Debian GNU/Linux 11 syzkaller ttyS0 Warning: Permanently added '[localhost]:59309' (ECDSA) to the list of known hosts. 2022/10/03 23:18:01 fuzzer started 2022/10/03 23:18:02 dialing manager at localhost:35095 syzkaller login: [ 36.232945] cgroup: Unknown subsys name 'net' [ 36.325744] cgroup: Unknown subsys name 'rlimit' 2022/10/03 23:18:16 syscalls: 205 2022/10/03 23:18:16 code coverage: enabled 2022/10/03 23:18:16 comparison tracing: enabled 2022/10/03 23:18:16 extra coverage: enabled 2022/10/03 23:18:16 setuid sandbox: enabled 2022/10/03 23:18:16 namespace sandbox: enabled 2022/10/03 23:18:16 Android sandbox: enabled 2022/10/03 23:18:16 fault injection: enabled 2022/10/03 23:18:16 leak checking: enabled 2022/10/03 23:18:16 net packet injection: enabled 2022/10/03 23:18:16 net device setup: enabled 2022/10/03 23:18:16 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/10/03 23:18:16 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/10/03 23:18:16 USB emulation: enabled 2022/10/03 23:18:16 hci packet injection: enabled 2022/10/03 23:18:16 wifi device emulation: failed to parse kernel version (6.0.0-rc7-next-20220930) 2022/10/03 23:18:16 802.15.4 emulation: enabled 2022/10/03 23:18:16 fetching corpus: 0, signal 0/0 (executing program) 2022/10/03 23:18:17 starting 8 fuzzer processes 23:18:17 executing program 0: clone3(&(0x7f00000004c0)={0x300810480, &(0x7f0000000200)=0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x41}, &(0x7f00000002c0)=""/235, 0xeb, &(0x7f00000003c0)=""/180, &(0x7f0000000480)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) clone3(&(0x7f0000000580)={0x12000000, &(0x7f0000000000)=0xffffffffffffffff, &(0x7f0000000040)=0x0, &(0x7f0000000080), {0x25}, &(0x7f00000000c0)=""/183, 0xb7, &(0x7f0000000180)=""/92, &(0x7f0000000540)=[0x0, 0x0, r1, 0x0], 0x4}, 0x58) newfstatat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', &(0x7f0000000640), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000700)=@IORING_OP_LINK_TIMEOUT={0xf, 0x3, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x77359400}, 0x1, 0xbfb693e9515bd81}, 0x1) r4 = pidfd_getfd(r0, r2, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x34, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x80000001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x401}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x60, 0x0, 0x20, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xef}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x200400c5}, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x54, 0x0, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xfe}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000c0) prctl$PR_SET_ENDIAN(0x14, 0x3) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f0000000bc0)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b00)={0x44, 0x0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x80c0}, 0x200c0080) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000c00)=[@window={0x3, 0xfffd, 0x9}, @mss={0x2, 0x5}, @window={0x3, 0x8, 0x8}, @sack_perm, @window={0x3, 0xff, 0x3}], 0x5) pipe2$9p(&(0x7f0000000c40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$P9_RFLUSH(r6, &(0x7f0000000c80)={0x7, 0x6d, 0x1}, 0x7) syz_genetlink_get_family_id$team(&(0x7f0000000cc0), r4) write$P9_RLOPEN(r4, &(0x7f0000000d00)={0x18, 0xd, 0x1, {{0x0, 0x0, 0x3}, 0x7}}, 0x18) sched_getattr(r3, &(0x7f0000000d40)={0x38}, 0x38, 0x0) write$P9_RFLUSH(r6, &(0x7f0000000d80)={0x7, 0x6d, 0x2}, 0x7) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000dc0)='cpu.weight\x00', 0x2, 0x0) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000e00)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) 23:18:18 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup(r0, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r0, &(0x7f0000000080), 0x2, 0x0) r2 = clone3(&(0x7f0000000540)={0x100, &(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000380), {0x1c}, &(0x7f00000003c0)=""/197, 0xc5, &(0x7f00000004c0)=""/34, &(0x7f0000000500)=[0x0, 0xffffffffffffffff], 0x2, {r0}}, 0x58) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000600), 0x200000, 0x0) clone3(&(0x7f0000000640)={0x2a040000, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140), {0x2d}, &(0x7f0000000180)=""/201, 0xc9, &(0x7f0000000280)=""/83, &(0x7f00000005c0)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff, r2, 0x0, 0x0, 0x0], 0x7, {r4}}, 0x58) r5 = openat$cgroup(r4, &(0x7f00000006c0)='syz1\x00', 0x200002, 0x0) openat$cgroup_type(r5, &(0x7f0000000700), 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000740)='memory.events.local\x00', 0x0, 0x0) ioctl$MON_IOCQ_RING_SIZE(r6, 0x9205) semctl$IPC_RMID(0x0, 0x0, 0x0) openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000000780), 0x2, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f00000007c0)='blkio.bfq.sectors\x00', 0x0, 0x0) ioctl$TUNGETDEVNETNS(r7, 0x54e3, 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r8, &(0x7f0000000840)='cgroup.kill\x00', 0x0, 0x0) r9 = syz_open_procfs(r3, &(0x7f0000000880)='net/psched\x00') openat$cgroup_freezer_state(r9, &(0x7f00000008c0), 0x2, 0x0) r10 = openat$cgroup(r1, &(0x7f0000000900)='syz1\x00', 0x200002, 0x0) mkdirat$cgroup(r10, &(0x7f0000000940)='syz1\x00', 0x1ff) 23:18:18 executing program 3: setns(0xffffffffffffffff, 0x20000000) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x300, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x7f}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008004}, 0x4044000) syz_genetlink_get_family_id$team(&(0x7f0000000200), r0) sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x48, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x77f}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x26a}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="26c96527eda8"}]}, 0x48}, 0x1, 0x0, 0x0, 0x40801}, 0x200080c0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000380)) r1 = ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) ioctl$NS_GET_NSTYPE(r1, 0xb703, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000480)=@buf={0x8e, &(0x7f00000003c0)="71e2339c93713094f951f760f1dac830c35e36dbc61b6ecd9f63dc66a00530f0d45aa7f1851391a8a1c99fff2906ab3f0cd489b9275919af1366f13eaa24e9a8f5e035a778b3d32ee72a6a9524044b6800f857bfc4105b28035a9e231b460c57061a8d9222169f9fb9ff7c3cbe8d90a16b0c1afa423d0a31a554793358c662f98f2dcd416959a57cafbb6b63c2b5"}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x8f7) r3 = socket(0x41ccac42a877bfcb, 0x80000, 0x80000000) syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), r3) ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='numa_maps\x00') r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), r3) sendmsg$BATADV_CMD_SET_MESH(r4, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r5, 0x200, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000001) r6 = pidfd_getfd(r4, r2, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r6, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x2c, r5, 0x97644e9bd3717bcc, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x10001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000884}, 0x48004) 23:18:18 executing program 2: r0 = socket(0x15, 0x6, 0x5) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x201}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x20000800) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) getpeername$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r0, &(0x7f0000000280)={&(0x7f0000000100), 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1f}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb471}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x8000) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f00000002c0), 0x612023, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000340), r0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0xd4, r4, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r2}, {0xb8, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1000}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r2}}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4000084}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000500)=@IORING_OP_FSYNC={0x3, 0x1, 0x0, @fd_index=0x1}, 0x7dd) ioctl$sock_SIOCADDRT(r3, 0x890b, &(0x7f0000000580)={0x0, @hci={0x1f, 0x4, 0x1}, @vsock={0x28, 0x0, 0x2710, @local}, @rc={0x1f, @any, 0x7}, 0x9, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000540)='wg2\x00', 0x0, 0x8}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f00000006c0)={'syztnl2\x00', &(0x7f0000000640)={'syztnl2\x00', r2, 0xf183990f3e8cdb0c, 0x3, 0x7, 0x3, 0x0, @dev={0xfe, 0x80, '\x00', 0x3e}, @mcast1, 0xe07, 0x80, 0x2c, 0x9}}) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000007c0)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000900)={'ip6tnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x29, 0x0, 0x6a, 0x3, 0x1, @dev={0xfe, 0x80, '\x00', 0x14}, @rand_addr=' \x01\x00', 0x80, 0x7, 0x1, 0x7}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000a00)={'batadv0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r3, &(0x7f00000011c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001180)={&(0x7f0000000a40)={0x71c, r4, 0x400, 0x70bd2c, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x104, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r2}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r5}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}]}}, {{0x8, 0x1, r2}, {0xf4, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3ff}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x1d8, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1f}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r2}, {0xc4, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2d}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r2}, {0x74, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2000000}}}]}}, {{0x8, 0x1, r2}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x6, 0x3, 0xff, 0x7fffffff}]}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}, {{0x8, 0x1, r2}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}]}, 0x71c}, 0x1, 0x0, 0x0, 0x4010}, 0x4000) syz_io_uring_setup(0x3d8b, &(0x7f0000001200)={0x0, 0x87c9, 0x2, 0x0, 0x16b, 0x0, r3}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000001280)=0x0, &(0x7f00000012c0)) syz_io_uring_submit(r9, 0x0, &(0x7f0000001300)=@IORING_OP_NOP={0x0, 0x5}, 0x80000000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001380)={'batadv0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000001600)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000015c0)={&(0x7f00000013c0)={0x1cc, r4, 0x800, 0x70bd25, 0x25dfdbfb, {}, [{{0x8, 0x1, r6}, {0x1b0, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffe}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xba15}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x400}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x20000014}, 0x40000004) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)={0x1c, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x80) 23:18:18 executing program 4: r0 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x80, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x80, 0x7f, 0x1, 0x7, 0x0, 0x0, 0x100000001, 0x20044, 0xa, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1ff, 0x0, @perf_bp={&(0x7f0000000000), 0x276f81b53b9c5599}, 0x5, 0x4, 0x9, 0x8, 0xffffffff, 0x3, 0x3, 0x0, 0x200, 0x0, 0x7fff}, 0xffffffffffffffff, 0x5, r0, 0xb) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000100), 0x2, 0x0) clone3(&(0x7f0000000480)={0x80000, &(0x7f0000000200), &(0x7f0000000240)=0x0, &(0x7f0000000280), {0x29}, &(0x7f00000002c0)=""/162, 0xa2, &(0x7f0000000380)=""/139, &(0x7f0000000440)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8, {r0}}, 0x58) r2 = perf_event_open(&(0x7f0000000180)={0x4, 0x80, 0x2, 0x6, 0x1, 0xff, 0x0, 0x2, 0x60200, 0x8, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000140), 0x5}, 0x0, 0xb7c, 0x200, 0x8, 0x7, 0x101, 0x8, 0x0, 0x4, 0x0, 0x80000000}, r1, 0x2, 0xffffffffffffffff, 0x8) socketpair(0x27, 0x800, 0x2, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000600)=@IORING_OP_WRITE={0x17, 0x2, 0x2000, @fd=r2, 0x401, &(0x7f0000000540)="3ef24cd70542ac8bc019b5d135682672d74b9dbbf543bc5e51397b09dadec9513366d6168fd6bbe73268013f34c2a1f7f63a7016bec9d6a86fc99e336dbfff7dc9f14ee9c690bb9aa8f4f564b6bcefa5c0d53562f22d69e13440dcae625ab21362e12ca2f5c711b76b330aa26d275c8a96f9bfe1b88e31fba11c94582e0e6d4a00ac6b589db062229a6e6fdd2375f669ed9a4a245e9d51bb84654c2e9059ea73f462e7ef655a00", 0xa7, 0x8, 0x6c0a4bb62b4bef20}, 0x4) mkdirat$cgroup(r0, &(0x7f0000000640)='syz0\x00', 0x1ff) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000006c0), r3) sendmsg$BATADV_CMD_TP_METER_CANCEL(r4, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x14, r5, 0x200, 0x70bd2c, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x2400c8c4) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x40}]}, 0x24}, 0x1, 0x0, 0x0, 0x40040}, 0x4008015) r6 = syz_open_procfs$userns(r1, &(0x7f00000008c0)) setns(r6, 0x8000000) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$team(&(0x7f0000000940), r0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000a00)={'syztnl2\x00', &(0x7f0000000980)={'syztnl2\x00', 0x0, 0x25, 0x20, 0x3f, 0x4, 0x7a, @remote, @private1, 0x8, 0x700, 0xffffffff, 0x9}}) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000b80)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000b40)={&(0x7f0000000a40)={0xec, r8, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [{{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}]}}, {{0x8, 0x1, r9}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}, {0x8}}}]}}]}, 0xec}, 0x1, 0x0, 0x0, 0x4000}, 0x88c1) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x44, 0x0, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_RINGS_RX={0x8, 0x6, 0xffffffff}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x10001}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x10001}, @ETHTOOL_A_RINGS_RX={0x8}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0xffffffe0}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0xe4c9}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x44080) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000d00)=0x100, 0x4) sendmsg$BATADV_CMD_GET_HARDIF(r4, &(0x7f0000000e00)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d80)={0x24, r5, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x92}, 0x40801) [ 51.631570] audit: type=1400 audit(1664839098.050:6): avc: denied { execmem } for pid=284 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 23:18:18 executing program 5: process_mrelease(0xffffffffffffffff, 0x0) r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/ipc\x00') ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f0000000040)) socketpair(0x1f, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r3, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_LINK={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x880}, 0x20000010) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), r1) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r4, 0x8, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7a}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x4000000) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'batadv_slave_1\x00'}) pkey_free(0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_COALESCE_TX_MAX_FRAMES_IRQ={0x8, 0x9, 0x7fffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000080}, 0x5) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000004c0)={'wg2\x00', 0x0}) getpeername$packet(r2, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000005c0)=0x14) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000e40)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000e00)={&(0x7f0000000600)={0x7ec, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x7}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e24}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r6}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x9}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e21}, @WGDEVICE_A_PEERS={0x7a0, 0x8, 0x0, 0x1, [{0x184, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x6}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}, 0xff}}, @WGPEER_A_ALLOWEDIPS={0x158, 0x9, 0x0, 0x1, [{0x154, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x22}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x3b}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5}}]}]}]}, {0x538, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x4}, @WGPEER_A_ALLOWEDIPS={0x1c0, 0x9, 0x0, 0x1, [{0xa0, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010100}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x1}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010102}, {0x5, 0x3, 0x2}}]}, {0x88, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00'}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5, 0x3, 0x2}}]}]}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x7}, @WGPEER_A_ALLOWEDIPS={0x364, 0x9, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x3}}]}, {0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0xa}}, {0x5, 0x3, 0x1}}]}, {0xe8, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0xa}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x5, 0x3, 0x2}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x2}}]}, {0xf4, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x31}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010100}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @local}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x13}}, {0x5}}]}, {0x88, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x1c}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x3}}]}]}]}, {0x4c, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e23, 0x5, @mcast2, 0x69c2}}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x8, @private1={0xfc, 0x1, '\x00', 0x1}, 0x5}}]}, {0x6c, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x3c, @mcast2, 0x3ff}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e24, @multicast2}}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "790619c6e19546078ee2ec3d14ee3d7b841a1c6de3296d39c1bedf35ac7e2359"}]}]}]}, 0x7ec}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$NS_GET_USERNS(r0, 0xb701, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000e80), r2) process_mrelease(0xffffffffffffffff, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_NEWPDP(r7, &(0x7f0000001080)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001040)={&(0x7f0000001000)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x40021) 23:18:18 executing program 6: newfstatat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x100) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x1000) r0 = semget$private(0x0, 0x2, 0x1) semctl$IPC_RMID(r0, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f0000000180)=@qipcrtr, &(0x7f0000000200)=0x80) semctl$SEM_STAT(r0, 0x3, 0x12, &(0x7f0000000240)=""/102) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), 0xffffffffffffffff) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000380)=0x14) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, r1, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x80}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfffffff8}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004844}, 0x800) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_SET_HARDIF(r3, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x50, r1, 0x420, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}, @BATADV_ATTR_HOP_PENALTY={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9f11}]}, 0x50}, 0x1, 0x0, 0x0, 0x2004c001}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000600)={'wlan0\x00'}) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x1c, r1, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x20000000) semctl$IPC_INFO(0x0, 0x4, 0x3, &(0x7f0000000740)=""/131) newfstatat(0xffffffffffffff9c, &(0x7f0000000800)='./file0\x00', &(0x7f0000000840), 0x100) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_TP_METER_CANCEL(r4, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x68, r1, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x3}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7f}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x48080) getpeername(r3, &(0x7f0000000a00)=@nfc_llcp, &(0x7f0000000a80)=0x80) sendmsg$BATADV_CMD_TP_METER_CANCEL(r4, &(0x7f0000000cc0)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x50001010}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x68, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x841}, 0x4008001) 23:18:18 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f00000008c0)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000900), 0xffffffffffffffff) getpeername(0xffffffffffffffff, &(0x7f0000000940)=@pppoe, &(0x7f00000009c0)=0x80) socketpair(0x26, 0x800, 0x9, &(0x7f0000000a00)={0xffffffffffffffff}) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000a80), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x40, r8, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x1) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) [ 52.881019] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 52.882634] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 52.885993] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 52.887026] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 52.888418] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 52.889611] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 52.895171] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 52.896240] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 52.898337] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 52.899469] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 52.900867] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 52.902376] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 52.909452] Bluetooth: hci0: HCI_REQ-0x0c1a [ 52.910803] Bluetooth: hci1: HCI_REQ-0x0c1a [ 52.948375] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 52.958075] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 52.960009] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 52.962935] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 52.964932] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 52.966141] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 52.972842] Bluetooth: hci2: HCI_REQ-0x0c1a [ 53.002347] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 53.004762] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 53.008173] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 53.014068] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 53.015803] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 53.017569] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 53.022348] Bluetooth: hci4: HCI_REQ-0x0c1a [ 53.063197] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 53.065140] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 53.077638] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 53.079202] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 53.084855] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 53.086027] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 53.093920] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 53.094956] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 53.096532] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 53.097823] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 53.099198] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 53.100532] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 53.105413] Bluetooth: hci7: HCI_REQ-0x0c1a [ 53.152736] Bluetooth: hci6: HCI_REQ-0x0c1a [ 53.196959] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 53.211040] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 53.212472] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 53.228994] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 53.235943] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 53.240592] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 53.269774] Bluetooth: hci5: HCI_REQ-0x0c1a [ 54.960094] Bluetooth: hci3: Opcode 0x c03 failed: -110 [ 54.960123] Bluetooth: hci0: command 0x0409 tx timeout [ 54.962038] Bluetooth: hci1: command 0x0409 tx timeout [ 55.023783] Bluetooth: hci2: command 0x0409 tx timeout [ 55.089067] Bluetooth: hci4: command 0x0409 tx timeout [ 55.152759] Bluetooth: hci7: command 0x0409 tx timeout [ 55.216805] Bluetooth: hci6: command 0x0409 tx timeout [ 55.343779] Bluetooth: hci5: command 0x0409 tx timeout [ 57.007836] Bluetooth: hci0: command 0x041b tx timeout [ 57.008713] Bluetooth: hci1: command 0x041b tx timeout [ 57.071874] Bluetooth: hci2: command 0x041b tx timeout [ 57.135735] Bluetooth: hci4: command 0x041b tx timeout [ 57.200062] Bluetooth: hci7: command 0x041b tx timeout [ 57.264099] Bluetooth: hci6: command 0x041b tx timeout [ 57.391818] Bluetooth: hci5: command 0x041b tx timeout [ 58.545335] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 58.559074] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 58.560643] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 58.567567] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 58.589030] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 58.590404] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 58.616162] Bluetooth: hci3: HCI_REQ-0x0c1a [ 59.055828] Bluetooth: hci1: command 0x040f tx timeout [ 59.056749] Bluetooth: hci0: command 0x040f tx timeout [ 59.119738] Bluetooth: hci2: command 0x040f tx timeout [ 59.183851] Bluetooth: hci4: command 0x040f tx timeout [ 59.247761] Bluetooth: hci7: command 0x040f tx timeout [ 59.311772] Bluetooth: hci6: command 0x040f tx timeout [ 59.439823] Bluetooth: hci5: command 0x040f tx timeout [ 60.655819] Bluetooth: hci3: command 0x0409 tx timeout [ 61.104814] Bluetooth: hci0: command 0x0419 tx timeout [ 61.105276] Bluetooth: hci1: command 0x0419 tx timeout [ 61.167725] Bluetooth: hci2: command 0x0419 tx timeout [ 61.231724] Bluetooth: hci4: command 0x0419 tx timeout [ 61.295708] Bluetooth: hci7: command 0x0419 tx timeout [ 61.359715] Bluetooth: hci6: command 0x0419 tx timeout [ 61.487756] Bluetooth: hci5: command 0x0419 tx timeout [ 62.704213] Bluetooth: hci3: command 0x041b tx timeout [ 64.752726] Bluetooth: hci3: command 0x040f tx timeout [ 66.799702] Bluetooth: hci3: command 0x0419 tx timeout 23:19:20 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f00000008c0)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000900), 0xffffffffffffffff) getpeername(0xffffffffffffffff, &(0x7f0000000940)=@pppoe, &(0x7f00000009c0)=0x80) socketpair(0x26, 0x800, 0x9, &(0x7f0000000a00)={0xffffffffffffffff}) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000a80), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x40, r8, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x1) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) [ 114.642529] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 114.646710] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 114.649058] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 114.655171] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 114.656985] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 114.658332] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 114.661314] Bluetooth: hci1: HCI_REQ-0x0c1a 23:19:21 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f00000008c0)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000900), 0xffffffffffffffff) getpeername(0xffffffffffffffff, &(0x7f0000000940)=@pppoe, &(0x7f00000009c0)=0x80) socketpair(0x26, 0x800, 0x9, &(0x7f0000000a00)={0xffffffffffffffff}) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000a80), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x40, r8, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x1) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) [ 114.809013] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 114.810950] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 114.812356] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 114.815257] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 114.817129] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 114.818462] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 114.824008] Bluetooth: hci2: HCI_REQ-0x0c1a [ 114.937246] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 114.944417] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 114.946916] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 114.952609] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 114.956082] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 114.958028] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 115.018213] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 115.019478] Bluetooth: hci5: HCI_REQ-0x0c1a [ 115.021487] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 115.033768] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 115.038046] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 115.041450] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 115.042779] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 115.049218] Bluetooth: hci4: HCI_REQ-0x0c1a 23:19:21 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f00000008c0)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000900), 0xffffffffffffffff) getpeername(0xffffffffffffffff, &(0x7f0000000940)=@pppoe, &(0x7f00000009c0)=0x80) socketpair(0x26, 0x800, 0x9, &(0x7f0000000a00)={0xffffffffffffffff}) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000a80), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x40, r8, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x1) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) 23:19:22 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f00000008c0)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000900), 0xffffffffffffffff) getpeername(0xffffffffffffffff, &(0x7f0000000940)=@pppoe, &(0x7f00000009c0)=0x80) socketpair(0x26, 0x800, 0x9, &(0x7f0000000a00)) syz_genetlink_get_family_id$batadv(&(0x7f0000000a80), 0xffffffffffffffff) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) 23:19:22 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f00000008c0)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000900), 0xffffffffffffffff) getpeername(0xffffffffffffffff, &(0x7f0000000940)=@pppoe, &(0x7f00000009c0)=0x80) socketpair(0x26, 0x800, 0x9, &(0x7f0000000a00)) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) [ 116.399735] Bluetooth: hci0: Opcode 0x c03 failed: -110 23:19:22 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f00000008c0)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000900), 0xffffffffffffffff) getpeername(0xffffffffffffffff, &(0x7f0000000940)=@pppoe, &(0x7f00000009c0)=0x80) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) 23:19:23 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f00000008c0)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000900), 0xffffffffffffffff) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) [ 116.719781] Bluetooth: hci1: command 0x0409 tx timeout [ 116.847857] Bluetooth: hci2: command 0x0409 tx timeout 23:19:23 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f00000008c0)) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) [ 116.911821] Bluetooth: hci7: Opcode 0x c03 failed: -110 [ 116.913264] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 117.039937] Bluetooth: hci5: command 0x0409 tx timeout [ 117.103779] Bluetooth: hci4: command 0x0409 tx timeout [ 118.768738] Bluetooth: hci1: command 0x041b tx timeout [ 118.782094] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 118.787301] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 118.791427] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 118.806967] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 118.810952] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 118.813728] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 118.823367] Bluetooth: hci0: HCI_REQ-0x0c1a [ 118.896745] Bluetooth: hci2: command 0x041b tx timeout [ 119.087757] Bluetooth: hci5: command 0x041b tx timeout [ 119.151765] Bluetooth: hci4: command 0x041b tx timeout [ 119.553293] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 119.559016] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 119.562267] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 119.574060] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 119.582030] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 119.584161] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 119.594928] Bluetooth: hci7: HCI_REQ-0x0c1a [ 120.815730] Bluetooth: hci1: command 0x040f tx timeout [ 120.879734] Bluetooth: hci0: command 0x0409 tx timeout [ 120.943713] Bluetooth: hci2: command 0x040f tx timeout [ 121.135711] Bluetooth: hci5: command 0x040f tx timeout [ 121.199782] Bluetooth: hci4: command 0x040f tx timeout [ 121.519745] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 121.647783] Bluetooth: hci7: command 0x0409 tx timeout [ 122.864201] Bluetooth: hci1: command 0x0419 tx timeout [ 122.927767] Bluetooth: hci0: command 0x041b tx timeout [ 122.992183] Bluetooth: hci2: command 0x0419 tx timeout [ 123.183770] Bluetooth: hci5: command 0x0419 tx timeout [ 123.247747] Bluetooth: hci4: command 0x0419 tx timeout [ 123.695850] Bluetooth: hci7: command 0x041b tx timeout [ 124.976709] Bluetooth: hci0: command 0x040f tx timeout [ 125.743742] Bluetooth: hci7: command 0x040f tx timeout [ 126.191795] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 127.024721] Bluetooth: hci0: command 0x0419 tx timeout [ 127.792703] Bluetooth: hci7: command 0x0419 tx timeout [ 128.756499] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 128.758693] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 128.763133] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 128.765408] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 128.766489] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 128.767623] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 128.795765] Bluetooth: hci6: HCI_REQ-0x0c1a [ 130.863937] Bluetooth: hci6: command 0x0409 tx timeout [ 132.911830] Bluetooth: hci6: command 0x041b tx timeout [ 134.959834] Bluetooth: hci6: command 0x040f tx timeout [ 137.007741] Bluetooth: hci6: command 0x0419 tx timeout [ 168.041016] audit: type=1400 audit(1664839214.460:7): avc: denied { open } for pid=6911 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 168.042542] audit: type=1400 audit(1664839214.460:8): avc: denied { kernel } for pid=6911 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 179.119746] INFO: task rcu_gp:3 blocked for more than 142 seconds. [ 179.120838] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.121567] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.122800] task:rcu_gp state:I stack:30328 pid:3 ppid:2 flags:0x00004000 [ 179.124749] Call Trace: [ 179.125113] [ 179.125448] __schedule+0x893/0x2470 [ 179.126064] ? io_schedule_timeout+0x150/0x150 [ 179.126735] ? do_raw_spin_lock+0x121/0x260 [ 179.127351] ? rwlock_bug.part.0+0x90/0x90 [ 179.127995] schedule+0xda/0x1b0 [ 179.128487] rescuer_thread+0x851/0xdb0 [ 179.129116] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.129898] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.130609] ? lockdep_hardirqs_on+0x79/0x100 [ 179.131300] ? worker_thread+0x1260/0x1260 [ 179.131945] kthread+0x2ed/0x3a0 [ 179.132472] ? kthread_complete_and_exit+0x40/0x40 [ 179.133196] ret_from_fork+0x22/0x30 [ 179.133790] [ 179.134123] INFO: task rcu_par_gp:4 blocked for more than 142 seconds. [ 179.135053] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.135838] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.136944] task:rcu_par_gp state:I stack:30944 pid:4 ppid:2 flags:0x00004000 [ 179.138167] Call Trace: [ 179.138531] [ 179.138901] __schedule+0x893/0x2470 [ 179.139449] ? io_schedule_timeout+0x150/0x150 [ 179.140126] ? do_raw_spin_lock+0x121/0x260 [ 179.140780] ? rwlock_bug.part.0+0x90/0x90 [ 179.141401] schedule+0xda/0x1b0 [ 179.141945] rescuer_thread+0x851/0xdb0 [ 179.142524] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.143274] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.144029] ? lockdep_hardirqs_on+0x79/0x100 [ 179.144701] ? worker_thread+0x1260/0x1260 [ 179.145319] kthread+0x2ed/0x3a0 [ 179.145891] ? kthread_complete_and_exit+0x40/0x40 [ 179.146627] ret_from_fork+0x22/0x30 [ 179.147217] [ 179.147552] INFO: task slub_flushwq:5 blocked for more than 142 seconds. [ 179.148511] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.149267] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.150379] task:slub_flushwq state:I stack:30944 pid:5 ppid:2 flags:0x00004000 [ 179.151555] Call Trace: [ 179.151953] [ 179.152285] __schedule+0x893/0x2470 [ 179.152870] ? io_schedule_timeout+0x150/0x150 [ 179.153539] ? do_raw_spin_lock+0x121/0x260 [ 179.154187] ? rwlock_bug.part.0+0x90/0x90 [ 179.154849] schedule+0xda/0x1b0 [ 179.155344] rescuer_thread+0x851/0xdb0 [ 179.155956] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.156695] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.157389] ? lockdep_hardirqs_on+0x79/0x100 [ 179.158085] ? worker_thread+0x1260/0x1260 [ 179.158726] kthread+0x2ed/0x3a0 [ 179.159216] ? kthread_complete_and_exit+0x40/0x40 [ 179.159942] ret_from_fork+0x22/0x30 [ 179.160493] [ 179.160861] INFO: task netns:6 blocked for more than 142 seconds. [ 179.161772] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.162511] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.163582] task:netns state:I stack:30944 pid:6 ppid:2 flags:0x00004000 [ 179.164768] Call Trace: [ 179.165134] [ 179.165466] __schedule+0x893/0x2470 [ 179.166065] ? io_schedule_timeout+0x150/0x150 [ 179.166757] ? do_raw_spin_lock+0x121/0x260 [ 179.167389] ? rwlock_bug.part.0+0x90/0x90 [ 179.168033] schedule+0xda/0x1b0 [ 179.168530] rescuer_thread+0x851/0xdb0 [ 179.169146] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.169910] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.170614] ? lockdep_hardirqs_on+0x79/0x100 [ 179.171330] ? worker_thread+0x1260/0x1260 [ 179.171982] kthread+0x2ed/0x3a0 [ 179.172475] ? kthread_complete_and_exit+0x40/0x40 [ 179.173215] ret_from_fork+0x22/0x30 [ 179.173849] [ 179.174198] INFO: task kworker/0:0H:8 blocked for more than 142 seconds. [ 179.175142] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.175911] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.176980] task:kworker/0:0H state:I stack:29760 pid:8 ppid:2 flags:0x00004000 [ 179.178185] Workqueue: 0x0 (events_highpri) [ 179.178851] Call Trace: [ 179.179227] [ 179.179555] __schedule+0x893/0x2470 [ 179.180140] ? io_schedule_timeout+0x150/0x150 [ 179.180865] schedule+0xda/0x1b0 [ 179.181381] worker_thread+0x15f/0x1260 [ 179.182068] ? process_one_work+0x16a0/0x16a0 [ 179.182763] kthread+0x2ed/0x3a0 [ 179.183247] ? kthread_complete_and_exit+0x40/0x40 [ 179.183986] ret_from_fork+0x22/0x30 [ 179.184542] [ 179.184913] INFO: task mm_percpu_wq:10 blocked for more than 143 seconds. [ 179.185886] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.186619] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.187693] task:mm_percpu_wq state:I stack:30944 pid:10 ppid:2 flags:0x00004000 [ 179.188826] Call Trace: [ 179.189177] [ 179.189510] __schedule+0x893/0x2470 [ 179.190078] ? io_schedule_timeout+0x150/0x150 [ 179.190733] ? do_raw_spin_lock+0x121/0x260 [ 179.191322] ? rwlock_bug.part.0+0x90/0x90 [ 179.191991] schedule+0xda/0x1b0 [ 179.192467] rescuer_thread+0x851/0xdb0 [ 179.193053] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.193773] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.194450] ? lockdep_hardirqs_on+0x79/0x100 [ 179.195098] ? worker_thread+0x1260/0x1260 [ 179.195718] kthread+0x2ed/0x3a0 [ 179.196192] ? kthread_complete_and_exit+0x40/0x40 [ 179.196903] ret_from_fork+0x22/0x30 [ 179.197453] [ 179.197839] INFO: task rcu_tasks_kthre:11 blocked for more than 143 seconds. [ 179.198792] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.199502] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.200550] task:rcu_tasks_kthre state:I stack:29272 pid:11 ppid:2 flags:0x00004000 [ 179.201708] Call Trace: [ 179.202069] [ 179.202391] __schedule+0x893/0x2470 [ 179.202966] ? io_schedule_timeout+0x150/0x150 [ 179.203607] ? mark_held_locks+0x9e/0xe0 [ 179.204216] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.204951] schedule+0xda/0x1b0 [ 179.205436] rcu_tasks_one_gp+0x3db/0xc10 [ 179.206107] rcu_tasks_kthread+0x80/0xa0 [ 179.206714] ? rcu_tasks_postscan+0x10/0x10 [ 179.207307] kthread+0x2ed/0x3a0 [ 179.207821] ? kthread_complete_and_exit+0x40/0x40 [ 179.208502] ret_from_fork+0x22/0x30 [ 179.209083] [ 179.209419] INFO: task kworker/1:0H:21 blocked for more than 143 seconds. [ 179.210376] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.211204] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.212288] task:kworker/1:0H state:I stack:29760 pid:21 ppid:2 flags:0x00004000 [ 179.213449] Workqueue: 0x0 (events_highpri) [ 179.214130] Call Trace: [ 179.214484] [ 179.214845] __schedule+0x893/0x2470 [ 179.215377] ? io_schedule_timeout+0x150/0x150 [ 179.216063] schedule+0xda/0x1b0 [ 179.216545] worker_thread+0x15f/0x1260 [ 179.217159] ? process_one_work+0x16a0/0x16a0 [ 179.217842] kthread+0x2ed/0x3a0 [ 179.218318] ? kthread_complete_and_exit+0x40/0x40 [ 179.219026] ret_from_fork+0x22/0x30 [ 179.219575] [ 179.219938] INFO: task inet_frag_wq:23 blocked for more than 143 seconds. [ 179.220879] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.221597] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.222636] task:inet_frag_wq state:I stack:30704 pid:23 ppid:2 flags:0x00004000 [ 179.223802] Call Trace: [ 179.224161] [ 179.224482] __schedule+0x893/0x2470 [ 179.225056] ? io_schedule_timeout+0x150/0x150 [ 179.225734] ? do_raw_spin_lock+0x121/0x260 [ 179.226334] ? rwlock_bug.part.0+0x90/0x90 [ 179.226964] schedule+0xda/0x1b0 [ 179.227449] rescuer_thread+0x851/0xdb0 [ 179.228050] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.228775] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.229462] ? lockdep_hardirqs_on+0x79/0x100 [ 179.230128] ? worker_thread+0x1260/0x1260 [ 179.230768] kthread+0x2ed/0x3a0 [ 179.231246] ? kthread_complete_and_exit+0x40/0x40 [ 179.231960] ret_from_fork+0x22/0x30 [ 179.232505] [ 179.232931] INFO: task writeback:28 blocked for more than 143 seconds. [ 179.233877] Not tainted 6.0.0-rc7-next-20220930 #1 [ 179.234588] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.235672] task:writeback state:I stack:30176 pid:28 ppid:2 flags:0x00004000 [ 179.236829] Call Trace: [ 179.237203] [ 179.237533] __schedule+0x893/0x2470 [ 179.238113] ? io_schedule_timeout+0x150/0x150 [ 179.238779] ? do_raw_spin_lock+0x121/0x260 [ 179.239376] ? rwlock_bug.part.0+0x90/0x90 [ 179.240023] schedule+0xda/0x1b0 [ 179.240507] rescuer_thread+0x851/0xdb0 [ 179.241108] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.241857] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.242539] ? lockdep_hardirqs_on+0x79/0x100 [ 179.243202] ? worker_thread+0x1260/0x1260 [ 179.243836] kthread+0x2ed/0x3a0 [ 179.244317] ? kthread_complete_and_exit+0x40/0x40 [ 179.245039] ret_from_fork+0x22/0x30 [ 179.245587] [ 179.246007] [ 179.246007] Showing all locks held in the system: [ 179.246864] 1 lock held by rcu_tasks_kthre/11: [ 179.247472] #0: ffffffff85406850 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc10 [ 179.248829] 1 lock held by khungtaskd/25: [ 179.249388] #0: ffffffff85407320 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 [ 179.250756] 2 locks held by in:imklog/187: [ 179.251320] #0: ffff88800f599268 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe7/0x100 [ 179.252508] #1: ffffffff853fa898 (log_wait.lock){-.-.}-{2:2}, at: __is_insn_slot_addr+0x0/0x250 [ 179.253805] 2 locks held by syz-executor/7127: [ 179.254422] [ 179.254707] ============================================= [ 179.254707] [ 183.728727] Bluetooth: hci3: command 0x0406 tx timeout 23:20:33 executing program 7: ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x2f, 0x6, 0x1, 0x100, 0x20, @remote, @dev={0xfe, 0x80, '\x00', 0x25}, 0x700, 0x8700, 0x3f, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x134, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000440)=@IORING_OP_READV=@pass_iovec={0x1, 0x2, 0x6000, @fd_index=0x5, 0x81, &(0x7f0000000400)=[{&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000380)=""/29, 0x1d}, {&(0x7f00000003c0)=""/8, 0x8}], 0x3, 0x12, 0x1}, 0xff) r2 = syz_open_dev$usbmon(&(0x7f0000000480), 0x6, 0x420080) mmap$usbmon(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x2000004, 0x20010, r2, 0x842) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r3, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x48000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000600)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x8, 0x0, "6e21c23d28a9ff2eca8e62f0f981e5bca5f242efd2367e52d679df21e0430db02190f0b59bb6a4683d7d539f4c89d3606c8ad9f44e1bc3134d63a1f0fd064313c31ffdcae51d8725f20d3dc47a793947"}, 0xd8) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r5, 0x2, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000b80)={0x5}, 0x4) 23:20:33 executing program 0: clone3(&(0x7f00000004c0)={0x300810480, &(0x7f0000000200)=0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x41}, &(0x7f00000002c0)=""/235, 0xeb, &(0x7f00000003c0)=""/180, &(0x7f0000000480)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) clone3(&(0x7f0000000580)={0x12000000, &(0x7f0000000000)=0xffffffffffffffff, &(0x7f0000000040)=0x0, &(0x7f0000000080), {0x25}, &(0x7f00000000c0)=""/183, 0xb7, &(0x7f0000000180)=""/92, &(0x7f0000000540)=[0x0, 0x0, r1, 0x0], 0x4}, 0x58) newfstatat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', &(0x7f0000000640), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000700)=@IORING_OP_LINK_TIMEOUT={0xf, 0x3, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x77359400}, 0x1, 0xbfb693e9515bd81}, 0x1) r4 = pidfd_getfd(r0, r2, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x34, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x80000001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x401}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x60, 0x0, 0x20, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xef}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x200400c5}, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x54, 0x0, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xfe}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000c0) prctl$PR_SET_ENDIAN(0x14, 0x3) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f0000000bc0)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b00)={0x44, 0x0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x80c0}, 0x200c0080) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000c00)=[@window={0x3, 0xfffd, 0x9}, @mss={0x2, 0x5}, @window={0x3, 0x8, 0x8}, @sack_perm, @window={0x3, 0xff, 0x3}], 0x5) pipe2$9p(&(0x7f0000000c40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$P9_RFLUSH(r6, &(0x7f0000000c80)={0x7, 0x6d, 0x1}, 0x7) syz_genetlink_get_family_id$team(&(0x7f0000000cc0), r4) write$P9_RLOPEN(r4, &(0x7f0000000d00)={0x18, 0xd, 0x1, {{0x0, 0x0, 0x3}, 0x7}}, 0x18) sched_getattr(r3, &(0x7f0000000d40)={0x38}, 0x38, 0x0) write$P9_RFLUSH(r6, &(0x7f0000000d80)={0x7, 0x6d, 0x2}, 0x7) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000dc0)='cpu.weight\x00', 0x2, 0x0) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000e00)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) 23:20:33 executing program 6: newfstatat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x100) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x1000) r0 = semget$private(0x0, 0x2, 0x1) semctl$IPC_RMID(r0, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f0000000180)=@qipcrtr, &(0x7f0000000200)=0x80) semctl$SEM_STAT(r0, 0x3, 0x12, &(0x7f0000000240)=""/102) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), 0xffffffffffffffff) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000380)=0x14) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, r1, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x80}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfffffff8}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004844}, 0x800) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_SET_HARDIF(r3, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x50, r1, 0x420, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}, @BATADV_ATTR_HOP_PENALTY={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9f11}]}, 0x50}, 0x1, 0x0, 0x0, 0x2004c001}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000600)={'wlan0\x00'}) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x1c, r1, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x20000000) semctl$IPC_INFO(0x0, 0x4, 0x3, &(0x7f0000000740)=""/131) newfstatat(0xffffffffffffff9c, &(0x7f0000000800)='./file0\x00', &(0x7f0000000840), 0x100) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_TP_METER_CANCEL(r4, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x68, r1, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x3}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7f}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x48080) getpeername(r3, &(0x7f0000000a00)=@nfc_llcp, &(0x7f0000000a80)=0x80) sendmsg$BATADV_CMD_TP_METER_CANCEL(r4, &(0x7f0000000cc0)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x50001010}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x68, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x841}, 0x4008001) 23:20:33 executing program 3: setns(0xffffffffffffffff, 0x20000000) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x300, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x7f}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008004}, 0x4044000) syz_genetlink_get_family_id$team(&(0x7f0000000200), r0) sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x48, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x77f}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x26a}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="26c96527eda8"}]}, 0x48}, 0x1, 0x0, 0x0, 0x40801}, 0x200080c0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000380)) r1 = ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) ioctl$NS_GET_NSTYPE(r1, 0xb703, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000480)=@buf={0x8e, &(0x7f00000003c0)="71e2339c93713094f951f760f1dac830c35e36dbc61b6ecd9f63dc66a00530f0d45aa7f1851391a8a1c99fff2906ab3f0cd489b9275919af1366f13eaa24e9a8f5e035a778b3d32ee72a6a9524044b6800f857bfc4105b28035a9e231b460c57061a8d9222169f9fb9ff7c3cbe8d90a16b0c1afa423d0a31a554793358c662f98f2dcd416959a57cafbb6b63c2b5"}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x8f7) r3 = socket(0x41ccac42a877bfcb, 0x80000, 0x80000000) syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), r3) ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000540)='numa_maps\x00') r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), r3) sendmsg$BATADV_CMD_SET_MESH(r4, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r5, 0x200, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000001) r6 = pidfd_getfd(r4, r2, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r6, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x2c, r5, 0x97644e9bd3717bcc, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x10001}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000884}, 0x48004) 23:20:33 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup(r0, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r0, &(0x7f0000000080), 0x2, 0x0) r2 = clone3(&(0x7f0000000540)={0x100, &(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000380), {0x1c}, &(0x7f00000003c0)=""/197, 0xc5, &(0x7f00000004c0)=""/34, &(0x7f0000000500)=[0x0, 0xffffffffffffffff], 0x2, {r0}}, 0x58) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000600), 0x200000, 0x0) clone3(&(0x7f0000000640)={0x2a040000, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140), {0x2d}, &(0x7f0000000180)=""/201, 0xc9, &(0x7f0000000280)=""/83, &(0x7f00000005c0)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff, r2, 0x0, 0x0, 0x0], 0x7, {r4}}, 0x58) r5 = openat$cgroup(r4, &(0x7f00000006c0)='syz1\x00', 0x200002, 0x0) openat$cgroup_type(r5, &(0x7f0000000700), 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000740)='memory.events.local\x00', 0x0, 0x0) ioctl$MON_IOCQ_RING_SIZE(r6, 0x9205) semctl$IPC_RMID(0x0, 0x0, 0x0) openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000000780), 0x2, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f00000007c0)='blkio.bfq.sectors\x00', 0x0, 0x0) ioctl$TUNGETDEVNETNS(r7, 0x54e3, 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r8, &(0x7f0000000840)='cgroup.kill\x00', 0x0, 0x0) r9 = syz_open_procfs(r3, &(0x7f0000000880)='net/psched\x00') openat$cgroup_freezer_state(r9, &(0x7f00000008c0), 0x2, 0x0) r10 = openat$cgroup(r1, &(0x7f0000000900)='syz1\x00', 0x200002, 0x0) mkdirat$cgroup(r10, &(0x7f0000000940)='syz1\x00', 0x1ff) 23:20:34 executing program 4: r0 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x80, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x80, 0x7f, 0x1, 0x7, 0x0, 0x0, 0x100000001, 0x20044, 0xa, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1ff, 0x0, @perf_bp={&(0x7f0000000000), 0x276f81b53b9c5599}, 0x5, 0x4, 0x9, 0x8, 0xffffffff, 0x3, 0x3, 0x0, 0x200, 0x0, 0x7fff}, 0xffffffffffffffff, 0x5, r0, 0xb) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000100), 0x2, 0x0) clone3(&(0x7f0000000480)={0x80000, &(0x7f0000000200), &(0x7f0000000240)=0x0, &(0x7f0000000280), {0x29}, &(0x7f00000002c0)=""/162, 0xa2, &(0x7f0000000380)=""/139, &(0x7f0000000440)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8, {r0}}, 0x58) r2 = perf_event_open(&(0x7f0000000180)={0x4, 0x80, 0x2, 0x6, 0x1, 0xff, 0x0, 0x2, 0x60200, 0x8, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000140), 0x5}, 0x0, 0xb7c, 0x200, 0x8, 0x7, 0x101, 0x8, 0x0, 0x4, 0x0, 0x80000000}, r1, 0x2, 0xffffffffffffffff, 0x8) socketpair(0x27, 0x800, 0x2, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000600)=@IORING_OP_WRITE={0x17, 0x2, 0x2000, @fd=r2, 0x401, &(0x7f0000000540)="3ef24cd70542ac8bc019b5d135682672d74b9dbbf543bc5e51397b09dadec9513366d6168fd6bbe73268013f34c2a1f7f63a7016bec9d6a86fc99e336dbfff7dc9f14ee9c690bb9aa8f4f564b6bcefa5c0d53562f22d69e13440dcae625ab21362e12ca2f5c711b76b330aa26d275c8a96f9bfe1b88e31fba11c94582e0e6d4a00ac6b589db062229a6e6fdd2375f669ed9a4a245e9d51bb84654c2e9059ea73f462e7ef655a00", 0xa7, 0x8, 0x6c0a4bb62b4bef20}, 0x4) mkdirat$cgroup(r0, &(0x7f0000000640)='syz0\x00', 0x1ff) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000006c0), r3) sendmsg$BATADV_CMD_TP_METER_CANCEL(r4, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x14, r5, 0x200, 0x70bd2c, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x2400c8c4) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x40}]}, 0x24}, 0x1, 0x0, 0x0, 0x40040}, 0x4008015) r6 = syz_open_procfs$userns(r1, &(0x7f00000008c0)) setns(r6, 0x8000000) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$team(&(0x7f0000000940), r0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000a00)={'syztnl2\x00', &(0x7f0000000980)={'syztnl2\x00', 0x0, 0x25, 0x20, 0x3f, 0x4, 0x7a, @remote, @private1, 0x8, 0x700, 0xffffffff, 0x9}}) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000b80)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000b40)={&(0x7f0000000a40)={0xec, r8, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [{{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}]}}, {{0x8, 0x1, r9}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}, {0x8}}}]}}]}, 0xec}, 0x1, 0x0, 0x0, 0x4000}, 0x88c1) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x44, 0x0, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_RINGS_RX={0x8, 0x6, 0xffffffff}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x10001}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x10001}, @ETHTOOL_A_RINGS_RX={0x8}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0xffffffe0}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0xe4c9}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x44080) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000d00)=0x100, 0x4) sendmsg$BATADV_CMD_GET_HARDIF(r4, &(0x7f0000000e00)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d80)={0x24, r5, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x92}, 0x40801) 23:20:34 executing program 5: process_mrelease(0xffffffffffffffff, 0x0) r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/ipc\x00') ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f0000000040)) socketpair(0x1f, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r3, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_LINK={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x880}, 0x20000010) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), r1) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r4, 0x8, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7a}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8090}, 0x4000000) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'batadv_slave_1\x00'}) pkey_free(0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x0, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_COALESCE_TX_MAX_FRAMES_IRQ={0x8, 0x9, 0x7fffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000080}, 0x5) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000004c0)={'wg2\x00', 0x0}) getpeername$packet(r2, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000005c0)=0x14) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000e40)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000e00)={&(0x7f0000000600)={0x7ec, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x7}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e24}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r6}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x9}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e21}, @WGDEVICE_A_PEERS={0x7a0, 0x8, 0x0, 0x1, [{0x184, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x6}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}, 0xff}}, @WGPEER_A_ALLOWEDIPS={0x158, 0x9, 0x0, 0x1, [{0x154, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x22}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x3b}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5}}]}]}]}, {0x538, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x4}, @WGPEER_A_ALLOWEDIPS={0x1c0, 0x9, 0x0, 0x1, [{0xa0, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010100}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x1}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010102}, {0x5, 0x3, 0x2}}]}, {0x88, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00'}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5, 0x3, 0x2}}]}]}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x7}, @WGPEER_A_ALLOWEDIPS={0x364, 0x9, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x3}}]}, {0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0xa}}, {0x5, 0x3, 0x1}}]}, {0xe8, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0xa}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x5, 0x3, 0x2}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x2}}]}, {0xf4, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x31}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010100}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @local}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x13}}, {0x5}}]}, {0x88, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x1c}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x3}}]}]}]}, {0x4c, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e23, 0x5, @mcast2, 0x69c2}}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x8, @private1={0xfc, 0x1, '\x00', 0x1}, 0x5}}]}, {0x6c, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x3c, @mcast2, 0x3ff}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e24, @multicast2}}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "790619c6e19546078ee2ec3d14ee3d7b841a1c6de3296d39c1bedf35ac7e2359"}]}]}]}, 0x7ec}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$NS_GET_USERNS(r0, 0xb701, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000e80), r2) process_mrelease(0xffffffffffffffff, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_NEWPDP(r7, &(0x7f0000001080)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001040)={&(0x7f0000001000)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x40021) 23:20:34 executing program 2: r0 = socket(0x15, 0x6, 0x5) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x201}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x20000800) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) getpeername$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r0, &(0x7f0000000280)={&(0x7f0000000100), 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1f}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb471}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x8000) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f00000002c0), 0x612023, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000340), r0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0xd4, r4, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r2}, {0xb8, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1000}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r2}}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4000084}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000500)=@IORING_OP_FSYNC={0x3, 0x1, 0x0, @fd_index=0x1}, 0x7dd) ioctl$sock_SIOCADDRT(r3, 0x890b, &(0x7f0000000580)={0x0, @hci={0x1f, 0x4, 0x1}, @vsock={0x28, 0x0, 0x2710, @local}, @rc={0x1f, @any, 0x7}, 0x9, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000540)='wg2\x00', 0x0, 0x8}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f00000006c0)={'syztnl2\x00', &(0x7f0000000640)={'syztnl2\x00', r2, 0xf183990f3e8cdb0c, 0x3, 0x7, 0x3, 0x0, @dev={0xfe, 0x80, '\x00', 0x3e}, @mcast1, 0xe07, 0x80, 0x2c, 0x9}}) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000007c0)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000900)={'ip6tnl0\x00', &(0x7f0000000880)={'syztnl0\x00', r2, 0x29, 0x0, 0x6a, 0x3, 0x1, @dev={0xfe, 0x80, '\x00', 0x14}, @rand_addr=' \x01\x00', 0x80, 0x7, 0x1, 0x7}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000a00)={'batadv0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r3, &(0x7f00000011c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001180)={&(0x7f0000000a40)={0x71c, r4, 0x400, 0x70bd2c, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x104, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r2}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r5}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}]}}, {{0x8, 0x1, r2}, {0xf4, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3ff}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x1d8, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1f}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r2}, {0xc4, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2d}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r2}, {0x74, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2000000}}}]}}, {{0x8, 0x1, r2}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x6, 0x3, 0xff, 0x7fffffff}]}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}, {{0x8, 0x1, r2}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}]}, 0x71c}, 0x1, 0x0, 0x0, 0x4010}, 0x4000) syz_io_uring_setup(0x3d8b, &(0x7f0000001200)={0x0, 0x87c9, 0x2, 0x0, 0x16b, 0x0, r3}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000001280)=0x0, &(0x7f00000012c0)) syz_io_uring_submit(r9, 0x0, &(0x7f0000001300)=@IORING_OP_NOP={0x0, 0x5}, 0x80000000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000001380)={'batadv0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000001600)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000015c0)={&(0x7f00000013c0)={0x1cc, r4, 0x800, 0x70bd25, 0x25dfdbfb, {}, [{{0x8, 0x1, r6}, {0x1b0, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffe}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xba15}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x400}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x20000014}, 0x40000004) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f00000018c0)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)={0x1c, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x80) 23:20:34 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup(r0, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_subtree(r0, &(0x7f0000000080), 0x2, 0x0) r2 = clone3(&(0x7f0000000540)={0x100, &(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000380), {0x1c}, &(0x7f00000003c0)=""/197, 0xc5, &(0x7f00000004c0)=""/34, &(0x7f0000000500)=[0x0, 0xffffffffffffffff], 0x2, {r0}}, 0x58) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000600), 0x200000, 0x0) clone3(&(0x7f0000000640)={0x2a040000, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140), {0x2d}, &(0x7f0000000180)=""/201, 0xc9, &(0x7f0000000280)=""/83, &(0x7f00000005c0)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff, r2, 0x0, 0x0, 0x0], 0x7, {r4}}, 0x58) r5 = openat$cgroup(r4, &(0x7f00000006c0)='syz1\x00', 0x200002, 0x0) openat$cgroup_type(r5, &(0x7f0000000700), 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000740)='memory.events.local\x00', 0x0, 0x0) ioctl$MON_IOCQ_RING_SIZE(r6, 0x9205) semctl$IPC_RMID(0x0, 0x0, 0x0) openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000000780), 0x2, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f00000007c0)='blkio.bfq.sectors\x00', 0x0, 0x0) ioctl$TUNGETDEVNETNS(r7, 0x54e3, 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r8, &(0x7f0000000840)='cgroup.kill\x00', 0x0, 0x0) r9 = syz_open_procfs(r3, &(0x7f0000000880)='net/psched\x00') openat$cgroup_freezer_state(r9, &(0x7f00000008c0), 0x2, 0x0) r10 = openat$cgroup(r1, &(0x7f0000000900)='syz1\x00', 0x200002, 0x0) mkdirat$cgroup(r10, &(0x7f0000000940)='syz1\x00', 0x1ff) 23:20:34 executing program 0: clone3(&(0x7f00000004c0)={0x300810480, &(0x7f0000000200)=0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x41}, &(0x7f00000002c0)=""/235, 0xeb, &(0x7f00000003c0)=""/180, &(0x7f0000000480)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) clone3(&(0x7f0000000580)={0x12000000, &(0x7f0000000000)=0xffffffffffffffff, &(0x7f0000000040)=0x0, &(0x7f0000000080), {0x25}, &(0x7f00000000c0)=""/183, 0xb7, &(0x7f0000000180)=""/92, &(0x7f0000000540)=[0x0, 0x0, r1, 0x0], 0x4}, 0x58) newfstatat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', &(0x7f0000000640), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000700)=@IORING_OP_LINK_TIMEOUT={0xf, 0x3, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x77359400}, 0x1, 0xbfb693e9515bd81}, 0x1) r4 = pidfd_getfd(r0, r2, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x34, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x80000001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x401}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x60, 0x0, 0x20, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xef}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x200400c5}, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x54, 0x0, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x3}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xfe}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000c0) prctl$PR_SET_ENDIAN(0x14, 0x3) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f0000000bc0)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b00)={0x44, 0x0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x80c0}, 0x200c0080) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000c00)=[@window={0x3, 0xfffd, 0x9}, @mss={0x2, 0x5}, @window={0x3, 0x8, 0x8}, @sack_perm, @window={0x3, 0xff, 0x3}], 0x5) pipe2$9p(&(0x7f0000000c40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$P9_RFLUSH(r6, &(0x7f0000000c80)={0x7, 0x6d, 0x1}, 0x7) syz_genetlink_get_family_id$team(&(0x7f0000000cc0), r4) write$P9_RLOPEN(r4, &(0x7f0000000d00)={0x18, 0xd, 0x1, {{0x0, 0x0, 0x3}, 0x7}}, 0x18) sched_getattr(r3, &(0x7f0000000d40)={0x38}, 0x38, 0x0) write$P9_RFLUSH(r6, &(0x7f0000000d80)={0x7, 0x6d, 0x2}, 0x7) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000dc0)='cpu.weight\x00', 0x2, 0x0) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000e00)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) VM DIAGNOSIS: 23:20:25 Registers: info registers vcpu 0 RAX=0000000000000074 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff823bb0f1 RDI=ffffffff8765a9a0 RBP=ffffffff8765a960 RSP=ffff88800902f988 R8 =0000000000000001 R9 =000000000000000a R10=0000000000000074 R11=0000000000000001 R12=0000000000000074 R13=ffffffff8765a960 R14=0000000000000010 R15=ffffffff823bb0e0 RIP=ffffffff823bb149 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fffb6fca080 CR3=00000000250a2000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 ffffffff00000000 0000000000000000 YMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM04=0000000000000000 0000000000000000 4040404040404040 4040404040404040 YMM05=0000000000000000 0000000000000000 5a5a5a5a5a5a5a5a 5a5a5a5a5a5a5a5a YMM06=0000000000000000 0000000000000000 2020202020202020 2020202020202020 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 25203a646672656d 6974206574616572 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 2000000020000000 2000000020000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=1ffff11000fe7b73 RBX=ffff8880098ca228 RCX=ffffffff812a8ed1 RDX=dffffc0000000000 RSI=ffff888008c03348 RDI=ffff888007f3db98 RBP=ffff888008c03180 RSP=ffff88801870fa00 R8 =0000000000000001 R9 =0000000000000246 R10=ffffed10030e1f2e R11=0000000000000001 R12=ffff88800efaac18 R13=0000000000000000 R14=ffff888007f3db68 R15=ffff88800efaabd0 RIP=ffffffff817bc706 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007fbb1859f900 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055b0a2e75648 CR3=000000000f22c000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff YMM01=0000000000000000 0000000000000000 3030623438613630 3638616663356134 YMM02=0000000000000000 0000000000000000 3830306234386136 3036386166633561 YMM03=0000000000000000 0000000000000000 2f6c616e72756f6a 2f676f6c2f6e7572 YMM04=0000000000000000 0000000000000000 0a199048c384d25b 00000000000ae988 YMM05=0000000000000000 0000000000000000 c8a54713b07d5f7b 000000000013d7c8 YMM06=0000000000000000 0000000000000000 8814c485cd32fe7e 000000000013d5c0 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 44495f474f4c5359 530069253d595449 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0020000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000