last executing test programs:

1.279555776s ago: executing program 1 (id=2):
r0 = userfaultfd(0x80001)
munmap(&(0x7f0000800000/0x800000)=nil, 0x800000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x110})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000003c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000})
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x76a9bba1a690db0f, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3cb140bb}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840)
r2 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c)
r3 = socket$kcm(0x10, 0x400000002, 0x0)
write$cgroup_subtree(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33)
r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
sendmsg$802154_dgram(r4, &(0x7f000000b8c0)={&(0x7f000000b800)={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0102}}}, 0x14, &(0x7f000000b880)={0x0}}, 0x0)
recvmsg(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000002a00)=[{&(0x7f00000017c0)=""/4098, 0x1002}, {&(0x7f0000005700)=""/4074, 0xfea}, {&(0x7f0000000780)=""/4139, 0x102b}, {&(0x7f0000000200)=""/115, 0x73}, {&(0x7f0000000040)=""/205, 0xcd}, {&(0x7f00000006c0)=""/177, 0xb1}, {&(0x7f0000000600)=""/154, 0x9a}, {&(0x7f0000000400)=""/24, 0x18}], 0x8, 0x0, 0x0, 0x2000000}, 0x120)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x103a42, 0x18)
write$FUSE_IOCTL(r5, &(0x7f0000000080)={0x20, 0x0, 0x0, {0x5, 0x4, 0x9, 0x7}}, 0x20)
copy_file_range(r5, 0x0, r5, 0x0, 0xfffffffffffffffe, 0x0)
r6 = socket(0x10, 0x3, 0x0)
write(r6, &(0x7f0000000100)="240000001e005f1814fffffffffffff807000000b800000000000000060005000d000000", 0x24)
write$binfmt_script(r2, &(0x7f00000000c0), 0x28)

1.264407533s ago: executing program 2 (id=3):
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000001a40)=[@in={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0x12}}], 0x10)
capset(&(0x7f0000000c00)={0x20080522}, &(0x7f0000000140))
sendto$inet(r0, &(0x7f0000000800)='-', 0x1, 0x240080d0, &(0x7f0000000040)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x44}}, 0x10)
r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x57e, 0x200e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x2, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
prctl$PR_MCE_KILL(0x21, 0x1, 0x2)
syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0)

1.101474683s ago: executing program 1 (id=5):
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000480)={'wlan0\x00'})
r4 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
ioctl(0xffffffffffffffff, 0x6, &(0x7f0000000540)="99cc36b975e0eb91d2809cb94706b5a401f5b026b5e188acc86f5f94509531c9ca9d70851f21f5480a3967b9c4a326d5ad82cbaea5177470c39aef4277f17117a9089c4e0324bd8c8dff55a89c5aed0c15b1a98249c71db33d96659f3dab55dfafa71b14ec2d816083b5851f0beddbf7d2f7d063d6a9bafe3acb5367cff95244850c3259777bb7538b968c01a4e6ab509eaa656cbc75ac8c2dd44371f33d040e6f1744fdeb05774e149bcd0623a7bb10958f0e238009b01ed85941dee03d394fe6ef4f26cbced116cada6bcfbf612c17bbdff9af36c457bd2afd9fcbb3dd89398597586179e6e14ae93cf930cac25dd9a3eac337a66235")
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f0000000440)={0xa4, r3, 0x4, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x9}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}], @NL80211_ATTR_DURATION={0x8, 0x57, 0xffffffff}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1b}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xf}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x229}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x25}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x100}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1725}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x21a}], @NL80211_ATTR_DURATION={0x8, 0x57, 0xfe1a}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}], @chandef_params]}, 0xa4}, 0x1, 0x0, 0x0, 0x404d0}, 0x48090)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', <r5=>0x0})
mmap$usbmon(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x13, 0xffffffffffffffff, 0xfffffffffffffff5)
sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010040000000000002034400000008000300", @ANYRES32=r5, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140002"], 0x4c}}, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000017e2dd0863238c9f716726ea07802040d9014f03010902120001000000000904000000ff1848a8a43ed9823466933e75c07d1c7b7eb0df87ff033106235db72f852b4f436672ed34303ad3c3bac60f9c9827538012afbc0770263244159383102b0541d4894d367ba3dc428e61ba28c08e139dc11daac6c13de3eadc7301053b95e23c33c2d60ebde4ce33843c5a6556fa3768515b29dfc53272c4df1201567875f0a6ca7991ca7c669382acebae9149ff2f06410d7fa0da06a72a22cb4c2257c305e63d5be675cf29b4f8e52d97d65672a798d713d716e3585800"/237, @ANYRES32=r1, @ANYBLOB="bb9eea3e21cba99aa7f7df07cd444679aa463a138f92fbaec67fb14a386e825c3d67f30bcb8a6ba30b8c7bcf5c25efa9cd7f66b0c4570f9f892bc106f1bb8962c149ff5cc391eee772f76b27c32d1773533ca6291d08a7287391f622677625308b2ecad19f1b47d3e777d0ae6e7c845c8e6287aa61915c6e10c3999b7ca50c6530050b7df58dcc8a223c57bd4496bf3fc4322a9101fd3e33b8bab7ce6e75f89eaa5ca6f9e852a0632c14608e96f2bb2548e96b858815ddf053dc30f9662d0d547ef2507309d61c498c2e1ff3dde992d013b2b1"], 0x0)

683.704121ms ago: executing program 3 (id=4):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x4008630a, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0})
r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x140)
ioctl$SG_GET_VERSION_NUM(r1, 0x2282, &(0x7f0000000080))
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040))

519.723888ms ago: executing program 0 (id=1):
r0 = socket$inet6(0xa, 0x4, 0x88)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
recvmmsg(r1, &(0x7f0000002a80), 0x0, 0x40000000, &(0x7f0000002b00)={0x0, 0x3938700})
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/psched\x00')
pread64(r2, &(0x7f0000000c80)=""/86, 0x56, 0x4000000000000ef)
write$cgroup_type(0xffffffffffffffff, &(0x7f0000002b80), 0x9)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="041311ba1596f970b5ddff0fc9000000000081ffc9000b00c8009f044f6301b5a433c69e854527d301470221362cf66bf2241f68c027afdbf58cd88d2f5ff6f2056a748961ca7fd2b1368b0504a6677a0d401e1fd0ccfb296a3c5a16e6d60ecd5f44a82a40e5a2333a697fbf6064c966ffa966b8"], 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@loopback, @in=@multicast2, 0x4e23, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {0xd10d, 0x1, 0x2000000000000000, 0x4}, {0x0, 0x0, 0x7}, 0x0, 0x1, 0x1, 0x1, 0x0, 0xd5630fea9b8cad78}, {{@in6=@remote, 0x0, 0x33}, 0x0, @in6=@mcast1, 0x10000000, 0x0, 0x0, 0x5}}, 0xe8)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc)
connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr, 0xf}, 0x1c)

399.467886ms ago: executing program 3 (id=6):
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0xdc032, 0xffffffffffffffff, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x8001)
ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000080))

298.320592ms ago: executing program 0 (id=7):
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@userxattr}]})
r0 = socket$qrtr(0x2a, 0x2, 0x0)
connect$qrtr(r0, &(0x7f0000000040), 0xc)
writev(r0, &(0x7f0000000180)=[{&(0x7f0000002680)="1e", 0xfdef}], 0x1)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000380)=@ethtool_per_queue_op={0x4b, 0xf, [0x7, 0x0, 0x81, 0xfffffff0, 0x3, 0x9, 0x31fa379a, 0x4, 0x8, 0x10001, 0x6, 0x1, 0x1291453b, 0x5, 0xffffffff, 0x1, 0xdc, 0x7f, 0x9, 0x4, 0x5, 0x88, 0x7, 0x9e, 0x8, 0xdd, 0x2, 0xfc4b, 0xf1, 0x2, 0x80000001, 0xe24, 0x8, 0x1, 0x9, 0x80000000, 0x4, 0x5, 0x8, 0x6, 0x0, 0xee8, 0x3ff, 0x8001, 0x2, 0x7fffffff, 0x7, 0x1, 0x0, 0x5, 0x9, 0x5, 0xb3, 0x9, 0x8, 0x80000001, 0x2, 0x80000001, 0x1, 0x8, 0x3, 0x40, 0x2, 0x0, 0x9, 0x7fffffff, 0x3, 0xc, 0xfcf3, 0x3, 0x2, 0x7c8, 0x5b9c, 0x7, 0x1, 0x1000, 0x2, 0x400, 0x6, 0x7, 0x80, 0x2, 0x4000004, 0x6, 0x73a0, 0x8000, 0x2d, 0x10, 0xfe3, 0x7, 0x6, 0xfff, 0x4, 0x3, 0xe54, 0xc, 0x3, 0x8, 0x3, 0x0, 0x8, 0x1, 0x5, 0x2, 0x3, 0x5, 0xf, 0x5, 0xfffffffc, 0xfffffffa, 0x1ff, 0x8, 0x4, 0x49, 0x3ff, 0xfffff2b7, 0x51, 0x80000001, 0x100, 0x8, 0x200, 0xbc, 0x2, 0xd3f, 0x280, 0x6, 0xffff, 0x6], "015d57fd9fe6295d1d6e33cb945aed0d6dda3a82dc0fe560d08c77b21d214b64563240f1abcc8d5c6b71481ffe0e29bed3bd88406f4fc9d9b847813891ac14541487d805b230c0f0e9c69acf"}})

241.602133ms ago: executing program 3 (id=8):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
rt_sigpending(0x0, 0x0) (async, rerun: 32)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async, rerun: 32)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000), &(0x7f0000000100)=0x4)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r1, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000680)=ANY=[@ANYBLOB="0c0100002d0001000000000000000000140073000000000000000000000000000000000009000080976b640868000000db0001"], 0x10c}], 0x1}, 0x0) (async)
r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async)
r3 = socket$qrtr(0x2a, 0x2, 0x0)
ioctl$sock_qrtr_TIOCOUTQ(r3, 0x8919, 0x0) (async)
r4 = socket$inet6(0xa, 0x3, 0x37)
setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000200)=0x633a, 0x4)
sendto$inet6(r4, 0x0, 0x0, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) (async, rerun: 64)
setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000000)=0x215, 0x4) (async, rerun: 64)
recvfrom$inet6(r4, 0x0, 0x0, 0x40000020, 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f00000002c0)={0x5, "0092938eda08a5513db99d08fdae429e4ae4c5bac9dd8259be4ee64b32c65e0a"}) (async)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f00000000c0)={0x9e, "6b4cd4bb69ae05b47135206d7aed4930442d20a60ef8151996a8657d64b442d0"}) (async)
r5 = socket$rxrpc(0x21, 0x2, 0xa)
bind$rxrpc(r5, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0xa, {0x2, 0x0, @empty}}, 0x24)
r6 = socket$packet(0x11, 0x3, 0x300)
rt_sigtimedwait(&(0x7f0000000140)={[0xfa]}, &(0x7f0000000240), &(0x7f0000000180)={0x77359400}, 0x8) (async)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'xfrm0\x00', <r7=>0x0})
sendto$packet(r6, &(0x7f0000000080)="4d01000000020000000100e50414090b0092000000000000005ee4cc040c1e5fcc2eae7fc0dacea9ed182143db4ee0891176789824", 0x35, 0x81, &(0x7f0000000000)={0x11, 0x0, r7, 0x1, 0x8a, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14)

103.340436ms ago: executing program 0 (id=9):
madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe)
r0 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
userfaultfd(0x1)
syz_io_uring_setup(0x50d0, &(0x7f0000000000)={0x0, 0xfffffffc, 0x8, 0x2, 0x332}, &(0x7f0000000100), &(0x7f0000ff4000))
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000380)={'erspan0\x00', 0x0})
syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[], 0x28}}, 0x0)
madvise(&(0x7f0000bae000/0x3000)=nil, 0x3000, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0)

34.914846ms ago: executing program 3 (id=10):
socket$kcm(0xa, 0x3, 0x87)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r0 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"})
syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="7a492786d21bc2d4af04d91800f2ff58782ca8c6f9dfaebf021e9ca08126caf224d913f49750b4c602aef5586a48ad07b22fe4a67e193b6e1b525cc81c4e8cfe4feee5c31ea64bed9ef5f0edc6b248c168ac22c713b2fae7c9e8095e97857fd362f360c4ee80a19f623707b658fec7ad23f37cc50e82b5baebc3bdbb9e305b4dc29672d345033beffe6eff0000000000000000", @ANYRES16, @ANYBLOB="04002cbd7000fddbdf251c0000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00080000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00090000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0000000000"], 0x8c}, 0x1, 0x0, 0x0, 0x20000000}, 0x50)
ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000040)={0x60, 0xa0, 0x0, 0x240, 0x0, 0x0, 0x0, 0x0, {0x10, 0x8, 0x1}, {0x8, 0x8, 0xfffffffe}, {0x3ff, 0x80000000}, {0x1000}})
write$tun(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120005000000140000006000000008008700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef)

0s ago: executing program 0 (id=11):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
setuid(0xee01) (async)
r1 = getpgrp(0x0)
r2 = syz_pidfd_open(r1, 0x0)
setns(r2, 0x40000000) (async, rerun: 32)
ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f0000000080)={{r0}, 0x3, &(0x7f0000000000)=[0x80000001, 0x2, 0x7], 0x0, 0x0, 0x1}) (rerun: 32)
r3 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00', <r5=>0x0})
sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)={0x38, r4, 0x1, 0x70bd2b, 0x2, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x4, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3c, 0x81, 0x10, 0x400, 0xc5c1, 0x40, 0x8, 0x1]}}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x200440c0}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.0.22' (ED25519) to the list of known hosts.
[   67.778872][ T5810] cgroup: Unknown subsys name 'net'
[   67.971019][ T5810] cgroup: Unknown subsys name 'cpuset'
[   67.979935][ T5810] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   69.411424][ T5810] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   71.412305][ T1297] ieee802154 phy0 wpan0: encryption failed: -22
[   71.418832][ T1297] ieee802154 phy1 wpan1: encryption failed: -22
[   72.714734][ T5833] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   72.723532][ T5833] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   72.731717][ T5833] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   72.735378][ T5836] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   72.740491][ T5833] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   72.747916][ T5836] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   72.754615][ T5833] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   72.761887][ T5836] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   72.785416][ T5837] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   72.793236][ T5836] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   72.801239][ T5836] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   72.801403][ T5834] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   72.816902][ T5836] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   72.825121][ T5837] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   72.832804][ T5836] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   72.839976][ T5837] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   72.847526][ T5834] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   72.848474][ T5837] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   72.863094][ T5834] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   72.863809][ T5837] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   73.331089][ T5820] chnl_net:caif_netlink_parms(): no params data found
[   73.461334][ T5819] chnl_net:caif_netlink_parms(): no params data found
[   73.503237][ T5822] chnl_net:caif_netlink_parms(): no params data found
[   73.581763][ T5821] chnl_net:caif_netlink_parms(): no params data found
[   73.678237][ T5820] bridge0: port 1(bridge_slave_0) entered blocking state
[   73.686033][ T5820] bridge0: port 1(bridge_slave_0) entered disabled state
[   73.694429][ T5820] bridge_slave_0: entered allmulticast mode
[   73.701675][ T5820] bridge_slave_0: entered promiscuous mode
[   73.740267][ T5820] bridge0: port 2(bridge_slave_1) entered blocking state
[   73.747927][ T5820] bridge0: port 2(bridge_slave_1) entered disabled state
[   73.755307][ T5820] bridge_slave_1: entered allmulticast mode
[   73.762722][ T5820] bridge_slave_1: entered promiscuous mode
[   73.786428][ T5819] bridge0: port 1(bridge_slave_0) entered blocking state
[   73.793852][ T5819] bridge0: port 1(bridge_slave_0) entered disabled state
[   73.801228][ T5819] bridge_slave_0: entered allmulticast mode
[   73.808414][ T5819] bridge_slave_0: entered promiscuous mode
[   73.847557][ T5819] bridge0: port 2(bridge_slave_1) entered blocking state
[   73.854771][ T5819] bridge0: port 2(bridge_slave_1) entered disabled state
[   73.862483][ T5819] bridge_slave_1: entered allmulticast mode
[   73.869674][ T5819] bridge_slave_1: entered promiscuous mode
[   73.894031][ T5822] bridge0: port 1(bridge_slave_0) entered blocking state
[   73.901335][ T5822] bridge0: port 1(bridge_slave_0) entered disabled state
[   73.908595][ T5822] bridge_slave_0: entered allmulticast mode
[   73.916422][ T5822] bridge_slave_0: entered promiscuous mode
[   73.939038][ T5820] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   73.960982][ T5822] bridge0: port 2(bridge_slave_1) entered blocking state
[   73.968351][ T5822] bridge0: port 2(bridge_slave_1) entered disabled state
[   73.976496][ T5822] bridge_slave_1: entered allmulticast mode
[   73.983942][ T5822] bridge_slave_1: entered promiscuous mode
[   74.006275][ T5820] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   74.059576][ T5819] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   74.081352][ T5821] bridge0: port 1(bridge_slave_0) entered blocking state
[   74.088668][ T5821] bridge0: port 1(bridge_slave_0) entered disabled state
[   74.095828][ T5821] bridge_slave_0: entered allmulticast mode
[   74.103164][ T5821] bridge_slave_0: entered promiscuous mode
[   74.124824][ T5819] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   74.151745][ T5820] team0: Port device team_slave_0 added
[   74.158102][ T5821] bridge0: port 2(bridge_slave_1) entered blocking state
[   74.165787][ T5821] bridge0: port 2(bridge_slave_1) entered disabled state
[   74.173431][ T5821] bridge_slave_1: entered allmulticast mode
[   74.180982][ T5821] bridge_slave_1: entered promiscuous mode
[   74.190639][ T5822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   74.214088][ T5820] team0: Port device team_slave_1 added
[   74.235143][ T5822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   74.246942][ T5819] team0: Port device team_slave_0 added
[   74.293723][ T5819] team0: Port device team_slave_1 added
[   74.328540][ T5821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   74.364151][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_0
[   74.371370][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   74.397468][ T5820] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   74.411705][ T5821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   74.438760][ T5822] team0: Port device team_slave_0 added
[   74.445172][ T5819] batman_adv: batadv0: Adding interface: batadv_slave_0
[   74.452539][ T5819] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   74.478489][ T5819] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   74.490409][ T5820] batman_adv: batadv0: Adding interface: batadv_slave_1
[   74.497503][ T5820] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   74.523495][ T5820] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   74.547343][ T5822] team0: Port device team_slave_1 added
[   74.553806][ T5819] batman_adv: batadv0: Adding interface: batadv_slave_1
[   74.561001][ T5819] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   74.587004][ T5819] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   74.608187][ T5821] team0: Port device team_slave_0 added
[   74.637078][ T5821] team0: Port device team_slave_1 added
[   74.688727][ T5819] hsr_slave_0: entered promiscuous mode
[   74.695661][ T5819] hsr_slave_1: entered promiscuous mode
[   74.715333][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_0
[   74.722453][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   74.748993][ T5822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   74.800555][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_1
[   74.807754][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   74.833820][ T5822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   74.848898][ T5825] Bluetooth: hci1: command tx timeout
[   74.860010][ T5820] hsr_slave_0: entered promiscuous mode
[   74.866380][ T5820] hsr_slave_1: entered promiscuous mode
[   74.872729][ T5820] debugfs: 'hsr0' already exists in 'hsr'
[   74.878545][ T5820] Cannot create hsr debugfs directory
[   74.884904][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_0
[   74.892333][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   74.918371][ T5821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   74.929021][ T5825] Bluetooth: hci0: command tx timeout
[   74.929072][ T5832] Bluetooth: hci2: command tx timeout
[   74.937560][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_1
[   74.940479][ T5837] Bluetooth: hci3: command tx timeout
[   74.947191][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   74.978411][ T5821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   75.124840][ T5822] hsr_slave_0: entered promiscuous mode
[   75.131785][ T5822] hsr_slave_1: entered promiscuous mode
[   75.138123][ T5822] debugfs: 'hsr0' already exists in 'hsr'
[   75.143854][ T5822] Cannot create hsr debugfs directory
[   75.186993][ T5821] hsr_slave_0: entered promiscuous mode
[   75.193429][ T5821] hsr_slave_1: entered promiscuous mode
[   75.199840][ T5821] debugfs: 'hsr0' already exists in 'hsr'
[   75.205579][ T5821] Cannot create hsr debugfs directory
[   75.589434][ T5819] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   75.603333][ T5819] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   75.614062][ T5819] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   75.633016][ T5819] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   75.689844][ T5820] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   75.712759][ T5820] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   75.725137][ T5820] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   75.735665][ T5820] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   75.850034][ T5822] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   75.861421][ T5822] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   75.886734][ T5822] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   75.900534][ T5822] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   75.970282][ T5821] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   75.982371][ T5821] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   75.993239][ T5821] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   76.005021][ T5821] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   76.026123][ T5819] 8021q: adding VLAN 0 to HW filter on device bond0
[   76.102547][ T5819] 8021q: adding VLAN 0 to HW filter on device team0
[   76.128676][ T5820] 8021q: adding VLAN 0 to HW filter on device bond0
[   76.153165][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   76.160431][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   76.193928][   T50] bridge0: port 2(bridge_slave_1) entered blocking state
[   76.201155][   T50] bridge0: port 2(bridge_slave_1) entered forwarding state
[   76.219178][ T5820] 8021q: adding VLAN 0 to HW filter on device team0
[   76.258942][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   76.266390][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   76.301771][   T13] bridge0: port 2(bridge_slave_1) entered blocking state
[   76.308937][   T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[   76.326227][ T5819] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   76.446037][ T5822] 8021q: adding VLAN 0 to HW filter on device bond0
[   76.524660][ T5821] 8021q: adding VLAN 0 to HW filter on device bond0
[   76.552930][ T5822] 8021q: adding VLAN 0 to HW filter on device team0
[   76.571893][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   76.579136][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   76.609459][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   76.616663][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   76.675708][ T5821] 8021q: adding VLAN 0 to HW filter on device team0
[   76.706225][   T60] bridge0: port 1(bridge_slave_0) entered blocking state
[   76.713510][   T60] bridge0: port 1(bridge_slave_0) entered forwarding state
[   76.741977][ T5819] 8021q: adding VLAN 0 to HW filter on device batadv0
[   76.756189][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   76.763462][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   76.929023][ T5837] Bluetooth: hci1: command tx timeout
[   76.944106][ T5820] 8021q: adding VLAN 0 to HW filter on device batadv0
[   76.963684][ T5819] veth0_vlan: entered promiscuous mode
[   76.994124][ T5819] veth1_vlan: entered promiscuous mode
[   77.008747][ T5837] Bluetooth: hci0: command tx timeout
[   77.020031][ T5837] Bluetooth: hci3: command tx timeout
[   77.025482][ T5837] Bluetooth: hci2: command tx timeout
[   77.113043][ T5820] veth0_vlan: entered promiscuous mode
[   77.160662][ T5820] veth1_vlan: entered promiscuous mode
[   77.184390][ T5819] veth0_macvtap: entered promiscuous mode
[   77.201361][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0
[   77.216478][ T5819] veth1_macvtap: entered promiscuous mode
[   77.262631][ T5819] batman_adv: batadv0: Interface activated: batadv_slave_0
[   77.295083][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0
[   77.308599][ T5819] batman_adv: batadv0: Interface activated: batadv_slave_1
[   77.323227][ T5820] veth0_macvtap: entered promiscuous mode
[   77.340548][ T5820] veth1_macvtap: entered promiscuous mode
[   77.354926][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   77.378300][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   77.388592][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   77.407909][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   77.420960][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_0
[   77.452226][ T5820] batman_adv: batadv0: Interface activated: batadv_slave_1
[   77.468073][   T60] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   77.489711][   T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   77.498792][   T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   77.527903][   T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   77.582017][ T5822] veth0_vlan: entered promiscuous mode
[   77.623312][ T5821] veth0_vlan: entered promiscuous mode
[   77.643694][   T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   77.650453][ T5822] veth1_vlan: entered promiscuous mode
[   77.671284][   T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   77.707923][ T5821] veth1_vlan: entered promiscuous mode
[   77.769308][   T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   77.780418][   T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   77.784672][ T5822] veth0_macvtap: entered promiscuous mode
[   77.795670][   T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   77.795732][   T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   77.843574][ T5822] veth1_macvtap: entered promiscuous mode
[   77.866141][   T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   77.882244][   T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   77.921983][ T5819] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   77.931107][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0
[   77.947433][ T5821] veth0_macvtap: entered promiscuous mode
[   77.971093][ T5821] veth1_macvtap: entered promiscuous mode
[   77.982244][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1
[   78.038938][   T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   78.068521][   T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   78.100742][   T36] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   78.116590][   T36] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   78.161060][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0
[   78.203815][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1
[   78.241048][ T5912] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[   78.241344][ T1004] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   78.273490][ T1004] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   78.283102][ T1004] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   78.305672][ T1004] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   78.383542][   T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   78.400763][ T5827] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[   78.406757][   T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   78.450259][   T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   78.462054][   T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   78.502459][   T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   78.523878][   T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   78.558073][  T793] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[   78.568626][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   78.578266][ T5827] usb 3-1: Using ep0 maxpacket: 16
[   78.583541][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   78.608954][ T5827] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[   78.634141][ T5827] usb 3-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00
[   78.658511][ T5827] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   78.717249][  T793] usb 2-1: Using ep0 maxpacket: 8
[   78.723725][  T793] usb 2-1: too many configurations: 128, using maximum allowed: 8
[   78.731711][ T5827] usb 3-1: config 0 descriptor??
[   78.740887][ T5920] binder: BC_ATTEMPT_ACQUIRE not supported
[   78.756787][ T5920] binder: 5917:5920 ioctl c0306201 2000000001c0 returned -22
[   78.779994][  T793] usb 2-1: unable to read config index 0 descriptor/start: -61
[   78.787972][  T793] usb 2-1: can't read configurations, error -61
[   78.909418][ T5837] Bluetooth: hci3: Malformed Event: 0x13
[   78.938882][  T793] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[   79.007618][ T5837] Bluetooth: hci1: command tx timeout
[   79.055639][ T5929] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[   79.088835][ T5837] Bluetooth: hci2: command tx timeout
[   79.089596][ T5832] Bluetooth: hci3: command tx timeout
[   79.095042][ T5837] Bluetooth: hci0: command tx timeout
[   79.130616][ T5934] sctp: [Deprecated]: syz.3.8 (pid 5934) Use of int in max_burst socket option.
[   79.130616][ T5934] Use struct sctp_assoc_value instead
[   79.150928][  T793] usb 2-1: Using ep0 maxpacket: 8
[   79.158529][  T793] usb 2-1: too many configurations: 128, using maximum allowed: 8
[   79.188104][  T793] usb 2-1: unable to read config index 0 descriptor/start: -61
[   79.195735][  T793] usb 2-1: can't read configurations, error -61
[   79.219838][ T5827] nintendo 0003:057E:200E.0001: unknown main item tag 0x0
[   79.230585][  T793] usb usb2-port1: attempt power cycle
[   79.259654][ T5827] nintendo 0003:057E:200E.0001: unknown main item tag 0x0
[   79.266844][ T5827] nintendo 0003:057E:200E.0001: unknown main item tag 0x0
[   79.312482][ T5940] ------------[ cut here ]------------
[   79.318623][ T5940] WARNING: ./include/linux/ns_common.h:311 at nsproxy_ns_active_put+0xa19/0xd30, CPU#0: syz.0.11/5940
[   79.330273][ T5940] Modules linked in:
[   79.334220][ T5940] CPU: 0 UID: 60929 PID: 5940 Comm: syz.0.11 Not tainted syzkaller #0 PREEMPT(full) 
[   79.338271][ T5943] syz.3.10 uses obsolete (PF_INET,SOCK_PACKET)
[   79.344119][ T5940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[   79.360079][ T5940] RIP: 0010:nsproxy_ns_active_put+0xa19/0xd30
[   79.366377][ T5940] Code: 0f 0b 90 e9 71 fc ff ff e8 d4 08 77 ff 90 0f 0b 90 e9 ab fc ff ff e8 c6 08 77 ff 90 0f 0b 90 e9 41 fd ff ff e8 b8 08 77 ff 90 <0f> 0b 90 e9 64 fd ff ff e8 aa 08 77 ff 90 0f 0b 90 e9 98 fd ff ff
[   79.386381][ T5940] RSP: 0018:ffffc90004e57d38 EFLAGS: 00010293
[   79.392553][ T5940] RAX: ffffffff824ac5e8 RBX: ffff88801d2e4888 RCX: ffff888030d70000
[   79.400997][ T5940] RDX: 0000000000000000 RSI: 00000000effffff8 RDI: 00000000effffff8
[   79.410615][ T5940] RBP: 00000000effffff8 R08: ffffffff8e36cbcb R09: 1ffffffff1c6d979
[   79.415911][ T5939] ------------[ cut here ]------------
[   79.419755][ T5940] R10: dffffc0000000000 R11: fffffbfff1c6d97a R12: dffffc0000000000
[   79.424184][ T5939] WARNING: ./include/linux/ns_common.h:288 at alloc_pid+0xad6/0xc70, CPU#1: syz.0.11/5939
[   79.432457][ T5940] R13: 1ffffffff1c6d965 R14: ffffffff8e36cb00 R15: ffffffff8e36cb28
[   79.442149][ T5939] Modules linked in:
[   79.442171][ T5939] CPU: 1 UID: 0 PID: 5939 Comm: syz.0.11 Not tainted syzkaller #0 PREEMPT(full) 
[   79.442190][ T5939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[   79.442202][ T5939] RIP: 0010:alloc_pid+0xad6/0xc70
[   79.442226][ T5939] Code: cc e8 ee d4 34 00 be 02 00 00 00 eb 0a e8 e2 d4 34 00 be 01 00 00 00 48 89 df e8 55 82 0c 03 e9 84 fa ff ff e8 cb d4 34 00 90 <0f> 0b 90 e9 2c fd ff ff e8 bd d4 34 00 90 0f 0b 90 e9 5b fd ff ff
[   79.442241][ T5939] RSP: 0018:ffffc90004e2f938 EFLAGS: 00010293
[   79.442258][ T5939] RAX: ffffffff818cf9d5 RBX: ffff888026d90168 RCX: ffff88802ad48000
[   79.442271][ T5939] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
[   79.442283][ T5939] RBP: ffff888077cd3b01 R08: ffff888026d9016b R09: 1ffff11004db202d
[   79.442296][ T5939] R10: dffffc0000000000 R11: ffffed1004db202e R12: dffffc0000000000
[   79.442310][ T5939] R13: 1ffff1100ef9a781 R14: ffff888026d90000 R15: dffffc0000000000
[   79.442323][ T5939] FS:  0000555564b7d500(0000) GS:ffff888125b7c000(0000) knlGS:0000000000000000
[   79.450490][ T5940] FS:  00007f96cbbf96c0(0000) GS:ffff888125a7c000(0000) knlGS:0000000000000000
[   79.454180][ T5939] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   79.463300][ T5940] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   79.463316][ T5940] CR2: 00007f96cbbd7f98 CR3: 000000003357c000 CR4: 00000000003526f0
[   79.463331][ T5940] Call Trace:
[   79.463351][ T5940]  <TASK>
[   79.473419][ T5939] CR2: 00007f96cbbb7d58 CR3: 000000003357c000 CR4: 00000000003526f0
[   79.478465][ T5940]  free_nsproxy+0x26/0x560
[   79.498979][ T5939] Call Trace:
[   79.504429][ T5940]  __se_sys_setns+0x1268/0x17d0
[   79.513007][ T5939]  <TASK>
[   79.513031][ T5939]  copy_process+0x18e7/0x3930
[   79.513068][ T5939]  ? copy_process+0x915/0x3930
[   79.513096][ T5939]  ? __pfx_copy_process+0x10/0x10
[   79.513130][ T5939]  kernel_clone+0x21e/0x840
[   79.513156][ T5939]  ? __pfx_kernel_clone+0x10/0x10
[   79.513185][ T5939]  ? __lock_acquire+0xab9/0xd20
[   79.513212][ T5939]  __se_sys_clone3+0x256/0x2d0
[   79.513233][ T5939]  ? __might_fault+0xb0/0x130
[   79.513256][ T5939]  ? __pfx___se_sys_clone3+0x10/0x10
[   79.513287][ T5939]  ? _copy_to_user+0x8a/0xb0
[   79.513325][ T5939]  ? do_syscall_64+0xbe/0xfa0
[   79.513351][ T5939]  do_syscall_64+0xfa/0xfa0
[   79.513374][ T5939]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   79.513391][ T5939]  ? clear_bhb_loop+0x60/0xb0
[   79.522040][ T5940]  ? __se_sys_setns+0x565/0x17d0
[   79.529982][ T5939]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   79.537918][ T5940]  ? __pfx___se_sys_setns+0x10/0x10
[   79.545826][ T5939] RIP: 0033:0x7f96cadc3e09
[   79.554782][ T5940]  ? do_syscall_64+0xbe/0xfa0
[   79.554812][ T5940]  do_syscall_64+0xfa/0xfa0
[   79.563755][ T5939] Code: cf 08 00 48 8d 3d dc cf 08 00 e8 e2 28 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7
[   79.570632][ T5940]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   79.570654][ T5940]  ? clear_bhb_loop+0x60/0xb0
[   79.570677][ T5940]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   79.570693][ T5940] RIP: 0033:0x7f96cad8f6c9
[   79.570709][ T5940] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   79.570723][ T5940] RSP: 002b:00007f96cbbf9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000134
[   79.570743][ T5940] RAX: ffffffffffffffda RBX: 00007f96cafe5fa0 RCX: 00007f96cad8f6c9
[   79.570756][ T5940] RDX: 0000000000000000 RSI: 0000000040000000 RDI: 0000000000000004
[   79.570768][ T5940] RBP: 00007f96cae11f91 R08: 0000000000000000 R09: 0000000000000000
[   79.570779][ T5940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   79.570790][ T5940] R13: 00007f96cafe6038 R14: 00007f96cafe5fa0 R15: 00007ffc0ae013e8
[   79.570817][ T5940]  </TASK>
[   79.570848][ T5940] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   79.570858][ T5940] CPU: 0 UID: 60929 PID: 5940 Comm: syz.0.11 Not tainted syzkaller #0 PREEMPT(full) 
[   79.570872][ T5940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[   79.570879][ T5940] Call Trace:
[   79.570885][ T5940]  <TASK>
[   79.570890][ T5940]  dump_stack_lvl+0x99/0x250
[   79.570910][ T5940]  ? __asan_memcpy+0x40/0x70
[   79.570930][ T5940]  ? __pfx_dump_stack_lvl+0x10/0x10
[   79.570949][ T5940]  ? __pfx__printk+0x10/0x10
[   79.570982][ T5940]  vpanic+0x237/0x6d0
[   79.570997][ T5940]  ? __pfx_vpanic+0x10/0x10
[   79.571009][ T5940]  ? is_bpf_text_address+0x26/0x2b0
[   79.571037][ T5940]  panic+0xb9/0xc0
[   79.571051][ T5940]  ? __pfx_panic+0x10/0x10
[   79.571080][ T5940]  __warn+0x334/0x4c0
[   79.571093][ T5940]  ? nsproxy_ns_active_put+0xa19/0xd30
[   79.571116][ T5940]  ? nsproxy_ns_active_put+0xa19/0xd30
[   79.571135][ T5940]  report_bug+0x2be/0x4f0
[   79.571160][ T5940]  ? nsproxy_ns_active_put+0xa19/0xd30
[   79.571180][ T5940]  ? nsproxy_ns_active_put+0xa19/0xd30
[   79.571198][ T5940]  ? nsproxy_ns_active_put+0xa1b/0xd30
[   79.571217][ T5940]  handle_bug+0x84/0x160
[   79.571241][ T5940]  exc_invalid_op+0x1a/0x50
[   79.571262][ T5940]  asm_exc_invalid_op+0x1a/0x20
[   79.571278][ T5940] RIP: 0010:nsproxy_ns_active_put+0xa19/0xd30
[   79.571297][ T5940] Code: 0f 0b 90 e9 71 fc ff ff e8 d4 08 77 ff 90 0f 0b 90 e9 ab fc ff ff e8 c6 08 77 ff 90 0f 0b 90 e9 41 fd ff ff e8 b8 08 77 ff 90 <0f> 0b 90 e9 64 fd ff ff e8 aa 08 77 ff 90 0f 0b 90 e9 98 fd ff ff
[   79.571310][ T5940] RSP: 0018:ffffc90004e57d38 EFLAGS: 00010293
[   79.571325][ T5940] RAX: ffffffff824ac5e8 RBX: ffff88801d2e4888 RCX: ffff888030d70000
[   79.571338][ T5940] RDX: 0000000000000000 RSI: 00000000effffff8 RDI: 00000000effffff8
[   79.571349][ T5940] RBP: 00000000effffff8 R08: ffffffff8e36cbcb R09: 1ffffffff1c6d979
[   79.571360][ T5940] R10: dffffc0000000000 R11: fffffbfff1c6d97a R12: dffffc0000000000
[   79.571373][ T5940] R13: 1ffffffff1c6d965 R14: ffffffff8e36cb00 R15: ffffffff8e36cb28
[   79.571393][ T5940]  ? nsproxy_ns_active_put+0xa18/0xd30
[   79.571418][ T5940]  ? nsproxy_ns_active_put+0xa18/0xd30
[   79.571439][ T5940]  free_nsproxy+0x26/0x560
[   79.571458][ T5940]  __se_sys_setns+0x1268/0x17d0
[   79.571476][ T5940]  ? __se_sys_setns+0x565/0x17d0
[   79.571501][ T5940]  ? __pfx___se_sys_setns+0x10/0x10
[   79.571525][ T5940]  ? do_syscall_64+0xbe/0xfa0
[   79.571547][ T5940]  do_syscall_64+0xfa/0xfa0
[   79.571568][ T5940]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   79.571584][ T5940]  ? clear_bhb_loop+0x60/0xb0
[   79.571604][ T5940]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   79.571620][ T5940] RIP: 0033:0x7f96cad8f6c9
[   79.571633][ T5940] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   79.571646][ T5940] RSP: 002b:00007f96cbbf9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000134
[   79.571662][ T5940] RAX: ffffffffffffffda RBX: 00007f96cafe5fa0 RCX: 00007f96cad8f6c9
[   79.571674][ T5940] RDX: 0000000000000000 RSI: 0000000040000000 RDI: 0000000000000004
[   79.571684][ T5940] RBP: 00007f96cae11f91 R08: 0000000000000000 R09: 0000000000000000
[   79.571695][ T5940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   79.571705][ T5940] R13: 00007f96cafe6038 R14: 00007f96cafe5fa0 R15: 00007ffc0ae013e8
[   79.571736][ T5940]  </TASK>
[   79.577840][ T5940] Kernel Offset: disabled