlink+0x160b/0x1c70
[   92.767000][ T7677]  rtnetlink_rcv_msg+0x7cf/0xb70
[   92.768514][ T7677] page last free pid 7145 tgid 7145 stack trace:
[   92.770418][ T7677]  __free_frozen_pages+0xc71/0xe70
[   92.771978][ T7677]  __put_partials+0x161/0x1c0
[   92.773416][ T7677]  put_cpu_partial+0x17c/0x250
[   92.774883][ T7677]  __slab_free+0x2f7/0x400
[   92.776223][ T7677]  qlist_free_all+0x97/0x140
[   92.777636][ T7677]  kasan_quarantine_reduce+0x148/0x160
[   92.779299][ T7677]  __kasan_slab_alloc+0x22/0x80
[   92.780810][ T7677]  __kmalloc_noprof+0x224/0x4f0
[   92.782307][ T7677]  fib6_info_alloc+0x30/0xf0
[   92.783709][ T7677]  ip6_route_info_create+0x142/0x860
[   92.785279][ T7677]  ip6_route_add+0x49/0x1b0
[   92.786624][ T7677]  inet6_addr_add+0x6b2/0xc00
[   92.788035][ T7677]  inet6_rtm_newaddr+0x93d/0xd20
[   92.789516][ T7677]  rtnetlink_rcv_msg+0x7cf/0xb70
[   92.790976][ T7677]  netlink_rcv_skb+0x208/0x470
[   92.792382][ T7677]  netlink_unicast+0x75c/0x8e0
[   92.793816][ T7677] 
[   92.794549][ T7677] Memory state around the buggy address:
[   92.796322][ T7677]  ffff8881174aff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   92.798711][ T7677]  ffff8881174b0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   92.801132][ T7677] >ffff8881174b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   92.803556][ T7677]                                ^
[   92.805073][ T7677]  ffff8881174b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   92.807473][ T7677]  ffff8881174b0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   92.809882][ T7677] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   92.812999][ T7677] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   92.815291][ T7677] CPU: 0 UID: 0 PID: 7677 Comm: khidpd_04f38002 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   92.819167][ T7677] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   92.822250][ T7677] Call Trace:
[   92.823266][ T7677]  <TASK>
[   92.824151][ T7677]  dump_stack_lvl+0x99/0x250
[   92.825512][ T7677]  ? __asan_memcpy+0x40/0x70
[   92.826964][ T7677]  ? __pfx_dump_stack_lvl+0x10/0x10
[   92.828640][ T7677]  ? __pfx__printk+0x10/0x10
[   92.830063][ T7677]  panic+0x2db/0x790
[   92.831254][ T7677]  ? __pfx_panic+0x10/0x10
[   92.832623][ T7677]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[   92.834429][ T7677]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   92.836180][ T7677]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   92.838105][ T7677]  ? print_memory_metadata+0x314/0x400
[   92.839780][ T7677]  ? __mutex_lock+0x738/0xe80
[   92.841226][ T7677]  check_panic_on_warn+0x89/0xb0
[   92.842772][ T7677]  ? __mutex_lock+0x738/0xe80
[   92.844211][ T7677]  end_report+0x78/0x160
[   92.845521][ T7677]  kasan_report+0x129/0x150
[   92.846933][ T7677]  ? __mutex_lock+0x738/0xe80
[   92.848366][ T7677]  __mutex_lock+0x738/0xe80
[   92.849771][ T7677]  ? __mutex_lock+0x51b/0xe80
[   92.851197][ T7677]  ? l2cap_unregister_user+0x6a/0x1b0
[   92.852851][ T7677]  ? __pfx___mutex_lock+0x10/0x10
[   92.854350][ T7677]  ? __pfx___timer_delete_sync+0x10/0x10
[   92.856021][ T7677]  l2cap_unregister_user+0x6a/0x1b0
[   92.857620][ T7677]  hidp_session_thread+0x3c9/0x410
[   92.859196][ T7677]  ? __pfx_hidp_session_thread+0x10/0x10
[   92.860902][ T7677]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[   92.862703][ T7677]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   92.864606][ T7677]  ? __pfx_hidp_session_wake_function+0x10/0x10
[   92.866512][ T7677]  ? __kthread_parkme+0x7b/0x200
[   92.868024][ T7677]  ? __kthread_parkme+0x1a1/0x200
[   92.869559][ T7677]  kthread+0x711/0x8a0
[   92.870820][ T7677]  ? __pfx_hidp_session_thread+0x10/0x10
[   92.872529][ T7677]  ? __pfx_kthread+0x10/0x10
[   92.873968][ T7677]  ? _raw_spin_unlock_irq+0x23/0x50
[   92.875551][ T7677]  ? lockdep_hardirqs_on+0x9c/0x150
[   92.877143][ T7677]  ? __pfx_kthread+0x10/0x10
[   92.878555][ T7677]  ret_from_fork+0x3fc/0x770
[   92.879939][ T7677]  ? __pfx_ret_from_fork+0x10/0x10
[   92.881456][ T7677]  ? __switch_to_asm+0x39/0x70
[   92.882886][ T7677]  ? __switch_to_asm+0x33/0x70
[   92.884333][ T7677]  ? __pfx_kthread+0x10/0x10
[   92.885783][ T7677]  ret_from_fork_asm+0x1a/0x30
[   92.887277][ T7677]  </TASK>
[   92.888781][ T7677] Kernel Offset: disabled
[   92.890076][ T7677] Rebooting in 86400 seconds..

VM DIAGNOSIS:
12:57:39  Registers:
info registers vcpu 0

CPU#0
RAX=000000000000006b RBX=000000000000006b RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90003d6f370
R8 =ffff888021538237 R9 =1ffff110042a7046 R10=dffffc0000000000 R11=ffffffff85478780
R12=dffffc0000000000 R13=ffffffff99af98c6 R14=ffffffff99dfe6e0 R15=0000000000000000
RIP=ffffffff854787fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00002000001e5030 CR3=000000010d2e6000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00007f0f0d9856a3 00007f0f0d9856a3 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=0000000000000000 00007f0f0d811b1f
XMM06=0000000000000000 00007f0f0d811b19 XMM07=0000000000000000 00007f0f0d811b2d
XMM08=0000000000000000 00007f0f0d811bb3 XMM09=0000000000000000 00007f0f0d811c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff81b4c210 RBX=ffff88813663b1c0 RCX=ffff888020e23980 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc9000382f700 RSP=ffffc9000382f5a0
R8 =ffffffff8fa1f3f7 R9 =1ffffffff1f43e7e R10=dffffc0000000000 R11=fffffbfff1f43e7f
R12=1ffff11009608385 R13=dffffc0000000000 R14=0000000000000000 R15=ffff88804b041c28
RIP=ffffffff81b4c1f9 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fece20e7d60 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00007fece15856a3 00007fece15856a3 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 00ff000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=0a37362073757461 7473206874697720
XMM06=6465746978652070 6f6f6c0a29646574 XMM07=74696d7265702074 6f6e206e6f697461
XMM08=7265704f203a3120 6f6e72726528200a XMM09=6769726f5f74696e 695f636e5f766461
XMM10=666666666666660a 342e79656b5f5f2e XMM11=6174616220622030 6534633130613966
XMM12=6666666666660a31 342e79656b5f5f2e XMM13=73766f2062203061 6663313061396666
XMM14=2e79656b5f5f2e74 656e5f74696e695f XMM15=6331306139666666 66666666660a3334
