f73bbb44859c5326100d4799f4751cd6a3837eb9d7127081bf66675eb4bd477acec9be81491d27662da33689ce0dd87fdd8971aaf70940cc70af2566ea6e4778590bba6977a930e543f32bf074ac8866d32a0759ce8a629631ebbb53fabbbdab4c897b2739ce96ad0b9c03fe4a764f996757cafc058dbd7f9129b20f9ac4b97739a5d3dc08d15c480772342be7eb0da96886a5e2428cd2b0c3783fc90d9ef5811b60fb2d4350eb24022f91f9441a43c855b363a38ef6d67032a38e8ca3f971219efbff6ffaffc8c40e8b842a45b04696ade9740ba68a0c5144cde666052f0de25ee604d791435c4839baca617dbd016f1d01480e9fea8587503a2a49bc0a46393196b9c493f1cddb281bf4b5afbbf007e0308615bcb7351877ec030767e362ffdaf9fa6c7f56aa28beec40bcdc2a35dd20009abb4813cd4fe52ea18a3851cd1aa7beb759b9b7459223d0507d83fd1e3ea2e22857a2517b23605ccd9ada4da111f0a5c355e606141e4429c8313b1523b843c235e2a3ba58e0c8135a5c39fb79a72a3b80680f5688c4556dc532a86ef60db77d4f6e3e38f0558cb1cef1a8c97b2f2ee23abdf65cb2ad28612ca1ea9b04e3c513ab169f9b46e7751b8d2acfb807c06ef9345b8397d38de47e14fba00a668011bf9979da9b7c12618a4ae9f6020dd27739766697e3a5d8bdcdd43517be0b67d07e05964d6455d80b54bf28a0a3bc9d871465cf1ae1d469e3f37447c4fd2dd13fc911cc6d6e688387f38839b778adb5294f04ef278782c619362b84d9f9661be78af0350b06c7b8bddf5ed99e3bb17f771c4a27b3c1f728a448808f3fd5dd1ac3b44cfd30b8e8fda315795e27adf3f6778c30a8f5c10ff72345956f5f9a675687d485ab877cef8290f28202447fffca218583ff9d296a117a56319be677725022f8747ad3afa0f0e6501872e7c7176e1e3348b8a1439d31304f59363b094859f3e398e4b5275da847506c403ae4e435485184791ad8a11e516e1838f539e9411664b6978dafc05a82a025e59ca14a37e3838496b631d503ab75581c1cb9f26a936950fd97e1d30c4026c8ccac49e6388958089c4d0442e36b1151ebb8f4c5f051070d727f18a747b68edca6b7befcf5964d5596f6b31eae1934dcfc445e03ba076e1deb552db68fa9771c2f5c6b3cc3642044bb9788c3c827dae1a6e73e253706c856747170cb3e62d5de3954d3c7aaf6ebcf40b3df74d9058346ff74e364290fef7934af5da471f7fe3f90dcdff1117e45c0c56864a7245fb0f31dbd8d92cd1a06b3258ad67a382b2114e8f5a02fb7e345c9c4f857adbf2e893240c9891893917e9015527c903f4321f51c8c210f5c77370d6116f03c81618a13a222dd9f3c151165ded653d31ac67caa98a1058f71056cd17bca361db767391d7553dada3a8c703453875efb5132da5793da1215a417bccb7c9e817dd8f0053973e24be42c20ff7395c71dbd4aa4d90b85473b8b997e3685226d20220dc7c84e7520915a7908f8d89f7fedb52c80906e5263dc41a892c53bf1206decc1f77af622c5a9d0929c6f7404e4382c8066aeef46760220f9a1eabbcb224605bb1f091ca33681a5077407b83daf1c62fbcc8dbcfd7822988d7814dea0bb3224bea82282198942fbd89b6f7bcccc2f1c6404bd8992586f0c0ae9642d67e681fe1e80abb053bed2baf26c2f43f97de05550d4a8e859edbc80901fc22685d76274b484d99054b7f3779730fde394dd0573cc73e38d572122a8c0c29910030840654d70f718910f1356b26a7ae7a52b6b27040780ab043c6b48f86ed528d69725902ca18c11939c226b0888b0a080a3fb29c4285d467357c7802d7ea4798e6d683b0fb9bc1201bf307ca2fd34ce13d22e7ba5adedadea176bc83dfd8d8f8ed155f160a2d9ad8a0c5546d511e3c2d2d2f47a2ce8c047a26cace25aeaa40cc109271b9892b79aa73a3bf27201ae5d3ae4ca8dbc4afbb0d36133773c55c99daef0ceca7b30a889015c7bdc9ffc96ff34cd72c2ce35c552df85c6065ff8e02b135490f7433fe66471d07da713d23fd99ed7b1bf60f35fe50527867db0de3c70f7d9f1ba5ad31aa75c3d52e58f7f98f7d6e37cd46bb2c3696c34a805f6dcf1c34bf8852ad27d66004ae4b4efc2c676be9ad98278906f85e00e313fcb39f8343fdffdd82a558d39c1758e54feda77feeb7a532764d34d96a99db4ab7ee3409511b671e07d8b4f3bff6951f604963ee4834fe14082028b6454b3074fa2820ecfb09949efe5e2deca6300c5f1a655ad31e017edcda7243bfa6c879d21fa5d91dc5f615450cc6a31213329ee51d9025a5e3ad3dec672c0729e3de1e3c6d471a986d1ca5b07d755849870d165bbac7f342e691d9ca5fa4b0c9efbecdd9e236f6437871fa2b934b9482be817885559a2cf6de5104b81105ef22f2cda73f07748fe8d0bfbe5dc6dde6a10021c87cc8df1b7967920133bec86e78f18207ed6e05ea35e39b309083a7c8d35ddf3af2f81a16658bd8f7b14e92f9006f858baf1bed927f4dda41bd7a1f83c20d89ee1ec3237693c2ebcbf5329fffd7593ae310ee51e9c9d84c2ddc7dce9acddeb61902c42afe1232aefbbe4adf06edc93208bf9b7c6304fe78b90478ef3faa4f564c75d010dfdf575db0470f4ec638acf9f6c0ee9142ad608773d7ef948b14c8d08aa092a830d315d035d7e15f5c778958bf16f7e57a7d3eca83c1ad52b7c849ffc126068d2a57799a3f8d6ac85433183873c2ef9a90cc4bc3a728d069d24b929074223733552270a5a141ce51c7a8fce54c46bb04347db2fee386619a3168cd76716666378f75bc8efc67399b7d91be4634ffe08e2ba55456aeedeb71c2f7191749b5b75dcf4a2930625cbd66f41df1462b9b58f7a82926b121f73582815f478c9d5610591180093b456db3895572225ff245e9c1073da3307ad7aaefc1aa5d1d101179d64b79374683eb1328ead164a1f0996221fa1a46f2274e6b62a576e2778d47bbc7d3cefe9c00e08d7fe78dab227a49297fa413cd572b42fc6812624ff5df46ae8601315515b9fa15147de5aea41b428ed6a181fe7cee4da096430c7e1e782f506bd3b2a22cee9be1d6190d138a74cb4e377a25511e293deb98a50a6324879e283a7dbeddbaa0719b242979141c6293d800512b2885eaae187173dadb9bda69d6e0aa182af0eb5aa268b41536eba2debd70cfec82624f69ec91d504aec4a1ffc7e3d112372e210e92ac3bb2b5e6e12bfcada147cc235c059851e9b29f79db712585ee767a2b79430d14a5741cfebba4da9031e24fc7891c4b9a3a5593eacccb24f54a6edfa47429900958c32c550a7e17640c3f0467d70792dc0c48a09f94e8b3789785f33eb375d1547314fc7e2699254e3721a940598af01141f51799313d6ca01366ff895c5dd2fc3f7bad3316bd98985fe98d82e227b8bfe25c9bb7b6df7d8ce8e430ea3b391ca7741c3e76de039bb360c23b6b31578b117058536ff044dc1e06d1731155387ca1d151f469e5662f7ae7de46518280162638f2499ebd053c18e366fb6e5dcbfd64e8fd339aa2c24f415de8e2aeb298ad6a310e150801b96bd7c83976b1efba2230d4ed3d2287819a68b01cd5ee56f17864f7de433a19286f41d021ed6d751a675ffae6a7ebb086856a0391756da1dadd4e7d72fa9e5511dc5a15ee713c2ec2a7c93be8abd8eabd4950aa9ec58e826fab630071da760ab1dbd6ae356f76c4946e96f9fd9ecc2afdd05b91be471535e90862a3ba9199d436e236de305ceeae0d144593644519ef1afe63edb6a76a60f73da4969c98bd449083e4018730117df550a38156fe9c51190177972fe6582896abb21e6693bbce89db6f826f6e3c4bbed762af2b7adda929c48031d4289e5451909f041157c3b093ec30ac3ce3f04ba7a4940be79664e14bdbed9ad1e3e9ac0e524061670babba033e23040015d13a946ec667449889c35fe0e5fd2947afefdb42d73b4811c4b0bfbc08278dd7866ff22591ee0beab5cde128b06cf8a7c81b8d9bdb3ad682724597673f822e9250b854439153b45e9d6d02829c369850c0a60b547ccddaad4dd8b2a11a62e1cce68d250bd715b658cba2076f8d2e7a68cb8c5ce6584999776a4d5073ced21be9b05832fdade6c0a94d3eaed724291df7d60af9a74eab275f11d5041048d2bd6b2b93f0f09667b2e1932b6bf4902315ff171900d15cfc31e68385149198fd8a5e99de09fb1ec71ae4ba54e3d802812bafb7c73bc02957b6b4bc0b15c9e7f7216d84fc374dd00aa1446e71592c3c1a39cfc628046796e0a79f4d345ec8b4c1cbbc2f12b8a5d66cafddd9bf45c69ee53f6b4728b5b5ef1ecab488deaf6df7b7603aacd85c7d14392fa1f72ae02a93e66ddf6a1676185e8437aaa7bb09fa1c276867059418e274d87e61354494e8c51864cd44e965be84af68bc6046d8da5ad5bd4a407ac84c296a0b0d34cf731b512748c013e7f589f3b568e071e401493faf0bd7dde5e3bcd14ef17537f0c2ba776047799b9b35717b20d15f0e6f0af8ed12aa5a2698b2b2d327470039df1e54cae7a83bed8b3f6401184238fc550742a2d5829cc3ab8797cb5a8afe01716560235744af8472d67caec958b4b8e1472aa642ee1a5dc4db71538dacc0a3c70989a79eae9bce7c39dbd46c936e98ff053d3dc35a4b3dcb88b7f8edef33f05645c66fd4a823e4c5be7ac44cf06b9c638ab558fe437ba6f5f018650a99986da2933f9fcbe00e9f0e78eb813580f3629b1710d6d0da6e2b01cb1a14361a9c8be386e794ee0b420303e65953ebd42a1b3872b7ecc52e35f7e9582c15c937f28fb037bed7842d5d3a1bcdaf77617bcfbde48b8b42df0ecf20060d97780fa02ebe631cc1b63856d3e35b71cef7a7c173cacf68023c95f2a831efeed6d52f7f7ecc00e1a73f75636af021fd3f80bdd494e8ec7038c7aca48ec902871689c7710ddaf3b484611d3e5e191081efe164c1f54b61f524424f30f507c77084536f72a5e357c87b53c44ab425476c1a1c8aecce95a7e7426c64f9ca2fcf7cd043975e3699f4f3955053c261643e9cd5a42ac472b904e7dec3fa333201feb0dd31ef21bac0803b8d4674ae0b42d2c619701bcf4593736c7b26c129650ad65c48f63279ff64bbb7533b00a090962f7951facbd567d0dabc4ba960aa3a64cbb9ccc603b9bdd9610f11ad2c20656eadaf374ad08dc0c13f2e2f6647beda358688e1d8a71372fa9e0f2f61b0be68e5a62e6c1bafaa47d9b86d28e91e9f5c67fc4df6976618f6c85fa82d1aa1533791979e63764debefc594eb4c7ceccfa3d5c87e26998bbb09545c07c160007cc876be9c8adbe2b7e2f1ec4cf4336cf50c340cdd632ed2d9f9f61e1c6c8489b8cc803d48eba534ce8104fe50a58e0e1e615cd7fa4f41639b269db40ca22a04a0e7456f237de895c05a8b9137967ae2e0861cebc668203f28d5f42e751b360899c7b4e86b5fa69a93daac17bae1d0249efbc01e5429a72cdc631cacfd1419c55ce7d134a220b5999112fe79e8f516855bde6c1ed7624fea0fd5ce16a12c1051949ef023368e09b67f56215426581ff0a7c76b6ec60441d478eb63546ecdfb56465dd8ae720a1759aa760e01bed6003c2ed97aa0b04292364c263b609ff216f450a2605e55a1d27b80343f4b1794f238d75b20e9c3a43cae306b9ffd43c2c09a49f9bfa367e588155b78edefd75aa06edf9cde7446148a7c1166460eadf32c8a30d867a5cfd51af056a4c95e1059028731eaac7f141e1b24a38a81f695802af1691e935a078afd15f874131dfcc44ede9369f9dc85ad3559939b5e402598b3a94109a6aecba7dcf2246437e942b75a76fda18f357ccecf1940873264830eb61ae8b4333c3870b493eb721af3ef5979138f8cb74e04f5c803c02b07e21f4948d8f6b00d08e48b9d045cc8eab5f565165383a68db0f0787d2b714fe66ce17cccbdfbea9a31884610012a1c5edfdf959f14bb412424f7683c91590f21c554e9e6a0dcb508e3f2bb0e779e1d00f7ac4962c12ec56e2a1b1bb59c3969953e5cb4c112ae4608c0210e84ba6ef1aace2cba0a8f648f804885409cab884606fd1f490b6ed7b542fcd061b434c3eb1ea3279701cbe6a8d4a5ac533b23e71ef4718b2afa65ced3824ad28a5bf704792f7d33127cfa954ed70170a106a81f5cd01adf5cd4bb970a289667519fed3c9587ab4458f5a8a575067401fa8aa6fc1a825455d74113338deec81111f38daa4575831a110cd48c458c3d7b89d45fba89361796196e1a0ad4fbdacbed8b886e5bcc3f888a3c396f039bd37114bab5ea40e75fc13b6db01b488ef910970301061d57915eb1916ba9bc08fe6b2f62fc7436b94be3f95aec0c9c85d655acf1dda447891aba7b6f327f48c3e04642a50e4d5c33a213cc9b07602ee894a824d224e25abdcb867ca568da19a4ded462e30d95d246098c180050dd4d3df2429caa37119647c5c31f852a484266033f7297f05aff5bbea54e8b626e56f73a577ececb58265a0c167d63d1b0efcd55ff0f388c62a466733003acc6e454e24ef708b662210d4cb7758fcba458757e7eaaf1cda1538294259e70e336811d2ad2591cead15bb57892ad585e730deffcf2e63c46a7183c4c1b13350275e32f9f93b8689fdcc3cd9722dbe4f7f173f4b1718801472f23ccabf1c83c238d3305a2678b4e06ef2a222a2a072ba26b51aa7e0bb7dfb053983871daa004dc8a1fece8416f1fc35e7e8f2aa8a55d0cea78b3da8acc2db0c208ac299863f35455e28c41b87bd356f1d7280239072a102eadfdefd90d15404364c8b7af38533a9153744b2d14e4740d19e4b2259f1b3cbba20172256a8f3df346435bacafb9c061ef412668ce4dea361d5be707f8181fba27cc7112560d0af824fd54b6c0d7801217c9afee6483b9977e0d62932d4a831146749d678f93a44ea837fa5bf080fe9369ab625ed06f26819c7235cbcca03cd9df65c2c7258440d1f04036f3cda7ce1d46903adf7d42234b1047a98f2d903f97b4ca210034cf10bf29a3e8768fb0a09efb9c9b18c317ee73b4bb67e05acdd4d8f24989a46205f4f309ac868001584ee5e930729f2dab6d5a990dcb8bebbce958cfac1a53cb337f7dd7a4a6c0c2037707cf649ea67857a62f2dc4eba212a02cb3698e5fb2dd36993142be77d36474ea2b673ce6f07010264650bc5a1660d9bee45d5c62a65c87e0f833c330961efa07495827d7c7d26c6cd23acf6e06181eec4faab3317cab634c2792510e0ac4831f7fe9006129372831fd52e2b8eb2366406a2bbc98745147815f79c406feab3d9b605e7476e00429cac5e4fffdbd7b85bb36d5cfaea1c1786f7180e820db0a5802ab20d6901a45f45fa8f85a5c4d7131788efd03e629dea5ce85ef86bae982da5723fca7092818fb2131bc665b5e064b54f9047a1b460a90c9420648e0f6513df465e62d1bd2c15ce740b8824f33d85fdb4cc5e62358cb64528586e528eec0fe22cc886f3fd2cc5b00333b6ed772a5b9f4eb0c70d616a7bf86d9ebc9c6a3ee362d6fb90bf5eaf0d415b3637ce88f0f06d03bc5e5389ec02063be8ed2970a1b3d53dec145adc1c61fd66f776e7be5f32be4800d22b2a3e5933e658e6457c2096c74decbec6bad5ff265235f948a1534d4b1cd6dc8e96e3e877b96b61a81e14e6e0793de76d9bd68d5549b342bf9a619e7f93d61d0a9d16f322d1119309c9d673be79a880c386cefbbbe8cdd77e018f31a123a67a1e8e62740fc84a65d011d14f1438148acf24aad984d4c935229e82415ebad988a1e88bbbd49d969a6c25beef4dece9476c8fba5211255b43c14ada69e17d3cba8f44167122ee780ef760cdba67d21dcf0b5a09afebf72cd3064467f0085e786b97f7491dd1a39e713e557334648f0879799a93e96333b9543ba1171c31f2fb942b057f0e5d72f6fe9fce9e74decc97c3884564a3d8b0ccc4a5e82b6f496238aeba96905358dbe041e2f3de96a33a3e49bd92b0b9bc25c3a6a167a72361fde6d2b9f48d3e933a7d1d777fe8a1f0018fa44b9697e64ddcc531020f2bb0d4254f0412d364559cd886e74c218a02121415549988c4ddc1457d07746b4ac537b824db978d3d03be340ddeb72b4ac0299fb4ad8cb101e593e5f675f483483556b7f3de12143922ee7c710aa40d515cf764a220f6a12b286832ec967643dd19a2bb49e43189a6414a2a34dd5172ef5a93938aa5bc33a45c6cb2731ed3ce74e45256a25bba004566984af098829f710d624828e9fd1886fc31ec6a03271eba2984f5d6a92dd9439f7d83984764a0b4f7628f54cc51581a4d8268fa1bf2dd549b28ab2afaf915fca9cb311e1e5392f70d9c11e82babe65c41578b92ceb90c4f7ee553024caa270ea8275ae15f11df4b09f95d8ea5306901cf9ac9714ba6677056a4ad60e32e38999d2135caeea1a4c301edc03aa9e12f3462bb944f6da5ac53484a12e7407ed8e2f7c3192cc384940112122477eb966d8c6355f32e567f0a7895ddff7c4243709a789eff469f94086928af949f617ae9a18e6ca2be31a405abd0efcd81adbe0d944df979c5f65f4db69b934b3b0c6aff8562291801b3dfe0a3907d3a0ea9341ea8b324b618442fa41e891d66e17280dc83ca3b617f123605e0cfc73bd0c9d289d35a99c887d628e50e08156d3c4338e82c55c4d8c759913e0a96749e4ae31168c93d3cfb77f27bbf97bb6d467b365403c5e7a1f8052462ba82006c157d7f22f5042de4f5fdd0232c41b40dedcd7be63e1172dbe0af1c0028fb7cfcf4f1b9abaf785f4191c8101a44db4f223c71e82992db714eeefa6fd7cd140c63256ff53f71838d3d9cd631618343f682885ba4d32e929e1c87bfcd2a2bb8630ff8f731e023ac209dd210a5d568ac69976da3c8d8db56e755643149aec0b83d4eff98b134de3e3e67f2890b522e07bde405211b3582ea559376803962aa13ee54b827d39aa803439637f6b9de2aa1cc3031e79a5b35033b981b2c0cc877da74401145f487b9ff7246ad6b241f8761d7346a5cc66bfdb13c8c865efe1905feb1c35f516eccdf29777ff9b618cb80999e29ff440617b5c436efb0194ac1f0a4e91110a1aee09a695d31919087c3d4c8e44895fe7a97a9f136194ef924efde55c5a9e397fb552add8ef6742814bdb51f5e0b50c14312c6fdfbc83cacbaee6edf04fa4d366afe263ca7a36c0c4d02cedbb01e4c511bdc9cb2da19cf6a8f3eb002284a84d406cce2d6baf9fee7d1ac7535b1c09d9e289ae1f247e90e1eb70d00", 0x2000, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}}, 0x0, 0x0, 0x0, 0x0, 0x0})
write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x8120a2}}, 0x50)

18:32:45 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000001c0)={0x0, 0x3f}, 0x8)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000000c0), 0x8)

18:32:45 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x19000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:45 executing program 2:
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r0, &(0x7f00000041c0)={0x2020, 0x0, <r1=>0x0}, 0x2020)
newfstatat(0xffffffffffffff9c, &(0x7f00000007c0)='./file0\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
umount2(&(0x7f0000000140)='./file0\x00', 0xa)
syz_fuse_handle_req(r0, &(0x7f0000006200)="390b7b5f3c1c744fc0141e4b56a3a96e12b16e2af9eb47ac42dfc420b3646f5228f0f2222675f5ae6f28e5a6051a8d49e1f7b0b6b2b4d9ec1d127b1992ae3db96965db6c06bd64c7baa0c321e5eec19a6522c7ffff088390da9dc5d9f3139d921d07b97392283f9c741c478f6fe3a07eff5c4c51ab93bf74e0b42ddd771b2fa1156b8b145cd361546afcd796ec3a7cd93a423a5368df3dbdfadd176b4cf6709243a0e4c01d75d5e92d64a31602f2997e12607813f05ab2b07d7fc9e1a5491433bd331aa1a77a54985827c656f3a2ddbf98e5728ab9b01254ef24aecdafcd52d31d28a2a70567501b3257ce080f0f8d1cd0cb2cfef8e5f3c1beda585d4916f5e3d7c700ac9b78f116f415b977518045792f3ee0403cfe454b90203a211f81fb8110ee7618e127bdf814c33ddc956aa75df9634efce9e374aa26c12e6103f73fed34fe1929adbf6fb899028fb32a6a8133ed0ac3765ca175c375e77c23c2b1c6417201979ee10d13f7d1733d49fbba19457c01b5cda0cc25b66da55729267edf125dac7e6799f49217576141a713d109cacc85fe0b5802df09407bf6058c3a808e3fa87cf05aaff9352c1d3c887a0c132e8c5770ac7b8e855f52cd34558df30d480cb450747a7ef170ae0e7fed6323acdafa4d094cb0b85828ee5df34c26e6cb3bca3a27ea705f1d9019807e3dc041cbbd95cff1ba77a9a7c022dd1ab3bc43137ff2475f1f091be9a9974684f7bf761c7a13d46c3c522d6fdfd4c93f81f1fa70fb24e401a4ab0f9b6e562756c08cb3f981da103fa41317052e302099ba6a1660aed84f71c7401daf13eea6692434192061a6bca16e20bcccd45c45dd95004ef7ba3e6969ff93d1f136d89333d3c76c1fd8f3e02b918928ba56d79693f0ae6b0d41366f24db42957a94de534c5c44b3c7c1090e63301c72e1af2ad37ad456508a7230a8f105c8bdca99aa039cdbf34ed4e5b006a87bf8dd3fd3d3f2f6309b179e303545cb02d5ba2bf97b995da4382e720ca45806fc0839f3d125dbebf60992c5c24629f46520110cc224c6f3df86a3bf057e058d90caad1d186d30ebcb3331d30e5d7a8f0f304c93d524c5f31da655c225e06b5b4f7abbcc662960272a41d4aad9ae2e7614b6a6c5c7069b1f3224cfb909e1976eba54be638b9205f4068edf8716a97cb8440c64333886ff29a9c9f8333179044e69ac34de6ded4604b23b2afdf829a7693ce712d3c0e915bc2e1545c826f91faaa6fed91c825612b55355c3ee2fc769f80cb84720ce191572295b55c806a5846b0dbfb640a0550db54f5483a1fcbf233810ef8b2a7ab2ba86a43ed883787cf31e4ea73e803f8026275f8cba9047e748a489890cd51147113bf2eab55d1b32eb136bcefa70999fd3c384221840cfb923c09ff19a514a326683ffc8135c92474591ba68001b4d3e1acc801a0632feaefaf5e83fc4e34a35aab966d746605f66ce270b9eb6abe5a3591b8110b49dceda30e0d5cd6b2c7a74a94e8a4dedafa427b77b26cc0fceb424fae84619ef0a84430882df19714e7d0b1142b547599d1de69b362feeb4245515a0b2e5eddd782579d924578495dd76b4723ec42958a511cc96e3bb6a57f1a88a2997ae288641ed0bfac356b59a4773a9add341064e44c83f060e0c24be7551efb3cfdd40bc03a156174bac2a6fc92e47be31ea6974e548b8619258cdbb6087c08f4f86f33693c2e1e6f3b21f987459d3b3faeecbac93832712d92eb24362ada8db02e95df8f6938b56c75501498e4fedeb2f0737eada4ade1c53dc12d34a7b1dac3bda4f53858d3a394a59773299c550dbf6c0ceeeece3045676edc57f98b73c2cda557e767795a532d1fcc6caaf277e01fd53af82c04227e12de80fc03c525660a0581d13b0f62a891c9c38d9d2f37b18da6eead8f58989d1984d8c378abcadf7dc76e71a68fa9776ab677c8189491b08bd593ab0025891d4299e1351fb06d6db9c8098d331533f43aa9a61301ef843a95bbc7de28f228579b418141925da789eb361208e65ed44f74a1a7157f6fc51195d99d673ed7da6a480f7e009ddb7744b716c14666d0ff0219d796ba07c499d7cbe65ccbc5d8ce18c8df28b3c1acb6b88064fb1b9db5aed201f9175d3127cc21b045d3f26fe9c18f764860c41eae45ca23a848bd8e69a6d162d43683d4dfc35a3517ab3d3cb02805987f298f87119eb773a837a5e36d42ba9dffffa9b90dfc8771fc50adb92aa81b89ea0f637634efa4285206cef527a65e8811e83600b6eb9da5f686b7aa5f73bbb44859c5326100d4799f4751cd6a3837eb9d7127081bf66675eb4bd477acec9be81491d27662da33689ce0dd87fdd8971aaf70940cc70af2566ea6e4778590bba6977a930e543f32bf074ac8866d32a0759ce8a629631ebbb53fabbbdab4c897b2739ce96ad0b9c03fe4a764f996757cafc058dbd7f9129b20f9ac4b97739a5d3dc08d15c480772342be7eb0da96886a5e2428cd2b0c3783fc90d9ef5811b60fb2d4350eb24022f91f9441a43c855b363a38ef6d67032a38e8ca3f971219efbff6ffaffc8c40e8b842a45b04696ade9740ba68a0c5144cde666052f0de25ee604d791435c4839baca617dbd016f1d01480e9fea8587503a2a49bc0a46393196b9c493f1cddb281bf4b5afbbf007e0308615bcb7351877ec030767e362ffdaf9fa6c7f56aa28beec40bcdc2a35dd20009abb4813cd4fe52ea18a3851cd1aa7beb759b9b7459223d0507d83fd1e3ea2e22857a2517b23605ccd9ada4da111f0a5c355e606141e4429c8313b1523b843c235e2a3ba58e0c8135a5c39fb79a72a3b80680f5688c4556dc532a86ef60db77d4f6e3e38f0558cb1cef1a8c97b2f2ee23abdf65cb2ad28612ca1ea9b04e3c513ab169f9b46e7751b8d2acfb807c06ef9345b8397d38de47e14fba00a668011bf9979da9b7c12618a4ae9f6020dd27739766697e3a5d8bdcdd43517be0b67d07e05964d6455d80b54bf28a0a3bc9d871465cf1ae1d469e3f37447c4fd2dd13fc911cc6d6e688387f38839b778adb5294f04ef278782c619362b84d9f9661be78af0350b06c7b8bddf5ed99e3bb17f771c4a27b3c1f728a448808f3fd5dd1ac3b44cfd30b8e8fda315795e27adf3f6778c30a8f5c10ff72345956f5f9a675687d485ab877cef8290f28202447fffca218583ff9d296a117a56319be677725022f8747ad3afa0f0e6501872e7c7176e1e3348b8a1439d31304f59363b094859f3e398e4b5275da847506c403ae4e435485184791ad8a11e516e1838f539e9411664b6978dafc05a82a025e59ca14a37e3838496b631d503ab75581c1cb9f26a936950fd97e1d30c4026c8ccac49e6388958089c4d0442e36b1151ebb8f4c5f051070d727f18a747b68edca6b7befcf5964d5596f6b31eae1934dcfc445e03ba076e1deb552db68fa9771c2f5c6b3cc3642044bb9788c3c827dae1a6e73e253706c856747170cb3e62d5de3954d3c7aaf6ebcf40b3df74d9058346ff74e364290fef7934af5da471f7fe3f90dcdff1117e45c0c56864a7245fb0f31dbd8d92cd1a06b3258ad67a382b2114e8f5a02fb7e345c9c4f857adbf2e893240c9891893917e9015527c903f4321f51c8c210f5c77370d6116f03c81618a13a222dd9f3c151165ded653d31ac67caa98a1058f71056cd17bca361db767391d7553dada3a8c703453875efb5132da5793da1215a417bccb7c9e817dd8f0053973e24be42c20ff7395c71dbd4aa4d90b85473b8b997e3685226d20220dc7c84e7520915a7908f8d89f7fedb52c80906e5263dc41a892c53bf1206decc1f77af622c5a9d0929c6f7404e4382c8066aeef46760220f9a1eabbcb224605bb1f091ca33681a5077407b83daf1c62fbcc8dbcfd7822988d7814dea0bb3224bea82282198942fbd89b6f7bcccc2f1c6404bd8992586f0c0ae9642d67e681fe1e80abb053bed2baf26c2f43f97de05550d4a8e859edbc80901fc22685d76274b484d99054b7f3779730fde394dd0573cc73e38d572122a8c0c29910030840654d70f718910f1356b26a7ae7a52b6b27040780ab043c6b48f86ed528d69725902ca18c11939c226b0888b0a080a3fb29c4285d467357c7802d7ea4798e6d683b0fb9bc1201bf307ca2fd34ce13d22e7ba5adedadea176bc83dfd8d8f8ed155f160a2d9ad8a0c5546d511e3c2d2d2f47a2ce8c047a26cace25aeaa40cc109271b9892b79aa73a3bf27201ae5d3ae4ca8dbc4afbb0d36133773c55c99daef0ceca7b30a889015c7bdc9ffc96ff34cd72c2ce35c552df85c6065ff8e02b135490f7433fe66471d07da713d23fd99ed7b1bf60f35fe50527867db0de3c70f7d9f1ba5ad31aa75c3d52e58f7f98f7d6e37cd46bb2c3696c34a805f6dcf1c34bf8852ad27d66004ae4b4efc2c676be9ad98278906f85e00e313fcb39f8343fdffdd82a558d39c1758e54feda77feeb7a532764d34d96a99db4ab7ee3409511b671e07d8b4f3bff6951f604963ee4834fe14082028b6454b3074fa2820ecfb09949efe5e2deca6300c5f1a655ad31e017edcda7243bfa6c879d21fa5d91dc5f615450cc6a31213329ee51d9025a5e3ad3dec672c0729e3de1e3c6d471a986d1ca5b07d755849870d165bbac7f342e691d9ca5fa4b0c9efbecdd9e236f6437871fa2b934b9482be817885559a2cf6de5104b81105ef22f2cda73f07748fe8d0bfbe5dc6dde6a10021c87cc8df1b7967920133bec86e78f18207ed6e05ea35e39b309083a7c8d35ddf3af2f81a16658bd8f7b14e92f9006f858baf1bed927f4dda41bd7a1f83c20d89ee1ec3237693c2ebcbf5329fffd7593ae310ee51e9c9d84c2ddc7dce9acddeb61902c42afe1232aefbbe4adf06edc93208bf9b7c6304fe78b90478ef3faa4f564c75d010dfdf575db0470f4ec638acf9f6c0ee9142ad608773d7ef948b14c8d08aa092a830d315d035d7e15f5c778958bf16f7e57a7d3eca83c1ad52b7c849ffc126068d2a57799a3f8d6ac85433183873c2ef9a90cc4bc3a728d069d24b929074223733552270a5a141ce51c7a8fce54c46bb04347db2fee386619a3168cd76716666378f75bc8efc67399b7d91be4634ffe08e2ba55456aeedeb71c2f7191749b5b75dcf4a2930625cbd66f41df1462b9b58f7a82926b121f73582815f478c9d5610591180093b456db3895572225ff245e9c1073da3307ad7aaefc1aa5d1d101179d64b79374683eb1328ead164a1f0996221fa1a46f2274e6b62a576e2778d47bbc7d3cefe9c00e08d7fe78dab227a49297fa413cd572b42fc6812624ff5df46ae8601315515b9fa15147de5aea41b428ed6a181fe7cee4da096430c7e1e782f506bd3b2a22cee9be1d6190d138a74cb4e377a25511e293deb98a50a6324879e283a7dbeddbaa0719b242979141c6293d800512b2885eaae187173dadb9bda69d6e0aa182af0eb5aa268b41536eba2debd70cfec82624f69ec91d504aec4a1ffc7e3d112372e210e92ac3bb2b5e6e12bfcada147cc235c059851e9b29f79db712585ee767a2b79430d14a5741cfebba4da9031e24fc7891c4b9a3a5593eacccb24f54a6edfa47429900958c32c550a7e17640c3f0467d70792dc0c48a09f94e8b3789785f33eb375d1547314fc7e2699254e3721a940598af01141f51799313d6ca01366ff895c5dd2fc3f7bad3316bd98985fe98d82e227b8bfe25c9bb7b6df7d8ce8e430ea3b391ca7741c3e76de039bb360c23b6b31578b117058536ff044dc1e06d1731155387ca1d151f469e5662f7ae7de46518280162638f2499ebd053c18e366fb6e5dcbfd64e8fd339aa2c24f415de8e2aeb298ad6a310e150801b96bd7c83976b1efba2230d4ed3d2287819a68b01cd5ee56f17864f7de433a19286f41d021ed6d751a675ffae6a7ebb086856a0391756da1dadd4e7d72fa9e5511dc5a15ee713c2ec2a7c93be8abd8eabd4950aa9ec58e826fab630071da760ab1dbd6ae356f76c4946e96f9fd9ecc2afdd05b91be471535e90862a3ba9199d436e236de305ceeae0d144593644519ef1afe63edb6a76a60f73da4969c98bd449083e4018730117df550a38156fe9c51190177972fe6582896abb21e6693bbce89db6f826f6e3c4bbed762af2b7adda929c48031d4289e5451909f041157c3b093ec30ac3ce3f04ba7a4940be79664e14bdbed9ad1e3e9ac0e524061670babba033e23040015d13a946ec667449889c35fe0e5fd2947afefdb42d73b4811c4b0bfbc08278dd7866ff22591ee0beab5cde128b06cf8a7c81b8d9bdb3ad682724597673f822e9250b854439153b45e9d6d02829c369850c0a60b547ccddaad4dd8b2a11a62e1cce68d250bd715b658cba2076f8d2e7a68cb8c5ce6584999776a4d5073ced21be9b05832fdade6c0a94d3eaed724291df7d60af9a74eab275f11d5041048d2bd6b2b93f0f09667b2e1932b6bf4902315ff171900d15cfc31e68385149198fd8a5e99de09fb1ec71ae4ba54e3d802812bafb7c73bc02957b6b4bc0b15c9e7f7216d84fc374dd00aa1446e71592c3c1a39cfc628046796e0a79f4d345ec8b4c1cbbc2f12b8a5d66cafddd9bf45c69ee53f6b4728b5b5ef1ecab488deaf6df7b7603aacd85c7d14392fa1f72ae02a93e66ddf6a1676185e8437aaa7bb09fa1c276867059418e274d87e61354494e8c51864cd44e965be84af68bc6046d8da5ad5bd4a407ac84c296a0b0d34cf731b512748c013e7f589f3b568e071e401493faf0bd7dde5e3bcd14ef17537f0c2ba776047799b9b35717b20d15f0e6f0af8ed12aa5a2698b2b2d327470039df1e54cae7a83bed8b3f6401184238fc550742a2d5829cc3ab8797cb5a8afe01716560235744af8472d67caec958b4b8e1472aa642ee1a5dc4db71538dacc0a3c70989a79eae9bce7c39dbd46c936e98ff053d3dc35a4b3dcb88b7f8edef33f05645c66fd4a823e4c5be7ac44cf06b9c638ab558fe437ba6f5f018650a99986da2933f9fcbe00e9f0e78eb813580f3629b1710d6d0da6e2b01cb1a14361a9c8be386e794ee0b420303e65953ebd42a1b3872b7ecc52e35f7e9582c15c937f28fb037bed7842d5d3a1bcdaf77617bcfbde48b8b42df0ecf20060d97780fa02ebe631cc1b63856d3e35b71cef7a7c173cacf68023c95f2a831efeed6d52f7f7ecc00e1a73f75636af021fd3f80bdd494e8ec7038c7aca48ec902871689c7710ddaf3b484611d3e5e191081efe164c1f54b61f524424f30f507c77084536f72a5e357c87b53c44ab425476c1a1c8aecce95a7e7426c64f9ca2fcf7cd043975e3699f4f3955053c261643e9cd5a42ac472b904e7dec3fa333201feb0dd31ef21bac0803b8d4674ae0b42d2c619701bcf4593736c7b26c129650ad65c48f63279ff64bbb7533b00a090962f7951facbd567d0dabc4ba960aa3a64cbb9ccc603b9bdd9610f11ad2c20656eadaf374ad08dc0c13f2e2f6647beda358688e1d8a71372fa9e0f2f61b0be68e5a62e6c1bafaa47d9b86d28e91e9f5c67fc4df6976618f6c85fa82d1aa1533791979e63764debefc594eb4c7ceccfa3d5c87e26998bbb09545c07c160007cc876be9c8adbe2b7e2f1ec4cf4336cf50c340cdd632ed2d9f9f61e1c6c8489b8cc803d48eba534ce8104fe50a58e0e1e615cd7fa4f41639b269db40ca22a04a0e7456f237de895c05a8b9137967ae2e0861cebc668203f28d5f42e751b360899c7b4e86b5fa69a93daac17bae1d0249efbc01e5429a72cdc631cacfd1419c55ce7d134a220b5999112fe79e8f516855bde6c1ed7624fea0fd5ce16a12c1051949ef023368e09b67f56215426581ff0a7c76b6ec60441d478eb63546ecdfb56465dd8ae720a1759aa760e01bed6003c2ed97aa0b04292364c263b609ff216f450a2605e55a1d27b80343f4b1794f238d75b20e9c3a43cae306b9ffd43c2c09a49f9bfa367e588155b78edefd75aa06edf9cde7446148a7c1166460eadf32c8a30d867a5cfd51af056a4c95e1059028731eaac7f141e1b24a38a81f695802af1691e935a078afd15f874131dfcc44ede9369f9dc85ad3559939b5e402598b3a94109a6aecba7dcf2246437e942b75a76fda18f357ccecf1940873264830eb61ae8b4333c3870b493eb721af3ef5979138f8cb74e04f5c803c02b07e21f4948d8f6b00d08e48b9d045cc8eab5f565165383a68db0f0787d2b714fe66ce17cccbdfbea9a31884610012a1c5edfdf959f14bb412424f7683c91590f21c554e9e6a0dcb508e3f2bb0e779e1d00f7ac4962c12ec56e2a1b1bb59c3969953e5cb4c112ae4608c0210e84ba6ef1aace2cba0a8f648f804885409cab884606fd1f490b6ed7b542fcd061b434c3eb1ea3279701cbe6a8d4a5ac533b23e71ef4718b2afa65ced3824ad28a5bf704792f7d33127cfa954ed70170a106a81f5cd01adf5cd4bb970a289667519fed3c9587ab4458f5a8a575067401fa8aa6fc1a825455d74113338deec81111f38daa4575831a110cd48c458c3d7b89d45fba89361796196e1a0ad4fbdacbed8b886e5bcc3f888a3c396f039bd37114bab5ea40e75fc13b6db01b488ef910970301061d57915eb1916ba9bc08fe6b2f62fc7436b94be3f95aec0c9c85d655acf1dda447891aba7b6f327f48c3e04642a50e4d5c33a213cc9b07602ee894a824d224e25abdcb867ca568da19a4ded462e30d95d246098c180050dd4d3df2429caa37119647c5c31f852a484266033f7297f05aff5bbea54e8b626e56f73a577ececb58265a0c167d63d1b0efcd55ff0f388c62a466733003acc6e454e24ef708b662210d4cb7758fcba458757e7eaaf1cda1538294259e70e336811d2ad2591cead15bb57892ad585e730deffcf2e63c46a7183c4c1b13350275e32f9f93b8689fdcc3cd9722dbe4f7f173f4b1718801472f23ccabf1c83c238d3305a2678b4e06ef2a222a2a072ba26b51aa7e0bb7dfb053983871daa004dc8a1fece8416f1fc35e7e8f2aa8a55d0cea78b3da8acc2db0c208ac299863f35455e28c41b87bd356f1d7280239072a102eadfdefd90d15404364c8b7af38533a9153744b2d14e4740d19e4b2259f1b3cbba20172256a8f3df346435bacafb9c061ef412668ce4dea361d5be707f8181fba27cc7112560d0af824fd54b6c0d7801217c9afee6483b9977e0d62932d4a831146749d678f93a44ea837fa5bf080fe9369ab625ed06f26819c7235cbcca03cd9df65c2c7258440d1f04036f3cda7ce1d46903adf7d42234b1047a98f2d903f97b4ca210034cf10bf29a3e8768fb0a09efb9c9b18c317ee73b4bb67e05acdd4d8f24989a46205f4f309ac868001584ee5e930729f2dab6d5a990dcb8bebbce958cfac1a53cb337f7dd7a4a6c0c2037707cf649ea67857a62f2dc4eba212a02cb3698e5fb2dd36993142be77d36474ea2b673ce6f07010264650bc5a1660d9bee45d5c62a65c87e0f833c330961efa07495827d7c7d26c6cd23acf6e06181eec4faab3317cab634c2792510e0ac4831f7fe9006129372831fd52e2b8eb2366406a2bbc98745147815f79c406feab3d9b605e7476e00429cac5e4fffdbd7b85bb36d5cfaea1c1786f7180e820db0a5802ab20d6901a45f45fa8f85a5c4d7131788efd03e629dea5ce85ef86bae982da5723fca7092818fb2131bc665b5e064b54f9047a1b460a90c9420648e0f6513df465e62d1bd2c15ce740b8824f33d85fdb4cc5e62358cb64528586e528eec0fe22cc886f3fd2cc5b00333b6ed772a5b9f4eb0c70d616a7bf86d9ebc9c6a3ee362d6fb90bf5eaf0d415b3637ce88f0f06d03bc5e5389ec02063be8ed2970a1b3d53dec145adc1c61fd66f776e7be5f32be4800d22b2a3e5933e658e6457c2096c74decbec6bad5ff265235f948a1534d4b1cd6dc8e96e3e877b96b61a81e14e6e0793de76d9bd68d5549b342bf9a619e7f93d61d0a9d16f322d1119309c9d673be79a880c386cefbbbe8cdd77e018f31a123a67a1e8e62740fc84a65d011d14f1438148acf24aad984d4c935229e82415ebad988a1e88bbbd49d969a6c25beef4dece9476c8fba5211255b43c14ada69e17d3cba8f44167122ee780ef760cdba67d21dcf0b5a09afebf72cd3064467f0085e786b97f7491dd1a39e713e557334648f0879799a93e96333b9543ba1171c31f2fb942b057f0e5d72f6fe9fce9e74decc97c3884564a3d8b0ccc4a5e82b6f496238aeba96905358dbe041e2f3de96a33a3e49bd92b0b9bc25c3a6a167a72361fde6d2b9f48d3e933a7d1d777fe8a1f0018fa44b9697e64ddcc531020f2bb0d4254f0412d364559cd886e74c218a02121415549988c4ddc1457d07746b4ac537b824db978d3d03be340ddeb72b4ac0299fb4ad8cb101e593e5f675f483483556b7f3de12143922ee7c710aa40d515cf764a220f6a12b286832ec967643dd19a2bb49e43189a6414a2a34dd5172ef5a93938aa5bc33a45c6cb2731ed3ce74e45256a25bba004566984af098829f710d624828e9fd1886fc31ec6a03271eba2984f5d6a92dd9439f7d83984764a0b4f7628f54cc51581a4d8268fa1bf2dd549b28ab2afaf915fca9cb311e1e5392f70d9c11e82babe65c41578b92ceb90c4f7ee553024caa270ea8275ae15f11df4b09f95d8ea5306901cf9ac9714ba6677056a4ad60e32e38999d2135caeea1a4c301edc03aa9e12f3462bb944f6da5ac53484a12e7407ed8e2f7c3192cc384940112122477eb966d8c6355f32e567f0a7895ddff7c4243709a789eff469f94086928af949f617ae9a18e6ca2be31a405abd0efcd81adbe0d944df979c5f65f4db69b934b3b0c6aff8562291801b3dfe0a3907d3a0ea9341ea8b324b618442fa41e891d66e17280dc83ca3b617f123605e0cfc73bd0c9d289d35a99c887d628e50e08156d3c4338e82c55c4d8c759913e0a96749e4ae31168c93d3cfb77f27bbf97bb6d467b365403c5e7a1f8052462ba82006c157d7f22f5042de4f5fdd0232c41b40dedcd7be63e1172dbe0af1c0028fb7cfcf4f1b9abaf785f4191c8101a44db4f223c71e82992db714eeefa6fd7cd140c63256ff53f71838d3d9cd631618343f682885ba4d32e929e1c87bfcd2a2bb8630ff8f731e023ac209dd210a5d568ac69976da3c8d8db56e755643149aec0b83d4eff98b134de3e3e67f2890b522e07bde405211b3582ea559376803962aa13ee54b827d39aa803439637f6b9de2aa1cc3031e79a5b35033b981b2c0cc877da74401145f487b9ff7246ad6b241f8761d7346a5cc66bfdb13c8c865efe1905feb1c35f516eccdf29777ff9b618cb80999e29ff440617b5c436efb0194ac1f0a4e91110a1aee09a695d31919087c3d4c8e44895fe7a97a9f136194ef924efde55c5a9e397fb552add8ef6742814bdb51f5e0b50c14312c6fdfbc83cacbaee6edf04fa4d366afe263ca7a36c0c4d02cedbb01e4c511bdc9cb2da19cf6a8f3eb002284a84d406cce2d6baf9fee7d1ac7535b1c09d9e289ae1f247e90e1eb70d00", 0x2000, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}}, 0x0, 0x0, 0x0, 0x0, 0x0})
write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x8120a2}}, 0x50)

[  635.874192][ T9214] usb 6-1: new high-speed USB device number 12 using dummy_hcd
[  636.231732][T20898] xt_hashlimit: max too large, truncated to 1048576
[  636.238903][T20898] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:45 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x1a000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  636.345874][ T9214] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0
18:32:46 executing program 1:
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r0, &(0x7f00000041c0)={0x2020, 0x0, <r1=>0x0}, 0x2020)
newfstatat(0xffffffffffffff9c, &(0x7f00000007c0)='./file0\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
umount2(&(0x7f0000000140)='./file0\x00', 0xa)
syz_fuse_handle_req(r0, &(0x7f0000006200)="390b7b5f3c1c744fc0141e4b56a3a96e12b16e2af9eb47ac42dfc420b3646f5228f0f2222675f5ae6f28e5a6051a8d49e1f7b0b6b2b4d9ec1d127b1992ae3db96965db6c06bd64c7baa0c321e5eec19a6522c7ffff088390da9dc5d9f3139d921d07b97392283f9c741c478f6fe3a07eff5c4c51ab93bf74e0b42ddd771b2fa1156b8b145cd361546afcd796ec3a7cd93a423a5368df3dbdfadd176b4cf6709243a0e4c01d75d5e92d64a31602f2997e12607813f05ab2b07d7fc9e1a5491433bd331aa1a77a54985827c656f3a2ddbf98e5728ab9b01254ef24aecdafcd52d31d28a2a70567501b3257ce080f0f8d1cd0cb2cfef8e5f3c1beda585d4916f5e3d7c700ac9b78f116f415b977518045792f3ee0403cfe454b90203a211f81fb8110ee7618e127bdf814c33ddc956aa75df9634efce9e374aa26c12e6103f73fed34fe1929adbf6fb899028fb32a6a8133ed0ac3765ca175c375e77c23c2b1c6417201979ee10d13f7d1733d49fbba19457c01b5cda0cc25b66da55729267edf125dac7e6799f49217576141a713d109cacc85fe0b5802df09407bf6058c3a808e3fa87cf05aaff9352c1d3c887a0c132e8c5770ac7b8e855f52cd34558df30d480cb450747a7ef170ae0e7fed6323acdafa4d094cb0b85828ee5df34c26e6cb3bca3a27ea705f1d9019807e3dc041cbbd95cff1ba77a9a7c022dd1ab3bc43137ff2475f1f091be9a9974684f7bf761c7a13d46c3c522d6fdfd4c93f81f1fa70fb24e401a4ab0f9b6e562756c08cb3f981da103fa41317052e302099ba6a1660aed84f71c7401daf13eea6692434192061a6bca16e20bcccd45c45dd95004ef7ba3e6969ff93d1f136d89333d3c76c1fd8f3e02b918928ba56d79693f0ae6b0d41366f24db42957a94de534c5c44b3c7c1090e63301c72e1af2ad37ad456508a7230a8f105c8bdca99aa039cdbf34ed4e5b006a87bf8dd3fd3d3f2f6309b179e303545cb02d5ba2bf97b995da4382e720ca45806fc0839f3d125dbebf60992c5c24629f46520110cc224c6f3df86a3bf057e058d90caad1d186d30ebcb3331d30e5d7a8f0f304c93d524c5f31da655c225e06b5b4f7abbcc662960272a41d4aad9ae2e7614b6a6c5c7069b1f3224cfb909e1976eba54be638b9205f4068edf8716a97cb8440c64333886ff29a9c9f8333179044e69ac34de6ded4604b23b2afdf829a7693ce712d3c0e915bc2e1545c826f91faaa6fed91c825612b55355c3ee2fc769f80cb84720ce191572295b55c806a5846b0dbfb640a0550db54f5483a1fcbf233810ef8b2a7ab2ba86a43ed883787cf31e4ea73e803f8026275f8cba9047e748a489890cd51147113bf2eab55d1b32eb136bcefa70999fd3c384221840cfb923c09ff19a514a326683ffc8135c92474591ba68001b4d3e1acc801a0632feaefaf5e83fc4e34a35aab966d746605f66ce270b9eb6abe5a3591b8110b49dceda30e0d5cd6b2c7a74a94e8a4dedafa427b77b26cc0fceb424fae84619ef0a84430882df19714e7d0b1142b547599d1de69b362feeb4245515a0b2e5eddd782579d924578495dd76b4723ec42958a511cc96e3bb6a57f1a88a2997ae288641ed0bfac356b59a4773a9add341064e44c83f060e0c24be7551efb3cfdd40bc03a156174bac2a6fc92e47be31ea6974e548b8619258cdbb6087c08f4f86f33693c2e1e6f3b21f987459d3b3faeecbac93832712d92eb24362ada8db02e95df8f6938b56c75501498e4fedeb2f0737eada4ade1c53dc12d34a7b1dac3bda4f53858d3a394a59773299c550dbf6c0ceeeece3045676edc57f98b73c2cda557e767795a532d1fcc6caaf277e01fd53af82c04227e12de80fc03c525660a0581d13b0f62a891c9c38d9d2f37b18da6eead8f58989d1984d8c378abcadf7dc76e71a68fa9776ab677c8189491b08bd593ab0025891d4299e1351fb06d6db9c8098d331533f43aa9a61301ef843a95bbc7de28f228579b418141925da789eb361208e65ed44f74a1a7157f6fc51195d99d673ed7da6a480f7e009ddb7744b716c14666d0ff0219d796ba07c499d7cbe65ccbc5d8ce18c8df28b3c1acb6b88064fb1b9db5aed201f9175d3127cc21b045d3f26fe9c18f764860c41eae45ca23a848bd8e69a6d162d43683d4dfc35a3517ab3d3cb02805987f298f87119eb773a837a5e36d42ba9dffffa9b90dfc8771fc50adb92aa81b89ea0f637634efa4285206cef527a65e8811e83600b6eb9da5f686b7aa5f73bbb44859c5326100d4799f4751cd6a3837eb9d7127081bf66675eb4bd477acec9be81491d27662da33689ce0dd87fdd8971aaf70940cc70af2566ea6e4778590bba6977a930e543f32bf074ac8866d32a0759ce8a629631ebbb53fabbbdab4c897b2739ce96ad0b9c03fe4a764f996757cafc058dbd7f9129b20f9ac4b97739a5d3dc08d15c480772342be7eb0da96886a5e2428cd2b0c3783fc90d9ef5811b60fb2d4350eb24022f91f9441a43c855b363a38ef6d67032a38e8ca3f971219efbff6ffaffc8c40e8b842a45b04696ade9740ba68a0c5144cde666052f0de25ee604d791435c4839baca617dbd016f1d01480e9fea8587503a2a49bc0a46393196b9c493f1cddb281bf4b5afbbf007e0308615bcb7351877ec030767e362ffdaf9fa6c7f56aa28beec40bcdc2a35dd20009abb4813cd4fe52ea18a3851cd1aa7beb759b9b7459223d0507d83fd1e3ea2e22857a2517b23605ccd9ada4da111f0a5c355e606141e4429c8313b1523b843c235e2a3ba58e0c8135a5c39fb79a72a3b80680f5688c4556dc532a86ef60db77d4f6e3e38f0558cb1cef1a8c97b2f2ee23abdf65cb2ad28612ca1ea9b04e3c513ab169f9b46e7751b8d2acfb807c06ef9345b8397d38de47e14fba00a668011bf9979da9b7c12618a4ae9f6020dd27739766697e3a5d8bdcdd43517be0b67d07e05964d6455d80b54bf28a0a3bc9d871465cf1ae1d469e3f37447c4fd2dd13fc911cc6d6e688387f38839b778adb5294f04ef278782c619362b84d9f9661be78af0350b06c7b8bddf5ed99e3bb17f771c4a27b3c1f728a448808f3fd5dd1ac3b44cfd30b8e8fda315795e27adf3f6778c30a8f5c10ff72345956f5f9a675687d485ab877cef8290f28202447fffca218583ff9d296a117a56319be677725022f8747ad3afa0f0e6501872e7c7176e1e3348b8a1439d31304f59363b094859f3e398e4b5275da847506c403ae4e435485184791ad8a11e516e1838f539e9411664b6978dafc05a82a025e59ca14a37e3838496b631d503ab75581c1cb9f26a936950fd97e1d30c4026c8ccac49e6388958089c4d0442e36b1151ebb8f4c5f051070d727f18a747b68edca6b7befcf5964d5596f6b31eae1934dcfc445e03ba076e1deb552db68fa9771c2f5c6b3cc3642044bb9788c3c827dae1a6e73e253706c856747170cb3e62d5de3954d3c7aaf6ebcf40b3df74d9058346ff74e364290fef7934af5da471f7fe3f90dcdff1117e45c0c56864a7245fb0f31dbd8d92cd1a06b3258ad67a382b2114e8f5a02fb7e345c9c4f857adbf2e893240c9891893917e9015527c903f4321f51c8c210f5c77370d6116f03c81618a13a222dd9f3c151165ded653d31ac67caa98a1058f71056cd17bca361db767391d7553dada3a8c703453875efb5132da5793da1215a417bccb7c9e817dd8f0053973e24be42c20ff7395c71dbd4aa4d90b85473b8b997e3685226d20220dc7c84e7520915a7908f8d89f7fedb52c80906e5263dc41a892c53bf1206decc1f77af622c5a9d0929c6f7404e4382c8066aeef46760220f9a1eabbcb224605bb1f091ca33681a5077407b83daf1c62fbcc8dbcfd7822988d7814dea0bb3224bea82282198942fbd89b6f7bcccc2f1c6404bd8992586f0c0ae9642d67e681fe1e80abb053bed2baf26c2f43f97de05550d4a8e859edbc80901fc22685d76274b484d99054b7f3779730fde394dd0573cc73e38d572122a8c0c29910030840654d70f718910f1356b26a7ae7a52b6b27040780ab043c6b48f86ed528d69725902ca18c11939c226b0888b0a080a3fb29c4285d467357c7802d7ea4798e6d683b0fb9bc1201bf307ca2fd34ce13d22e7ba5adedadea176bc83dfd8d8f8ed155f160a2d9ad8a0c5546d511e3c2d2d2f47a2ce8c047a26cace25aeaa40cc109271b9892b79aa73a3bf27201ae5d3ae4ca8dbc4afbb0d36133773c55c99daef0ceca7b30a889015c7bdc9ffc96ff34cd72c2ce35c552df85c6065ff8e02b135490f7433fe66471d07da713d23fd99ed7b1bf60f35fe50527867db0de3c70f7d9f1ba5ad31aa75c3d52e58f7f98f7d6e37cd46bb2c3696c34a805f6dcf1c34bf8852ad27d66004ae4b4efc2c676be9ad98278906f85e00e313fcb39f8343fdffdd82a558d39c1758e54feda77feeb7a532764d34d96a99db4ab7ee3409511b671e07d8b4f3bff6951f604963ee4834fe14082028b6454b3074fa2820ecfb09949efe5e2deca6300c5f1a655ad31e017edcda7243bfa6c879d21fa5d91dc5f615450cc6a31213329ee51d9025a5e3ad3dec672c0729e3de1e3c6d471a986d1ca5b07d755849870d165bbac7f342e691d9ca5fa4b0c9efbecdd9e236f6437871fa2b934b9482be817885559a2cf6de5104b81105ef22f2cda73f07748fe8d0bfbe5dc6dde6a10021c87cc8df1b7967920133bec86e78f18207ed6e05ea35e39b309083a7c8d35ddf3af2f81a16658bd8f7b14e92f9006f858baf1bed927f4dda41bd7a1f83c20d89ee1ec3237693c2ebcbf5329fffd7593ae310ee51e9c9d84c2ddc7dce9acddeb61902c42afe1232aefbbe4adf06edc93208bf9b7c6304fe78b90478ef3faa4f564c75d010dfdf575db0470f4ec638acf9f6c0ee9142ad608773d7ef948b14c8d08aa092a830d315d035d7e15f5c778958bf16f7e57a7d3eca83c1ad52b7c849ffc126068d2a57799a3f8d6ac85433183873c2ef9a90cc4bc3a728d069d24b929074223733552270a5a141ce51c7a8fce54c46bb04347db2fee386619a3168cd76716666378f75bc8efc67399b7d91be4634ffe08e2ba55456aeedeb71c2f7191749b5b75dcf4a2930625cbd66f41df1462b9b58f7a82926b121f73582815f478c9d5610591180093b456db3895572225ff245e9c1073da3307ad7aaefc1aa5d1d101179d64b79374683eb1328ead164a1f0996221fa1a46f2274e6b62a576e2778d47bbc7d3cefe9c00e08d7fe78dab227a49297fa413cd572b42fc6812624ff5df46ae8601315515b9fa15147de5aea41b428ed6a181fe7cee4da096430c7e1e782f506bd3b2a22cee9be1d6190d138a74cb4e377a25511e293deb98a50a6324879e283a7dbeddbaa0719b242979141c6293d800512b2885eaae187173dadb9bda69d6e0aa182af0eb5aa268b41536eba2debd70cfec82624f69ec91d504aec4a1ffc7e3d112372e210e92ac3bb2b5e6e12bfcada147cc235c059851e9b29f79db712585ee767a2b79430d14a5741cfebba4da9031e24fc7891c4b9a3a5593eacccb24f54a6edfa47429900958c32c550a7e17640c3f0467d70792dc0c48a09f94e8b3789785f33eb375d1547314fc7e2699254e3721a940598af01141f51799313d6ca01366ff895c5dd2fc3f7bad3316bd98985fe98d82e227b8bfe25c9bb7b6df7d8ce8e430ea3b391ca7741c3e76de039bb360c23b6b31578b117058536ff044dc1e06d1731155387ca1d151f469e5662f7ae7de46518280162638f2499ebd053c18e366fb6e5dcbfd64e8fd339aa2c24f415de8e2aeb298ad6a310e150801b96bd7c83976b1efba2230d4ed3d2287819a68b01cd5ee56f17864f7de433a19286f41d021ed6d751a675ffae6a7ebb086856a0391756da1dadd4e7d72fa9e5511dc5a15ee713c2ec2a7c93be8abd8eabd4950aa9ec58e826fab630071da760ab1dbd6ae356f76c4946e96f9fd9ecc2afdd05b91be471535e90862a3ba9199d436e236de305ceeae0d144593644519ef1afe63edb6a76a60f73da4969c98bd449083e4018730117df550a38156fe9c51190177972fe6582896abb21e6693bbce89db6f826f6e3c4bbed762af2b7adda929c48031d4289e5451909f041157c3b093ec30ac3ce3f04ba7a4940be79664e14bdbed9ad1e3e9ac0e524061670babba033e23040015d13a946ec667449889c35fe0e5fd2947afefdb42d73b4811c4b0bfbc08278dd7866ff22591ee0beab5cde128b06cf8a7c81b8d9bdb3ad682724597673f822e9250b854439153b45e9d6d02829c369850c0a60b547ccddaad4dd8b2a11a62e1cce68d250bd715b658cba2076f8d2e7a68cb8c5ce6584999776a4d5073ced21be9b05832fdade6c0a94d3eaed724291df7d60af9a74eab275f11d5041048d2bd6b2b93f0f09667b2e1932b6bf4902315ff171900d15cfc31e68385149198fd8a5e99de09fb1ec71ae4ba54e3d802812bafb7c73bc02957b6b4bc0b15c9e7f7216d84fc374dd00aa1446e71592c3c1a39cfc628046796e0a79f4d345ec8b4c1cbbc2f12b8a5d66cafddd9bf45c69ee53f6b4728b5b5ef1ecab488deaf6df7b7603aacd85c7d14392fa1f72ae02a93e66ddf6a1676185e8437aaa7bb09fa1c276867059418e274d87e61354494e8c51864cd44e965be84af68bc6046d8da5ad5bd4a407ac84c296a0b0d34cf731b512748c013e7f589f3b568e071e401493faf0bd7dde5e3bcd14ef17537f0c2ba776047799b9b35717b20d15f0e6f0af8ed12aa5a2698b2b2d327470039df1e54cae7a83bed8b3f6401184238fc550742a2d5829cc3ab8797cb5a8afe01716560235744af8472d67caec958b4b8e1472aa642ee1a5dc4db71538dacc0a3c70989a79eae9bce7c39dbd46c936e98ff053d3dc35a4b3dcb88b7f8edef33f05645c66fd4a823e4c5be7ac44cf06b9c638ab558fe437ba6f5f018650a99986da2933f9fcbe00e9f0e78eb813580f3629b1710d6d0da6e2b01cb1a14361a9c8be386e794ee0b420303e65953ebd42a1b3872b7ecc52e35f7e9582c15c937f28fb037bed7842d5d3a1bcdaf77617bcfbde48b8b42df0ecf20060d97780fa02ebe631cc1b63856d3e35b71cef7a7c173cacf68023c95f2a831efeed6d52f7f7ecc00e1a73f75636af021fd3f80bdd494e8ec7038c7aca48ec902871689c7710ddaf3b484611d3e5e191081efe164c1f54b61f524424f30f507c77084536f72a5e357c87b53c44ab425476c1a1c8aecce95a7e7426c64f9ca2fcf7cd043975e3699f4f3955053c261643e9cd5a42ac472b904e7dec3fa333201feb0dd31ef21bac0803b8d4674ae0b42d2c619701bcf4593736c7b26c129650ad65c48f63279ff64bbb7533b00a090962f7951facbd567d0dabc4ba960aa3a64cbb9ccc603b9bdd9610f11ad2c20656eadaf374ad08dc0c13f2e2f6647beda358688e1d8a71372fa9e0f2f61b0be68e5a62e6c1bafaa47d9b86d28e91e9f5c67fc4df6976618f6c85fa82d1aa1533791979e63764debefc594eb4c7ceccfa3d5c87e26998bbb09545c07c160007cc876be9c8adbe2b7e2f1ec4cf4336cf50c340cdd632ed2d9f9f61e1c6c8489b8cc803d48eba534ce8104fe50a58e0e1e615cd7fa4f41639b269db40ca22a04a0e7456f237de895c05a8b9137967ae2e0861cebc668203f28d5f42e751b360899c7b4e86b5fa69a93daac17bae1d0249efbc01e5429a72cdc631cacfd1419c55ce7d134a220b5999112fe79e8f516855bde6c1ed7624fea0fd5ce16a12c1051949ef023368e09b67f56215426581ff0a7c76b6ec60441d478eb63546ecdfb56465dd8ae720a1759aa760e01bed6003c2ed97aa0b04292364c263b609ff216f450a2605e55a1d27b80343f4b1794f238d75b20e9c3a43cae306b9ffd43c2c09a49f9bfa367e588155b78edefd75aa06edf9cde7446148a7c1166460eadf32c8a30d867a5cfd51af056a4c95e1059028731eaac7f141e1b24a38a81f695802af1691e935a078afd15f874131dfcc44ede9369f9dc85ad3559939b5e402598b3a94109a6aecba7dcf2246437e942b75a76fda18f357ccecf1940873264830eb61ae8b4333c3870b493eb721af3ef5979138f8cb74e04f5c803c02b07e21f4948d8f6b00d08e48b9d045cc8eab5f565165383a68db0f0787d2b714fe66ce17cccbdfbea9a31884610012a1c5edfdf959f14bb412424f7683c91590f21c554e9e6a0dcb508e3f2bb0e779e1d00f7ac4962c12ec56e2a1b1bb59c3969953e5cb4c112ae4608c0210e84ba6ef1aace2cba0a8f648f804885409cab884606fd1f490b6ed7b542fcd061b434c3eb1ea3279701cbe6a8d4a5ac533b23e71ef4718b2afa65ced3824ad28a5bf704792f7d33127cfa954ed70170a106a81f5cd01adf5cd4bb970a289667519fed3c9587ab4458f5a8a575067401fa8aa6fc1a825455d74113338deec81111f38daa4575831a110cd48c458c3d7b89d45fba89361796196e1a0ad4fbdacbed8b886e5bcc3f888a3c396f039bd37114bab5ea40e75fc13b6db01b488ef910970301061d57915eb1916ba9bc08fe6b2f62fc7436b94be3f95aec0c9c85d655acf1dda447891aba7b6f327f48c3e04642a50e4d5c33a213cc9b07602ee894a824d224e25abdcb867ca568da19a4ded462e30d95d246098c180050dd4d3df2429caa37119647c5c31f852a484266033f7297f05aff5bbea54e8b626e56f73a577ececb58265a0c167d63d1b0efcd55ff0f388c62a466733003acc6e454e24ef708b662210d4cb7758fcba458757e7eaaf1cda1538294259e70e336811d2ad2591cead15bb57892ad585e730deffcf2e63c46a7183c4c1b13350275e32f9f93b8689fdcc3cd9722dbe4f7f173f4b1718801472f23ccabf1c83c238d3305a2678b4e06ef2a222a2a072ba26b51aa7e0bb7dfb053983871daa004dc8a1fece8416f1fc35e7e8f2aa8a55d0cea78b3da8acc2db0c208ac299863f35455e28c41b87bd356f1d7280239072a102eadfdefd90d15404364c8b7af38533a9153744b2d14e4740d19e4b2259f1b3cbba20172256a8f3df346435bacafb9c061ef412668ce4dea361d5be707f8181fba27cc7112560d0af824fd54b6c0d7801217c9afee6483b9977e0d62932d4a831146749d678f93a44ea837fa5bf080fe9369ab625ed06f26819c7235cbcca03cd9df65c2c7258440d1f04036f3cda7ce1d46903adf7d42234b1047a98f2d903f97b4ca210034cf10bf29a3e8768fb0a09efb9c9b18c317ee73b4bb67e05acdd4d8f24989a46205f4f309ac868001584ee5e930729f2dab6d5a990dcb8bebbce958cfac1a53cb337f7dd7a4a6c0c2037707cf649ea67857a62f2dc4eba212a02cb3698e5fb2dd36993142be77d36474ea2b673ce6f07010264650bc5a1660d9bee45d5c62a65c87e0f833c330961efa07495827d7c7d26c6cd23acf6e06181eec4faab3317cab634c2792510e0ac4831f7fe9006129372831fd52e2b8eb2366406a2bbc98745147815f79c406feab3d9b605e7476e00429cac5e4fffdbd7b85bb36d5cfaea1c1786f7180e820db0a5802ab20d6901a45f45fa8f85a5c4d7131788efd03e629dea5ce85ef86bae982da5723fca7092818fb2131bc665b5e064b54f9047a1b460a90c9420648e0f6513df465e62d1bd2c15ce740b8824f33d85fdb4cc5e62358cb64528586e528eec0fe22cc886f3fd2cc5b00333b6ed772a5b9f4eb0c70d616a7bf86d9ebc9c6a3ee362d6fb90bf5eaf0d415b3637ce88f0f06d03bc5e5389ec02063be8ed2970a1b3d53dec145adc1c61fd66f776e7be5f32be4800d22b2a3e5933e658e6457c2096c74decbec6bad5ff265235f948a1534d4b1cd6dc8e96e3e877b96b61a81e14e6e0793de76d9bd68d5549b342bf9a619e7f93d61d0a9d16f322d1119309c9d673be79a880c386cefbbbe8cdd77e018f31a123a67a1e8e62740fc84a65d011d14f1438148acf24aad984d4c935229e82415ebad988a1e88bbbd49d969a6c25beef4dece9476c8fba5211255b43c14ada69e17d3cba8f44167122ee780ef760cdba67d21dcf0b5a09afebf72cd3064467f0085e786b97f7491dd1a39e713e557334648f0879799a93e96333b9543ba1171c31f2fb942b057f0e5d72f6fe9fce9e74decc97c3884564a3d8b0ccc4a5e82b6f496238aeba96905358dbe041e2f3de96a33a3e49bd92b0b9bc25c3a6a167a72361fde6d2b9f48d3e933a7d1d777fe8a1f0018fa44b9697e64ddcc531020f2bb0d4254f0412d364559cd886e74c218a02121415549988c4ddc1457d07746b4ac537b824db978d3d03be340ddeb72b4ac0299fb4ad8cb101e593e5f675f483483556b7f3de12143922ee7c710aa40d515cf764a220f6a12b286832ec967643dd19a2bb49e43189a6414a2a34dd5172ef5a93938aa5bc33a45c6cb2731ed3ce74e45256a25bba004566984af098829f710d624828e9fd1886fc31ec6a03271eba2984f5d6a92dd9439f7d83984764a0b4f7628f54cc51581a4d8268fa1bf2dd549b28ab2afaf915fca9cb311e1e5392f70d9c11e82babe65c41578b92ceb90c4f7ee553024caa270ea8275ae15f11df4b09f95d8ea5306901cf9ac9714ba6677056a4ad60e32e38999d2135caeea1a4c301edc03aa9e12f3462bb944f6da5ac53484a12e7407ed8e2f7c3192cc384940112122477eb966d8c6355f32e567f0a7895ddff7c4243709a789eff469f94086928af949f617ae9a18e6ca2be31a405abd0efcd81adbe0d944df979c5f65f4db69b934b3b0c6aff8562291801b3dfe0a3907d3a0ea9341ea8b324b618442fa41e891d66e17280dc83ca3b617f123605e0cfc73bd0c9d289d35a99c887d628e50e08156d3c4338e82c55c4d8c759913e0a96749e4ae31168c93d3cfb77f27bbf97bb6d467b365403c5e7a1f8052462ba82006c157d7f22f5042de4f5fdd0232c41b40dedcd7be63e1172dbe0af1c0028fb7cfcf4f1b9abaf785f4191c8101a44db4f223c71e82992db714eeefa6fd7cd140c63256ff53f71838d3d9cd631618343f682885ba4d32e929e1c87bfcd2a2bb8630ff8f731e023ac209dd210a5d568ac69976da3c8d8db56e755643149aec0b83d4eff98b134de3e3e67f2890b522e07bde405211b3582ea559376803962aa13ee54b827d39aa803439637f6b9de2aa1cc3031e79a5b35033b981b2c0cc877da74401145f487b9ff7246ad6b241f8761d7346a5cc66bfdb13c8c865efe1905feb1c35f516eccdf29777ff9b618cb80999e29ff440617b5c436efb0194ac1f0a4e91110a1aee09a695d31919087c3d4c8e44895fe7a97a9f136194ef924efde55c5a9e397fb552add8ef6742814bdb51f5e0b50c14312c6fdfbc83cacbaee6edf04fa4d366afe263ca7a36c0c4d02cedbb01e4c511bdc9cb2da19cf6a8f3eb002284a84d406cce2d6baf9fee7d1ac7535b1c09d9e289ae1f247e90e1eb70d00", 0x2000, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}}, 0x0, 0x0, 0x0, 0x0, 0x0})
write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x8120a2}}, 0x50)

18:32:46 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000001c0)={0x0, 0x3f}, 0x8)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000000c0), 0x8)

[  636.513616][ T9214] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  636.523239][ T9214] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  636.531568][ T9214] usb 6-1: Product: syz
[  636.536220][ T9214] usb 6-1: Manufacturer: syz
[  636.540949][ T9214] usb 6-1: SerialNumber: syz
18:32:46 executing program 3:
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r0, &(0x7f00000041c0)={0x2020, 0x0, <r1=>0x0}, 0x2020)
newfstatat(0xffffffffffffff9c, &(0x7f00000007c0)='./file0\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
umount2(&(0x7f0000000140)='./file0\x00', 0xa)
syz_fuse_handle_req(r0, &(0x7f0000006200)="390b7b5f3c1c744fc0141e4b56a3a96e12b16e2af9eb47ac42dfc420b3646f5228f0f2222675f5ae6f28e5a6051a8d49e1f7b0b6b2b4d9ec1d127b1992ae3db96965db6c06bd64c7baa0c321e5eec19a6522c7ffff088390da9dc5d9f3139d921d07b97392283f9c741c478f6fe3a07eff5c4c51ab93bf74e0b42ddd771b2fa1156b8b145cd361546afcd796ec3a7cd93a423a5368df3dbdfadd176b4cf6709243a0e4c01d75d5e92d64a31602f2997e12607813f05ab2b07d7fc9e1a5491433bd331aa1a77a54985827c656f3a2ddbf98e5728ab9b01254ef24aecdafcd52d31d28a2a70567501b3257ce080f0f8d1cd0cb2cfef8e5f3c1beda585d4916f5e3d7c700ac9b78f116f415b977518045792f3ee0403cfe454b90203a211f81fb8110ee7618e127bdf814c33ddc956aa75df9634efce9e374aa26c12e6103f73fed34fe1929adbf6fb899028fb32a6a8133ed0ac3765ca175c375e77c23c2b1c6417201979ee10d13f7d1733d49fbba19457c01b5cda0cc25b66da55729267edf125dac7e6799f49217576141a713d109cacc85fe0b5802df09407bf6058c3a808e3fa87cf05aaff9352c1d3c887a0c132e8c5770ac7b8e855f52cd34558df30d480cb450747a7ef170ae0e7fed6323acdafa4d094cb0b85828ee5df34c26e6cb3bca3a27ea705f1d9019807e3dc041cbbd95cff1ba77a9a7c022dd1ab3bc43137ff2475f1f091be9a9974684f7bf761c7a13d46c3c522d6fdfd4c93f81f1fa70fb24e401a4ab0f9b6e562756c08cb3f981da103fa41317052e302099ba6a1660aed84f71c7401daf13eea6692434192061a6bca16e20bcccd45c45dd95004ef7ba3e6969ff93d1f136d89333d3c76c1fd8f3e02b918928ba56d79693f0ae6b0d41366f24db42957a94de534c5c44b3c7c1090e63301c72e1af2ad37ad456508a7230a8f105c8bdca99aa039cdbf34ed4e5b006a87bf8dd3fd3d3f2f6309b179e303545cb02d5ba2bf97b995da4382e720ca45806fc0839f3d125dbebf60992c5c24629f46520110cc224c6f3df86a3bf057e058d90caad1d186d30ebcb3331d30e5d7a8f0f304c93d524c5f31da655c225e06b5b4f7abbcc662960272a41d4aad9ae2e7614b6a6c5c7069b1f3224cfb909e1976eba54be638b9205f4068edf8716a97cb8440c64333886ff29a9c9f8333179044e69ac34de6ded4604b23b2afdf829a7693ce712d3c0e915bc2e1545c826f91faaa6fed91c825612b55355c3ee2fc769f80cb84720ce191572295b55c806a5846b0dbfb640a0550db54f5483a1fcbf233810ef8b2a7ab2ba86a43ed883787cf31e4ea73e803f8026275f8cba9047e748a489890cd51147113bf2eab55d1b32eb136bcefa70999fd3c384221840cfb923c09ff19a514a326683ffc8135c92474591ba68001b4d3e1acc801a0632feaefaf5e83fc4e34a35aab966d746605f66ce270b9eb6abe5a3591b8110b49dceda30e0d5cd6b2c7a74a94e8a4dedafa427b77b26cc0fceb424fae84619ef0a84430882df19714e7d0b1142b547599d1de69b362feeb4245515a0b2e5eddd782579d924578495dd76b4723ec42958a511cc96e3bb6a57f1a88a2997ae288641ed0bfac356b59a4773a9add341064e44c83f060e0c24be7551efb3cfdd40bc03a156174bac2a6fc92e47be31ea6974e548b8619258cdbb6087c08f4f86f33693c2e1e6f3b21f987459d3b3faeecbac93832712d92eb24362ada8db02e95df8f6938b56c75501498e4fedeb2f0737eada4ade1c53dc12d34a7b1dac3bda4f53858d3a394a59773299c550dbf6c0ceeeece3045676edc57f98b73c2cda557e767795a532d1fcc6caaf277e01fd53af82c04227e12de80fc03c525660a0581d13b0f62a891c9c38d9d2f37b18da6eead8f58989d1984d8c378abcadf7dc76e71a68fa9776ab677c8189491b08bd593ab0025891d4299e1351fb06d6db9c8098d331533f43aa9a61301ef843a95bbc7de28f228579b418141925da789eb361208e65ed44f74a1a7157f6fc51195d99d673ed7da6a480f7e009ddb7744b716c14666d0ff0219d796ba07c499d7cbe65ccbc5d8ce18c8df28b3c1acb6b88064fb1b9db5aed201f9175d3127cc21b045d3f26fe9c18f764860c41eae45ca23a848bd8e69a6d162d43683d4dfc35a3517ab3d3cb02805987f298f87119eb773a837a5e36d42ba9dffffa9b90dfc8771fc50adb92aa81b89ea0f637634efa4285206cef527a65e8811e83600b6eb9da5f686b7aa5f73bbb44859c5326100d4799f4751cd6a3837eb9d7127081bf66675eb4bd477acec9be81491d27662da33689ce0dd87fdd8971aaf70940cc70af2566ea6e4778590bba6977a930e543f32bf074ac8866d32a0759ce8a629631ebbb53fabbbdab4c897b2739ce96ad0b9c03fe4a764f996757cafc058dbd7f9129b20f9ac4b97739a5d3dc08d15c480772342be7eb0da96886a5e2428cd2b0c3783fc90d9ef5811b60fb2d4350eb24022f91f9441a43c855b363a38ef6d67032a38e8ca3f971219efbff6ffaffc8c40e8b842a45b04696ade9740ba68a0c5144cde666052f0de25ee604d791435c4839baca617dbd016f1d01480e9fea8587503a2a49bc0a46393196b9c493f1cddb281bf4b5afbbf007e0308615bcb7351877ec030767e362ffdaf9fa6c7f56aa28beec40bcdc2a35dd20009abb4813cd4fe52ea18a3851cd1aa7beb759b9b7459223d0507d83fd1e3ea2e22857a2517b23605ccd9ada4da111f0a5c355e606141e4429c8313b1523b843c235e2a3ba58e0c8135a5c39fb79a72a3b80680f5688c4556dc532a86ef60db77d4f6e3e38f0558cb1cef1a8c97b2f2ee23abdf65cb2ad28612ca1ea9b04e3c513ab169f9b46e7751b8d2acfb807c06ef9345b8397d38de47e14fba00a668011bf9979da9b7c12618a4ae9f6020dd27739766697e3a5d8bdcdd43517be0b67d07e05964d6455d80b54bf28a0a3bc9d871465cf1ae1d469e3f37447c4fd2dd13fc911cc6d6e688387f38839b778adb5294f04ef278782c619362b84d9f9661be78af0350b06c7b8bddf5ed99e3bb17f771c4a27b3c1f728a448808f3fd5dd1ac3b44cfd30b8e8fda315795e27adf3f6778c30a8f5c10ff72345956f5f9a675687d485ab877cef8290f28202447fffca218583ff9d296a117a56319be677725022f8747ad3afa0f0e6501872e7c7176e1e3348b8a1439d31304f59363b094859f3e398e4b5275da847506c403ae4e435485184791ad8a11e516e1838f539e9411664b6978dafc05a82a025e59ca14a37e3838496b631d503ab75581c1cb9f26a936950fd97e1d30c4026c8ccac49e6388958089c4d0442e36b1151ebb8f4c5f051070d727f18a747b68edca6b7befcf5964d5596f6b31eae1934dcfc445e03ba076e1deb552db68fa9771c2f5c6b3cc3642044bb9788c3c827dae1a6e73e253706c856747170cb3e62d5de3954d3c7aaf6ebcf40b3df74d9058346ff74e364290fef7934af5da471f7fe3f90dcdff1117e45c0c56864a7245fb0f31dbd8d92cd1a06b3258ad67a382b2114e8f5a02fb7e345c9c4f857adbf2e893240c9891893917e9015527c903f4321f51c8c210f5c77370d6116f03c81618a13a222dd9f3c151165ded653d31ac67caa98a1058f71056cd17bca361db767391d7553dada3a8c703453875efb5132da5793da1215a417bccb7c9e817dd8f0053973e24be42c20ff7395c71dbd4aa4d90b85473b8b997e3685226d20220dc7c84e7520915a7908f8d89f7fedb52c80906e5263dc41a892c53bf1206decc1f77af622c5a9d0929c6f7404e4382c8066aeef46760220f9a1eabbcb224605bb1f091ca33681a5077407b83daf1c62fbcc8dbcfd7822988d7814dea0bb3224bea82282198942fbd89b6f7bcccc2f1c6404bd8992586f0c0ae9642d67e681fe1e80abb053bed2baf26c2f43f97de05550d4a8e859edbc80901fc22685d76274b484d99054b7f3779730fde394dd0573cc73e38d572122a8c0c29910030840654d70f718910f1356b26a7ae7a52b6b27040780ab043c6b48f86ed528d69725902ca18c11939c226b0888b0a080a3fb29c4285d467357c7802d7ea4798e6d683b0fb9bc1201bf307ca2fd34ce13d22e7ba5adedadea176bc83dfd8d8f8ed155f160a2d9ad8a0c5546d511e3c2d2d2f47a2ce8c047a26cace25aeaa40cc109271b9892b79aa73a3bf27201ae5d3ae4ca8dbc4afbb0d36133773c55c99daef0ceca7b30a889015c7bdc9ffc96ff34cd72c2ce35c552df85c6065ff8e02b135490f7433fe66471d07da713d23fd99ed7b1bf60f35fe50527867db0de3c70f7d9f1ba5ad31aa75c3d52e58f7f98f7d6e37cd46bb2c3696c34a805f6dcf1c34bf8852ad27d66004ae4b4efc2c676be9ad98278906f85e00e313fcb39f8343fdffdd82a558d39c1758e54feda77feeb7a532764d34d96a99db4ab7ee3409511b671e07d8b4f3bff6951f604963ee4834fe14082028b6454b3074fa2820ecfb09949efe5e2deca6300c5f1a655ad31e017edcda7243bfa6c879d21fa5d91dc5f615450cc6a31213329ee51d9025a5e3ad3dec672c0729e3de1e3c6d471a986d1ca5b07d755849870d165bbac7f342e691d9ca5fa4b0c9efbecdd9e236f6437871fa2b934b9482be817885559a2cf6de5104b81105ef22f2cda73f07748fe8d0bfbe5dc6dde6a10021c87cc8df1b7967920133bec86e78f18207ed6e05ea35e39b309083a7c8d35ddf3af2f81a16658bd8f7b14e92f9006f858baf1bed927f4dda41bd7a1f83c20d89ee1ec3237693c2ebcbf5329fffd7593ae310ee51e9c9d84c2ddc7dce9acddeb61902c42afe1232aefbbe4adf06edc93208bf9b7c6304fe78b90478ef3faa4f564c75d010dfdf575db0470f4ec638acf9f6c0ee9142ad608773d7ef948b14c8d08aa092a830d315d035d7e15f5c778958bf16f7e57a7d3eca83c1ad52b7c849ffc126068d2a57799a3f8d6ac85433183873c2ef9a90cc4bc3a728d069d24b929074223733552270a5a141ce51c7a8fce54c46bb04347db2fee386619a3168cd76716666378f75bc8efc67399b7d91be4634ffe08e2ba55456aeedeb71c2f7191749b5b75dcf4a2930625cbd66f41df1462b9b58f7a82926b121f73582815f478c9d5610591180093b456db3895572225ff245e9c1073da3307ad7aaefc1aa5d1d101179d64b79374683eb1328ead164a1f0996221fa1a46f2274e6b62a576e2778d47bbc7d3cefe9c00e08d7fe78dab227a49297fa413cd572b42fc6812624ff5df46ae8601315515b9fa15147de5aea41b428ed6a181fe7cee4da096430c7e1e782f506bd3b2a22cee9be1d6190d138a74cb4e377a25511e293deb98a50a6324879e283a7dbeddbaa0719b242979141c6293d800512b2885eaae187173dadb9bda69d6e0aa182af0eb5aa268b41536eba2debd70cfec82624f69ec91d504aec4a1ffc7e3d112372e210e92ac3bb2b5e6e12bfcada147cc235c059851e9b29f79db712585ee767a2b79430d14a5741cfebba4da9031e24fc7891c4b9a3a5593eacccb24f54a6edfa47429900958c32c550a7e17640c3f0467d70792dc0c48a09f94e8b3789785f33eb375d1547314fc7e2699254e3721a940598af01141f51799313d6ca01366ff895c5dd2fc3f7bad3316bd98985fe98d82e227b8bfe25c9bb7b6df7d8ce8e430ea3b391ca7741c3e76de039bb360c23b6b31578b117058536ff044dc1e06d1731155387ca1d151f469e5662f7ae7de46518280162638f2499ebd053c18e366fb6e5dcbfd64e8fd339aa2c24f415de8e2aeb298ad6a310e150801b96bd7c83976b1efba2230d4ed3d2287819a68b01cd5ee56f17864f7de433a19286f41d021ed6d751a675ffae6a7ebb086856a0391756da1dadd4e7d72fa9e5511dc5a15ee713c2ec2a7c93be8abd8eabd4950aa9ec58e826fab630071da760ab1dbd6ae356f76c4946e96f9fd9ecc2afdd05b91be471535e90862a3ba9199d436e236de305ceeae0d144593644519ef1afe63edb6a76a60f73da4969c98bd449083e4018730117df550a38156fe9c51190177972fe6582896abb21e6693bbce89db6f826f6e3c4bbed762af2b7adda929c48031d4289e5451909f041157c3b093ec30ac3ce3f04ba7a4940be79664e14bdbed9ad1e3e9ac0e524061670babba033e23040015d13a946ec667449889c35fe0e5fd2947afefdb42d73b4811c4b0bfbc08278dd7866ff22591ee0beab5cde128b06cf8a7c81b8d9bdb3ad682724597673f822e9250b854439153b45e9d6d02829c369850c0a60b547ccddaad4dd8b2a11a62e1cce68d250bd715b658cba2076f8d2e7a68cb8c5ce6584999776a4d5073ced21be9b05832fdade6c0a94d3eaed724291df7d60af9a74eab275f11d5041048d2bd6b2b93f0f09667b2e1932b6bf4902315ff171900d15cfc31e68385149198fd8a5e99de09fb1ec71ae4ba54e3d802812bafb7c73bc02957b6b4bc0b15c9e7f7216d84fc374dd00aa1446e71592c3c1a39cfc628046796e0a79f4d345ec8b4c1cbbc2f12b8a5d66cafddd9bf45c69ee53f6b4728b5b5ef1ecab488deaf6df7b7603aacd85c7d14392fa1f72ae02a93e66ddf6a1676185e8437aaa7bb09fa1c276867059418e274d87e61354494e8c51864cd44e965be84af68bc6046d8da5ad5bd4a407ac84c296a0b0d34cf731b512748c013e7f589f3b568e071e401493faf0bd7dde5e3bcd14ef17537f0c2ba776047799b9b35717b20d15f0e6f0af8ed12aa5a2698b2b2d327470039df1e54cae7a83bed8b3f6401184238fc550742a2d5829cc3ab8797cb5a8afe01716560235744af8472d67caec958b4b8e1472aa642ee1a5dc4db71538dacc0a3c70989a79eae9bce7c39dbd46c936e98ff053d3dc35a4b3dcb88b7f8edef33f05645c66fd4a823e4c5be7ac44cf06b9c638ab558fe437ba6f5f018650a99986da2933f9fcbe00e9f0e78eb813580f3629b1710d6d0da6e2b01cb1a14361a9c8be386e794ee0b420303e65953ebd42a1b3872b7ecc52e35f7e9582c15c937f28fb037bed7842d5d3a1bcdaf77617bcfbde48b8b42df0ecf20060d97780fa02ebe631cc1b63856d3e35b71cef7a7c173cacf68023c95f2a831efeed6d52f7f7ecc00e1a73f75636af021fd3f80bdd494e8ec7038c7aca48ec902871689c7710ddaf3b484611d3e5e191081efe164c1f54b61f524424f30f507c77084536f72a5e357c87b53c44ab425476c1a1c8aecce95a7e7426c64f9ca2fcf7cd043975e3699f4f3955053c261643e9cd5a42ac472b904e7dec3fa333201feb0dd31ef21bac0803b8d4674ae0b42d2c619701bcf4593736c7b26c129650ad65c48f63279ff64bbb7533b00a090962f7951facbd567d0dabc4ba960aa3a64cbb9ccc603b9bdd9610f11ad2c20656eadaf374ad08dc0c13f2e2f6647beda358688e1d8a71372fa9e0f2f61b0be68e5a62e6c1bafaa47d9b86d28e91e9f5c67fc4df6976618f6c85fa82d1aa1533791979e63764debefc594eb4c7ceccfa3d5c87e26998bbb09545c07c160007cc876be9c8adbe2b7e2f1ec4cf4336cf50c340cdd632ed2d9f9f61e1c6c8489b8cc803d48eba534ce8104fe50a58e0e1e615cd7fa4f41639b269db40ca22a04a0e7456f237de895c05a8b9137967ae2e0861cebc668203f28d5f42e751b360899c7b4e86b5fa69a93daac17bae1d0249efbc01e5429a72cdc631cacfd1419c55ce7d134a220b5999112fe79e8f516855bde6c1ed7624fea0fd5ce16a12c1051949ef023368e09b67f56215426581ff0a7c76b6ec60441d478eb63546ecdfb56465dd8ae720a1759aa760e01bed6003c2ed97aa0b04292364c263b609ff216f450a2605e55a1d27b80343f4b1794f238d75b20e9c3a43cae306b9ffd43c2c09a49f9bfa367e588155b78edefd75aa06edf9cde7446148a7c1166460eadf32c8a30d867a5cfd51af056a4c95e1059028731eaac7f141e1b24a38a81f695802af1691e935a078afd15f874131dfcc44ede9369f9dc85ad3559939b5e402598b3a94109a6aecba7dcf2246437e942b75a76fda18f357ccecf1940873264830eb61ae8b4333c3870b493eb721af3ef5979138f8cb74e04f5c803c02b07e21f4948d8f6b00d08e48b9d045cc8eab5f565165383a68db0f0787d2b714fe66ce17cccbdfbea9a31884610012a1c5edfdf959f14bb412424f7683c91590f21c554e9e6a0dcb508e3f2bb0e779e1d00f7ac4962c12ec56e2a1b1bb59c3969953e5cb4c112ae4608c0210e84ba6ef1aace2cba0a8f648f804885409cab884606fd1f490b6ed7b542fcd061b434c3eb1ea3279701cbe6a8d4a5ac533b23e71ef4718b2afa65ced3824ad28a5bf704792f7d33127cfa954ed70170a106a81f5cd01adf5cd4bb970a289667519fed3c9587ab4458f5a8a575067401fa8aa6fc1a825455d74113338deec81111f38daa4575831a110cd48c458c3d7b89d45fba89361796196e1a0ad4fbdacbed8b886e5bcc3f888a3c396f039bd37114bab5ea40e75fc13b6db01b488ef910970301061d57915eb1916ba9bc08fe6b2f62fc7436b94be3f95aec0c9c85d655acf1dda447891aba7b6f327f48c3e04642a50e4d5c33a213cc9b07602ee894a824d224e25abdcb867ca568da19a4ded462e30d95d246098c180050dd4d3df2429caa37119647c5c31f852a484266033f7297f05aff5bbea54e8b626e56f73a577ececb58265a0c167d63d1b0efcd55ff0f388c62a466733003acc6e454e24ef708b662210d4cb7758fcba458757e7eaaf1cda1538294259e70e336811d2ad2591cead15bb57892ad585e730deffcf2e63c46a7183c4c1b13350275e32f9f93b8689fdcc3cd9722dbe4f7f173f4b1718801472f23ccabf1c83c238d3305a2678b4e06ef2a222a2a072ba26b51aa7e0bb7dfb053983871daa004dc8a1fece8416f1fc35e7e8f2aa8a55d0cea78b3da8acc2db0c208ac299863f35455e28c41b87bd356f1d7280239072a102eadfdefd90d15404364c8b7af38533a9153744b2d14e4740d19e4b2259f1b3cbba20172256a8f3df346435bacafb9c061ef412668ce4dea361d5be707f8181fba27cc7112560d0af824fd54b6c0d7801217c9afee6483b9977e0d62932d4a831146749d678f93a44ea837fa5bf080fe9369ab625ed06f26819c7235cbcca03cd9df65c2c7258440d1f04036f3cda7ce1d46903adf7d42234b1047a98f2d903f97b4ca210034cf10bf29a3e8768fb0a09efb9c9b18c317ee73b4bb67e05acdd4d8f24989a46205f4f309ac868001584ee5e930729f2dab6d5a990dcb8bebbce958cfac1a53cb337f7dd7a4a6c0c2037707cf649ea67857a62f2dc4eba212a02cb3698e5fb2dd36993142be77d36474ea2b673ce6f07010264650bc5a1660d9bee45d5c62a65c87e0f833c330961efa07495827d7c7d26c6cd23acf6e06181eec4faab3317cab634c2792510e0ac4831f7fe9006129372831fd52e2b8eb2366406a2bbc98745147815f79c406feab3d9b605e7476e00429cac5e4fffdbd7b85bb36d5cfaea1c1786f7180e820db0a5802ab20d6901a45f45fa8f85a5c4d7131788efd03e629dea5ce85ef86bae982da5723fca7092818fb2131bc665b5e064b54f9047a1b460a90c9420648e0f6513df465e62d1bd2c15ce740b8824f33d85fdb4cc5e62358cb64528586e528eec0fe22cc886f3fd2cc5b00333b6ed772a5b9f4eb0c70d616a7bf86d9ebc9c6a3ee362d6fb90bf5eaf0d415b3637ce88f0f06d03bc5e5389ec02063be8ed2970a1b3d53dec145adc1c61fd66f776e7be5f32be4800d22b2a3e5933e658e6457c2096c74decbec6bad5ff265235f948a1534d4b1cd6dc8e96e3e877b96b61a81e14e6e0793de76d9bd68d5549b342bf9a619e7f93d61d0a9d16f322d1119309c9d673be79a880c386cefbbbe8cdd77e018f31a123a67a1e8e62740fc84a65d011d14f1438148acf24aad984d4c935229e82415ebad988a1e88bbbd49d969a6c25beef4dece9476c8fba5211255b43c14ada69e17d3cba8f44167122ee780ef760cdba67d21dcf0b5a09afebf72cd3064467f0085e786b97f7491dd1a39e713e557334648f0879799a93e96333b9543ba1171c31f2fb942b057f0e5d72f6fe9fce9e74decc97c3884564a3d8b0ccc4a5e82b6f496238aeba96905358dbe041e2f3de96a33a3e49bd92b0b9bc25c3a6a167a72361fde6d2b9f48d3e933a7d1d777fe8a1f0018fa44b9697e64ddcc531020f2bb0d4254f0412d364559cd886e74c218a02121415549988c4ddc1457d07746b4ac537b824db978d3d03be340ddeb72b4ac0299fb4ad8cb101e593e5f675f483483556b7f3de12143922ee7c710aa40d515cf764a220f6a12b286832ec967643dd19a2bb49e43189a6414a2a34dd5172ef5a93938aa5bc33a45c6cb2731ed3ce74e45256a25bba004566984af098829f710d624828e9fd1886fc31ec6a03271eba2984f5d6a92dd9439f7d83984764a0b4f7628f54cc51581a4d8268fa1bf2dd549b28ab2afaf915fca9cb311e1e5392f70d9c11e82babe65c41578b92ceb90c4f7ee553024caa270ea8275ae15f11df4b09f95d8ea5306901cf9ac9714ba6677056a4ad60e32e38999d2135caeea1a4c301edc03aa9e12f3462bb944f6da5ac53484a12e7407ed8e2f7c3192cc384940112122477eb966d8c6355f32e567f0a7895ddff7c4243709a789eff469f94086928af949f617ae9a18e6ca2be31a405abd0efcd81adbe0d944df979c5f65f4db69b934b3b0c6aff8562291801b3dfe0a3907d3a0ea9341ea8b324b618442fa41e891d66e17280dc83ca3b617f123605e0cfc73bd0c9d289d35a99c887d628e50e08156d3c4338e82c55c4d8c759913e0a96749e4ae31168c93d3cfb77f27bbf97bb6d467b365403c5e7a1f8052462ba82006c157d7f22f5042de4f5fdd0232c41b40dedcd7be63e1172dbe0af1c0028fb7cfcf4f1b9abaf785f4191c8101a44db4f223c71e82992db714eeefa6fd7cd140c63256ff53f71838d3d9cd631618343f682885ba4d32e929e1c87bfcd2a2bb8630ff8f731e023ac209dd210a5d568ac69976da3c8d8db56e755643149aec0b83d4eff98b134de3e3e67f2890b522e07bde405211b3582ea559376803962aa13ee54b827d39aa803439637f6b9de2aa1cc3031e79a5b35033b981b2c0cc877da74401145f487b9ff7246ad6b241f8761d7346a5cc66bfdb13c8c865efe1905feb1c35f516eccdf29777ff9b618cb80999e29ff440617b5c436efb0194ac1f0a4e91110a1aee09a695d31919087c3d4c8e44895fe7a97a9f136194ef924efde55c5a9e397fb552add8ef6742814bdb51f5e0b50c14312c6fdfbc83cacbaee6edf04fa4d366afe263ca7a36c0c4d02cedbb01e4c511bdc9cb2da19cf6a8f3eb002284a84d406cce2d6baf9fee7d1ac7535b1c09d9e289ae1f247e90e1eb70d00", 0x2000, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}}, 0x0, 0x0, 0x0, 0x0, 0x0})
write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x8120a2}}, 0x50)

[  636.640761][T20911] xt_hashlimit: max too large, truncated to 1048576
[  636.647929][T20911] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:46 executing program 2:
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r0, &(0x7f00000041c0)={0x2020, 0x0, <r1=>0x0}, 0x2020)
newfstatat(0xffffffffffffff9c, &(0x7f00000007c0)='./file0\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
umount2(&(0x7f0000000140)='./file0\x00', 0xa)
syz_fuse_handle_req(r0, &(0x7f0000006200)="390b7b5f3c1c744fc0141e4b56a3a96e12b16e2af9eb47ac42dfc420b3646f5228f0f2222675f5ae6f28e5a6051a8d49e1f7b0b6b2b4d9ec1d127b1992ae3db96965db6c06bd64c7baa0c321e5eec19a6522c7ffff088390da9dc5d9f3139d921d07b97392283f9c741c478f6fe3a07eff5c4c51ab93bf74e0b42ddd771b2fa1156b8b145cd361546afcd796ec3a7cd93a423a5368df3dbdfadd176b4cf6709243a0e4c01d75d5e92d64a31602f2997e12607813f05ab2b07d7fc9e1a5491433bd331aa1a77a54985827c656f3a2ddbf98e5728ab9b01254ef24aecdafcd52d31d28a2a70567501b3257ce080f0f8d1cd0cb2cfef8e5f3c1beda585d4916f5e3d7c700ac9b78f116f415b977518045792f3ee0403cfe454b90203a211f81fb8110ee7618e127bdf814c33ddc956aa75df9634efce9e374aa26c12e6103f73fed34fe1929adbf6fb899028fb32a6a8133ed0ac3765ca175c375e77c23c2b1c6417201979ee10d13f7d1733d49fbba19457c01b5cda0cc25b66da55729267edf125dac7e6799f49217576141a713d109cacc85fe0b5802df09407bf6058c3a808e3fa87cf05aaff9352c1d3c887a0c132e8c5770ac7b8e855f52cd34558df30d480cb450747a7ef170ae0e7fed6323acdafa4d094cb0b85828ee5df34c26e6cb3bca3a27ea705f1d9019807e3dc041cbbd95cff1ba77a9a7c022dd1ab3bc43137ff2475f1f091be9a9974684f7bf761c7a13d46c3c522d6fdfd4c93f81f1fa70fb24e401a4ab0f9b6e562756c08cb3f981da103fa41317052e302099ba6a1660aed84f71c7401daf13eea6692434192061a6bca16e20bcccd45c45dd95004ef7ba3e6969ff93d1f136d89333d3c76c1fd8f3e02b918928ba56d79693f0ae6b0d41366f24db42957a94de534c5c44b3c7c1090e63301c72e1af2ad37ad456508a7230a8f105c8bdca99aa039cdbf34ed4e5b006a87bf8dd3fd3d3f2f6309b179e303545cb02d5ba2bf97b995da4382e720ca45806fc0839f3d125dbebf60992c5c24629f46520110cc224c6f3df86a3bf057e058d90caad1d186d30ebcb3331d30e5d7a8f0f304c93d524c5f31da655c225e06b5b4f7abbcc662960272a41d4aad9ae2e7614b6a6c5c7069b1f3224cfb909e1976eba54be638b9205f4068edf8716a97cb8440c64333886ff29a9c9f8333179044e69ac34de6ded4604b23b2afdf829a7693ce712d3c0e915bc2e1545c826f91faaa6fed91c825612b55355c3ee2fc769f80cb84720ce191572295b55c806a5846b0dbfb640a0550db54f5483a1fcbf233810ef8b2a7ab2ba86a43ed883787cf31e4ea73e803f8026275f8cba9047e748a489890cd51147113bf2eab55d1b32eb136bcefa70999fd3c384221840cfb923c09ff19a514a326683ffc8135c92474591ba68001b4d3e1acc801a0632feaefaf5e83fc4e34a35aab966d746605f66ce270b9eb6abe5a3591b8110b49dceda30e0d5cd6b2c7a74a94e8a4dedafa427b77b26cc0fceb424fae84619ef0a84430882df19714e7d0b1142b547599d1de69b362feeb4245515a0b2e5eddd782579d924578495dd76b4723ec42958a511cc96e3bb6a57f1a88a2997ae288641ed0bfac356b59a4773a9add341064e44c83f060e0c24be7551efb3cfdd40bc03a156174bac2a6fc92e47be31ea6974e548b8619258cdbb6087c08f4f86f33693c2e1e6f3b21f987459d3b3faeecbac93832712d92eb24362ada8db02e95df8f6938b56c75501498e4fedeb2f0737eada4ade1c53dc12d34a7b1dac3bda4f53858d3a394a59773299c550dbf6c0ceeeece3045676edc57f98b73c2cda557e767795a532d1fcc6caaf277e01fd53af82c04227e12de80fc03c525660a0581d13b0f62a891c9c38d9d2f37b18da6eead8f58989d1984d8c378abcadf7dc76e71a68fa9776ab677c8189491b08bd593ab0025891d4299e1351fb06d6db9c8098d331533f43aa9a61301ef843a95bbc7de28f228579b418141925da789eb361208e65ed44f74a1a7157f6fc51195d99d673ed7da6a480f7e009ddb7744b716c14666d0ff0219d796ba07c499d7cbe65ccbc5d8ce18c8df28b3c1acb6b88064fb1b9db5aed201f9175d3127cc21b045d3f26fe9c18f764860c41eae45ca23a848bd8e69a6d162d43683d4dfc35a3517ab3d3cb02805987f298f87119eb773a837a5e36d42ba9dffffa9b90dfc8771fc50adb92aa81b89ea0f637634efa4285206cef527a65e8811e83600b6eb9da5f686b7aa5f73bbb44859c5326100d4799f4751cd6a3837eb9d7127081bf66675eb4bd477acec9be81491d27662da33689ce0dd87fdd8971aaf70940cc70af2566ea6e4778590bba6977a930e543f32bf074ac8866d32a0759ce8a629631ebbb53fabbbdab4c897b2739ce96ad0b9c03fe4a764f996757cafc058dbd7f9129b20f9ac4b97739a5d3dc08d15c480772342be7eb0da96886a5e2428cd2b0c3783fc90d9ef5811b60fb2d4350eb24022f91f9441a43c855b363a38ef6d67032a38e8ca3f971219efbff6ffaffc8c40e8b842a45b04696ade9740ba68a0c5144cde666052f0de25ee604d791435c4839baca617dbd016f1d01480e9fea8587503a2a49bc0a46393196b9c493f1cddb281bf4b5afbbf007e0308615bcb7351877ec030767e362ffdaf9fa6c7f56aa28beec40bcdc2a35dd20009abb4813cd4fe52ea18a3851cd1aa7beb759b9b7459223d0507d83fd1e3ea2e22857a2517b23605ccd9ada4da111f0a5c355e606141e4429c8313b1523b843c235e2a3ba58e0c8135a5c39fb79a72a3b80680f5688c4556dc532a86ef60db77d4f6e3e38f0558cb1cef1a8c97b2f2ee23abdf65cb2ad28612ca1ea9b04e3c513ab169f9b46e7751b8d2acfb807c06ef9345b8397d38de47e14fba00a668011bf9979da9b7c12618a4ae9f6020dd27739766697e3a5d8bdcdd43517be0b67d07e05964d6455d80b54bf28a0a3bc9d871465cf1ae1d469e3f37447c4fd2dd13fc911cc6d6e688387f38839b778adb5294f04ef278782c619362b84d9f9661be78af0350b06c7b8bddf5ed99e3bb17f771c4a27b3c1f728a448808f3fd5dd1ac3b44cfd30b8e8fda315795e27adf3f6778c30a8f5c10ff72345956f5f9a675687d485ab877cef8290f28202447fffca218583ff9d296a117a56319be677725022f8747ad3afa0f0e6501872e7c7176e1e3348b8a1439d31304f59363b094859f3e398e4b5275da847506c403ae4e435485184791ad8a11e516e1838f539e9411664b6978dafc05a82a025e59ca14a37e3838496b631d503ab75581c1cb9f26a936950fd97e1d30c4026c8ccac49e6388958089c4d0442e36b1151ebb8f4c5f051070d727f18a747b68edca6b7befcf5964d5596f6b31eae1934dcfc445e03ba076e1deb552db68fa9771c2f5c6b3cc3642044bb9788c3c827dae1a6e73e253706c856747170cb3e62d5de3954d3c7aaf6ebcf40b3df74d9058346ff74e364290fef7934af5da471f7fe3f90dcdff1117e45c0c56864a7245fb0f31dbd8d92cd1a06b3258ad67a382b2114e8f5a02fb7e345c9c4f857adbf2e893240c9891893917e9015527c903f4321f51c8c210f5c77370d6116f03c81618a13a222dd9f3c151165ded653d31ac67caa98a1058f71056cd17bca361db767391d7553dada3a8c703453875efb5132da5793da1215a417bccb7c9e817dd8f0053973e24be42c20ff7395c71dbd4aa4d90b85473b8b997e3685226d20220dc7c84e7520915a7908f8d89f7fedb52c80906e5263dc41a892c53bf1206decc1f77af622c5a9d0929c6f7404e4382c8066aeef46760220f9a1eabbcb224605bb1f091ca33681a5077407b83daf1c62fbcc8dbcfd7822988d7814dea0bb3224bea82282198942fbd89b6f7bcccc2f1c6404bd8992586f0c0ae9642d67e681fe1e80abb053bed2baf26c2f43f97de05550d4a8e859edbc80901fc22685d76274b484d99054b7f3779730fde394dd0573cc73e38d572122a8c0c29910030840654d70f718910f1356b26a7ae7a52b6b27040780ab043c6b48f86ed528d69725902ca18c11939c226b0888b0a080a3fb29c4285d467357c7802d7ea4798e6d683b0fb9bc1201bf307ca2fd34ce13d22e7ba5adedadea176bc83dfd8d8f8ed155f160a2d9ad8a0c5546d511e3c2d2d2f47a2ce8c047a26cace25aeaa40cc109271b9892b79aa73a3bf27201ae5d3ae4ca8dbc4afbb0d36133773c55c99daef0ceca7b30a889015c7bdc9ffc96ff34cd72c2ce35c552df85c6065ff8e02b135490f7433fe66471d07da713d23fd99ed7b1bf60f35fe50527867db0de3c70f7d9f1ba5ad31aa75c3d52e58f7f98f7d6e37cd46bb2c3696c34a805f6dcf1c34bf8852ad27d66004ae4b4efc2c676be9ad98278906f85e00e313fcb39f8343fdffdd82a558d39c1758e54feda77feeb7a532764d34d96a99db4ab7ee3409511b671e07d8b4f3bff6951f604963ee4834fe14082028b6454b3074fa2820ecfb09949efe5e2deca6300c5f1a655ad31e017edcda7243bfa6c879d21fa5d91dc5f615450cc6a31213329ee51d9025a5e3ad3dec672c0729e3de1e3c6d471a986d1ca5b07d755849870d165bbac7f342e691d9ca5fa4b0c9efbecdd9e236f6437871fa2b934b9482be817885559a2cf6de5104b81105ef22f2cda73f07748fe8d0bfbe5dc6dde6a10021c87cc8df1b7967920133bec86e78f18207ed6e05ea35e39b309083a7c8d35ddf3af2f81a16658bd8f7b14e92f9006f858baf1bed927f4dda41bd7a1f83c20d89ee1ec3237693c2ebcbf5329fffd7593ae310ee51e9c9d84c2ddc7dce9acddeb61902c42afe1232aefbbe4adf06edc93208bf9b7c6304fe78b90478ef3faa4f564c75d010dfdf575db0470f4ec638acf9f6c0ee9142ad608773d7ef948b14c8d08aa092a830d315d035d7e15f5c778958bf16f7e57a7d3eca83c1ad52b7c849ffc126068d2a57799a3f8d6ac85433183873c2ef9a90cc4bc3a728d069d24b929074223733552270a5a141ce51c7a8fce54c46bb04347db2fee386619a3168cd76716666378f75bc8efc67399b7d91be4634ffe08e2ba55456aeedeb71c2f7191749b5b75dcf4a2930625cbd66f41df1462b9b58f7a82926b121f73582815f478c9d5610591180093b456db3895572225ff245e9c1073da3307ad7aaefc1aa5d1d101179d64b79374683eb1328ead164a1f0996221fa1a46f2274e6b62a576e2778d47bbc7d3cefe9c00e08d7fe78dab227a49297fa413cd572b42fc6812624ff5df46ae8601315515b9fa15147de5aea41b428ed6a181fe7cee4da096430c7e1e782f506bd3b2a22cee9be1d6190d138a74cb4e377a25511e293deb98a50a6324879e283a7dbeddbaa0719b242979141c6293d800512b2885eaae187173dadb9bda69d6e0aa182af0eb5aa268b41536eba2debd70cfec82624f69ec91d504aec4a1ffc7e3d112372e210e92ac3bb2b5e6e12bfcada147cc235c059851e9b29f79db712585ee767a2b79430d14a5741cfebba4da9031e24fc7891c4b9a3a5593eacccb24f54a6edfa47429900958c32c550a7e17640c3f0467d70792dc0c48a09f94e8b3789785f33eb375d1547314fc7e2699254e3721a940598af01141f51799313d6ca01366ff895c5dd2fc3f7bad3316bd98985fe98d82e227b8bfe25c9bb7b6df7d8ce8e430ea3b391ca7741c3e76de039bb360c23b6b31578b117058536ff044dc1e06d1731155387ca1d151f469e5662f7ae7de46518280162638f2499ebd053c18e366fb6e5dcbfd64e8fd339aa2c24f415de8e2aeb298ad6a310e150801b96bd7c83976b1efba2230d4ed3d2287819a68b01cd5ee56f17864f7de433a19286f41d021ed6d751a675ffae6a7ebb086856a0391756da1dadd4e7d72fa9e5511dc5a15ee713c2ec2a7c93be8abd8eabd4950aa9ec58e826fab630071da760ab1dbd6ae356f76c4946e96f9fd9ecc2afdd05b91be471535e90862a3ba9199d436e236de305ceeae0d144593644519ef1afe63edb6a76a60f73da4969c98bd449083e4018730117df550a38156fe9c51190177972fe6582896abb21e6693bbce89db6f826f6e3c4bbed762af2b7adda929c48031d4289e5451909f041157c3b093ec30ac3ce3f04ba7a4940be79664e14bdbed9ad1e3e9ac0e524061670babba033e23040015d13a946ec667449889c35fe0e5fd2947afefdb42d73b4811c4b0bfbc08278dd7866ff22591ee0beab5cde128b06cf8a7c81b8d9bdb3ad682724597673f822e9250b854439153b45e9d6d02829c369850c0a60b547ccddaad4dd8b2a11a62e1cce68d250bd715b658cba2076f8d2e7a68cb8c5ce6584999776a4d5073ced21be9b05832fdade6c0a94d3eaed724291df7d60af9a74eab275f11d5041048d2bd6b2b93f0f09667b2e1932b6bf4902315ff171900d15cfc31e68385149198fd8a5e99de09fb1ec71ae4ba54e3d802812bafb7c73bc02957b6b4bc0b15c9e7f7216d84fc374dd00aa1446e71592c3c1a39cfc628046796e0a79f4d345ec8b4c1cbbc2f12b8a5d66cafddd9bf45c69ee53f6b4728b5b5ef1ecab488deaf6df7b7603aacd85c7d14392fa1f72ae02a93e66ddf6a1676185e8437aaa7bb09fa1c276867059418e274d87e61354494e8c51864cd44e965be84af68bc6046d8da5ad5bd4a407ac84c296a0b0d34cf731b512748c013e7f589f3b568e071e401493faf0bd7dde5e3bcd14ef17537f0c2ba776047799b9b35717b20d15f0e6f0af8ed12aa5a2698b2b2d327470039df1e54cae7a83bed8b3f6401184238fc550742a2d5829cc3ab8797cb5a8afe01716560235744af8472d67caec958b4b8e1472aa642ee1a5dc4db71538dacc0a3c70989a79eae9bce7c39dbd46c936e98ff053d3dc35a4b3dcb88b7f8edef33f05645c66fd4a823e4c5be7ac44cf06b9c638ab558fe437ba6f5f018650a99986da2933f9fcbe00e9f0e78eb813580f3629b1710d6d0da6e2b01cb1a14361a9c8be386e794ee0b420303e65953ebd42a1b3872b7ecc52e35f7e9582c15c937f28fb037bed7842d5d3a1bcdaf77617bcfbde48b8b42df0ecf20060d97780fa02ebe631cc1b63856d3e35b71cef7a7c173cacf68023c95f2a831efeed6d52f7f7ecc00e1a73f75636af021fd3f80bdd494e8ec7038c7aca48ec902871689c7710ddaf3b484611d3e5e191081efe164c1f54b61f524424f30f507c77084536f72a5e357c87b53c44ab425476c1a1c8aecce95a7e7426c64f9ca2fcf7cd043975e3699f4f3955053c261643e9cd5a42ac472b904e7dec3fa333201feb0dd31ef21bac0803b8d4674ae0b42d2c619701bcf4593736c7b26c129650ad65c48f63279ff64bbb7533b00a090962f7951facbd567d0dabc4ba960aa3a64cbb9ccc603b9bdd9610f11ad2c20656eadaf374ad08dc0c13f2e2f6647beda358688e1d8a71372fa9e0f2f61b0be68e5a62e6c1bafaa47d9b86d28e91e9f5c67fc4df6976618f6c85fa82d1aa1533791979e63764debefc594eb4c7ceccfa3d5c87e26998bbb09545c07c160007cc876be9c8adbe2b7e2f1ec4cf4336cf50c340cdd632ed2d9f9f61e1c6c8489b8cc803d48eba534ce8104fe50a58e0e1e615cd7fa4f41639b269db40ca22a04a0e7456f237de895c05a8b9137967ae2e0861cebc668203f28d5f42e751b360899c7b4e86b5fa69a93daac17bae1d0249efbc01e5429a72cdc631cacfd1419c55ce7d134a220b5999112fe79e8f516855bde6c1ed7624fea0fd5ce16a12c1051949ef023368e09b67f56215426581ff0a7c76b6ec60441d478eb63546ecdfb56465dd8ae720a1759aa760e01bed6003c2ed97aa0b04292364c263b609ff216f450a2605e55a1d27b80343f4b1794f238d75b20e9c3a43cae306b9ffd43c2c09a49f9bfa367e588155b78edefd75aa06edf9cde7446148a7c1166460eadf32c8a30d867a5cfd51af056a4c95e1059028731eaac7f141e1b24a38a81f695802af1691e935a078afd15f874131dfcc44ede9369f9dc85ad3559939b5e402598b3a94109a6aecba7dcf2246437e942b75a76fda18f357ccecf1940873264830eb61ae8b4333c3870b493eb721af3ef5979138f8cb74e04f5c803c02b07e21f4948d8f6b00d08e48b9d045cc8eab5f565165383a68db0f0787d2b714fe66ce17cccbdfbea9a31884610012a1c5edfdf959f14bb412424f7683c91590f21c554e9e6a0dcb508e3f2bb0e779e1d00f7ac4962c12ec56e2a1b1bb59c3969953e5cb4c112ae4608c0210e84ba6ef1aace2cba0a8f648f804885409cab884606fd1f490b6ed7b542fcd061b434c3eb1ea3279701cbe6a8d4a5ac533b23e71ef4718b2afa65ced3824ad28a5bf704792f7d33127cfa954ed70170a106a81f5cd01adf5cd4bb970a289667519fed3c9587ab4458f5a8a575067401fa8aa6fc1a825455d74113338deec81111f38daa4575831a110cd48c458c3d7b89d45fba89361796196e1a0ad4fbdacbed8b886e5bcc3f888a3c396f039bd37114bab5ea40e75fc13b6db01b488ef910970301061d57915eb1916ba9bc08fe6b2f62fc7436b94be3f95aec0c9c85d655acf1dda447891aba7b6f327f48c3e04642a50e4d5c33a213cc9b07602ee894a824d224e25abdcb867ca568da19a4ded462e30d95d246098c180050dd4d3df2429caa37119647c5c31f852a484266033f7297f05aff5bbea54e8b626e56f73a577ececb58265a0c167d63d1b0efcd55ff0f388c62a466733003acc6e454e24ef708b662210d4cb7758fcba458757e7eaaf1cda1538294259e70e336811d2ad2591cead15bb57892ad585e730deffcf2e63c46a7183c4c1b13350275e32f9f93b8689fdcc3cd9722dbe4f7f173f4b1718801472f23ccabf1c83c238d3305a2678b4e06ef2a222a2a072ba26b51aa7e0bb7dfb053983871daa004dc8a1fece8416f1fc35e7e8f2aa8a55d0cea78b3da8acc2db0c208ac299863f35455e28c41b87bd356f1d7280239072a102eadfdefd90d15404364c8b7af38533a9153744b2d14e4740d19e4b2259f1b3cbba20172256a8f3df346435bacafb9c061ef412668ce4dea361d5be707f8181fba27cc7112560d0af824fd54b6c0d7801217c9afee6483b9977e0d62932d4a831146749d678f93a44ea837fa5bf080fe9369ab625ed06f26819c7235cbcca03cd9df65c2c7258440d1f04036f3cda7ce1d46903adf7d42234b1047a98f2d903f97b4ca210034cf10bf29a3e8768fb0a09efb9c9b18c317ee73b4bb67e05acdd4d8f24989a46205f4f309ac868001584ee5e930729f2dab6d5a990dcb8bebbce958cfac1a53cb337f7dd7a4a6c0c2037707cf649ea67857a62f2dc4eba212a02cb3698e5fb2dd36993142be77d36474ea2b673ce6f07010264650bc5a1660d9bee45d5c62a65c87e0f833c330961efa07495827d7c7d26c6cd23acf6e06181eec4faab3317cab634c2792510e0ac4831f7fe9006129372831fd52e2b8eb2366406a2bbc98745147815f79c406feab3d9b605e7476e00429cac5e4fffdbd7b85bb36d5cfaea1c1786f7180e820db0a5802ab20d6901a45f45fa8f85a5c4d7131788efd03e629dea5ce85ef86bae982da5723fca7092818fb2131bc665b5e064b54f9047a1b460a90c9420648e0f6513df465e62d1bd2c15ce740b8824f33d85fdb4cc5e62358cb64528586e528eec0fe22cc886f3fd2cc5b00333b6ed772a5b9f4eb0c70d616a7bf86d9ebc9c6a3ee362d6fb90bf5eaf0d415b3637ce88f0f06d03bc5e5389ec02063be8ed2970a1b3d53dec145adc1c61fd66f776e7be5f32be4800d22b2a3e5933e658e6457c2096c74decbec6bad5ff265235f948a1534d4b1cd6dc8e96e3e877b96b61a81e14e6e0793de76d9bd68d5549b342bf9a619e7f93d61d0a9d16f322d1119309c9d673be79a880c386cefbbbe8cdd77e018f31a123a67a1e8e62740fc84a65d011d14f1438148acf24aad984d4c935229e82415ebad988a1e88bbbd49d969a6c25beef4dece9476c8fba5211255b43c14ada69e17d3cba8f44167122ee780ef760cdba67d21dcf0b5a09afebf72cd3064467f0085e786b97f7491dd1a39e713e557334648f0879799a93e96333b9543ba1171c31f2fb942b057f0e5d72f6fe9fce9e74decc97c3884564a3d8b0ccc4a5e82b6f496238aeba96905358dbe041e2f3de96a33a3e49bd92b0b9bc25c3a6a167a72361fde6d2b9f48d3e933a7d1d777fe8a1f0018fa44b9697e64ddcc531020f2bb0d4254f0412d364559cd886e74c218a02121415549988c4ddc1457d07746b4ac537b824db978d3d03be340ddeb72b4ac0299fb4ad8cb101e593e5f675f483483556b7f3de12143922ee7c710aa40d515cf764a220f6a12b286832ec967643dd19a2bb49e43189a6414a2a34dd5172ef5a93938aa5bc33a45c6cb2731ed3ce74e45256a25bba004566984af098829f710d624828e9fd1886fc31ec6a03271eba2984f5d6a92dd9439f7d83984764a0b4f7628f54cc51581a4d8268fa1bf2dd549b28ab2afaf915fca9cb311e1e5392f70d9c11e82babe65c41578b92ceb90c4f7ee553024caa270ea8275ae15f11df4b09f95d8ea5306901cf9ac9714ba6677056a4ad60e32e38999d2135caeea1a4c301edc03aa9e12f3462bb944f6da5ac53484a12e7407ed8e2f7c3192cc384940112122477eb966d8c6355f32e567f0a7895ddff7c4243709a789eff469f94086928af949f617ae9a18e6ca2be31a405abd0efcd81adbe0d944df979c5f65f4db69b934b3b0c6aff8562291801b3dfe0a3907d3a0ea9341ea8b324b618442fa41e891d66e17280dc83ca3b617f123605e0cfc73bd0c9d289d35a99c887d628e50e08156d3c4338e82c55c4d8c759913e0a96749e4ae31168c93d3cfb77f27bbf97bb6d467b365403c5e7a1f8052462ba82006c157d7f22f5042de4f5fdd0232c41b40dedcd7be63e1172dbe0af1c0028fb7cfcf4f1b9abaf785f4191c8101a44db4f223c71e82992db714eeefa6fd7cd140c63256ff53f71838d3d9cd631618343f682885ba4d32e929e1c87bfcd2a2bb8630ff8f731e023ac209dd210a5d568ac69976da3c8d8db56e755643149aec0b83d4eff98b134de3e3e67f2890b522e07bde405211b3582ea559376803962aa13ee54b827d39aa803439637f6b9de2aa1cc3031e79a5b35033b981b2c0cc877da74401145f487b9ff7246ad6b241f8761d7346a5cc66bfdb13c8c865efe1905feb1c35f516eccdf29777ff9b618cb80999e29ff440617b5c436efb0194ac1f0a4e91110a1aee09a695d31919087c3d4c8e44895fe7a97a9f136194ef924efde55c5a9e397fb552add8ef6742814bdb51f5e0b50c14312c6fdfbc83cacbaee6edf04fa4d366afe263ca7a36c0c4d02cedbb01e4c511bdc9cb2da19cf6a8f3eb002284a84d406cce2d6baf9fee7d1ac7535b1c09d9e289ae1f247e90e1eb70d00", 0x2000, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}}, 0x0, 0x0, 0x0, 0x0, 0x0})
write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x8120a2}}, 0x50)

[  636.704966][ T9214] cdc_ether: probe of 6-1:1.0 failed with error -22
[  636.907036][ T9214] usb 6-1: USB disconnect, device number 12
[  637.714267][ T9214] usb 6-1: new high-speed USB device number 13 using dummy_hcd
[  638.163343][ T9214] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0
[  638.333831][ T9214] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  638.344744][ T9214] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  638.353361][ T9214] usb 6-1: Product: syz
[  638.357738][ T9214] usb 6-1: Manufacturer: syz
[  638.362498][ T9214] usb 6-1: SerialNumber: syz
[  638.468680][ T9214] cdc_ether: probe of 6-1:1.0 failed with error -22
18:32:48 executing program 5:
syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x5, &(0x7f0000000200)={0x5, 0xf, 0x5}})

18:32:48 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x20000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:48 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000001c0)={0x0, 0x3f}, 0x8)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000000c0), 0x8)

18:32:48 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@union={0x0, 0x2, 0x0, 0x5, 0x0, 0x0, [{}, {}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x40}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102389, 0x18ff5}], 0x0, 0x0, 0x0, 0x0)
tkill(r0, 0x1d)
wait4(0x0, 0x0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
r1 = gettid()
rt_sigqueueinfo(r1, 0x3c, &(0x7f0000000040))

18:32:48 executing program 1:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:48 executing program 2:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r1, 0x0)
preadv(r0, &(0x7f0000000280)=[{0x0}], 0x1, 0x0, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0)
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000003900)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb9, 0xb9, 0x9, [@typedef, @int, @fwd, @func_proto, @func_proto, @array, @typedef, @ptr, @restrict, @datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], 'W'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0xdd}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102389, 0x18ff5}], 0x0, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
wait4(0x0, 0x0, 0x0, 0x0)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
r3 = gettid()
rt_sigqueueinfo(r3, 0x3c, &(0x7f0000000040))

[  638.569394][ T9214] usb 6-1: USB disconnect, device number 13
18:32:48 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x25000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  638.738733][T20970] xt_hashlimit: max too large, truncated to 1048576
18:32:48 executing program 2:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r1, 0x0)
preadv(r0, &(0x7f0000000280)=[{0x0}], 0x1, 0x0, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0)
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000003900)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb9, 0xb9, 0x9, [@typedef, @int, @fwd, @func_proto, @func_proto, @array, @typedef, @ptr, @restrict, @datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], 'W'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0xdd}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102389, 0x18ff5}], 0x0, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
wait4(0x0, 0x0, 0x0, 0x0)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
r3 = gettid()
rt_sigqueueinfo(r3, 0x3c, &(0x7f0000000040))

[  638.738796][T20970] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:48 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001140)={<r0=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000240)={'bond_slave_1\x00', &(0x7f0000000040)=@ethtool_gfeatures})

18:32:48 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@union={0x0, 0x2, 0x0, 0x5, 0x0, 0x0, [{}, {}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x40}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102389, 0x18ff5}], 0x0, 0x0, 0x0, 0x0)
tkill(r0, 0x1d)
wait4(0x0, 0x0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
r1 = gettid()
rt_sigqueueinfo(r1, 0x3c, &(0x7f0000000040))

18:32:48 executing program 1:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

[  639.211574][T20993] xt_hashlimit: max too large, truncated to 1048576
[  639.218729][T20993] xt_hashlimit: overflow, try lower: 1711341568/0
[  639.243334][ T1979] usb 6-1: new high-speed USB device number 14 using dummy_hcd
18:32:48 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x270b0000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  639.592349][T21006] xt_hashlimit: max too large, truncated to 1048576
[  639.599327][T21006] xt_hashlimit: overflow, try lower: 1711341568/0
[  639.684496][ T1979] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0
[  639.876072][ T1979] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  639.885653][ T1979] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  639.894471][ T1979] usb 6-1: Product: syz
[  639.898774][ T1979] usb 6-1: Manufacturer: syz
[  639.903596][ T1979] usb 6-1: SerialNumber: syz
[  639.955278][ T1979] cdc_ether: probe of 6-1:1.0 failed with error -22
[  640.185808][ T1979] usb 6-1: USB disconnect, device number 14
18:32:50 executing program 5:
syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x5, &(0x7f0000000200)={0x5, 0xf, 0x5}})

18:32:50 executing program 2:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r1, 0x0)
preadv(r0, &(0x7f0000000280)=[{0x0}], 0x1, 0x0, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0)
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000003900)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb9, 0xb9, 0x9, [@typedef, @int, @fwd, @func_proto, @func_proto, @array, @typedef, @ptr, @restrict, @datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], 'W'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0xdd}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102389, 0x18ff5}], 0x0, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
wait4(0x0, 0x0, 0x0, 0x0)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
r3 = gettid()
rt_sigqueueinfo(r3, 0x3c, &(0x7f0000000040))

18:32:50 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x28020000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:50 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001140)={<r0=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000240)={'bond_slave_1\x00', &(0x7f0000000040)=@ethtool_gfeatures})

18:32:50 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@union={0x0, 0x2, 0x0, 0x5, 0x0, 0x0, [{}, {}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x40}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102389, 0x18ff5}], 0x0, 0x0, 0x0, 0x0)
tkill(r0, 0x1d)
wait4(0x0, 0x0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
r1 = gettid()
rt_sigqueueinfo(r1, 0x3c, &(0x7f0000000040))

18:32:50 executing program 1:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

[  640.899252][T21028] xt_hashlimit: max too large, truncated to 1048576
[  640.906278][T21028] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:50 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x280b0000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:50 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001140)={<r0=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000240)={'bond_slave_1\x00', &(0x7f0000000040)=@ethtool_gfeatures})

18:32:50 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@union={0x0, 0x2, 0x0, 0x5, 0x0, 0x0, [{}, {}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x40}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102389, 0x18ff5}], 0x0, 0x0, 0x0, 0x0)
tkill(r0, 0x1d)
wait4(0x0, 0x0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
r1 = gettid()
rt_sigqueueinfo(r1, 0x3c, &(0x7f0000000040))

18:32:50 executing program 1:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:50 executing program 2:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r1, 0x0)
preadv(r0, &(0x7f0000000280)=[{0x0}], 0x1, 0x0, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0)
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000003900)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb9, 0xb9, 0x9, [@typedef, @int, @fwd, @func_proto, @func_proto, @array, @typedef, @ptr, @restrict, @datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], 'W'}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0xdd}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102389, 0x18ff5}], 0x0, 0x0, 0x0, 0x0)
tkill(r2, 0x40)
wait4(0x0, 0x0, 0x0, 0x0)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080))
r3 = gettid()
rt_sigqueueinfo(r3, 0x3c, &(0x7f0000000040))

18:32:51 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x48000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  641.385937][T21047] xt_hashlimit: max too large, truncated to 1048576
[  641.392760][T21047] xt_hashlimit: overflow, try lower: 1711341568/0
[  641.476909][ T8787] usb 6-1: new high-speed USB device number 15 using dummy_hcd
[  641.808462][T21064] xt_hashlimit: max too large, truncated to 1048576
[  641.815949][T21064] xt_hashlimit: overflow, try lower: 1711341568/0
[  641.955164][ T8787] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0
[  642.134384][ T8787] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  642.143973][ T8787] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  642.152225][ T8787] usb 6-1: Product: syz
[  642.156731][ T8787] usb 6-1: Manufacturer: syz
[  642.161464][ T8787] usb 6-1: SerialNumber: syz
[  642.229563][ T8787] cdc_ether: probe of 6-1:1.0 failed with error -22
[  642.458959][ T9214] usb 6-1: USB disconnect, device number 15
18:32:52 executing program 5:
syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x5, &(0x7f0000000200)={0x5, 0xf, 0x5}})

18:32:52 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:52 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001140)={<r0=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000240)={'bond_slave_1\x00', &(0x7f0000000040)=@ethtool_gfeatures})

18:32:52 executing program 2:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:52 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x4c000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:52 executing program 1:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

[  643.256716][T21098] xt_hashlimit: max too large, truncated to 1048576
[  643.263795][T21098] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:52 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x58010000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:53 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:53 executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:53 executing program 1:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:53 executing program 2:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

[  643.643847][T21112] xt_hashlimit: max too large, truncated to 1048576
[  643.650742][T21112] xt_hashlimit: overflow, try lower: 1711341568/0
[  643.658098][ T9214] usb 6-1: new high-speed USB device number 16 using dummy_hcd
18:32:53 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x60000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  644.143329][ T9214] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0
[  644.184574][T21130] xt_hashlimit: max too large, truncated to 1048576
[  644.191377][T21130] xt_hashlimit: overflow, try lower: 1711341568/0
[  644.364648][ T9214] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  644.374268][ T9214] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  644.383903][ T9214] usb 6-1: Product: syz
[  644.388208][ T9214] usb 6-1: Manufacturer: syz
[  644.393461][ T9214] usb 6-1: SerialNumber: syz
[  644.475022][ T9214] cdc_ether: probe of 6-1:1.0 failed with error -22
[  644.699158][ T1979] usb 6-1: USB disconnect, device number 16
18:32:54 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:54 executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:54 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x68000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:54 executing program 1:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:54 executing program 2:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

[  645.473915][T21157] xt_hashlimit: max too large, truncated to 1048576
[  645.480802][T21157] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:55 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x6c000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:55 executing program 5:
syz_emit_ethernet(0x40, &(0x7f0000000100)={@multicast, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "637605", 0xa, 0x0, 0x0, @private0, @remote, {[@srh={0x33}], ',]'}}}}}, 0x0)

18:32:55 executing program 0:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r2 = epoll_create(0x1)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e80)='/proc/zoneinfo\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
dup2(r3, r2)

18:32:55 executing program 1:
seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000040)=0x3)

18:32:55 executing program 3:
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cpuacct.usage_percpu_user\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000580)=""/143, &(0x7f0000000340)=0xfee5)
open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x3, 0x3, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@cstype3={0x5, 0xb}], 0x1)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfb, 0x0, 0x0, 0x0, 0x400000000000000]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2, 0x5e22, @local}, 0x10)
sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[]}}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_NMI(r2, 0xae9a)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380))
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000000), 0xc, 0x0}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:32:55 executing program 2:
r0 = socket$pptp(0x18, 0x1, 0x2)
connect(r0, &(0x7f0000000040)=@tipc, 0x80)

[  646.045234][T21168] xt_hashlimit: max too large, truncated to 1048576
[  646.052082][T21168] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:55 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x74000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:55 executing program 5:
syz_emit_ethernet(0x40, &(0x7f0000000100)={@multicast, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "637605", 0xa, 0x0, 0x0, @private0, @remote, {[@srh={0x33}], ',]'}}}}}, 0x0)

18:32:56 executing program 2:
r0 = socket$pptp(0x18, 0x1, 0x2)
connect(r0, &(0x7f0000000040)=@tipc, 0x80)

18:32:56 executing program 1:
seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000040)=0x3)

18:32:56 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, 0x2, 0x3, 0x201, 0x0, 0x0, {}, [@NFQA_CFG_QUEUE_MAXLEN={0x8}, @NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x1}}]}, 0x30}}, 0x0)

[  646.591225][T21189] xt_hashlimit: max too large, truncated to 1048576
[  646.598362][T21189] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:56 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x7a000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:56 executing program 3:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x1, 0x7, 0x2, 0x9}, 0x40)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x1000000}, 0x38)

18:32:56 executing program 5:
syz_emit_ethernet(0x40, &(0x7f0000000100)={@multicast, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "637605", 0xa, 0x0, 0x0, @private0, @remote, {[@srh={0x33}], ',]'}}}}}, 0x0)

[  646.988556][T21204] xt_hashlimit: max too large, truncated to 1048576
[  646.995593][T21204] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:56 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0xe0030000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:56 executing program 2:
r0 = socket$pptp(0x18, 0x1, 0x2)
connect(r0, &(0x7f0000000040)=@tipc, 0x80)

18:32:56 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, 0x2, 0x3, 0x201, 0x0, 0x0, {}, [@NFQA_CFG_QUEUE_MAXLEN={0x8}, @NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x1}}]}, 0x30}}, 0x0)

18:32:56 executing program 1:
seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000040)=0x3)

18:32:57 executing program 3:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x1, 0x7, 0x2, 0x9}, 0x40)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x1000000}, 0x38)

18:32:57 executing program 5:
syz_emit_ethernet(0x40, &(0x7f0000000100)={@multicast, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "637605", 0xa, 0x0, 0x0, @private0, @remote, {[@srh={0x33}], ',]'}}}}}, 0x0)

[  647.393833][T21217] xt_hashlimit: max too large, truncated to 1048576
[  647.400670][T21217] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:57 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0xff000000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:57 executing program 2:
r0 = socket$pptp(0x18, 0x1, 0x2)
connect(r0, &(0x7f0000000040)=@tipc, 0x80)

18:32:57 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, 0x2, 0x3, 0x201, 0x0, 0x0, {}, [@NFQA_CFG_QUEUE_MAXLEN={0x8}, @NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x1}}]}, 0x30}}, 0x0)

18:32:57 executing program 1:
seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000040)=0x3)

[  647.760757][T21229] xt_hashlimit: max too large, truncated to 1048576
[  647.767665][T21229] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:57 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0xffffe000, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:57 executing program 3:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x1, 0x7, 0x2, 0x9}, 0x40)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x1000000}, 0x38)

18:32:57 executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x1, 0x7, 0x2, 0x9}, 0x40)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x1000000}, 0x38)

18:32:57 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xc004ae02, 0xc04a01)

[  648.214893][T21241] xt_hashlimit: max too large, truncated to 1048576
[  648.221721][T21241] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:57 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, 0x2, 0x3, 0x201, 0x0, 0x0, {}, [@NFQA_CFG_QUEUE_MAXLEN={0x8}, @NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x1}}]}, 0x30}}, 0x0)

18:32:57 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:58 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vcs(0xffffff9c, &(0x7f0000000040), 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, &(0x7f00000000c0)="0f0fdd1c66f083a5db1944f20f3066b9c809000066b8635b000066ba000000000f3066b9cb0a000066b80800000066ba008000000f30660f38817f4636f2af0bc76767f26fba4300b80090ef", 0x4c}], 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:32:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x90, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:58 executing program 3:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x1, 0x7, 0x2, 0x9}, 0x40)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x1000000}, 0x38)

18:32:58 executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x1, 0x7, 0x2, 0x9}, 0x40)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x1000000}, 0x38)

18:32:58 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xc004ae02, 0xc04a01)

18:32:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x110, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:58 executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

18:32:58 executing program 3:
clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0)
clock_gettime(0x2, &(0x7f0000000000))

18:32:58 executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x1, 0x7, 0x2, 0x9}, 0x40)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x1000000}, 0x38)

18:32:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x228, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:59 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vcs(0xffffff9c, &(0x7f0000000040), 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, &(0x7f00000000c0)="0f0fdd1c66f083a5db1944f20f3066b9c809000066b8635b000066ba000000000f3066b9cb0a000066b80800000066ba008000000f30660f38817f4636f2af0bc76767f26fba4300b80090ef", 0x4c}], 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  649.379307][T21287] input: syz1 as /devices/virtual/input/input14
18:32:59 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xc004ae02, 0xc04a01)

[  649.542636][T21296] input: syz1 as /devices/virtual/input/input15
18:32:59 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:59 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vcs(0xffffff9c, &(0x7f0000000040), 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, &(0x7f00000000c0)="0f0fdd1c66f083a5db1944f20f3066b9c809000066b8635b000066ba000000000f3066b9cb0a000066b80800000066ba008000000f30660f38817f4636f2af0bc76767f26fba4300b80090ef", 0x4c}], 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:32:59 executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

18:32:59 executing program 3:
clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0)
clock_gettime(0x2, &(0x7f0000000000))

[  650.069306][T21322] xt_hashlimit: max too large, truncated to 1048576
[  650.076267][T21322] xt_hashlimit: overflow, try lower: 1711341568/0
18:32:59 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xc004ae02, 0xc04a01)

18:32:59 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x2, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:32:59 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vcs(0xffffff9c, &(0x7f0000000040), 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, &(0x7f00000000c0)="0f0fdd1c66f083a5db1944f20f3066b9c809000066b8635b000066ba000000000f3066b9cb0a000066b80800000066ba008000000f30660f38817f4636f2af0bc76767f26fba4300b80090ef", 0x4c}], 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  650.375167][T21332] input: syz1 as /devices/virtual/input/input16
18:33:00 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vcs(0xffffff9c, &(0x7f0000000040), 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, &(0x7f00000000c0)="0f0fdd1c66f083a5db1944f20f3066b9c809000066b8635b000066ba000000000f3066b9cb0a000066b80800000066ba008000000f30660f38817f4636f2af0bc76767f26fba4300b80090ef", 0x4c}], 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  650.492641][T21345] xt_hashlimit: max too large, truncated to 1048576
[  650.499714][T21345] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x3, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:00 executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

18:33:00 executing program 5:
clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0)
clock_gettime(0x2, &(0x7f0000000000))

18:33:00 executing program 3:
clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0)
clock_gettime(0x2, &(0x7f0000000000))

18:33:00 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vcs(0xffffff9c, &(0x7f0000000040), 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, &(0x7f00000000c0)="0f0fdd1c66f083a5db1944f20f3066b9c809000066b8635b000066ba000000000f3066b9cb0a000066b80800000066ba008000000f30660f38817f4636f2af0bc76767f26fba4300b80090ef", 0x4c}], 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  651.030254][T21364] xt_hashlimit: max too large, truncated to 1048576
[  651.040042][T21364] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:00 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
openat$vcs(0xffffff9c, &(0x7f0000000040), 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, &(0x7f00000000c0)="0f0fdd1c66f083a5db1944f20f3066b9c809000066b8635b000066ba000000000f3066b9cb0a000066b80800000066ba008000000f30660f38817f4636f2af0bc76767f26fba4300b80090ef", 0x4c}], 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:33:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x4, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  651.128566][T21369] input: syz1 as /devices/virtual/input/input17
[  651.415190][T21389] xt_hashlimit: max too large, truncated to 1048576
[  651.422107][T21389] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:01 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x5, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:01 executing program 0:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

18:33:01 executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

18:33:01 executing program 1:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

18:33:01 executing program 5:
clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0)
clock_gettime(0x2, &(0x7f0000000000))

[  651.848395][T21401] xt_hashlimit: max too large, truncated to 1048576
[  651.859327][T21401] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:01 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x6, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  652.075169][T21410] input: syz1 as /devices/virtual/input/input19
[  652.170136][T21413] input: syz1 as /devices/virtual/input/input20
18:33:01 executing program 0:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

18:33:01 executing program 3:
clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0)
clock_gettime(0x2, &(0x7f0000000000))

[  652.330561][T21428] xt_hashlimit: max too large, truncated to 1048576
[  652.338266][T21428] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:02 executing program 1:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

18:33:02 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x7, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:02 executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

[  652.700190][T21439] input: syz1 as /devices/virtual/input/input21
18:33:02 executing program 0:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

[  652.766621][T21444] xt_hashlimit: max too large, truncated to 1048576
[  652.775406][T21444] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:02 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x8, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  652.834261][T21446] input: syz1 as /devices/virtual/input/input22
18:33:02 executing program 5:
clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0)
clock_gettime(0x2, &(0x7f0000000000))

18:33:02 executing program 1:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

18:33:02 executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_CREATE(r0, 0x5501)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

[  653.204241][T21465] xt_hashlimit: max too large, truncated to 1048576
[  653.211081][T21465] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:02 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x9, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:03 executing program 0:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

[  653.372607][T21472] input: syz1 as /devices/virtual/input/input23
[  653.544529][T21484] input: syz1 as /devices/virtual/input/input24
[  653.562592][T21485] xt_hashlimit: max too large, truncated to 1048576
[  653.569611][T21485] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:03 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xa, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:03 executing program 3:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

18:33:03 executing program 1:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

18:33:03 executing program 2:
syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
r0 = syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040))

18:33:03 executing program 0:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

[  654.049869][T21501] xt_hashlimit: max too large, truncated to 1048576
[  654.056868][T21501] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:03 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0xe1}, 0x10)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000003c00)=ANY=[@ANYBLOB="300000001a00df1e050000000000000080"], 0x30}}, 0x0)

[  654.136431][T21503] xt_hashlimit: max too large, truncated to 1048576
[  654.143318][T21503] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:03 executing program 3:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

18:33:04 executing program 1:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

18:33:04 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xb, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  654.433998][T21513] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'.
18:33:04 executing program 2:
syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
r0 = syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040))

[  654.531906][T21516] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'.
18:33:04 executing program 3:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

[  654.800225][T21520] xt_hashlimit: max too large, truncated to 1048576
[  654.807205][T21520] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:04 executing program 0:
syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
r0 = syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040))

18:33:04 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xc, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:04 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0xe1}, 0x10)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000003c00)=ANY=[@ANYBLOB="300000001a00df1e050000000000000080"], 0x30}}, 0x0)

18:33:04 executing program 1:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
sendto$inet6(r0, &(0x7f0000000340)="18", 0x1, 0xc080, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @mcast2, 0x3f}, 0x1c)
setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3", 0x1}], 0x1, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x400000a)

[  655.206928][T21533] xt_hashlimit: max too large, truncated to 1048576
[  655.207134][T21534] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'.
[  655.213968][T21533] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:04 executing program 2:
syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
r0 = syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040))

18:33:04 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xd, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:05 executing program 0:
syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
r0 = syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040))

18:33:05 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

18:33:05 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0xe1}, 0x10)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000003c00)=ANY=[@ANYBLOB="300000001a00df1e050000000000000080"], 0x30}}, 0x0)

18:33:05 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
mkdir(&(0x7f00000020c0)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002000), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [], 0x3d}})

18:33:05 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xe, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  655.826102][T21551] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
[  655.902544][T21557] qfq: no options
18:33:05 executing program 2:
syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
r0 = syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040))

18:33:05 executing program 0:
syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
r0 = syz_open_dev$dmmidi(&(0x7f00000000c0), 0x2, 0x2201)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040))

[  655.990754][T21561] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'.
18:33:05 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x10, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:05 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

18:33:06 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0xe1}, 0x10)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000003c00)=ANY=[@ANYBLOB="300000001a00df1e050000000000000080"], 0x30}}, 0x0)

18:33:06 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
mkdir(&(0x7f00000020c0)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002000), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [], 0x3d}})

[  656.491425][T21578] hashlimit_mt_check_common: 2 callbacks suppressed
[  656.491493][T21578] xt_hashlimit: max too large, truncated to 1048576
[  656.505292][T21578] hashlimit_mt_check_common: 2 callbacks suppressed
[  656.505357][T21578] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:06 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x11, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:06 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

[  656.619793][T21583] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
18:33:06 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

[  656.689551][T21589] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'.
[  656.717850][T21590] qfq: no options
[  656.942223][T21595] xt_hashlimit: max too large, truncated to 1048576
[  656.949315][T21595] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:06 executing program 5:
r0 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10)
connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xfffffffffffffed3, &(0x7f0000000940)=[{&(0x7f00000006c0)='O', 0x57e}], 0x1}}], 0x4000000000003bd, 0x8800)
write$binfmt_misc(r1, &(0x7f0000000300)={'syz1'}, 0x4)

18:33:06 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

[  657.012190][T21597] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
18:33:06 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x12, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  657.089519][T21601] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  657.119251][T21607] qfq: no options
[  657.155096][T21612] qfq: no options
18:33:06 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
mkdir(&(0x7f00000020c0)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002000), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [], 0x3d}})

18:33:07 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

18:33:07 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

[  657.423024][T21619] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
[  657.517188][T21622] qfq: no options
[  657.532251][T21623] xt_hashlimit: max too large, truncated to 1048576
[  657.539508][T21623] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:07 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x19, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:07 executing program 5:
r0 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10)
connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xfffffffffffffed3, &(0x7f0000000940)=[{&(0x7f00000006c0)='O', 0x57e}], 0x1}}], 0x4000000000003bd, 0x8800)
write$binfmt_misc(r1, &(0x7f0000000300)={'syz1'}, 0x4)

18:33:07 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

[  657.814135][T21641] qfq: no options
[  657.900378][T21648] qfq: no options
18:33:07 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
mkdir(&(0x7f00000020c0)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002000), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [], 0x3d}})

[  657.973602][T21649] xt_hashlimit: max too large, truncated to 1048576
[  657.980453][T21649] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:07 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x1a, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:07 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

18:33:07 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_route(r3, &(0x7f0000004200)={0x0, 0x0, &(0x7f00000041c0)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@delchain={0x24, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xffff}}}, 0x24}}, 0x0)

[  658.219457][T21662] qfq: no options
18:33:08 executing program 5:
r0 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10)
connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xfffffffffffffed3, &(0x7f0000000940)=[{&(0x7f00000006c0)='O', 0x57e}], 0x1}}], 0x4000000000003bd, 0x8800)
write$binfmt_misc(r1, &(0x7f0000000300)={'syz1'}, 0x4)

[  658.499814][T21673] xt_hashlimit: max too large, truncated to 1048576
[  658.506879][T21673] xt_hashlimit: overflow, try lower: 1711341568/0
[  658.547568][T21677] qfq: no options
18:33:08 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10)
connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xfffffffffffffed3, &(0x7f0000000940)=[{&(0x7f00000006c0)='O', 0x57e}], 0x1}}], 0x4000000000003bd, 0x8800)
write$binfmt_misc(r1, &(0x7f0000000300)={'syz1'}, 0x4)

18:33:08 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x25, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  658.585188][T21684] qfq: no options
18:33:08 executing program 1:
r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000240)={0x0, 0x9, 0x1, {0x1, @vbi={0x0, 0x0, 0x0, 0x0, [0x0, 0xffffffff]}}})

18:33:08 executing program 2:
r0 = socket$inet6(0xa, 0x1, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
getsockopt$inet6_buf(r0, 0x29, 0x4b, &(0x7f0000002080)=""/102393, &(0x7f0000000080)=0x18ff9)

18:33:08 executing program 0:
r0 = socket$inet(0x2, 0x3, 0x49)
setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006cdffb)="8907040000", 0x5)
sendmmsg$inet(r0, &(0x7f0000001680)=[{{&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}}], 0x1, 0x0)

[  659.114611][T21691] xt_hashlimit: max too large, truncated to 1048576
[  659.121432][T21691] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:08 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x48, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:08 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10)
connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xfffffffffffffed3, &(0x7f0000000940)=[{&(0x7f00000006c0)='O', 0x57e}], 0x1}}], 0x4000000000003bd, 0x8800)
write$binfmt_misc(r1, &(0x7f0000000300)={'syz1'}, 0x4)

18:33:09 executing program 5:
r0 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10)
connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xfffffffffffffed3, &(0x7f0000000940)=[{&(0x7f00000006c0)='O', 0x57e}], 0x1}}], 0x4000000000003bd, 0x8800)
write$binfmt_misc(r1, &(0x7f0000000300)={'syz1'}, 0x4)

[  659.507024][T21706] xt_hashlimit: max too large, truncated to 1048576
[  659.514039][T21706] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:09 executing program 1:
r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000240)={0x0, 0x9, 0x1, {0x1, @vbi={0x0, 0x0, 0x0, 0x0, [0x0, 0xffffffff]}}})

18:33:09 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x4c, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x1, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
getsockopt$inet6_buf(r0, 0x29, 0x4b, &(0x7f0000002080)=""/102393, &(0x7f0000000080)=0x18ff9)

18:33:09 executing program 0:
r0 = socket$inet(0x2, 0x3, 0x49)
setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006cdffb)="8907040000", 0x5)
sendmmsg$inet(r0, &(0x7f0000001680)=[{{&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}}], 0x1, 0x0)

[  659.895058][T21717] xt_hashlimit: max too large, truncated to 1048576
[  659.901870][T21717] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:09 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10)
connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xfffffffffffffed3, &(0x7f0000000940)=[{&(0x7f00000006c0)='O', 0x57e}], 0x1}}], 0x4000000000003bd, 0x8800)
write$binfmt_misc(r1, &(0x7f0000000300)={'syz1'}, 0x4)

18:33:09 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x60, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:09 executing program 5:
r0 = socket$inet(0x2, 0x3, 0x49)
setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006cdffb)="8907040000", 0x5)
sendmmsg$inet(r0, &(0x7f0000001680)=[{{&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}}], 0x1, 0x0)

18:33:09 executing program 1:
r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000240)={0x0, 0x9, 0x1, {0x1, @vbi={0x0, 0x0, 0x0, 0x0, [0x0, 0xffffffff]}}})

18:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x1, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
getsockopt$inet6_buf(r0, 0x29, 0x4b, &(0x7f0000002080)=""/102393, &(0x7f0000000080)=0x18ff9)

[  660.239210][T21729] xt_hashlimit: max too large, truncated to 1048576
[  660.246163][T21729] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:09 executing program 0:
r0 = socket$inet(0x2, 0x3, 0x49)
setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006cdffb)="8907040000", 0x5)
sendmmsg$inet(r0, &(0x7f0000001680)=[{{&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}}], 0x1, 0x0)

18:33:09 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x68, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:10 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
pipe(&(0x7f0000000300)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}}, 0x0)
write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfec8)
splice(r1, 0x0, r3, 0x0, 0x103e8, 0x0)

18:33:10 executing program 1:
r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000240)={0x0, 0x9, 0x1, {0x1, @vbi={0x0, 0x0, 0x0, 0x0, [0x0, 0xffffffff]}}})

[  660.644221][T21743] xt_hashlimit: max too large, truncated to 1048576
[  660.651060][T21743] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:10 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x6c, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:10 executing program 5:
r0 = socket$inet(0x2, 0x3, 0x49)
setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006cdffb)="8907040000", 0x5)
sendmmsg$inet(r0, &(0x7f0000001680)=[{{&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}}], 0x1, 0x0)

18:33:10 executing program 2:
r0 = socket$inet6(0xa, 0x1, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f00000002c0)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
getsockopt$inet6_buf(r0, 0x29, 0x4b, &(0x7f0000002080)=""/102393, &(0x7f0000000080)=0x18ff9)

18:33:10 executing program 0:
r0 = socket$inet(0x2, 0x3, 0x49)
setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006cdffb)="8907040000", 0x5)
sendmmsg$inet(r0, &(0x7f0000001680)=[{{&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}}], 0x1, 0x0)

18:33:10 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x74, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:10 executing program 1:
r0 = io_uring_setup(0x7e9a, &(0x7f0000000000))
r1 = eventfd(0x0)
io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x2, &(0x7f0000000080)=r1, 0x1)

18:33:11 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
pipe(&(0x7f0000000300)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}}, 0x0)
write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfec8)
splice(r1, 0x0, r3, 0x0, 0x103e8, 0x0)

18:33:11 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x7a, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:11 executing program 5:
r0 = socket$inet(0x2, 0x3, 0x49)
setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00006cdffb)="8907040000", 0x5)
sendmmsg$inet(r0, &(0x7f0000001680)=[{{&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}}], 0x1, 0x0)

18:33:11 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f00000028c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000006100)={0x18, 0x13, 0x409, 0x0, 0x0, "", [@nested={0x7, 0x0, 0x0, 0x1, [@generic="559232"]}]}, 0x18}], 0x1}, 0x0)

18:33:11 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

[  661.779181][T21778] hashlimit_mt_check_common: 2 callbacks suppressed
[  661.779328][T21778] xt_hashlimit: max too large, truncated to 1048576
[  661.796520][T21778] hashlimit_mt_check_common: 2 callbacks suppressed
[  661.796587][T21778] xt_hashlimit: overflow, try lower: 1711341568/0
[  661.825460][T21779] xt_hashlimit: max too large, truncated to 1048576
[  661.832281][T21779] xt_hashlimit: overflow, try lower: 1711341568/0
[  661.998245][T21786] validate_nla: 4 callbacks suppressed
[  661.998317][T21786] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
18:33:11 executing program 5:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

18:33:11 executing program 1:
r0 = io_uring_setup(0x7e9a, &(0x7f0000000000))
r1 = eventfd(0x0)
io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x2, &(0x7f0000000080)=r1, 0x1)

[  662.203301][T21788] bond1: (slave bridge1): Enslaving as a backup interface with an up link
[  662.219740][T21789] 8021q: adding VLAN 0 to HW filter on device bond1
[  662.232308][T21789] bond0: (slave bond1): Enslaving as an active interface with an up link
[  662.244315][ T1230] bond1: (slave bridge1): link status definitely down, disabling slave
18:33:11 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
pipe(&(0x7f0000000300)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}}, 0x0)
write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfec8)
splice(r1, 0x0, r3, 0x0, 0x103e8, 0x0)

18:33:12 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f00000028c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000006100)={0x18, 0x13, 0x409, 0x0, 0x0, "", [@nested={0x7, 0x0, 0x0, 0x1, [@generic="559232"]}]}, 0x18}], 0x1}, 0x0)

18:33:12 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x158, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:12 executing program 1:
r0 = io_uring_setup(0x7e9a, &(0x7f0000000000))
r1 = eventfd(0x0)
io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x2, &(0x7f0000000080)=r1, 0x1)

18:33:12 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x228, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  662.790254][T21824] bond0: (slave bond1): Releasing backup interface
[  662.813281][T21837] xt_hashlimit: max too large, truncated to 1048576
[  662.820288][T21837] xt_hashlimit: overflow, try lower: 1711341568/0
[  662.889827][T21824] bond1 (unregistering): (slave bridge1): Releasing backup interface
[  663.123905][T21846] xt_hashlimit: max too large, truncated to 1048576
[  663.130813][T21846] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:12 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x300, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  663.286537][T21824] bond1 (unregistering): Released all slaves
18:33:13 executing program 1:
r0 = io_uring_setup(0x7e9a, &(0x7f0000000000))
r1 = eventfd(0x0)
io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x2, &(0x7f0000000080)=r1, 0x1)

[  663.502769][T21884] xt_hashlimit: max too large, truncated to 1048576
[  663.509842][T21884] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:13 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x3e0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  663.551571][T21788] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
18:33:13 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f00000028c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000006100)={0x18, 0x13, 0x409, 0x0, 0x0, "", [@nested={0x7, 0x0, 0x0, 0x1, [@generic="559232"]}]}, 0x18}], 0x1}, 0x0)

[  663.864687][T21908] xt_hashlimit: max too large, truncated to 1048576
[  663.871525][T21908] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:13 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:13 executing program 5:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

18:33:13 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
pipe(&(0x7f0000000300)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}}, 0x0)
write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfec8)
splice(r1, 0x0, r3, 0x0, 0x103e8, 0x0)

18:33:13 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x500, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:13 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:13 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f00000028c0)={0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000006100)={0x18, 0x13, 0x409, 0x0, 0x0, "", [@nested={0x7, 0x0, 0x0, 0x1, [@generic="559232"]}]}, 0x18}], 0x1}, 0x0)

[  664.238469][T21918] xt_hashlimit: max too large, truncated to 1048576
[  664.246895][T21918] xt_hashlimit: overflow, try lower: 1711341568/0
[  664.260410][T21921] netlink: 'syz-executor.1': attribute type 1 has an invalid length.
18:33:14 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x600, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  664.323054][T21923] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[  664.466418][T21961] bond1: (slave bridge2): Enslaving as a backup interface with an up link
[  664.494525][T21958] bond1: (slave bridge1): Enslaving as a backup interface with an up link
[  664.509766][T21963] 8021q: adding VLAN 0 to HW filter on device bond1
[  664.522199][T21963] bond0: (slave bond1): Enslaving as an active interface with an up link
[  664.534316][ T1230] bond1: (slave bridge1): link status definitely down, disabling slave
[  664.552973][T21995] 8021q: adding VLAN 0 to HW filter on device bond1
[  664.565687][T21995] bond0: (slave bond1): Enslaving as an active interface with an up link
18:33:14 executing program 3:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

[  664.908421][T22008] xt_hashlimit: max too large, truncated to 1048576
[  664.915584][T22008] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:14 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x700, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  665.190595][T22003] bond0: (slave bond1): Releasing backup interface
[  665.211207][T22015] xt_hashlimit: max too large, truncated to 1048576
[  665.218955][T22015] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:14 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x900, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  665.256928][T22003] bond1 (unregistering): (slave bridge2): Releasing backup interface
[  665.552419][T22022] xt_hashlimit: max too large, truncated to 1048576
[  665.559486][T22022] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:15 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xa00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  665.595291][T22003] bond1 (unregistering): Released all slaves
18:33:15 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xb00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  666.163103][T21921] bond0: (slave bond1): Releasing backup interface
[  666.237745][T21921] bond1 (unregistering): (slave bridge1): Releasing backup interface
[  666.450801][T21921] bond1 (unregistering): Released all slaves
18:33:16 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:16 executing program 5:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

18:33:16 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xb27, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:16 executing program 2:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

18:33:16 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:16 executing program 3:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

[  667.154763][T22112] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
18:33:17 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xb28, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  667.339555][T22154] hashlimit_mt_check_common: 2 callbacks suppressed
[  667.339624][T22154] xt_hashlimit: max too large, truncated to 1048576
[  667.353525][T22154] hashlimit_mt_check_common: 2 callbacks suppressed
[  667.353591][T22154] xt_hashlimit: overflow, try lower: 1711341568/0
[  667.406456][T22117] netlink: 'syz-executor.1': attribute type 1 has an invalid length.
[  667.485734][T22118] bond1: (slave bridge3): Enslaving as a backup interface with an up link
[  667.508234][T22152] 8021q: adding VLAN 0 to HW filter on device bond1
[  667.520924][T22152] bond0: (slave bond1): Enslaving as an active interface with an up link
[  667.550979][T22122] bond1: (slave bridge2): Enslaving as a backup interface with an up link
[  667.586265][T22156] 8021q: adding VLAN 0 to HW filter on device bond1
[  667.599684][T22156] bond0: (slave bond1): Enslaving as an active interface with an up link
[  667.840492][T22212] xt_hashlimit: max too large, truncated to 1048576
[  667.847629][T22212] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:17 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xc00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  668.106023][T22159] bond0: (slave bond1): Releasing backup interface
18:33:17 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xd00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  668.160446][T22159] bond1 (unregistering): (slave bridge3): Releasing backup interface
[  668.191708][T22218] xt_hashlimit: max too large, truncated to 1048576
[  668.199094][T22218] xt_hashlimit: overflow, try lower: 1711341568/0
[  668.577571][T22222] xt_hashlimit: max too large, truncated to 1048576
[  668.584600][T22222] xt_hashlimit: overflow, try lower: 1711341568/0
[  668.610422][T22159] bond1 (unregistering): Released all slaves
[  668.847838][  T153] bond1: (slave bridge2): link status definitely down, disabling slave
18:33:18 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xe00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:18 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:18 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:18 executing program 2:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

18:33:18 executing program 5:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

18:33:18 executing program 3:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

[  669.330756][T22268] xt_hashlimit: max too large, truncated to 1048576
[  669.337989][T22268] xt_hashlimit: overflow, try lower: 1711341568/0
[  669.340199][T22269] netlink: 'syz-executor.1': attribute type 1 has an invalid length.
18:33:19 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x1100, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  669.481609][T22276] bond2: (slave bridge3): Enslaving as a backup interface with an up link
[  669.497574][T22279] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[  669.599905][T22320] bond1: (slave bridge4): Enslaving as a backup interface with an up link
[  669.640661][T22276] bond2 (unregistering): (slave bridge3): Releasing backup interface
[  669.663320][T22322] skbuff: bad partial csum: csum=65530/19 headroom=64 headlen=15
18:33:19 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x1200, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  670.030079][T22368] xt_hashlimit: max too large, truncated to 1048576
[  670.037121][T22368] xt_hashlimit: overflow, try lower: 1711341568/0
[  670.063205][T22276] bond2 (unregistering): Released all slaves
[  670.179150][T22323] 8021q: adding VLAN 0 to HW filter on device bond1
[  670.190026][T22323] bond0: (slave bond1): Enslaving as an active interface with an up link
18:33:20 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x1900, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  670.366422][T22408] xt_hashlimit: max too large, truncated to 1048576
[  670.373371][T22408] xt_hashlimit: overflow, try lower: 1711341568/0
[  670.565597][T22327] bond0: (slave bond1): Releasing backup interface
[  670.632777][T22327] bond1 (unregistering): (slave bridge4): Releasing backup interface
18:33:20 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x1a00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  670.677532][T22413] xt_hashlimit: max too large, truncated to 1048576
[  670.684858][T22413] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:20 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x2000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  670.852408][T22417] xt_hashlimit: max too large, truncated to 1048576
[  670.859378][T22417] xt_hashlimit: overflow, try lower: 1711341568/0
[  670.873766][T22327] bond1 (unregistering): Released all slaves
[  671.273715][T22459] xt_hashlimit: max too large, truncated to 1048576
[  671.280470][T22459] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:21 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x2500, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:21 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:21 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:21 executing program 2:
io_setup(0x1, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0)
lsetxattr$system_posix_acl(0x0, &(0x7f00000000c0)='system.posix_acl_access\x00', 0x0, 0x4c, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x1000)
io_submit(r0, 0xa, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

18:33:21 executing program 5:
syz_emit_ethernet(0x9e, &(0x7f0000000440)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "a0f009", 0x68, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x1, 0x9, "a78ce540cd4f791153d5dea6b2590b1c71a8242373244ad2439adc07df0a69748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c11b37adac15084dbaf736b41e5a81802"}, {0x0, 0x1, "000005000000000000000000"}]}}}}}}, 0x0)

18:33:21 executing program 3:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2, 0xa, 0x0, 0x9, 0x2}, 0x10}}, 0x0)

[  671.730659][T22464] netlink: 'syz-executor.1': attribute type 1 has an invalid length.
18:33:21 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x270b, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  671.852539][T22468] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[  671.960855][T22470] bond2: (slave bridge4): Enslaving as a backup interface with an up link
[  672.006781][T22516] bond2 (unregistering): (slave bridge4): Releasing backup interface
18:33:22 executing program 5:
syz_emit_ethernet(0x9e, &(0x7f0000000440)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "a0f009", 0x68, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x1, 0x9, "a78ce540cd4f791153d5dea6b2590b1c71a8242373244ad2439adc07df0a69748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c11b37adac15084dbaf736b41e5a81802"}, {0x0, 0x1, "000005000000000000000000"}]}}}}}}, 0x0)

[  672.512152][T22557] hashlimit_mt_check_common: 1 callbacks suppressed
[  672.512216][T22557] xt_hashlimit: max too large, truncated to 1048576
[  672.526262][T22557] hashlimit_mt_check_common: 1 callbacks suppressed
[  672.526328][T22557] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:22 executing program 3:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2, 0xa, 0x0, 0x9, 0x2}, 0x10}}, 0x0)

[  672.659859][T22516] bond2 (unregistering): Released all slaves
18:33:22 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x2802, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  672.838319][T22475] bond1: (slave bridge5): Enslaving as a backup interface with an up link
[  672.862397][T22512] 8021q: adding VLAN 0 to HW filter on device bond1
[  672.875332][T22512] bond0: (slave bond1): Enslaving as an active interface with an up link
18:33:22 executing program 5:
syz_emit_ethernet(0x9e, &(0x7f0000000440)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "a0f009", 0x68, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x1, 0x9, "a78ce540cd4f791153d5dea6b2590b1c71a8242373244ad2439adc07df0a69748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c11b37adac15084dbaf736b41e5a81802"}, {0x0, 0x1, "000005000000000000000000"}]}}}}}}, 0x0)

[  672.955545][T22601] xt_hashlimit: max too large, truncated to 1048576
[  672.962393][T22601] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:22 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x280b, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:22 executing program 3:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2, 0xa, 0x0, 0x9, 0x2}, 0x10}}, 0x0)

[  673.289924][T22610] xt_hashlimit: max too large, truncated to 1048576
[  673.297994][T22610] xt_hashlimit: overflow, try lower: 1711341568/0
[  673.360502][T22553] bond0: (slave bond1): Releasing backup interface
[  673.425088][T22553] bond1 (unregistering): (slave bridge5): Releasing backup interface
[  673.695207][T22553] bond1 (unregistering): Released all slaves
18:33:23 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:23 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:23 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x4800, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:23 executing program 5:
syz_emit_ethernet(0x9e, &(0x7f0000000440)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "a0f009", 0x68, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x1, 0x9, "a78ce540cd4f791153d5dea6b2590b1c71a8242373244ad2439adc07df0a69748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c11b37adac15084dbaf736b41e5a81802"}, {0x0, 0x1, "000005000000000000000000"}]}}}}}}, 0x0)

18:33:23 executing program 3:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2, 0xa, 0x0, 0x9, 0x2}, 0x10}}, 0x0)

18:33:23 executing program 2:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockopt$inet6_int(r0, 0x29, 0xc8, 0x0, 0xffffffffffffffff)

[  674.136965][T22655] netlink: 'syz-executor.1': attribute type 1 has an invalid length.
[  674.151481][T22658] xt_hashlimit: max too large, truncated to 1048576
[  674.158531][T22658] xt_hashlimit: overflow, try lower: 1711341568/0
[  674.251568][T22663] bond2: (slave bridge5): Enslaving as a backup interface with an up link
18:33:23 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x4c00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  674.303379][T22700] 8021q: adding VLAN 0 to HW filter on device bond2
[  674.316669][T22700] bond0: (slave bond2): Enslaving as an active interface with an up link
18:33:24 executing program 3:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0x40045542, &(0x7f0000004000))
syz_open_dev$dmmidi(&(0x7f00000000c0), 0xc64a, 0x5)

18:33:24 executing program 5:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x8, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff66}, 0x48)

18:33:24 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x5801, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  674.716650][T22710] xt_hashlimit: max too large, truncated to 1048576
[  674.723776][T22710] xt_hashlimit: overflow, try lower: 1711341568/0
[  674.795545][T22703] bond0: (slave bond2): Releasing backup interface
[  674.855663][T22703] bond2 (unregistering): (slave bridge5): Releasing backup interface
18:33:24 executing program 5:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x8, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff66}, 0x48)

[  675.101862][T22719] xt_hashlimit: max too large, truncated to 1048576
[  675.109330][T22719] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:24 executing program 3:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0x40045542, &(0x7f0000004000))
syz_open_dev$dmmidi(&(0x7f00000000c0), 0xc64a, 0x5)

[  675.358058][T22703] bond2 (unregistering): Released all slaves
[  675.491332][T22702] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
18:33:25 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:25 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000011002504000000000000000010000000", @ANYRES32=r11], 0x20}}, 0x0)

18:33:25 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x6000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:25 executing program 5:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x8, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff66}, 0x48)

18:33:25 executing program 3:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0x40045542, &(0x7f0000004000))
syz_open_dev$dmmidi(&(0x7f00000000c0), 0xc64a, 0x5)

18:33:25 executing program 2:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockopt$inet6_int(r0, 0x29, 0xc8, 0x0, 0xffffffffffffffff)

18:33:25 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x6800, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  675.989150][T22769] xt_hashlimit: max too large, truncated to 1048576
[  675.996131][T22769] xt_hashlimit: overflow, try lower: 1711341568/0
[  676.086395][T22776] netlink: 'syz-executor.1': attribute type 1 has an invalid length.
18:33:25 executing program 5:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x8, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff66}, 0x48)

[  676.278285][T22778] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[  676.380871][T22783] bond2: (slave bridge6): Enslaving as a backup interface with an up link
[  676.410739][T22784] bond1: (slave bridge6): Enslaving as a backup interface with an up link
[  676.433302][T22811] 8021q: adding VLAN 0 to HW filter on device bond2
[  676.446432][T22811] bond0: (slave bond2): Enslaving as an active interface with an up link
[  676.461989][T22812] 8021q: adding VLAN 0 to HW filter on device bond1
[  676.475121][T22812] bond0: (slave bond1): Enslaving as an active interface with an up link
18:33:26 executing program 3:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0x40045542, &(0x7f0000004000))
syz_open_dev$dmmidi(&(0x7f00000000c0), 0xc64a, 0x5)

[  676.591169][T22859] xt_hashlimit: max too large, truncated to 1048576
[  676.598323][T22859] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:26 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x6c00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:26 executing program 2:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockopt$inet6_int(r0, 0x29, 0xc8, 0x0, 0xffffffffffffffff)

18:33:26 executing program 5:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0x40045542, &(0x7f0000004000))
syz_open_dev$dmmidi(&(0x7f00000000c0), 0xc64a, 0x5)

[  677.079313][T22820] bond0: (slave bond2): Releasing backup interface
[  677.124930][T22869] xt_hashlimit: max too large, truncated to 1048576
[  677.131759][T22869] xt_hashlimit: overflow, try lower: 1711341568/0
[  677.177162][T22820] bond2 (unregistering): (slave bridge6): Releasing backup interface
[  677.472326][T22820] bond2 (unregistering): Released all slaves
[  677.888401][T22821] bond0: (slave bond1): Releasing backup interface
[  677.937864][T22821] bond1 (unregistering): (slave bridge6): Releasing backup interface
[  678.088041][T22821] bond1 (unregistering): Released all slaves
18:33:28 executing program 2:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockopt$inet6_int(r0, 0x29, 0xc8, 0x0, 0xffffffffffffffff)

18:33:28 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x7400, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:28 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NFT_MSG_GETOBJ_RESET(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x44}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r3}]}}}]}, 0x3c}}, 0x0)

18:33:28 executing program 5:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0x40045542, &(0x7f0000004000))
syz_open_dev$dmmidi(&(0x7f00000000c0), 0xc64a, 0x5)

18:33:28 executing program 0:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002)
io_setup(0x8, &(0x7f0000000600)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f00000000c0)="03508d4a", 0x10}])

[  678.622277][T22955] xt_hashlimit: max too large, truncated to 1048576
[  678.629715][T22955] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:28 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x7a00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:28 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_DEBUGREGS(r2, 0x4080aea2, &(0x7f0000000140)={[], 0x0, 0x0, 0x1})

18:33:28 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r0, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, &(0x7f00000000c0))

18:33:28 executing program 5:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0x40045542, &(0x7f0000004000))
syz_open_dev$dmmidi(&(0x7f00000000c0), 0xc64a, 0x5)

18:33:28 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NFT_MSG_GETOBJ_RESET(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x44}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r3}]}}}]}, 0x3c}}, 0x0)

18:33:28 executing program 0:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002)
io_setup(0x8, &(0x7f0000000600)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f00000000c0)="03508d4a", 0x10}])

[  679.150870][T22968] xt_hashlimit: max too large, truncated to 1048576
[  679.157696][T22968] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:28 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xe003, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:29 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_DEBUGREGS(r2, 0x4080aea2, &(0x7f0000000140)={[], 0x0, 0x0, 0x1})

18:33:29 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NFT_MSG_GETOBJ_RESET(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x44}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r3}]}}}]}, 0x3c}}, 0x0)

18:33:29 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r0, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, &(0x7f00000000c0))

18:33:29 executing program 5:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]})
lstat(0x0, 0x0)

[  679.532717][T22989] xt_hashlimit: max too large, truncated to 1048576
[  679.540776][T22989] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:29 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xff00, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:29 executing program 0:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002)
io_setup(0x8, &(0x7f0000000600)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f00000000c0)="03508d4a", 0x10}])

[  679.867155][   T34] audit: type=1326 audit(1620930809.502:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23002 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4665d9 code=0x7ffc0000
[  679.890139][   T34] audit: type=1326 audit(1620930809.502:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23002 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4665d9 code=0x7ffc0000
18:33:29 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NFT_MSG_GETOBJ_RESET(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x44}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r3}]}}}]}, 0x3c}}, 0x0)

18:33:29 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_DEBUGREGS(r2, 0x4080aea2, &(0x7f0000000140)={[], 0x0, 0x0, 0x1})

[  680.059090][T23009] xt_hashlimit: max too large, truncated to 1048576
[  680.065981][T23009] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:29 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x40000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  680.148429][   T34] audit: type=1326 audit(1620930809.562:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23002 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=6 compat=0 ip=0x4665d9 code=0x7ffc0000
[  680.171219][   T34] audit: type=1326 audit(1620930809.562:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23002 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4665d9 code=0x7ffc0000
[  680.194179][   T34] audit: type=1326 audit(1620930809.562:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23002 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4665d9 code=0x7ffc0000
[  680.218383][   T34] audit: type=1326 audit(1620930809.572:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23002 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=157 compat=0 ip=0x4665d9 code=0x7ffc0000
18:33:29 executing program 5:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]})
lstat(0x0, 0x0)

[  680.241605][   T34] audit: type=1326 audit(1620930809.572:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23002 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4665d9 code=0x7ffc0000
[  680.264538][   T34] audit: type=1326 audit(1620930809.572:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23002 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4665d9 code=0x7ffc0000
18:33:29 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r0, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, &(0x7f00000000c0))

[  680.545201][T23027] xt_hashlimit: max too large, truncated to 1048576
[  680.552220][T23027] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:30 executing program 0:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002)
io_setup(0x8, &(0x7f0000000600)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f00000000c0)="03508d4a", 0x10}])

18:33:30 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x100000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:30 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_DEBUGREGS(r2, 0x4080aea2, &(0x7f0000000140)={[], 0x0, 0x0, 0x1})

18:33:30 executing program 5:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]})
lstat(0x0, 0x0)

18:33:30 executing program 3:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]})
lstat(0x0, 0x0)

18:33:30 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r0, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, &(0x7f00000000c0))

18:33:30 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xe0ffff, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  680.990402][T23039] xt_hashlimit: max too large, truncated to 1048576
[  680.997582][T23039] xt_hashlimit: overflow, try lower: 1711341568/0
[  681.171328][   T34] audit: type=1326 audit(1620930810.302:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23030 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4665d9 code=0x7ffc0000
[  681.194403][   T34] audit: type=1326 audit(1620930810.302:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23030 comm="syz-executor.5" exe="/root/syz-executor.5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4665d9 code=0x7ffc0000
18:33:31 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x2, 0x0)
write(r4, 0x0, 0x0)
getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=r5, @ANYBLOB="000000000000ce001c0012800b00010062726964676500000c0002800800050001"], 0x3c}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x8001, 0x0)

18:33:31 executing program 1:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

[  681.484269][T23055] xt_hashlimit: max too large, truncated to 1048576
[  681.491130][T23055] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:31 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x1000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:31 executing program 3:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]})
lstat(0x0, 0x0)

18:33:31 executing program 5:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]})
lstat(0x0, 0x0)

18:33:31 executing program 2:
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c00000010001fff0000000000000000f0ff0000", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e00000004000280080004003645"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0)
r0 = socket(0x10, 0x80002, 0x0)
sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0)

[  681.811646][T23062] dccp_close: ABORT with 692 bytes unread
[  681.941387][T23070] xt_hashlimit: max too large, truncated to 1048576
[  681.948529][T23070] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:31 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x2000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  682.100190][T23078] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  682.109353][T23078] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  682.118475][T23078] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  682.127554][T23078] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  682.136774][T23078] device vxlan0 entered promiscuous mode
18:33:31 executing program 3:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]})
lstat(0x0, 0x0)

18:33:32 executing program 5:
r0 = syz_open_dev$vim2m(&(0x7f0000000400), 0x4, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000500)={0x2, @pix_mp={0x0, 0x0, 0x0, 0x8}})

[  682.413341][T23082] xt_hashlimit: max too large, truncated to 1048576
[  682.420144][T23082] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:32 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x3000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:32 executing program 1:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

18:33:32 executing program 2:
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c00000010001fff0000000000000000f0ff0000", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e00000004000280080004003645"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0)
r0 = socket(0x10, 0x80002, 0x0)
sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0)

18:33:32 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x2, 0x0)
write(r4, 0x0, 0x0)
getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=r5, @ANYBLOB="000000000000ce001c0012800b00010062726964676500000c0002800800050001"], 0x3c}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x8001, 0x0)

[  682.855701][T23093] xt_hashlimit: max too large, truncated to 1048576
[  682.862529][T23093] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:32 executing program 3:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x2, 0x0)
write(r4, 0x0, 0x0)
getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=r5, @ANYBLOB="000000000000ce001c0012800b00010062726964676500000c0002800800050001"], 0x3c}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x8001, 0x0)

18:33:32 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x4000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:32 executing program 5:
r0 = syz_open_dev$vim2m(&(0x7f0000000400), 0x4, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000500)={0x2, @pix_mp={0x0, 0x0, 0x0, 0x8}})

[  682.994222][T23098] dccp_close: ABORT with 692 bytes unread
18:33:32 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x5000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:33 executing program 1:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

18:33:33 executing program 2:
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c00000010001fff0000000000000000f0ff0000", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e00000004000280080004003645"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0)
r0 = socket(0x10, 0x80002, 0x0)
sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0)

18:33:33 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x6000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:33 executing program 5:
r0 = syz_open_dev$vim2m(&(0x7f0000000400), 0x4, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000500)={0x2, @pix_mp={0x0, 0x0, 0x0, 0x8}})

[  683.951178][T23127] dccp_close: ABORT with 692 bytes unread
[  684.037939][T23131] hashlimit_mt_check_common: 2 callbacks suppressed
[  684.038008][T23131] xt_hashlimit: max too large, truncated to 1048576
[  684.052429][T23131] hashlimit_mt_check_common: 2 callbacks suppressed
[  684.052500][T23131] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:33 executing program 2:
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c00000010001fff0000000000000000f0ff0000", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e00000004000280080004003645"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0)
r0 = socket(0x10, 0x80002, 0x0)
sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0)

18:33:33 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x2, 0x0)
write(r4, 0x0, 0x0)
getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=r5, @ANYBLOB="000000000000ce001c0012800b00010062726964676500000c0002800800050001"], 0x3c}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x8001, 0x0)

18:33:33 executing program 3:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x2, 0x0)
write(r4, 0x0, 0x0)
getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=r5, @ANYBLOB="000000000000ce001c0012800b00010062726964676500000c0002800800050001"], 0x3c}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x8001, 0x0)

18:33:33 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x7000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:33 executing program 5:
r0 = syz_open_dev$vim2m(&(0x7f0000000400), 0x4, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000500)={0x2, @pix_mp={0x0, 0x0, 0x0, 0x8}})

18:33:34 executing program 1:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

[  684.558665][T23144] xt_hashlimit: max too large, truncated to 1048576
[  684.565663][T23144] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:34 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x8000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  684.884302][T23154] dccp_close: ABORT with 692 bytes unread
18:33:34 executing program 5:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

18:33:34 executing program 2:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

[  684.980464][T23156] xt_hashlimit: max too large, truncated to 1048576
[  684.987442][T23156] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:34 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x9000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  685.258529][T23162] dccp_close: ABORT with 692 bytes unread
[  685.340034][T23164] dccp_close: ABORT with 692 bytes unread
[  685.353447][T23166] xt_hashlimit: max too large, truncated to 1048576
[  685.360255][T23166] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:35 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xa000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:35 executing program 3:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x2, 0x0)
write(r4, 0x0, 0x0)
getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=r5, @ANYBLOB="000000000000ce001c0012800b00010062726964676500000c0002800800050001"], 0x3c}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x8001, 0x0)

18:33:35 executing program 1:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

18:33:35 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x2, 0x0)
write(r4, 0x0, 0x0)
getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=r5, @ANYBLOB="000000000000ce001c0012800b00010062726964676500000c0002800800050001"], 0x3c}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x8001, 0x0)

18:33:35 executing program 2:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

[  685.838801][T23171] xt_hashlimit: max too large, truncated to 1048576
[  685.845887][T23171] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:35 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xb000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:35 executing program 5:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

[  685.968336][T23178] dccp_close: ABORT with 692 bytes unread
[  686.162686][T23189] dccp_close: ABORT with 692 bytes unread
[  686.245139][T23193] xt_hashlimit: max too large, truncated to 1048576
[  686.251992][T23193] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:36 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xc000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  686.331052][T23194] dccp_close: ABORT with 692 bytes unread
18:33:36 executing program 1:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

18:33:36 executing program 2:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

[  686.677261][T23200] xt_hashlimit: max too large, truncated to 1048576
[  686.684354][T23200] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:36 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xd000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:36 executing program 5:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

[  686.864498][T23205] dccp_close: ABORT with 692 bytes unread
[  686.998299][T23207] dccp_close: ABORT with 692 bytes unread
[  687.159600][T23209] xt_hashlimit: max too large, truncated to 1048576
[  687.166727][T23209] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:36 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xe000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  687.364499][T23214] dccp_close: ABORT with 692 bytes unread
18:33:37 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0xae41, &(0x7f0000000100)={0x9})

18:33:37 executing program 0:
r0 = syz_open_dev$video(&(0x7f0000000000), 0x6287, 0x0)
ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f00000002c0)={0x80000000, 0x32315258, 0x280, 0x168, 0x0, @stepwise})

18:33:37 executing program 1:
r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @loopback}, 0x1c)
listen(r1, 0xff3d)
r2 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
accept4(r1, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
write$binfmt_aout(r2, &(0x7f00000015c0)=ANY=[], 0x2b4)
preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)

[  687.685538][T23221] xt_hashlimit: max too large, truncated to 1048576
[  687.694253][T23221] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:37 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x10000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:37 executing program 2:
syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000083910808c60515928f8e010203010902120001000000000904000000ff"], 0x0)

18:33:37 executing program 5:
r0 = add_key$keyring(&(0x7f0000000040), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key(&(0x7f0000000080)='pkcs7_test\x00', 0x0, &(0x7f0000000140)="3081a3", 0x3, r0)

18:33:37 executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x5a}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0)

[  687.977810][T23230] dccp_close: ABORT with 692 bytes unread
18:33:37 executing program 0:
r0 = syz_open_dev$video(&(0x7f0000000000), 0x6287, 0x0)
ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f00000002c0)={0x80000000, 0x32315258, 0x280, 0x168, 0x0, @stepwise})

[  688.165882][T23234] xt_hashlimit: max too large, truncated to 1048576
[  688.172704][T23234] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:37 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x11000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:38 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a000102"], 0x1c}}, 0x0)

[  688.433889][ T1979] usb 3-1: new high-speed USB device number 20 using dummy_hcd
18:33:38 executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x5a}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0)

18:33:38 executing program 5:
r0 = add_key$keyring(&(0x7f0000000040), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key(&(0x7f0000000080)='pkcs7_test\x00', 0x0, &(0x7f0000000140)="3081a3", 0x3, r0)

[  688.673183][ T1979] usb 3-1: Using ep0 maxpacket: 8
18:33:38 executing program 0:
r0 = syz_open_dev$video(&(0x7f0000000000), 0x6287, 0x0)
ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f00000002c0)={0x80000000, 0x32315258, 0x280, 0x168, 0x0, @stepwise})

18:33:38 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x12000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:38 executing program 1:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x1401, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0)

18:33:38 executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x5a}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0)

[  688.953338][ T1979] usb 3-1: New USB device found, idVendor=05c6, idProduct=9215, bcdDevice=8e.8f
[  688.962644][ T1979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  688.971529][ T1979] usb 3-1: Product: syz
[  688.976366][ T1979] usb 3-1: Manufacturer: syz
[  688.981121][ T1979] usb 3-1: SerialNumber: syz
[  689.139503][ T1979] usb 3-1: config 0 descriptor??
[  689.192992][ T1979] qmi_wwan: probe of 3-1:0.0 failed with error -22
[  689.274343][T23269] hashlimit_mt_check_common: 1 callbacks suppressed
[  689.274422][T23269] xt_hashlimit: max too large, truncated to 1048576
[  689.288610][T23269] hashlimit_mt_check_common: 1 callbacks suppressed
[  689.288668][T23269] xt_hashlimit: overflow, try lower: 1711341568/0
[  689.397726][ T1979] usb 3-1: USB disconnect, device number 20
[  690.193364][   T55] usb 3-1: new high-speed USB device number 21 using dummy_hcd
[  690.453334][   T55] usb 3-1: Using ep0 maxpacket: 8
[  690.754030][   T55] usb 3-1: New USB device found, idVendor=05c6, idProduct=9215, bcdDevice=8e.8f
[  690.765937][   T55] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  690.774899][   T55] usb 3-1: Product: syz
[  690.779210][   T55] usb 3-1: Manufacturer: syz
[  690.784023][   T55] usb 3-1: SerialNumber: syz
[  690.897843][   T55] usb 3-1: config 0 descriptor??
[  690.975360][   T55] qmi_wwan: probe of 3-1:0.0 failed with error -22
18:33:41 executing program 2:
syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000083910808c60515928f8e010203010902120001000000000904000000ff"], 0x0)

18:33:41 executing program 5:
r0 = add_key$keyring(&(0x7f0000000040), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key(&(0x7f0000000080)='pkcs7_test\x00', 0x0, &(0x7f0000000140)="3081a3", 0x3, r0)

18:33:41 executing program 0:
r0 = syz_open_dev$video(&(0x7f0000000000), 0x6287, 0x0)
ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f00000002c0)={0x80000000, 0x32315258, 0x280, 0x168, 0x0, @stepwise})

18:33:41 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x19000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:41 executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x5a}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0)

18:33:41 executing program 1:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x1401, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0)

[  691.437347][ T9214] usb 3-1: USB disconnect, device number 21
[  691.785664][T23301] xt_hashlimit: max too large, truncated to 1048576
[  691.795505][T23301] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:41 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x1a000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:41 executing program 1:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x1401, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0)

18:33:41 executing program 3:
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x38}}, 0x0)

18:33:41 executing program 5:
r0 = add_key$keyring(&(0x7f0000000040), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key(&(0x7f0000000080)='pkcs7_test\x00', 0x0, &(0x7f0000000140)="3081a3", 0x3, r0)

18:33:41 executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x9, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x8000003}}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)

[  692.245738][T23311] xt_hashlimit: max too large, truncated to 1048576
[  692.252492][T23311] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:41 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x20000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  692.293745][   T55] usb 3-1: new high-speed USB device number 22 using dummy_hcd
[  692.615923][   T55] usb 3-1: Using ep0 maxpacket: 8
[  693.035931][   T55] usb 3-1: New USB device found, idVendor=05c6, idProduct=9215, bcdDevice=8e.8f
[  693.045270][   T55] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  693.053652][   T55] usb 3-1: Product: syz
[  693.057927][   T55] usb 3-1: Manufacturer: syz
[  693.062647][   T55] usb 3-1: SerialNumber: syz
[  693.287854][T23332] xt_hashlimit: max too large, truncated to 1048576
[  693.294970][T23332] xt_hashlimit: overflow, try lower: 1711341568/0
[  693.373523][ T1979] usb 1-1: new high-speed USB device number 11 using dummy_hcd
[  693.377839][   T55] usb 3-1: config 0 descriptor??
[  693.430937][   T55] qmi_wwan: probe of 3-1:0.0 failed with error -22
[  693.645638][   T55] usb 3-1: USB disconnect, device number 22
[  693.736062][ T1979] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  693.934044][ T1979] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  693.943446][ T1979] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  693.951616][ T1979] usb 1-1: Product: syz
[  693.956115][ T1979] usb 1-1: Manufacturer: syz
[  693.960883][ T1979] usb 1-1: SerialNumber: syz
[  694.085111][ T1979] hub 1-1:1.0: bad descriptor, ignoring hub
[  694.091300][ T1979] hub: probe of 1-1:1.0 failed with error -5
18:33:43 executing program 2:
syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000083910808c60515928f8e010203010902120001000000000904000000ff"], 0x0)

18:33:43 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='oom_score_adj\x00')
pwritev(r0, &(0x7f0000000700)=[{&(0x7f00000000c0)='\f', 0x1}], 0x1, 0x0, 0x0)

18:33:43 executing program 1:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x1401, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0)

18:33:43 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x25000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:43 executing program 3:
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x38}}, 0x0)

[  694.179825][ T3127] ieee802154 phy0 wpan0: encryption failed: -22
[  694.186659][ T3127] ieee802154 phy1 wpan1: encryption failed: -22
[  694.390815][T23355] xt_hashlimit: max too large, truncated to 1048576
[  694.397975][T23355] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:44 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x270b0000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:44 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='oom_score_adj\x00')
pwritev(r0, &(0x7f0000000700)=[{&(0x7f00000000c0)='\f', 0x1}], 0x1, 0x0, 0x0)

[  695.193567][ T1979] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42
[  695.200193][ T1979] cdc_ncm 1-1:1.0: setting rx_max = 16384
[  695.223374][ T8447] usb 3-1: new high-speed USB device number 23 using dummy_hcd
18:33:44 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:45 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x28020000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  695.412143][ T1979] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM, 42:42:42:42:42:42
[  695.431881][T23367] xt_hashlimit: max too large, truncated to 1048576
[  695.438691][T23367] xt_hashlimit: overflow, try lower: 1711341568/0
[  695.475853][ T8447] usb 3-1: Using ep0 maxpacket: 8
[  695.500815][T23379] "syz-executor.1" (23379) uses obsolete ecb(arc4) skcipher
[  695.564719][ T1979] usb 1-1: USB disconnect, device number 11
[  695.572212][ T1979] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM
[  695.755129][ T8447] usb 3-1: New USB device found, idVendor=05c6, idProduct=9215, bcdDevice=8e.8f
[  695.764694][ T8447] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  695.773164][ T8447] usb 3-1: Product: syz
[  695.777450][ T8447] usb 3-1: Manufacturer: syz
[  695.783645][ T8447] usb 3-1: SerialNumber: syz
[  696.030838][T23395] xt_hashlimit: max too large, truncated to 1048576
[  696.037916][T23395] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:45 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x280b0000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  696.081029][ T8447] usb 3-1: config 0 descriptor??
[  696.140575][ T8447] qmi_wwan: probe of 3-1:0.0 failed with error -22
[  696.313996][ T1979] usb 1-1: new high-speed USB device number 12 using dummy_hcd
[  696.365201][T23408] "syz-executor.1" (23408) uses obsolete ecb(arc4) skcipher
[  696.393638][ T9214] usb 3-1: USB disconnect, device number 23
18:33:46 executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x9, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x8000003}}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)

18:33:46 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='oom_score_adj\x00')
pwritev(r0, &(0x7f0000000700)=[{&(0x7f00000000c0)='\f', 0x1}], 0x1, 0x0, 0x0)

[  696.773260][ T1979] usb 1-1: unable to read config index 0 descriptor/start: -71
[  696.781127][ T1979] usb 1-1: can't read configurations, error -71
18:33:46 executing program 2:
syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000083910808c60515928f8e010203010902120001000000000904000000ff"], 0x0)

18:33:46 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:46 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x48000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:46 executing program 3:
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x38}}, 0x0)

18:33:46 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='oom_score_adj\x00')
pwritev(r0, &(0x7f0000000700)=[{&(0x7f00000000c0)='\f', 0x1}], 0x1, 0x0, 0x0)

[  697.202016][T23425] xt_hashlimit: max too large, truncated to 1048576
[  697.209123][T23425] xt_hashlimit: overflow, try lower: 1711341568/0
[  697.234183][T23429] "syz-executor.1" (23429) uses obsolete ecb(arc4) skcipher
18:33:47 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x4c000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  697.553324][ T1979] usb 1-1: new high-speed USB device number 13 using dummy_hcd
[  697.883194][ T8447] usb 3-1: new high-speed USB device number 24 using dummy_hcd
[  697.973485][ T1979] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  698.144833][ T8447] usb 3-1: Using ep0 maxpacket: 8
18:33:47 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

[  698.223553][ T1979] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  698.233157][ T1979] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  698.236394][T23441] xt_hashlimit: max too large, truncated to 1048576
[  698.242454][ T1979] usb 1-1: Product: syz
[  698.248043][T23441] xt_hashlimit: overflow, try lower: 1711341568/0
[  698.259207][ T1979] usb 1-1: Manufacturer: syz
[  698.264044][ T1979] usb 1-1: SerialNumber: syz
18:33:47 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x58010000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  698.441049][T23446] "syz-executor.5" (23446) uses obsolete ecb(arc4) skcipher
[  698.475885][ T8447] usb 3-1: New USB device found, idVendor=05c6, idProduct=9215, bcdDevice=8e.8f
18:33:48 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

[  698.485403][ T8447] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  698.493979][ T8447] usb 3-1: Product: syz
[  698.498280][ T8447] usb 3-1: Manufacturer: syz
[  698.503248][ T8447] usb 3-1: SerialNumber: syz
[  698.534538][ T1979] hub 1-1:1.0: bad descriptor, ignoring hub
[  698.540709][ T1979] hub: probe of 1-1:1.0 failed with error -5
[  698.572282][T23450] xt_hashlimit: max too large, truncated to 1048576
[  698.579304][T23450] xt_hashlimit: overflow, try lower: 1711341568/0
[  698.627802][ T8447] usb 3-1: config 0 descriptor??
18:33:48 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x60000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  698.681361][ T8447] qmi_wwan: probe of 3-1:0.0 failed with error -22
[  698.814418][T23460] xt_hashlimit: max too large, truncated to 1048576
[  698.821371][T23460] xt_hashlimit: overflow, try lower: 1711341568/0
[  698.922285][ T8447] usb 3-1: USB disconnect, device number 24
[  698.961190][T23466] "syz-executor.1" (23466) uses obsolete ecb(arc4) skcipher
[  699.680076][ T1979] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42
[  699.687008][ T1979] cdc_ncm 1-1:1.0: setting rx_max = 16384
[  699.922341][ T1979] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM, 42:42:42:42:42:42
[  700.105285][ T1979] usb 1-1: USB disconnect, device number 13
[  700.112696][ T1979] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM
18:33:50 executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x9, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x8000003}}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)

18:33:50 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x68000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:50 executing program 3:
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x38}}, 0x0)

18:33:50 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:50 executing program 2:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:50 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

[  700.623691][T23490] "syz-executor.1" (23490) uses obsolete ecb(arc4) skcipher
[  700.681723][T23492] "syz-executor.2" (23492) uses obsolete ecb(arc4) skcipher
[  700.750369][T23497] xt_hashlimit: max too large, truncated to 1048576
[  700.757566][T23497] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:50 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x6c000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  701.133334][T14515] usb 1-1: new high-speed USB device number 14 using dummy_hcd
[  701.583194][T14515] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  701.591580][T23517] xt_hashlimit: max too large, truncated to 1048576
[  701.601170][T23517] xt_hashlimit: overflow, try lower: 1711341568/0
[  701.685501][T23518] xt_hashlimit: max too large, truncated to 1048576
[  701.692267][T23518] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:51 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x74000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  701.884486][T14515] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  701.893935][T14515] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  701.902091][T14515] usb 1-1: Product: syz
[  701.906571][T14515] usb 1-1: Manufacturer: syz
[  701.911303][T14515] usb 1-1: SerialNumber: syz
18:33:51 executing program 2:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:51 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:51 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

[  702.195365][T14515] hub 1-1:1.0: bad descriptor, ignoring hub
[  702.201547][T14515] hub: probe of 1-1:1.0 failed with error -5
[  702.282130][T23527] xt_hashlimit: max too large, truncated to 1048576
[  702.289233][T23527] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:51 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x7a000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  702.332659][T23532] "syz-executor.1" (23532) uses obsolete ecb(arc4) skcipher
[  702.389907][T23534] "syz-executor.2" (23534) uses obsolete ecb(arc4) skcipher
[  702.589159][T23539] "syz-executor.5" (23539) uses obsolete ecb(arc4) skcipher
[  702.695761][T23541] xt_hashlimit: max too large, truncated to 1048576
[  702.703339][T23541] xt_hashlimit: overflow, try lower: 1711341568/0
[  703.323877][T14515] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42
[  703.330637][T14515] cdc_ncm 1-1:1.0: setting rx_max = 16384
[  703.550377][T14515] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM, 42:42:42:42:42:42
[  703.685407][T14515] usb 1-1: USB disconnect, device number 14
[  703.697968][T14515] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM
18:33:53 executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x9, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x8000003}}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)

18:33:53 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xe0030000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:53 executing program 2:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:53 executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:53 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:53 executing program 5:
futex(&(0x7f000000cffc)=0x1, 0x8b, 0x1, 0x0, &(0x7f0000048000), 0x0)
futex(&(0x7f000000cffc), 0x8c, 0x1, 0x0, &(0x7f0000048000)=0xfffffffd, 0x0)

[  704.217424][T23571] "syz-executor.1" (23571) uses obsolete ecb(arc4) skcipher
[  704.304957][T23573] xt_hashlimit: max too large, truncated to 1048576
[  704.311789][T23573] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:54 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xff000000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  704.389447][T23582] "syz-executor.2" (23582) uses obsolete ecb(arc4) skcipher
[  704.409385][T23584] "syz-executor.3" (23584) uses obsolete ecb(arc4) skcipher
18:33:54 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0xffffe000, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  704.619525][T23592] xt_hashlimit: max too large, truncated to 1048576
[  704.626895][T23592] xt_hashlimit: overflow, try lower: 1711341568/0
[  704.746955][   T55] usb 1-1: new high-speed USB device number 15 using dummy_hcd
18:33:54 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x2}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  704.789530][T23596] xt_hashlimit: max too large, truncated to 1048576
[  704.799478][T23596] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:54 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x3}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  704.975596][T23601] xt_hashlimit: max too large, truncated to 1048576
[  704.982347][T23601] xt_hashlimit: overflow, try lower: 1711341568/0
[  705.144900][   T55] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
18:33:54 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

[  705.343247][   T55] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  705.352615][   T55] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  705.357252][T23608] xt_hashlimit: max too large, truncated to 1048576
[  705.361403][   T55] usb 1-1: Product: syz
[  705.368265][T23608] xt_hashlimit: overflow, try lower: 1711341568/0
[  705.372272][   T55] usb 1-1: Manufacturer: syz
[  705.383528][   T55] usb 1-1: SerialNumber: syz
18:33:55 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x4}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  705.674490][   T55] hub 1-1:1.0: bad descriptor, ignoring hub
[  705.680678][   T55] hub: probe of 1-1:1.0 failed with error -5
[  705.768145][T23617] "syz-executor.1" (23617) uses obsolete ecb(arc4) skcipher
[  705.800778][T23618] xt_hashlimit: max too large, truncated to 1048576
[  705.812005][T23618] xt_hashlimit: overflow, try lower: 1711341568/0
[  706.813603][   T55] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42
[  706.820226][   T55] cdc_ncm 1-1:1.0: setting rx_max = 16384
[  707.056427][   T55] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM, 42:42:42:42:42:42
[  707.134565][   T55] usb 1-1: USB disconnect, device number 15
[  707.141889][   T55] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM
18:33:57 executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:57 executing program 2:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2, 0x12, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x9}]}, 0x18}}, 0x0)

18:33:57 executing program 5:
futex(&(0x7f000000cffc)=0x1, 0x8b, 0x1, 0x0, &(0x7f0000048000), 0x0)
futex(&(0x7f000000cffc), 0x8c, 0x1, 0x0, &(0x7f0000048000)=0xfffffffd, 0x0)

18:33:57 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x5}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:57 executing program 1:
futex(&(0x7f000000cffc)=0x1, 0x8b, 0x1, 0x0, &(0x7f0000048000), 0x0)
futex(&(0x7f000000cffc), 0x8c, 0x1, 0x0, &(0x7f0000048000)=0xfffffffd, 0x0)

[  708.004896][T23660] "syz-executor.3" (23660) uses obsolete ecb(arc4) skcipher
[  708.050841][T23661] xt_hashlimit: max too large, truncated to 1048576
[  708.058009][T23661] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:57 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:58 executing program 2:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2, 0x12, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x9}]}, 0x18}}, 0x0)

18:33:58 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

18:33:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x7}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  708.557636][T23671] xt_hashlimit: max too large, truncated to 1048576
[  708.564665][T23671] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:58 executing program 1:
futex(&(0x7f000000cffc)=0x1, 0x8b, 0x1, 0x0, &(0x7f0000048000), 0x0)
futex(&(0x7f000000cffc), 0x8c, 0x1, 0x0, &(0x7f0000048000)=0xfffffffd, 0x0)

[  708.999032][T23684] xt_hashlimit: max too large, truncated to 1048576
[  709.006115][T23684] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x8}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:58 executing program 5:
futex(&(0x7f000000cffc)=0x1, 0x8b, 0x1, 0x0, &(0x7f0000048000), 0x0)
futex(&(0x7f000000cffc), 0x8c, 0x1, 0x0, &(0x7f0000048000)=0xfffffffd, 0x0)

18:33:58 executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000022c0)="8c", 0x1)
r1 = accept$alg(r0, 0x0, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
poll(&(0x7f00000023c0)=[{r2, 0x82}], 0x1, 0x85e)
ftruncate(r3, 0x200004)
sendfile(r2, r3, 0x0, 0x80001d00c0d1)

18:33:58 executing program 2:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2, 0x12, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x9}]}, 0x18}}, 0x0)

18:33:58 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

[  709.479920][T23697] xt_hashlimit: max too large, truncated to 1048576
[  709.486931][T23697] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:59 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x9}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:59 executing program 2:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x2, 0x12, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x9}]}, 0x18}}, 0x0)

[  709.623771][T23705] "syz-executor.3" (23705) uses obsolete ecb(arc4) skcipher
[  709.798175][T23709] xt_hashlimit: max too large, truncated to 1048576
[  709.805254][T23709] xt_hashlimit: overflow, try lower: 1711341568/0
18:33:59 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xa}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:33:59 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

18:33:59 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

[  710.275673][T23719] xt_hashlimit: max too large, truncated to 1048576
[  710.282528][T23719] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xb}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:00 executing program 1:
futex(&(0x7f000000cffc)=0x1, 0x8b, 0x1, 0x0, &(0x7f0000048000), 0x0)
futex(&(0x7f000000cffc), 0x8c, 0x1, 0x0, &(0x7f0000048000)=0xfffffffd, 0x0)

18:34:00 executing program 5:
futex(&(0x7f000000cffc)=0x1, 0x8b, 0x1, 0x0, &(0x7f0000048000), 0x0)
futex(&(0x7f000000cffc), 0x8c, 0x1, 0x0, &(0x7f0000048000)=0xfffffffd, 0x0)

18:34:00 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

18:34:00 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

18:34:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xc}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  710.737583][T23727] xt_hashlimit: max too large, truncated to 1048576
[  710.744595][T23727] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:00 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

18:34:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xd}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  711.099149][T23744] xt_hashlimit: max too large, truncated to 1048576
[  711.106276][T23744] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:00 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

18:34:01 executing program 0:
syz_emit_ethernet(0x66, &(0x7f0000000180)={@local, @remote, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "900f22", 0x30, 0x67, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[@hopopts={0x0, 0x1, '\x00', [@padn={0x1, 0x1, [0x0]}, @jumbo]}, @dstopts={0x0, 0x1, '\x00', [@padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @ra]}]}}}}}, 0x0)

[  711.491067][T23754] xt_hashlimit: max too large, truncated to 1048576
[  711.498102][T23754] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:01 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

18:34:01 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xe}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:01 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e00000029000504d25a80648c63940d0124fc6004000f400a003d005a00000037153e370a00018003000000d1bd", 0x2e}], 0x1}, 0x0)
close(r0)

18:34:01 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000140)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff06000000010000004500000025000000190004c00000000007fd17e5ffff0606040000000000000000", 0x39}], 0x1)

18:34:01 executing program 0:
syz_emit_ethernet(0x66, &(0x7f0000000180)={@local, @remote, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "900f22", 0x30, 0x67, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[@hopopts={0x0, 0x1, '\x00', [@padn={0x1, 0x1, [0x0]}, @jumbo]}, @dstopts={0x0, 0x1, '\x00', [@padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @ra]}]}}}}}, 0x0)

[  712.033949][T23767] xt_hashlimit: max too large, truncated to 1048576
[  712.040698][T23767] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:01 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c)
connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0)
sendmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

18:34:01 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x10}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  712.169803][T23774] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  712.181132][T23775] netlink: 'syz-executor.5': attribute type 4 has an invalid length.
[  712.250349][T23776] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:34:02 executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x64, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2f}]}, 0x64}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x40, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100a}]}, 0x40}}, 0x0)

18:34:02 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000140)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff06000000010000004500000025000000190004c00000000007fd17e5ffff0606040000000000000000", 0x39}], 0x1)

[  712.694172][T23784] xt_hashlimit: max too large, truncated to 1048576
[  712.700906][T23784] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:02 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e00000029000504d25a80648c63940d0124fc6004000f400a003d005a00000037153e370a00018003000000d1bd", 0x2e}], 0x1}, 0x0)
close(r0)

18:34:02 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x11}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:02 executing program 0:
syz_emit_ethernet(0x66, &(0x7f0000000180)={@local, @remote, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "900f22", 0x30, 0x67, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[@hopopts={0x0, 0x1, '\x00', [@padn={0x1, 0x1, [0x0]}, @jumbo]}, @dstopts={0x0, 0x1, '\x00', [@padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @ra]}]}}}}}, 0x0)

18:34:02 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e00000029000504d25a80648c63940d0124fc6004000f400a003d005a00000037153e370a00018003000000d1bd", 0x2e}], 0x1}, 0x0)
close(r0)

18:34:02 executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x64, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2f}]}, 0x64}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x40, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100a}]}, 0x40}}, 0x0)

[  712.971863][T23793] netlink: 'syz-executor.5': attribute type 4 has an invalid length.
18:34:02 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x12}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  713.065056][T23797] xt_hashlimit: max too large, truncated to 1048576
[  713.071878][T23797] xt_hashlimit: overflow, try lower: 1711341568/0
[  713.092413][T23799] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:34:02 executing program 0:
syz_emit_ethernet(0x66, &(0x7f0000000180)={@local, @remote, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "900f22", 0x30, 0x67, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[@hopopts={0x0, 0x1, '\x00', [@padn={0x1, 0x1, [0x0]}, @jumbo]}, @dstopts={0x0, 0x1, '\x00', [@padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @ra]}]}}}}}, 0x0)

[  713.248131][T23804] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:34:02 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000140)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff06000000010000004500000025000000190004c00000000007fd17e5ffff0606040000000000000000", 0x39}], 0x1)

18:34:03 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e00000029000504d25a80648c63940d0124fc6004000f400a003d005a00000037153e370a00018003000000d1bd", 0x2e}], 0x1}, 0x0)
close(r0)

[  713.544346][T23809] xt_hashlimit: max too large, truncated to 1048576
[  713.551176][T23809] xt_hashlimit: overflow, try lower: 1711341568/0
[  713.580201][T23810] xt_hashlimit: max too large, truncated to 1048576
[  713.587132][T23810] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:03 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e00000029000504d25a80648c63940d0124fc6004000f400a003d005a00000037153e370a00018003000000d1bd", 0x2e}], 0x1}, 0x0)
close(r0)

18:34:03 executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x64, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2f}]}, 0x64}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x40, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100a}]}, 0x40}}, 0x0)

[  713.696202][T23816] netlink: 'syz-executor.5': attribute type 4 has an invalid length.
[  713.747208][T23818] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:34:03 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x19}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:03 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x64, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2f}]}, 0x64}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x40, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100a}]}, 0x40}}, 0x0)

[  713.992397][T23820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:34:03 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e00000029000504d25a80648c63940d0124fc6004000f400a003d005a00000037153e370a00018003000000d1bd", 0x2e}], 0x1}, 0x0)
close(r0)

18:34:03 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
writev(r1, &(0x7f0000000140)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff06000000010000004500000025000000190004c00000000007fd17e5ffff0606040000000000000000", 0x39}], 0x1)

18:34:03 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e00000029000504d25a80648c63940d0124fc6004000f400a003d005a00000037153e370a00018003000000d1bd", 0x2e}], 0x1}, 0x0)
close(r0)

[  714.280316][T23826] xt_hashlimit: max too large, truncated to 1048576
[  714.287345][T23826] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:04 executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x64, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2f}]}, 0x64}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x40, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100a}]}, 0x40}}, 0x0)

18:34:04 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1a}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  714.400867][T23833] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  714.445491][T23834] netlink: 'syz-executor.5': attribute type 4 has an invalid length.
18:34:04 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x64, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2f}]}, 0x64}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x40, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100a}]}, 0x40}}, 0x0)

18:34:04 executing program 1:
r0 = socket$unix(0x1, 0x1, 0x0)
sendmsg$unix(r0, &(0x7f0000008340)={0x0, 0x0, 0x0}, 0x48005)

[  714.673555][T23837] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  714.677671][T23839] xt_hashlimit: max too large, truncated to 1048576
[  714.690721][T23839] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:04 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x25}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:04 executing program 2:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0)
pread64(r0, 0x0, 0x0, 0x0)

18:34:04 executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000b00)=@migrate={0x138, 0x21, 0x101, 0x0, 0x0, {{@in6=@private1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}, [@migrate={0xe8, 0x11, [{@in, @in=@empty, @in, @in6=@empty}, {@in=@local, @in=@private, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in=@dev}, {@in, @in=@private, @in6=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x3507}]}]}, 0x138}}, 0x0)

18:34:04 executing program 3:
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="891e06147c9aee3bc4f7e04a54614caca2fcbed7976b67ac13f53fbaee5836ff35f458388dbe633fd3fccf1dd3bc32f8f64139f04bc38ad18c64d2823a5b02c4cadac646571ef34b1908ac69908d60b79df9", 0x52, 0x0, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'})
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="fd", 0x1}], 0x1)

[  715.168574][T23850] xt_hashlimit: max too large, truncated to 1048576
[  715.175548][T23850] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:04 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x48}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:05 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x64, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2f}]}, 0x64}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x40, 0x0, 0x1, 0x40b, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x18, 0x3}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100a}]}, 0x40}}, 0x0)

18:34:05 executing program 1:
r0 = socket$unix(0x1, 0x1, 0x0)
sendmsg$unix(r0, &(0x7f0000008340)={0x0, 0x0, 0x0}, 0x48005)

18:34:05 executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000b00)=@migrate={0x138, 0x21, 0x101, 0x0, 0x0, {{@in6=@private1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}, [@migrate={0xe8, 0x11, [{@in, @in=@empty, @in, @in6=@empty}, {@in=@local, @in=@private, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in=@dev}, {@in, @in=@private, @in6=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x3507}]}]}, 0x138}}, 0x0)

18:34:05 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x4c}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:05 executing program 2:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0)
pread64(r0, 0x0, 0x0, 0x0)

18:34:05 executing program 3:
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="891e06147c9aee3bc4f7e04a54614caca2fcbed7976b67ac13f53fbaee5836ff35f458388dbe633fd3fccf1dd3bc32f8f64139f04bc38ad18c64d2823a5b02c4cadac646571ef34b1908ac69908d60b79df9", 0x52, 0x0, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'})
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="fd", 0x1}], 0x1)

18:34:05 executing program 1:
r0 = socket$unix(0x1, 0x1, 0x0)
sendmsg$unix(r0, &(0x7f0000008340)={0x0, 0x0, 0x0}, 0x48005)

18:34:05 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
timer_create(0x0, 0x0, &(0x7f0000000200))
timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x77359400}}, &(0x7f00000001c0))

18:34:05 executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000b00)=@migrate={0x138, 0x21, 0x101, 0x0, 0x0, {{@in6=@private1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}, [@migrate={0xe8, 0x11, [{@in, @in=@empty, @in, @in6=@empty}, {@in=@local, @in=@private, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in=@dev}, {@in, @in=@private, @in6=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x3507}]}]}, 0x138}}, 0x0)

18:34:05 executing program 2:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0)
pread64(r0, 0x0, 0x0, 0x0)

18:34:05 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x60}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:06 executing program 1:
r0 = socket$unix(0x1, 0x1, 0x0)
sendmsg$unix(r0, &(0x7f0000008340)={0x0, 0x0, 0x0}, 0x48005)

18:34:06 executing program 3:
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="891e06147c9aee3bc4f7e04a54614caca2fcbed7976b67ac13f53fbaee5836ff35f458388dbe633fd3fccf1dd3bc32f8f64139f04bc38ad18c64d2823a5b02c4cadac646571ef34b1908ac69908d60b79df9", 0x52, 0x0, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'})
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="fd", 0x1}], 0x1)

18:34:06 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
timer_create(0x0, 0x0, &(0x7f0000000200))
timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x77359400}}, &(0x7f00000001c0))

18:34:06 executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000b00)=@migrate={0x138, 0x21, 0x101, 0x0, 0x0, {{@in6=@private1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}, [@migrate={0xe8, 0x11, [{@in, @in=@empty, @in, @in6=@empty}, {@in=@local, @in=@private, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in=@dev}, {@in, @in=@private, @in6=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x3507}]}]}, 0x138}}, 0x0)

[  716.696983][T23905] hashlimit_mt_check_common: 2 callbacks suppressed
[  716.697052][T23905] xt_hashlimit: max too large, truncated to 1048576
[  716.710671][T23905] hashlimit_mt_check_common: 2 callbacks suppressed
[  716.710736][T23905] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:06 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x68}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:06 executing program 2:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0)
pread64(r0, 0x0, 0x0, 0x0)

18:34:06 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
timer_create(0x0, 0x0, &(0x7f0000000200))
timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x77359400}}, &(0x7f00000001c0))

18:34:07 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
timer_create(0x0, 0x0, &(0x7f0000000200))
timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x77359400}}, &(0x7f00000001c0))

18:34:07 executing program 3:
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="891e06147c9aee3bc4f7e04a54614caca2fcbed7976b67ac13f53fbaee5836ff35f458388dbe633fd3fccf1dd3bc32f8f64139f04bc38ad18c64d2823a5b02c4cadac646571ef34b1908ac69908d60b79df9", 0x52, 0x0, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'})
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="fd", 0x1}], 0x1)

[  717.414418][T23925] xt_hashlimit: max too large, truncated to 1048576
[  717.421333][T23925] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:07 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000001000010400"/20, @ANYRES32=r2, @ANYBLOB="0000000007000000140012000c000100627269646765"], 0x34}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000500)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x0, @dev}}]}]}]}, 0x50}}, 0x0)

18:34:07 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6c}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:07 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

[  717.794506][T23939] __nla_validate_parse: 5 callbacks suppressed
[  717.794573][T23939] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
18:34:07 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
timer_create(0x0, 0x0, &(0x7f0000000200))
timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x77359400}}, &(0x7f00000001c0))

18:34:07 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x74}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  717.926347][T23947] xt_hashlimit: max too large, truncated to 1048576
[  717.933372][T23947] xt_hashlimit: overflow, try lower: 1711341568/0
[  718.047097][T23953] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
18:34:07 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
timer_create(0x0, 0x0, &(0x7f0000000200))
timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x77359400}}, &(0x7f00000001c0))

18:34:07 executing program 3:
r0 = socket(0x10, 0x3, 0x0)
r1 = socket(0x11, 0x800000003, 0x0)
bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r1, &(0x7f0000005400)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x17}}]}, 0x78}}, 0x0)

18:34:07 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

18:34:08 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000001000010400"/20, @ANYRES32=r2, @ANYBLOB="0000000007000000140012000c000100627269646765"], 0x34}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000500)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x0, @dev}}]}]}]}, 0x50}}, 0x0)

[  718.391649][T23960] xt_hashlimit: max too large, truncated to 1048576
[  718.398712][T23960] xt_hashlimit: overflow, try lower: 1711341568/0
[  718.447317][T23964] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.3'.
18:34:08 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x7a}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:08 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
timer_create(0x0, 0x0, &(0x7f0000000200))
timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000180)={{}, {0x77359400}}, &(0x7f00000001c0))

[  718.552210][T23968] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.3'.
18:34:08 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

[  718.650126][T23970] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
18:34:08 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

18:34:08 executing program 3:
r0 = socket(0x10, 0x3, 0x0)
r1 = socket(0x11, 0x800000003, 0x0)
bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r1, &(0x7f0000005400)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x17}}]}, 0x78}}, 0x0)

[  718.871901][T23977] xt_hashlimit: max too large, truncated to 1048576
[  718.879029][T23977] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:08 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x158}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:08 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000001000010400"/20, @ANYRES32=r2, @ANYBLOB="0000000007000000140012000c000100627269646765"], 0x34}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000500)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x0, @dev}}]}]}]}, 0x50}}, 0x0)

18:34:08 executing program 1:
r0 = socket(0x10, 0x3, 0x0)
r1 = socket(0x11, 0x800000003, 0x0)
bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r1, &(0x7f0000005400)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x17}}]}, 0x78}}, 0x0)

[  719.281665][T23989] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.3'.
[  719.289081][T23990] xt_hashlimit: max too large, truncated to 1048576
[  719.298196][T23990] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:09 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

[  719.338834][T23991] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
18:34:09 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x228}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:09 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

[  719.592845][T24000] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.1'.
18:34:09 executing program 3:
r0 = socket(0x10, 0x3, 0x0)
r1 = socket(0x11, 0x800000003, 0x0)
bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r1, &(0x7f0000005400)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x17}}]}, 0x78}}, 0x0)

18:34:09 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000001000010400"/20, @ANYRES32=r2, @ANYBLOB="0000000007000000140012000c000100627269646765"], 0x34}}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000500)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x0, @dev}}]}]}]}, 0x50}}, 0x0)

[  719.806847][T24005] xt_hashlimit: max too large, truncated to 1048576
[  719.814312][T24005] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:09 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x300}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:09 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

18:34:09 executing program 1:
r0 = socket(0x10, 0x3, 0x0)
r1 = socket(0x11, 0x800000003, 0x0)
bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r1, &(0x7f0000005400)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x17}}]}, 0x78}}, 0x0)

[  720.058470][T24010] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.3'.
18:34:09 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

[  720.115933][T24012] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
[  720.235639][T24018] xt_hashlimit: max too large, truncated to 1048576
[  720.242453][T24018] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:09 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x3e0}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:10 executing program 3:
r0 = socket(0x10, 0x3, 0x0)
r1 = socket(0x11, 0x800000003, 0x0)
bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r1, &(0x7f0000005400)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x17}}]}, 0x78}}, 0x0)

18:34:10 executing program 5:
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa)
r4 = getpid()
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x4}]}]}, 0x34}}, 0x0)

18:34:10 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

18:34:10 executing program 1:
r0 = socket(0x10, 0x3, 0x0)
r1 = socket(0x11, 0x800000003, 0x0)
bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r1, &(0x7f0000005400)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x17}}]}, 0x78}}, 0x0)

[  720.608065][T24029] xt_hashlimit: max too large, truncated to 1048576
[  720.615138][T24029] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:10 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x500}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:10 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8082, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000040)=0x8000)
close_range(r0, 0xffffffffffffffff, 0x0)

[  720.859849][T24037] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check.
[  721.015154][T24043] xt_hashlimit: max too large, truncated to 1048576
[  721.022005][T24043] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:10 executing program 3:
r0 = socket$inet6_dccp(0xa, 0x6, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x10d, 0xd, &(0x7f0000000000), 0x4)

18:34:10 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x600}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:10 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00')
sendmsg$AUDIT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
writev(r1, &(0x7f0000000080), 0x5b)

18:34:11 executing program 1:
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
syz_emit_ethernet(0x66, &(0x7f0000000200)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "dc9a00", 0x2, 0x3a, 0x0, @local, @mcast2, {[], @dest_unreach={0x1, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "0100", 0x0, 0x0, 0x0, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}}}}, 0x0)

18:34:11 executing program 5:
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa)
r4 = getpid()
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x4}]}]}, 0x34}}, 0x0)

18:34:11 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x700}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:11 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8082, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000040)=0x8000)
close_range(r0, 0xffffffffffffffff, 0x0)

18:34:11 executing program 3:
r0 = socket$inet6_dccp(0xa, 0x6, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x10d, 0xd, &(0x7f0000000000), 0x4)

[  721.789799][T24067] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check.
[  721.839241][T24069] hashlimit_mt_check_common: 1 callbacks suppressed
[  721.839305][T24069] xt_hashlimit: max too large, truncated to 1048576
[  721.853558][T24069] hashlimit_mt_check_common: 1 callbacks suppressed
[  721.853616][T24069] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:11 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8082, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000040)=0x8000)
close_range(r0, 0xffffffffffffffff, 0x0)

18:34:11 executing program 1:
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
syz_emit_ethernet(0x66, &(0x7f0000000200)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "dc9a00", 0x2, 0x3a, 0x0, @local, @mcast2, {[], @dest_unreach={0x1, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "0100", 0x0, 0x0, 0x0, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}}}}, 0x0)

18:34:11 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x900}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:11 executing program 5:
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa)
r4 = getpid()
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x4}]}]}, 0x34}}, 0x0)

[  722.362183][T24085] xt_hashlimit: max too large, truncated to 1048576
[  722.369178][T24085] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:12 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xa00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:12 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8082, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000040)=0x8000)
close_range(r0, 0xffffffffffffffff, 0x0)

18:34:12 executing program 3:
r0 = socket$inet6_dccp(0xa, 0x6, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x10d, 0xd, &(0x7f0000000000), 0x4)

[  722.466914][T24090] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check.
18:34:12 executing program 1:
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
syz_emit_ethernet(0x66, &(0x7f0000000200)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "dc9a00", 0x2, 0x3a, 0x0, @local, @mcast2, {[], @dest_unreach={0x1, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "0100", 0x0, 0x0, 0x0, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}}}}, 0x0)

18:34:12 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8082, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000040)=0x8000)
close_range(r0, 0xffffffffffffffff, 0x0)

18:34:12 executing program 5:
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa)
r4 = getpid()
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x4}]}]}, 0x34}}, 0x0)

[  722.791334][T24095] xt_hashlimit: max too large, truncated to 1048576
[  722.798575][T24095] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:12 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xb00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:12 executing program 3:
r0 = socket$inet6_dccp(0xa, 0x6, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x10d, 0xd, &(0x7f0000000000), 0x4)

18:34:12 executing program 1:
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
syz_emit_ethernet(0x66, &(0x7f0000000200)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "dc9a00", 0x2, 0x3a, 0x0, @local, @mcast2, {[], @dest_unreach={0x1, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "0100", 0x0, 0x0, 0x0, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}}}}, 0x0)

[  723.153736][T24108] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check.
18:34:12 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8082, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000040)=0x8000)
close_range(r0, 0xffffffffffffffff, 0x0)

[  723.248424][T24110] xt_hashlimit: max too large, truncated to 1048576
[  723.255539][T24110] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:12 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xb27}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:13 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8082, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000040)=0x8000)
close_range(r0, 0xffffffffffffffff, 0x0)

18:34:13 executing program 5:
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa)
r4 = getpid()
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x4}]}]}, 0x34}}, 0x0)

18:34:13 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x200000000000011, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_NF_CALL_IPTABLES={0x5}]}}}]}, 0x3c}}, 0x0)

[  723.702400][T24124] xt_hashlimit: max too large, truncated to 1048576
[  723.709595][T24124] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:13 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xb28}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:13 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r2=>0x0})
r3 = dup2(r0, r0)
sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x34, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe3}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}]}]}]}, 0x34}}, 0x0)

[  723.931333][T24131] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check.
18:34:13 executing program 0:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

18:34:13 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
unshare(0x8000400)
setsockopt$inet_udp_int(r0, 0x88, 0x0, 0x0, 0x19)

[  724.169477][T24136] xt_hashlimit: max too large, truncated to 1048576
[  724.176457][T24136] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:13 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xc00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:13 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x200000000000011, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_NF_CALL_IPTABLES={0x5}]}}}]}, 0x3c}}, 0x0)

18:34:14 executing program 5:
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa)
r4 = getpid()
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x4}]}]}, 0x34}}, 0x0)

18:34:14 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r2=>0x0})
r3 = dup2(r0, r0)
sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x34, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe3}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}]}]}]}, 0x34}}, 0x0)

18:34:14 executing program 0:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

[  724.725544][T24154] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check.
[  724.747280][T24155] xt_hashlimit: max too large, truncated to 1048576
[  724.754246][T24155] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:14 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
unshare(0x8000400)
setsockopt$inet_udp_int(r0, 0x88, 0x0, 0x0, 0x19)

18:34:14 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xd00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:14 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x200000000000011, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_NF_CALL_IPTABLES={0x5}]}}}]}, 0x3c}}, 0x0)

18:34:14 executing program 5:
openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa)
r4 = getpid()
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x4}]}]}, 0x34}}, 0x0)

18:34:14 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r2=>0x0})
r3 = dup2(r0, r0)
sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x34, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe3}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}]}]}]}, 0x34}}, 0x0)

[  725.280854][T24168] xt_hashlimit: max too large, truncated to 1048576
[  725.288060][T24168] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:15 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xe00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:15 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
unshare(0x8000400)
setsockopt$inet_udp_int(r0, 0x88, 0x0, 0x0, 0x19)

18:34:15 executing program 0:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

[  725.497178][T24176] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check.
18:34:15 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x200000000000011, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_NF_CALL_IPTABLES={0x5}]}}}]}, 0x3c}}, 0x0)

[  725.715342][T24181] xt_hashlimit: max too large, truncated to 1048576
[  725.722200][T24181] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:15 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r2=>0x0})
r3 = dup2(r0, r0)
sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x34, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe3}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}]}]}]}, 0x34}}, 0x0)

18:34:15 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1100}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:15 executing program 5:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

18:34:15 executing program 0:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

18:34:15 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
unshare(0x8000400)
setsockopt$inet_udp_int(r0, 0x88, 0x0, 0x0, 0x19)

[  726.243778][T24195] xt_hashlimit: max too large, truncated to 1048576
[  726.251084][T24195] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:15 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

18:34:16 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1200}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:16 executing program 5:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

18:34:16 executing program 1:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
getsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, &(0x7f0000000040))

18:34:16 executing program 0:
socket(0x1e, 0x0, 0x7)

18:34:16 executing program 2:
mlock(&(0x7f0000fef000/0x4000)=nil, 0x4000)
mlock(&(0x7f0000ff0000/0xe000)=nil, 0xe000)

18:34:16 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1900}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:16 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

18:34:16 executing program 5:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

18:34:16 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000dc0)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}, {@in=@multicast2, 0x0, 0x2b}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'wp384-generic\x00'}}}]}, 0x138}}, 0x0)

[  727.329034][T24232] hashlimit_mt_check_common: 1 callbacks suppressed
[  727.329170][T24232] xt_hashlimit: max too large, truncated to 1048576
[  727.343214][T24232] hashlimit_mt_check_common: 1 callbacks suppressed
[  727.343276][T24232] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:17 executing program 0:
socket(0x1e, 0x0, 0x7)

18:34:17 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1a00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:17 executing program 2:
mlock(&(0x7f0000fef000/0x4000)=nil, 0x4000)
mlock(&(0x7f0000ff0000/0xe000)=nil, 0xe000)

18:34:17 executing program 3:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000900), 0x10)
sendmsg$can_bcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x5, 0x824, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a93e2759ac33f2fc86b17382a407e7a5330a9bca061ce60e2bf78e6557a6e05ea778792e7c9c119720a80b5695ac32f4edecda68099e5a32f7f3a357b5871f3e"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x5, 0x960, 0x0, {}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5d7e95544813dc8317714833496930513f79f404cae80b75101d1dcfdc435eb79a9d84324f72ca44f7700679806f47deb412dc49393a82cde528f3e7823a27d7"}}, 0x80}}, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "7c8960aef79a8312"}}, 0x48}}, 0x0)

18:34:17 executing program 5:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, 0x2, 0x7, 0x5, 0x0, 0x0, {}, [@NFACCT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x0)

18:34:17 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000dc0)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}, {@in=@multicast2, 0x0, 0x2b}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'wp384-generic\x00'}}}]}, 0x138}}, 0x0)

[  728.007642][T24246] xt_hashlimit: max too large, truncated to 1048576
[  728.014696][T24246] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:17 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x2000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:17 executing program 0:
socket(0x1e, 0x0, 0x7)

18:34:17 executing program 2:
mlock(&(0x7f0000fef000/0x4000)=nil, 0x4000)
mlock(&(0x7f0000ff0000/0xe000)=nil, 0xe000)

18:34:17 executing program 3:
io_setup(0x83, &(0x7f00000003c0)=<r0=>0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
io_submit(r0, 0x0, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = eventfd2(0x0, 0x0)
io_submit(r0, 0x2, &(0x7f0000001400)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}, 0x0])

18:34:18 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000dc0)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}, {@in=@multicast2, 0x0, 0x2b}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'wp384-generic\x00'}}}]}, 0x138}}, 0x0)

18:34:18 executing program 5:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, 0x2, 0x7, 0x5, 0x0, 0x0, {}, [@NFACCT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x0)

[  728.449728][T24260] xt_hashlimit: max too large, truncated to 1048576
[  728.456696][T24260] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:18 executing program 0:
socket(0x1e, 0x0, 0x7)

18:34:18 executing program 2:
mlock(&(0x7f0000fef000/0x4000)=nil, 0x4000)
mlock(&(0x7f0000ff0000/0xe000)=nil, 0xe000)

18:34:18 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x2500}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:18 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000dc0)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}, {@in=@multicast2, 0x0, 0x2b}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'wp384-generic\x00'}}}]}, 0x138}}, 0x0)

18:34:18 executing program 5:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, 0x2, 0x7, 0x5, 0x0, 0x0, {}, [@NFACCT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x0)

18:34:18 executing program 3:
io_setup(0x83, &(0x7f00000003c0)=<r0=>0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
io_submit(r0, 0x0, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = eventfd2(0x0, 0x0)
io_submit(r0, 0x2, &(0x7f0000001400)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}, 0x0])

[  729.186983][T24277] xt_hashlimit: max too large, truncated to 1048576
[  729.193898][T24277] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:18 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x270b}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:18 executing program 0:
io_setup(0x83, &(0x7f00000003c0)=<r0=>0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
io_submit(r0, 0x0, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = eventfd2(0x0, 0x0)
io_submit(r0, 0x2, &(0x7f0000001400)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}, 0x0])

18:34:19 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = getpgid(0x0)
ioprio_get$pid(0x2, r1)

18:34:19 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x2802}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  729.550169][T24292] xt_hashlimit: max too large, truncated to 1048576
[  729.557274][T24292] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:19 executing program 1:
rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8)
r0 = gettid()
tkill(r0, 0x32)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x5, 0x4, @tid=r0}, &(0x7f0000000300))
r1 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8)
clock_gettime(0x0, &(0x7f0000000040)={0x0, <r2=>0x0})
timer_settime(0x0, 0x3, &(0x7f000004a000)={{0x0, 0x1}, {0x0, r2+10000000}}, 0x0)
readv(r1, &(0x7f0000000000)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x49)

18:34:19 executing program 5:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, 0x2, 0x7, 0x5, 0x0, 0x0, {}, [@NFACCT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x0)

18:34:19 executing program 3:
io_setup(0x83, &(0x7f00000003c0)=<r0=>0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
io_submit(r0, 0x0, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = eventfd2(0x0, 0x0)
io_submit(r0, 0x2, &(0x7f0000001400)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}, 0x0])

18:34:19 executing program 0:
io_setup(0x83, &(0x7f00000003c0)=<r0=>0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
io_submit(r0, 0x0, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = eventfd2(0x0, 0x0)
io_submit(r0, 0x2, &(0x7f0000001400)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}, 0x0])

[  729.959746][T24305] xt_hashlimit: max too large, truncated to 1048576
[  729.966997][T24305] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:19 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x280b}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:19 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = getpgid(0x0)
ioprio_get$pid(0x2, r1)

18:34:19 executing program 1:
rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8)
r0 = gettid()
tkill(r0, 0x32)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x5, 0x4, @tid=r0}, &(0x7f0000000300))
r1 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8)
clock_gettime(0x0, &(0x7f0000000040)={0x0, <r2=>0x0})
timer_settime(0x0, 0x3, &(0x7f000004a000)={{0x0, 0x1}, {0x0, r2+10000000}}, 0x0)
readv(r1, &(0x7f0000000000)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x49)

18:34:19 executing program 5:
rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8)
r0 = gettid()
tkill(r0, 0x32)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x5, 0x4, @tid=r0}, &(0x7f0000000300))
r1 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8)
clock_gettime(0x0, &(0x7f0000000040)={0x0, <r2=>0x0})
timer_settime(0x0, 0x3, &(0x7f000004a000)={{0x0, 0x1}, {0x0, r2+10000000}}, 0x0)
readv(r1, &(0x7f0000000000)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x49)

18:34:20 executing program 0:
io_setup(0x83, &(0x7f00000003c0)=<r0=>0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
io_submit(r0, 0x0, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = eventfd2(0x0, 0x0)
io_submit(r0, 0x2, &(0x7f0000001400)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}, 0x0])

[  730.532848][T24321] xt_hashlimit: max too large, truncated to 1048576
[  730.539977][T24321] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:20 executing program 3:
io_setup(0x83, &(0x7f00000003c0)=<r0=>0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
io_submit(r0, 0x0, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = eventfd2(0x0, 0x0)
io_submit(r0, 0x2, &(0x7f0000001400)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r3}, 0x0])

18:34:20 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x4800}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:20 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = getpgid(0x0)
ioprio_get$pid(0x2, r1)

18:34:20 executing program 5:
rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8)
r0 = gettid()
tkill(r0, 0x32)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x5, 0x4, @tid=r0}, &(0x7f0000000300))
r1 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8)
clock_gettime(0x0, &(0x7f0000000040)={0x0, <r2=>0x0})
timer_settime(0x0, 0x3, &(0x7f000004a000)={{0x0, 0x1}, {0x0, r2+10000000}}, 0x0)
readv(r1, &(0x7f0000000000)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x49)

18:34:20 executing program 1:
rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8)
r0 = gettid()
tkill(r0, 0x32)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x5, 0x4, @tid=r0}, &(0x7f0000000300))
r1 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8)
clock_gettime(0x0, &(0x7f0000000040)={0x0, <r2=>0x0})
timer_settime(0x0, 0x3, &(0x7f000004a000)={{0x0, 0x1}, {0x0, r2+10000000}}, 0x0)
readv(r1, &(0x7f0000000000)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x49)

[  730.962116][T24332] xt_hashlimit: max too large, truncated to 1048576
[  730.969169][T24332] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:20 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x4c00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:20 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = getpgid(0x0)
ioprio_get$pid(0x2, r1)

18:34:20 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000100)=@RTM_NEWMDB={0x18, 0x54, 0x368c8fec64c9b411, 0x0, 0x0, {0x7, r1}}, 0x18}}, 0x0)

18:34:21 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = getpgid(0x0)
ioprio_get$pid(0x2, r1)

18:34:21 executing program 1:
rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8)
r0 = gettid()
tkill(r0, 0x32)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x5, 0x4, @tid=r0}, &(0x7f0000000300))
r1 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8)
clock_gettime(0x0, &(0x7f0000000040)={0x0, <r2=>0x0})
timer_settime(0x0, 0x3, &(0x7f000004a000)={{0x0, 0x1}, {0x0, r2+10000000}}, 0x0)
readv(r1, &(0x7f0000000000)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x49)

18:34:21 executing program 5:
rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8)
r0 = gettid()
tkill(r0, 0x32)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x5, 0x4, @tid=r0}, &(0x7f0000000300))
r1 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8)
clock_gettime(0x0, &(0x7f0000000040)={0x0, <r2=>0x0})
timer_settime(0x0, 0x3, &(0x7f000004a000)={{0x0, 0x1}, {0x0, r2+10000000}}, 0x0)
readv(r1, &(0x7f0000000000)=[{&(0x7f0000000840)=""/4096, 0x1000}], 0x49)

[  731.498706][T24344] xt_hashlimit: max too large, truncated to 1048576
[  731.506107][T24344] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:21 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x5801}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:21 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = getpgid(0x0)
ioprio_get$pid(0x2, r1)

18:34:21 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000100)=@RTM_NEWMDB={0x18, 0x54, 0x368c8fec64c9b411, 0x0, 0x0, {0x7, r1}}, 0x18}}, 0x0)

18:34:21 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

[  731.960265][T24360] xt_hashlimit: max too large, truncated to 1048576
[  731.967315][T24360] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:21 executing program 2:
r0 = socket$inet(0x2, 0xa, 0x0)
getsockopt$sock_timeval(r0, 0x1, 0x1e, 0x0, &(0x7f0000001a00))

18:34:21 executing program 5:
r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000780)={0x80002000})
epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0)

18:34:21 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  732.244936][T24371] syz-executor.2 uses obsolete (PF_INET,SOCK_PACKET)
[  732.265288][   T34] kauditd_printk_skb: 20 callbacks suppressed
[  732.265350][   T34] audit: type=1804 audit(1620930861.902:32): pid=24369 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/newroot/583/file0/bus" dev="sda1" ino=13858 res=1 errno=0
18:34:22 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = getpgid(0x0)
ioprio_get$pid(0x2, r1)

[  732.437434][   T34] audit: type=1804 audit(1620930861.942:33): pid=24369 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/newroot/583/file0/bus" dev="sda1" ino=13858 res=1 errno=0
[  732.518391][T24378] xt_hashlimit: max too large, truncated to 1048576
[  732.525363][T24378] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:22 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6800}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:22 executing program 2:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000000000000000000a4000000850000006d00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000300)='lock_acquire\x00', r0}, 0x10)
syz_emit_ethernet(0x72, &(0x7f00000000c0)={@local, @multicast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x7, 0xc, 0x7, 0x3, 0x0, [{@remote}]}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}}}}}}, 0x0)

[  732.568026][T24379] xt_hashlimit: max too large, truncated to 1048576
[  732.575135][T24379] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:22 executing program 5:
r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000780)={0x80002000})
epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0)

18:34:22 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000100)=@RTM_NEWMDB={0x18, 0x54, 0x368c8fec64c9b411, 0x0, 0x0, {0x7, r1}}, 0x18}}, 0x0)

18:34:22 executing program 3:
r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000780)={0x80002000})
epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0)

[  733.041544][T24389] xt_hashlimit: max too large, truncated to 1048576
[  733.048694][T24389] xt_hashlimit: overflow, try lower: 1711341568/0
[  733.111909][   T34] audit: type=1804 audit(1620930862.742:34): pid=24395 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/newroot/583/file0/file0/bus" dev="sda1" ino=13860 res=1 errno=0
18:34:22 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6c00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:22 executing program 2:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000000000000000000a4000000850000006d00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000300)='lock_acquire\x00', r0}, 0x10)
syz_emit_ethernet(0x72, &(0x7f00000000c0)={@local, @multicast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x7, 0xc, 0x7, 0x3, 0x0, [{@remote}]}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}}}}}}, 0x0)

[  733.330895][   T34] audit: type=1804 audit(1620930862.782:35): pid=24392 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/newroot/583/file0/file0/bus" dev="sda1" ino=13860 res=1 errno=0
18:34:23 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:23 executing program 5:
r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000780)={0x80002000})
epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0)

18:34:23 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000100)=@RTM_NEWMDB={0x18, 0x54, 0x368c8fec64c9b411, 0x0, 0x0, {0x7, r1}}, 0x18}}, 0x0)

18:34:23 executing program 3:
r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000780)={0x80002000})
epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0)

[  733.694563][T24405] xt_hashlimit: max too large, truncated to 1048576
[  733.701307][T24405] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:23 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x7400}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:23 executing program 2:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000000000000000000a4000000850000006d00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000300)='lock_acquire\x00', r0}, 0x10)
syz_emit_ethernet(0x72, &(0x7f00000000c0)={@local, @multicast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x7, 0xc, 0x7, 0x3, 0x0, [{@remote}]}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}}}}}}, 0x0)

18:34:23 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:23 executing program 5:
r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000780)={0x80002000})
epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0)

[  734.101950][T24419] xt_hashlimit: max too large, truncated to 1048576
[  734.109090][T24419] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:23 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x7a00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  734.212270][   T34] audit: type=1804 audit(1620930863.842:36): pid=24421 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/newroot/584/file0/bus" dev="sda1" ino=13858 res=1 errno=0
[  734.234951][   T34] audit: type=1804 audit(1620930863.842:37): pid=24425 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/newroot/584/file0/bus" dev="sda1" ino=13858 res=1 errno=0
18:34:23 executing program 3:
r0 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000780)={0x80002000})
epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0)

[  734.486405][   T34] audit: type=1804 audit(1620930864.092:38): pid=24430 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/newroot/610/file0/bus" dev="sda1" ino=13866 res=1 errno=0
[  734.511520][   T34] audit: type=1804 audit(1620930864.102:39): pid=24430 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/newroot/610/file0/bus" dev="sda1" ino=13866 res=1 errno=0
18:34:24 executing program 2:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000000000000000000a4000000850000006d00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000300)='lock_acquire\x00', r0}, 0x10)
syz_emit_ethernet(0x72, &(0x7f00000000c0)={@local, @multicast, @void, {@ipv4={0x800, @gre={{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x7, 0xc, 0x7, 0x3, 0x0, [{@remote}]}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}}}}}}, 0x0)

[  734.603284][T24434] xt_hashlimit: max too large, truncated to 1048576
[  734.610109][T24434] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:24 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xe003}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  735.247610][T24444] xt_hashlimit: max too large, truncated to 1048576
[  735.254510][T24444] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:25 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:25 executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:25 executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:25 executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:25 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xff00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  735.445289][   T34] audit: type=1804 audit(1620930865.082:40): pid=24449 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/newroot/467/file0/bus" dev="sda1" ino=13909 res=1 errno=0
[  735.606919][   T34] audit: type=1804 audit(1620930865.122:41): pid=24449 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/newroot/467/file0/bus" dev="sda1" ino=13909 res=1 errno=0
[  735.621156][T24456] xt_hashlimit: max too large, truncated to 1048576
[  735.636577][T24456] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:25 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:25 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x40000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  736.248694][T24471] xt_hashlimit: max too large, truncated to 1048576
[  736.255818][T24471] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:26 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x100000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:26 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

[  736.721543][T24479] xt_hashlimit: max too large, truncated to 1048576
[  736.728539][T24479] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:26 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xe0ffff}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:26 executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:26 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:26 executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:26 executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:26 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  737.321383][   T34] kauditd_printk_skb: 10 callbacks suppressed
[  737.321441][   T34] audit: type=1804 audit(1620930866.952:52): pid=24496 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/newroot/612/file0/bus" dev="sda1" ino=13866 res=1 errno=0
[  737.350736][   T34] audit: type=1804 audit(1620930866.962:53): pid=24496 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/newroot/612/file0/bus" dev="sda1" ino=13866 res=1 errno=0
18:34:27 executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

[  737.824429][   T34] audit: type=1804 audit(1620930867.202:54): pid=24503 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/newroot/335/file0/bus" dev="sda1" ino=13913 res=1 errno=0
[  737.847217][   T34] audit: type=1804 audit(1620930867.202:55): pid=24506 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/newroot/335/file0/bus" dev="sda1" ino=13913 res=1 errno=0
[  737.870696][   T34] audit: type=1804 audit(1620930867.242:56): pid=24500 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/newroot/468/file0/bus" dev="sda1" ino=13909 res=1 errno=0
[  737.893496][   T34] audit: type=1804 audit(1620930867.252:57): pid=24504 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/newroot/468/file0/bus" dev="sda1" ino=13909 res=1 errno=0
[  737.907733][T24510] hashlimit_mt_check_common: 1 callbacks suppressed
[  737.907929][T24510] xt_hashlimit: max too large, truncated to 1048576
[  737.915814][   T34] audit: type=1804 audit(1620930867.282:58): pid=24505 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/newroot/556/file0/bus" dev="sda1" ino=13912 res=1 errno=0
[  737.922340][T24510] hashlimit_mt_check_common: 1 callbacks suppressed
[  737.922395][T24510] xt_hashlimit: overflow, try lower: 1711341568/0
[  737.929192][   T34] audit: type=1804 audit(1620930867.282:59): pid=24508 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/newroot/556/file0/bus" dev="sda1" ino=13912 res=1 errno=0
18:34:27 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x2000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:28 executing program 1:
r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0)
write$9p(r0, &(0x7f0000000000)="0600000000000000c9b90003050000002a1ff7adf576f3790f68bc2c197cbf8d63735a09ab8383afd2de1a5587fe067fde18fa64249e1dabdd9514480a16f3733d18f833b3aacfcf04f7b0bdd78687423a6bff51b9f9218a249e3d00000000500000000000000000", 0x68)

18:34:28 executing program 0:
clone(0x1000000218007fb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6c6fe16420656372797074667320747275737465643a757365723a20"], 0x32, 0x0)
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)

18:34:28 executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

[  738.740684][T24520] xt_hashlimit: max too large, truncated to 1048576
[  738.747914][T24520] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:28 executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0)
chdir(&(0x7f0000000240)='./file0\x00')
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000040)=<r1=>0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0)
r3 = creat(&(0x7f0000002dc0)='./bus\x00', 0x0)
write$binfmt_elf64(r3, &(0x7f0000000080)=ANY=[], 0xfffffd28)
dup2(r2, r0)
fcntl$setstatus(r0, 0x4, 0x6800)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}])

18:34:28 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x3000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:28 executing program 0:
r0 = socket(0x2000000000000021, 0x2, 0x10000000000002)
sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000100100000d000000ec0000000000000b"], 0x18}}], 0x1, 0x0)

[  738.878039][T24527] encrypted_key: keyword 'loád' not recognized
18:34:28 executing program 1:
r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0)
write$9p(r0, &(0x7f0000000000)="0600000000000000c9b90003050000002a1ff7adf576f3790f68bc2c197cbf8d63735a09ab8383afd2de1a5587fe067fde18fa64249e1dabdd9514480a16f3733d18f833b3aacfcf04f7b0bdd78687423a6bff51b9f9218a249e3d00000000500000000000000000", 0x68)

[  739.092232][T24533] xt_hashlimit: max too large, truncated to 1048576
[  739.102247][T24533] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:28 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x4000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  739.211884][   T34] audit: type=1804 audit(1620930868.062:60): pid=24516 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/newroot/469/file0/bus" dev="sda1" ino=13909 res=1 errno=0
[  739.234684][   T34] audit: type=1804 audit(1620930868.082:61): pid=24516 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/newroot/469/file0/bus" dev="sda1" ino=13909 res=1 errno=0
18:34:29 executing program 1:
r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0)
write$9p(r0, &(0x7f0000000000)="0600000000000000c9b90003050000002a1ff7adf576f3790f68bc2c197cbf8d63735a09ab8383afd2de1a5587fe067fde18fa64249e1dabdd9514480a16f3733d18f833b3aacfcf04f7b0bdd78687423a6bff51b9f9218a249e3d00000000500000000000000000", 0x68)

[  739.714125][T24549] xt_hashlimit: max too large, truncated to 1048576
[  739.721015][T24549] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:29 executing program 0:
r0 = socket(0x2000000000000021, 0x2, 0x10000000000002)
sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000100100000d000000ec0000000000000b"], 0x18}}], 0x1, 0x0)

18:34:29 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x5000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:29 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
getresuid(&(0x7f00000003c0), &(0x7f0000005880), &(0x7f00000058c0))

18:34:30 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
syz_emit_ethernet(0xd2, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd60010100009c1100fe8000000000000000000000000000bbff02000000000000000000000000000100000e22"], 0x0)

[  740.521520][T24564] xt_hashlimit: max too large, truncated to 1048576
[  740.528696][T24564] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:30 executing program 1:
r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0)
write$9p(r0, &(0x7f0000000000)="0600000000000000c9b90003050000002a1ff7adf576f3790f68bc2c197cbf8d63735a09ab8383afd2de1a5587fe067fde18fa64249e1dabdd9514480a16f3733d18f833b3aacfcf04f7b0bdd78687423a6bff51b9f9218a249e3d00000000500000000000000000", 0x68)

18:34:30 executing program 0:
r0 = socket(0x2000000000000021, 0x2, 0x10000000000002)
sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000100100000d000000ec0000000000000b"], 0x18}}], 0x1, 0x0)

18:34:30 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
getresuid(&(0x7f00000003c0), &(0x7f0000005880), &(0x7f00000058c0))

18:34:30 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:30 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r0, 0x0)
semtimedop(0x0, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680})

[  741.036268][T24579] xt_hashlimit: max too large, truncated to 1048576
[  741.046102][T24579] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:30 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x7000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:30 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
syz_emit_ethernet(0xd2, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd60010100009c1100fe8000000000000000000000000000bbff02000000000000000000000000000100000e22"], 0x0)

18:34:30 executing program 0:
r0 = socket(0x2000000000000021, 0x2, 0x10000000000002)
sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000100100000d000000ec0000000000000b"], 0x18}}], 0x1, 0x0)

18:34:30 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
getresuid(&(0x7f00000003c0), &(0x7f0000005880), &(0x7f00000058c0))

18:34:31 executing program 1:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
syz_emit_ethernet(0xd2, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd60010100009c1100fe8000000000000000000000000000bbff02000000000000000000000000000100000e22"], 0x0)

18:34:31 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r0, 0x0)
semtimedop(0x0, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680})

[  741.494694][T24589] xt_hashlimit: max too large, truncated to 1048576
[  741.501438][T24589] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:31 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x8000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:31 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
syz_emit_ethernet(0xd2, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd60010100009c1100fe8000000000000000000000000000bbff02000000000000000000000000000100000e22"], 0x0)

18:34:31 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
getresuid(&(0x7f00000003c0), &(0x7f0000005880), &(0x7f00000058c0))

18:34:31 executing program 1:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
syz_emit_ethernet(0xd2, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd60010100009c1100fe8000000000000000000000000000bbff02000000000000000000000000000100000e22"], 0x0)

[  741.913899][T24603] xt_hashlimit: max too large, truncated to 1048576
[  741.921113][T24603] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:31 executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x5, 0x5, 0x7, 0x9}, 0x40)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x5, 0x4, 0x100000001, 0x0, r0}, 0x40)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000005c0)={r1, &(0x7f0000000580)}, 0x20)

18:34:31 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x9000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:31 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r0, 0x0)
semtimedop(0x0, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680})

18:34:31 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
syz_emit_ethernet(0xd2, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd60010100009c1100fe8000000000000000000000000000bbff02000000000000000000000000000100000e22"], 0x0)

[  742.275714][T24615] xt_hashlimit: max too large, truncated to 1048576
[  742.282561][T24615] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:32 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xa000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:32 executing program 3:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
unshare(0x24020400)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000018c0)=""/246)
ioctl$PPPIOCSMAXCID(r0, 0x40047459, 0x0)

18:34:32 executing program 1:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
syz_emit_ethernet(0xd2, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd60010100009c1100fe8000000000000000000000000000bbff02000000000000000000000000000100000e22"], 0x0)

18:34:32 executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x5, 0x5, 0x7, 0x9}, 0x40)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x5, 0x4, 0x100000001, 0x0, r0}, 0x40)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000005c0)={r1, &(0x7f0000000580)}, 0x20)

18:34:32 executing program 2:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r0, 0x0)
semtimedop(0x0, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680})

[  742.738313][T24627] xt_hashlimit: max too large, truncated to 1048576
[  742.745476][T24627] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:32 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xb000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:32 executing program 5:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x5, 0x5, 0x7, 0x9}, 0x40)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x5, 0x4, 0x100000001, 0x0, r0}, 0x40)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000005c0)={r1, &(0x7f0000000580)}, 0x20)

[  743.160902][T24645] xt_hashlimit: max too large, truncated to 1048576
[  743.167873][T24645] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:32 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r0)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000400)={0x20, r1, 0x311, 0x0, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x20}}, 0x0)

18:34:32 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xc000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:32 executing program 3:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
unshare(0x24020400)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000018c0)=""/246)
ioctl$PPPIOCSMAXCID(r0, 0x40047459, 0x0)

18:34:33 executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x5, 0x5, 0x7, 0x9}, 0x40)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x5, 0x4, 0x100000001, 0x0, r0}, 0x40)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000005c0)={r1, &(0x7f0000000580)}, 0x20)

18:34:33 executing program 2:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
unshare(0x24020400)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000018c0)=""/246)
ioctl$PPPIOCSMAXCID(r0, 0x40047459, 0x0)

18:34:33 executing program 5:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x5, 0x5, 0x7, 0x9}, 0x40)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x5, 0x4, 0x100000001, 0x0, r0}, 0x40)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000005c0)={r1, &(0x7f0000000580)}, 0x20)

[  743.590400][T24655] xt_hashlimit: max too large, truncated to 1048576
[  743.597404][T24655] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:33 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xd000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:33 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r0)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000400)={0x20, r1, 0x311, 0x0, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x20}}, 0x0)

18:34:33 executing program 0:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x5, 0x5, 0x7, 0x9}, 0x40)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x5, 0x4, 0x100000001, 0x0, r0}, 0x40)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000005c0)={r1, &(0x7f0000000580)}, 0x20)

18:34:33 executing program 2:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
unshare(0x24020400)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000018c0)=""/246)
ioctl$PPPIOCSMAXCID(r0, 0x40047459, 0x0)

18:34:33 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xe000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  744.058690][T24676] xt_hashlimit: max too large, truncated to 1048576
[  744.065973][T24676] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:33 executing program 5:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x5, 0x5, 0x7, 0x9}, 0x40)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x5, 0x4, 0x100000001, 0x0, r0}, 0x40)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r2, 0x0)
preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000005c0)={r1, &(0x7f0000000580)}, 0x20)

18:34:33 executing program 3:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
unshare(0x24020400)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000018c0)=""/246)
ioctl$PPPIOCSMAXCID(r0, 0x40047459, 0x0)

[  744.388391][T24692] xt_hashlimit: max too large, truncated to 1048576
[  744.395795][T24692] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:34 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r0)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000400)={0x20, r1, 0x311, 0x0, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x20}}, 0x0)

18:34:34 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x10000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:34 executing program 0:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:34 executing program 2:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
unshare(0x24020400)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000018c0)=""/246)
ioctl$PPPIOCSMAXCID(r0, 0x40047459, 0x0)

18:34:34 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

[  744.835529][T24707] xt_hashlimit: max too large, truncated to 1048576
[  744.842400][T24707] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:34 executing program 3:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
unshare(0x24020400)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000018c0)=""/246)
ioctl$PPPIOCSMAXCID(r0, 0x40047459, 0x0)

18:34:34 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x11000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:34 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r0)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000400)={0x20, r1, 0x311, 0x0, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x20}}, 0x0)

[  745.305106][T24730] xt_hashlimit: max too large, truncated to 1048576
[  745.312530][T24730] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:35 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x12000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:35 executing program 0:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:35 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

18:34:35 executing program 2:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

18:34:35 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

18:34:35 executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

[  745.811415][T24745] xt_hashlimit: max too large, truncated to 1048576
[  745.818610][T24745] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:35 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x19000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:35 executing program 2:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

[  746.340949][T24762] xt_hashlimit: max too large, truncated to 1048576
[  746.348246][T24762] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:36 executing program 0:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:36 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1a000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:36 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

18:34:36 executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:36 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

18:34:36 executing program 2:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

[  746.785499][T24771] xt_hashlimit: max too large, truncated to 1048576
[  746.792341][T24771] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:36 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x20000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:36 executing program 5:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

18:34:36 executing program 0:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

[  747.250314][T24787] xt_hashlimit: max too large, truncated to 1048576
[  747.257250][T24787] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:36 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x25000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:36 executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:37 executing program 2:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:37 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@private1, @mcast1, @empty, 0x0, 0x0, 0x3, 0x0, 0x0, 0x20})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_udp_int(r1, 0x11, 0xb, 0x0, &(0x7f00000010c0))
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4)
r3 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', <r4=>0x0})
bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r4}, 0x14)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@loopback, @remote, @empty, 0x0, 0x7, 0x0, 0x0, 0x3, 0x8051024c, r4})

18:34:37 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x270b0000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:37 executing program 5:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:37 executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:37 executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:37 executing program 2:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:38 executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newsa={0x160, 0x10, 0x713, 0x0, 0x0, {{@in=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {@in6=@private1, 0x0, 0x32}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_aead={0x70, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x120, 0x40, "68264a8ebb52ca7d8480822c8f000000000000003bdfac832bb57ddd53c3749354fbcad0"}}]}, 0x160}}, 0x0)

[  748.359845][T24813] hashlimit_mt_check_common: 1 callbacks suppressed
[  748.359922][T24813] xt_hashlimit: max too large, truncated to 1048576
[  748.375106][T24813] hashlimit_mt_check_common: 1 callbacks suppressed
[  748.375169][T24813] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:38 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x28020000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:38 executing program 5:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:38 executing program 2:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:38 executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

[  749.037139][T24832] xt_hashlimit: max too large, truncated to 1048576
[  749.044020][T24832] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:38 executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:38 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x280b0000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  749.673768][T24861] xt_hashlimit: max too large, truncated to 1048576
[  749.682235][T24861] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:39 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x48000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:39 executing program 5:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:39 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4})

18:34:39 executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newsa={0x160, 0x10, 0x713, 0x0, 0x0, {{@in=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {@in6=@private1, 0x0, 0x32}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_aead={0x70, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x120, 0x40, "68264a8ebb52ca7d8480822c8f000000000000003bdfac832bb57ddd53c3749354fbcad0"}}]}, 0x160}}, 0x0)

18:34:39 executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

18:34:39 executing program 1:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000000300)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xfeff, @rand_addr=0x64010100}, 0x4, 0x0, 0x4, 0x2}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000000180)}], 0x1, &(0x7f00000012c0)=[{0x78, 0x0, 0x5, "d7f26beb86c0748c01001b91b73d423ec1dfb9520491775d7588f9ba88fc93ac54866a3e4755c8af82d38c038f7c017ac65a71668223993c8e569c21b224c05f29a72948e2bdd6ae68cb9290328e4564d224b093f6883e43e35128890c556e3b57a3654b"}], 0x78}}, {{0x0, 0x0, &(0x7f0000002440)}}], 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6}]}}}]}, 0x38}}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0xfffffffffffffffc)
r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
keyctl$search(0x1d, 0x0, 0x0, &(0x7f00000000c0)={'syz', 0x1}, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55)
request_key(0x0, &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0)

[  750.217247][T24877] xt_hashlimit: max too large, truncated to 1048576
[  750.224383][T24877] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:39 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x4c000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:40 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:40 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000080)={{0x2, 0x0, @dev}, {0x0, @multicast}, 0x2a, {0x2, 0x0, @empty}, 'wg2\x00'})

[  750.800068][T24897] xt_hashlimit: max too large, truncated to 1048576
[  750.807737][T24897] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:40 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x4000000a, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000004c0)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/3, 0x3}], 0x3, 0x0, 0x0, 0x0)
tkill(r0, 0x3c)
write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @ext={0x4a, &(0x7f0000000380)="98a2cd9e00550f47e89a1069878a23b50cec416dc81a234841c9c503b7ee9fb9c2c32940a73e7f7dbf4cffd64b66fe03006f324b8015e6665b50b9a8d70f9345bd9707d6b2beb28e778c"}}], 0x1c)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

18:34:41 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x58010000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:41 executing program 1:
r0 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
syz_io_uring_setup(0x200, &(0x7f00000004c0)={0x0, 0x7, 0x8}, &(0x7f00005c2000/0x2000)=nil, &(0x7f00007bc000/0x12000)=nil, &(0x7f0000000100), &(0x7f0000000540))

18:34:41 executing program 2:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x2}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x40505412)

18:34:41 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x4000000a, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000004c0)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/3, 0x3}], 0x3, 0x0, 0x0, 0x0)
tkill(r0, 0x3c)
write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @ext={0x4a, &(0x7f0000000380)="98a2cd9e00550f47e89a1069878a23b50cec416dc81a234841c9c503b7ee9fb9c2c32940a73e7f7dbf4cffd64b66fe03006f324b8015e6665b50b9a8d70f9345bd9707d6b2beb28e778c"}}], 0x1c)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

18:34:41 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x60000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  751.968085][T24915] xt_hashlimit: max too large, truncated to 1048576
[  751.975905][T24915] xt_hashlimit: overflow, try lower: 1711341568/0
[  752.272050][T24929] xt_hashlimit: max too large, truncated to 1048576
[  752.280215][T24929] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:42 executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newsa={0x160, 0x10, 0x713, 0x0, 0x0, {{@in=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {@in6=@private1, 0x0, 0x32}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_aead={0x70, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x120, 0x40, "68264a8ebb52ca7d8480822c8f000000000000003bdfac832bb57ddd53c3749354fbcad0"}}]}, 0x160}}, 0x0)

18:34:42 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:42 executing program 1:
r0 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
syz_io_uring_setup(0x200, &(0x7f00000004c0)={0x0, 0x7, 0x8}, &(0x7f00005c2000/0x2000)=nil, &(0x7f00007bc000/0x12000)=nil, &(0x7f0000000100), &(0x7f0000000540))

18:34:42 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x68000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:42 executing program 2:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x2}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x40505412)

[  752.547594][T24937] xt_hashlimit: max too large, truncated to 1048576
[  752.554510][T24937] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:42 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6c000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:42 executing program 1:
r0 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
syz_io_uring_setup(0x200, &(0x7f00000004c0)={0x0, 0x7, 0x8}, &(0x7f00005c2000/0x2000)=nil, &(0x7f00007bc000/0x12000)=nil, &(0x7f0000000100), &(0x7f0000000540))

18:34:42 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:42 executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newsa={0x160, 0x10, 0x713, 0x0, 0x0, {{@in=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {@in6=@private1, 0x0, 0x32}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_aead={0x70, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x120, 0x40, "68264a8ebb52ca7d8480822c8f000000000000003bdfac832bb57ddd53c3749354fbcad0"}}]}, 0x160}}, 0x0)

18:34:42 executing program 2:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x2}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x40505412)

[  752.974259][T24948] xt_hashlimit: max too large, truncated to 1048576
[  752.981167][T24948] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:44 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x4000000a, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000004c0)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/3, 0x3}], 0x3, 0x0, 0x0, 0x0)
tkill(r0, 0x3c)
write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @ext={0x4a, &(0x7f0000000380)="98a2cd9e00550f47e89a1069878a23b50cec416dc81a234841c9c503b7ee9fb9c2c32940a73e7f7dbf4cffd64b66fe03006f324b8015e6665b50b9a8d70f9345bd9707d6b2beb28e778c"}}], 0x1c)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

18:34:44 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x74000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:44 executing program 1:
r0 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
syz_io_uring_setup(0x200, &(0x7f00000004c0)={0x0, 0x7, 0x8}, &(0x7f00005c2000/0x2000)=nil, &(0x7f00007bc000/0x12000)=nil, &(0x7f0000000100), &(0x7f0000000540))

18:34:44 executing program 2:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x2}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x40505412)

18:34:44 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:44 executing program 0:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x2}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x40505412)

[  755.239271][T24971] xt_hashlimit: max too large, truncated to 1048576
[  755.246713][T24971] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:44 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x7a000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:45 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:45 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:45 executing program 0:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x2}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x40505412)

[  755.618548][ T3127] ieee802154 phy0 wpan0: encryption failed: -22
[  755.625658][ T3127] ieee802154 phy1 wpan1: encryption failed: -22
[  755.710560][T24988] xt_hashlimit: max too large, truncated to 1048576
[  755.717602][T24988] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:45 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:45 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xe0030000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  756.072708][T25003] xt_hashlimit: max too large, truncated to 1048576
[  756.079665][T25003] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:48 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x4000000a, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000004c0)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/3, 0x3}], 0x3, 0x0, 0x0, 0x0)
tkill(r0, 0x3c)
write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @ext={0x4a, &(0x7f0000000380)="98a2cd9e00550f47e89a1069878a23b50cec416dc81a234841c9c503b7ee9fb9c2c32940a73e7f7dbf4cffd64b66fe03006f324b8015e6665b50b9a8d70f9345bd9707d6b2beb28e778c"}}], 0x1c)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

18:34:48 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:48 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xff000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:48 executing program 0:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x2}})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x40505412)

18:34:48 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:48 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

[  758.649566][T25026] xt_hashlimit: max too large, truncated to 1048576
[  758.658189][T25026] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:48 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xffffe000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:48 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:48 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:48 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:48 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

[  759.160496][T25038] xt_hashlimit: max too large, truncated to 1048576
[  759.170129][T25038] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:48 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x100000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  759.598026][T25050] xt_hashlimit: max too large, truncated to 1048576
[  759.605100][T25050] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:51 executing program 3:
r0 = syz_open_dev$vcsu(&(0x7f0000000d00), 0x0, 0x0)
unlinkat(r0, &(0x7f0000000000)='./file0\x00', 0x200)

18:34:51 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:51 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:51 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x4000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:51 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xc0)

18:34:51 executing program 5:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0)
write$vga_arbiter(r0, &(0x7f0000000000)=@other={'unlock', ' ', 'io+mem'}, 0xe)

[  761.979987][T25071] xt_hashlimit: max too large, truncated to 1048576
[  761.987427][T25071] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:51 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xe0ffff00000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:51 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:51 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xc0)

18:34:51 executing program 5:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0)
write$vga_arbiter(r0, &(0x7f0000000000)=@other={'unlock', ' ', 'io+mem'}, 0xe)

18:34:51 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:52 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
close(r0)
r1 = socket$inet6_sctp(0xa, 0x801, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x1}, 0x8)
sendfile(r0, r2, 0x0, 0x80001d00c0d0)

[  762.465236][T25081] xt_hashlimit: max too large, truncated to 1048576
[  762.472647][T25081] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:52 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x100000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:52 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xc0)

18:34:52 executing program 5:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0)
write$vga_arbiter(r0, &(0x7f0000000000)=@other={'unlock', ' ', 'io+mem'}, 0xe)

18:34:52 executing program 0:
clone(0x200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000540)='\x97&\x89\\\xd0\xe7\xca\xc7ZO\x94:\xe1\x01\xe5`iq@Nse;\xa8Fpj\x0e\x04!\xd5\xc5YBz\x94\xaf\x13\xe9\xd2\x0f\xc2G\x86\x06\x00\xf1/V\x8cvS\xa6K&u\x9dX\xcc\r\x12\x11\x99\xe7\xce\xaeA\xb8-E\xa1\xf8\xe4~IS\xc1\x04\xf78\xf1\'\xdfv\x90\xbc\xd1\xda\x88j\x16\xeb>\x8c\xa1\x03\xf3\xaf\xfd\xf4&a?\xcaG\n\x02j\x9b}\xc6G\x86\xb2\xdeY\x17yX $\xfcU\x9d\x02\x00\x00\x00\x00\x00\x00\x02\x00\xe6\xff\x00\x00\x00\x81\n\xf3\v\x8d\x12pa\x91\x9b\x8cxd\x06\xa7k\n\x86\xc3\xb6\x910\xf2\x03\x00\xaf\xe1jd\xda\x1f\x8b\x9eVrd\xa4\xb34\xfcUj\x1ad:#\x96\xf9\xd3\x1c]ImZlU=.\x18)\xcf\x1am\xd5\xe0\xdb\xdc\xd7\x8e\xe0\xa3\x82\xec\x9b\xfb\xc9\x81\x9c\xdc\xb7\x0f\xdd\xd3\xd7\xbe\x89\x7f3\x1d\x1c@\x8eu\x85\xces\x89\x95&3FX\xb1\xaf\xa6\x96\xa2\x13\x1f-\b\xcf1J\xd9\x13Q\x94R/\xdf\x1e\x9e\xe57\xda{\xe1D\x00\x00\x00\x00H\xe6\x0f\xe0]\xef\x8b\xcdk\xfe\xf6\xcc+rp\xd5\b~\xf6\xa2\x87\xed<\xc2bO\x88\x03n% \xf8{^\xd6\xcc\x10\xc1\xb3\x9f\xb8IbR:/q~\xad}\xa1^\xa7\xcd\xe2\xb9\x86\x89\x8e\xf0>\x12\x13\xf5\xe9ho{pI\xac\xbe\x9dBF\xd4\b8\xdd\xf0D\xd21S%\xf7\xf7 G\xc4\'cH\xa8\xcf/\xad\x1d\xbbn\xa6\xe1t<,_\xbcz|0GT\n\xb4\x14\xef\x11&\xca\x00\x9d\x81\x9ezJ\x96\xa2\xc2\x14\x0fT\x19D\xe2v0o\x1a\xe2|\xe1\xe5\x80\xbf\x1d\xd6\xe04L\xea\xfd\x9b\x1e\xdcx\xd4\x16\x17\xb7\x04S\xd8\x18\f\xb5\xe9\x1b.|\xe9\x01\x97*\xf2lty\x0e\x8c4O\xb93\xd7', 0x0)
fcntl$setlease(r0, 0x400, 0x1)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000)
r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
write$apparmor_exec(r1, &(0x7f0000000000)={'exec ', ':\x00'}, 0x7)
fcntl$setlease(r0, 0x400, 0x0)

[  762.959488][T25098] xt_hashlimit: max too large, truncated to 1048576
[  762.966705][T25098] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:52 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x200000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:52 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000))
openat(r1, &(0x7f0000000480)='./file0\x00', 0x2, 0x1a2)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x3)
ioctl$TCFLSH(r2, 0x540b, 0x2)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/133, 0x85}, {&(0x7f0000000140)=""/196, 0xc4}], 0x2)
r3 = signalfd4(r2, &(0x7f0000000380)={[0x9]}, 0x8, 0x80800)
sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x4}, {0x4, 0x10}, {0xffff, 0xffff}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4c040)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000180)=0x14)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000500)=0xc000000)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)
ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000280)={0x2, 0x1, 0x2, 0x401, 0x4, [{0x7, 0xf86, 0x2, '\x00', 0x100}, {0x200, 0x800, 0x2, '\x00', 0x1200}, {0x3ff, 0x0, 0x72, '\x00', 0x204}, {0x5, 0x8, 0x9, '\x00', 0x1306}]})

18:34:52 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
close(r0)
r1 = socket$inet6_sctp(0xa, 0x801, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x1}, 0x8)
sendfile(r0, r2, 0x0, 0x80001d00c0d0)

[  763.409032][T25115] xt_hashlimit: max too large, truncated to 1048576
[  763.416095][T25115] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:53 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xc0)

18:34:53 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x300000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:53 executing program 5:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0)
write$vga_arbiter(r0, &(0x7f0000000000)=@other={'unlock', ' ', 'io+mem'}, 0xe)

18:34:53 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@getpolicy={0x5c, 0x15, 0x1, 0x0, 0x0, {{@in6=@private2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}}, [@sec_ctx={0xc, 0x8, {0xfffffffffffffeee}}]}, 0x5c}}, 0x0)

[  763.844368][T25128] xt_hashlimit: max too large, truncated to 1048576
[  763.851247][T25128] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:53 executing program 0:
clone(0x200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000540)='\x97&\x89\\\xd0\xe7\xca\xc7ZO\x94:\xe1\x01\xe5`iq@Nse;\xa8Fpj\x0e\x04!\xd5\xc5YBz\x94\xaf\x13\xe9\xd2\x0f\xc2G\x86\x06\x00\xf1/V\x8cvS\xa6K&u\x9dX\xcc\r\x12\x11\x99\xe7\xce\xaeA\xb8-E\xa1\xf8\xe4~IS\xc1\x04\xf78\xf1\'\xdfv\x90\xbc\xd1\xda\x88j\x16\xeb>\x8c\xa1\x03\xf3\xaf\xfd\xf4&a?\xcaG\n\x02j\x9b}\xc6G\x86\xb2\xdeY\x17yX $\xfcU\x9d\x02\x00\x00\x00\x00\x00\x00\x02\x00\xe6\xff\x00\x00\x00\x81\n\xf3\v\x8d\x12pa\x91\x9b\x8cxd\x06\xa7k\n\x86\xc3\xb6\x910\xf2\x03\x00\xaf\xe1jd\xda\x1f\x8b\x9eVrd\xa4\xb34\xfcUj\x1ad:#\x96\xf9\xd3\x1c]ImZlU=.\x18)\xcf\x1am\xd5\xe0\xdb\xdc\xd7\x8e\xe0\xa3\x82\xec\x9b\xfb\xc9\x81\x9c\xdc\xb7\x0f\xdd\xd3\xd7\xbe\x89\x7f3\x1d\x1c@\x8eu\x85\xces\x89\x95&3FX\xb1\xaf\xa6\x96\xa2\x13\x1f-\b\xcf1J\xd9\x13Q\x94R/\xdf\x1e\x9e\xe57\xda{\xe1D\x00\x00\x00\x00H\xe6\x0f\xe0]\xef\x8b\xcdk\xfe\xf6\xcc+rp\xd5\b~\xf6\xa2\x87\xed<\xc2bO\x88\x03n% \xf8{^\xd6\xcc\x10\xc1\xb3\x9f\xb8IbR:/q~\xad}\xa1^\xa7\xcd\xe2\xb9\x86\x89\x8e\xf0>\x12\x13\xf5\xe9ho{pI\xac\xbe\x9dBF\xd4\b8\xdd\xf0D\xd21S%\xf7\xf7 G\xc4\'cH\xa8\xcf/\xad\x1d\xbbn\xa6\xe1t<,_\xbcz|0GT\n\xb4\x14\xef\x11&\xca\x00\x9d\x81\x9ezJ\x96\xa2\xc2\x14\x0fT\x19D\xe2v0o\x1a\xe2|\xe1\xe5\x80\xbf\x1d\xd6\xe04L\xea\xfd\x9b\x1e\xdcx\xd4\x16\x17\xb7\x04S\xd8\x18\f\xb5\xe9\x1b.|\xe9\x01\x97*\xf2lty\x0e\x8c4O\xb93\xd7', 0x0)
fcntl$setlease(r0, 0x400, 0x1)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000)
r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
write$apparmor_exec(r1, &(0x7f0000000000)={'exec ', ':\x00'}, 0x7)
fcntl$setlease(r0, 0x400, 0x0)

18:34:53 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x400000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:53 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
close(r0)
r1 = socket$inet6_sctp(0xa, 0x801, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x1}, 0x8)
sendfile(r0, r2, 0x0, 0x80001d00c0d0)

18:34:53 executing program 2:
clone(0x200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000540)='\x97&\x89\\\xd0\xe7\xca\xc7ZO\x94:\xe1\x01\xe5`iq@Nse;\xa8Fpj\x0e\x04!\xd5\xc5YBz\x94\xaf\x13\xe9\xd2\x0f\xc2G\x86\x06\x00\xf1/V\x8cvS\xa6K&u\x9dX\xcc\r\x12\x11\x99\xe7\xce\xaeA\xb8-E\xa1\xf8\xe4~IS\xc1\x04\xf78\xf1\'\xdfv\x90\xbc\xd1\xda\x88j\x16\xeb>\x8c\xa1\x03\xf3\xaf\xfd\xf4&a?\xcaG\n\x02j\x9b}\xc6G\x86\xb2\xdeY\x17yX $\xfcU\x9d\x02\x00\x00\x00\x00\x00\x00\x02\x00\xe6\xff\x00\x00\x00\x81\n\xf3\v\x8d\x12pa\x91\x9b\x8cxd\x06\xa7k\n\x86\xc3\xb6\x910\xf2\x03\x00\xaf\xe1jd\xda\x1f\x8b\x9eVrd\xa4\xb34\xfcUj\x1ad:#\x96\xf9\xd3\x1c]ImZlU=.\x18)\xcf\x1am\xd5\xe0\xdb\xdc\xd7\x8e\xe0\xa3\x82\xec\x9b\xfb\xc9\x81\x9c\xdc\xb7\x0f\xdd\xd3\xd7\xbe\x89\x7f3\x1d\x1c@\x8eu\x85\xces\x89\x95&3FX\xb1\xaf\xa6\x96\xa2\x13\x1f-\b\xcf1J\xd9\x13Q\x94R/\xdf\x1e\x9e\xe57\xda{\xe1D\x00\x00\x00\x00H\xe6\x0f\xe0]\xef\x8b\xcdk\xfe\xf6\xcc+rp\xd5\b~\xf6\xa2\x87\xed<\xc2bO\x88\x03n% \xf8{^\xd6\xcc\x10\xc1\xb3\x9f\xb8IbR:/q~\xad}\xa1^\xa7\xcd\xe2\xb9\x86\x89\x8e\xf0>\x12\x13\xf5\xe9ho{pI\xac\xbe\x9dBF\xd4\b8\xdd\xf0D\xd21S%\xf7\xf7 G\xc4\'cH\xa8\xcf/\xad\x1d\xbbn\xa6\xe1t<,_\xbcz|0GT\n\xb4\x14\xef\x11&\xca\x00\x9d\x81\x9ezJ\x96\xa2\xc2\x14\x0fT\x19D\xe2v0o\x1a\xe2|\xe1\xe5\x80\xbf\x1d\xd6\xe04L\xea\xfd\x9b\x1e\xdcx\xd4\x16\x17\xb7\x04S\xd8\x18\f\xb5\xe9\x1b.|\xe9\x01\x97*\xf2lty\x0e\x8c4O\xb93\xd7', 0x0)
fcntl$setlease(r0, 0x400, 0x1)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000)
r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
write$apparmor_exec(r1, &(0x7f0000000000)={'exec ', ':\x00'}, 0x7)
fcntl$setlease(r0, 0x400, 0x0)

18:34:53 executing program 5:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff}, 0x111}}, 0x20)
write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0xffffffffffffffff}}}, 0x90)

18:34:53 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@getpolicy={0x5c, 0x15, 0x1, 0x0, 0x0, {{@in6=@private2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}}, [@sec_ctx={0xc, 0x8, {0xfffffffffffffeee}}]}, 0x5c}}, 0x0)

[  764.374718][T25141] xt_hashlimit: max too large, truncated to 1048576
[  764.381673][T25141] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:54 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x500000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:54 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
close(r0)
r1 = socket$inet6_sctp(0xa, 0x801, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x1}, 0x8)
sendfile(r0, r2, 0x0, 0x80001d00c0d0)

18:34:54 executing program 0:
clone(0x200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000540)='\x97&\x89\\\xd0\xe7\xca\xc7ZO\x94:\xe1\x01\xe5`iq@Nse;\xa8Fpj\x0e\x04!\xd5\xc5YBz\x94\xaf\x13\xe9\xd2\x0f\xc2G\x86\x06\x00\xf1/V\x8cvS\xa6K&u\x9dX\xcc\r\x12\x11\x99\xe7\xce\xaeA\xb8-E\xa1\xf8\xe4~IS\xc1\x04\xf78\xf1\'\xdfv\x90\xbc\xd1\xda\x88j\x16\xeb>\x8c\xa1\x03\xf3\xaf\xfd\xf4&a?\xcaG\n\x02j\x9b}\xc6G\x86\xb2\xdeY\x17yX $\xfcU\x9d\x02\x00\x00\x00\x00\x00\x00\x02\x00\xe6\xff\x00\x00\x00\x81\n\xf3\v\x8d\x12pa\x91\x9b\x8cxd\x06\xa7k\n\x86\xc3\xb6\x910\xf2\x03\x00\xaf\xe1jd\xda\x1f\x8b\x9eVrd\xa4\xb34\xfcUj\x1ad:#\x96\xf9\xd3\x1c]ImZlU=.\x18)\xcf\x1am\xd5\xe0\xdb\xdc\xd7\x8e\xe0\xa3\x82\xec\x9b\xfb\xc9\x81\x9c\xdc\xb7\x0f\xdd\xd3\xd7\xbe\x89\x7f3\x1d\x1c@\x8eu\x85\xces\x89\x95&3FX\xb1\xaf\xa6\x96\xa2\x13\x1f-\b\xcf1J\xd9\x13Q\x94R/\xdf\x1e\x9e\xe57\xda{\xe1D\x00\x00\x00\x00H\xe6\x0f\xe0]\xef\x8b\xcdk\xfe\xf6\xcc+rp\xd5\b~\xf6\xa2\x87\xed<\xc2bO\x88\x03n% \xf8{^\xd6\xcc\x10\xc1\xb3\x9f\xb8IbR:/q~\xad}\xa1^\xa7\xcd\xe2\xb9\x86\x89\x8e\xf0>\x12\x13\xf5\xe9ho{pI\xac\xbe\x9dBF\xd4\b8\xdd\xf0D\xd21S%\xf7\xf7 G\xc4\'cH\xa8\xcf/\xad\x1d\xbbn\xa6\xe1t<,_\xbcz|0GT\n\xb4\x14\xef\x11&\xca\x00\x9d\x81\x9ezJ\x96\xa2\xc2\x14\x0fT\x19D\xe2v0o\x1a\xe2|\xe1\xe5\x80\xbf\x1d\xd6\xe04L\xea\xfd\x9b\x1e\xdcx\xd4\x16\x17\xb7\x04S\xd8\x18\f\xb5\xe9\x1b.|\xe9\x01\x97*\xf2lty\x0e\x8c4O\xb93\xd7', 0x0)
fcntl$setlease(r0, 0x400, 0x1)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000)
r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
write$apparmor_exec(r1, &(0x7f0000000000)={'exec ', ':\x00'}, 0x7)
fcntl$setlease(r0, 0x400, 0x0)

[  764.911931][T25164] xt_hashlimit: max too large, truncated to 1048576
[  764.918997][T25164] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:54 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x600000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:54 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@getpolicy={0x5c, 0x15, 0x1, 0x0, 0x0, {{@in6=@private2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}}, [@sec_ctx={0xc, 0x8, {0xfffffffffffffeee}}]}, 0x5c}}, 0x0)

18:34:54 executing program 5:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff}, 0x111}}, 0x20)
write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0xffffffffffffffff}}}, 0x90)

18:34:54 executing program 2:
clone(0x200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000540)='\x97&\x89\\\xd0\xe7\xca\xc7ZO\x94:\xe1\x01\xe5`iq@Nse;\xa8Fpj\x0e\x04!\xd5\xc5YBz\x94\xaf\x13\xe9\xd2\x0f\xc2G\x86\x06\x00\xf1/V\x8cvS\xa6K&u\x9dX\xcc\r\x12\x11\x99\xe7\xce\xaeA\xb8-E\xa1\xf8\xe4~IS\xc1\x04\xf78\xf1\'\xdfv\x90\xbc\xd1\xda\x88j\x16\xeb>\x8c\xa1\x03\xf3\xaf\xfd\xf4&a?\xcaG\n\x02j\x9b}\xc6G\x86\xb2\xdeY\x17yX $\xfcU\x9d\x02\x00\x00\x00\x00\x00\x00\x02\x00\xe6\xff\x00\x00\x00\x81\n\xf3\v\x8d\x12pa\x91\x9b\x8cxd\x06\xa7k\n\x86\xc3\xb6\x910\xf2\x03\x00\xaf\xe1jd\xda\x1f\x8b\x9eVrd\xa4\xb34\xfcUj\x1ad:#\x96\xf9\xd3\x1c]ImZlU=.\x18)\xcf\x1am\xd5\xe0\xdb\xdc\xd7\x8e\xe0\xa3\x82\xec\x9b\xfb\xc9\x81\x9c\xdc\xb7\x0f\xdd\xd3\xd7\xbe\x89\x7f3\x1d\x1c@\x8eu\x85\xces\x89\x95&3FX\xb1\xaf\xa6\x96\xa2\x13\x1f-\b\xcf1J\xd9\x13Q\x94R/\xdf\x1e\x9e\xe57\xda{\xe1D\x00\x00\x00\x00H\xe6\x0f\xe0]\xef\x8b\xcdk\xfe\xf6\xcc+rp\xd5\b~\xf6\xa2\x87\xed<\xc2bO\x88\x03n% \xf8{^\xd6\xcc\x10\xc1\xb3\x9f\xb8IbR:/q~\xad}\xa1^\xa7\xcd\xe2\xb9\x86\x89\x8e\xf0>\x12\x13\xf5\xe9ho{pI\xac\xbe\x9dBF\xd4\b8\xdd\xf0D\xd21S%\xf7\xf7 G\xc4\'cH\xa8\xcf/\xad\x1d\xbbn\xa6\xe1t<,_\xbcz|0GT\n\xb4\x14\xef\x11&\xca\x00\x9d\x81\x9ezJ\x96\xa2\xc2\x14\x0fT\x19D\xe2v0o\x1a\xe2|\xe1\xe5\x80\xbf\x1d\xd6\xe04L\xea\xfd\x9b\x1e\xdcx\xd4\x16\x17\xb7\x04S\xd8\x18\f\xb5\xe9\x1b.|\xe9\x01\x97*\xf2lty\x0e\x8c4O\xb93\xd7', 0x0)
fcntl$setlease(r0, 0x400, 0x1)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000)
r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
write$apparmor_exec(r1, &(0x7f0000000000)={'exec ', ':\x00'}, 0x7)
fcntl$setlease(r0, 0x400, 0x0)

[  765.274534][T25175] xt_hashlimit: max too large, truncated to 1048576
[  765.281400][T25175] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:55 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x700000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:55 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@getpolicy={0x5c, 0x15, 0x1, 0x0, 0x0, {{@in6=@private2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}}, [@sec_ctx={0xc, 0x8, {0xfffffffffffffeee}}]}, 0x5c}}, 0x0)

18:34:55 executing program 5:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff}, 0x111}}, 0x20)
write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0xffffffffffffffff}}}, 0x90)

18:34:55 executing program 0:
clone(0x200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000540)='\x97&\x89\\\xd0\xe7\xca\xc7ZO\x94:\xe1\x01\xe5`iq@Nse;\xa8Fpj\x0e\x04!\xd5\xc5YBz\x94\xaf\x13\xe9\xd2\x0f\xc2G\x86\x06\x00\xf1/V\x8cvS\xa6K&u\x9dX\xcc\r\x12\x11\x99\xe7\xce\xaeA\xb8-E\xa1\xf8\xe4~IS\xc1\x04\xf78\xf1\'\xdfv\x90\xbc\xd1\xda\x88j\x16\xeb>\x8c\xa1\x03\xf3\xaf\xfd\xf4&a?\xcaG\n\x02j\x9b}\xc6G\x86\xb2\xdeY\x17yX $\xfcU\x9d\x02\x00\x00\x00\x00\x00\x00\x02\x00\xe6\xff\x00\x00\x00\x81\n\xf3\v\x8d\x12pa\x91\x9b\x8cxd\x06\xa7k\n\x86\xc3\xb6\x910\xf2\x03\x00\xaf\xe1jd\xda\x1f\x8b\x9eVrd\xa4\xb34\xfcUj\x1ad:#\x96\xf9\xd3\x1c]ImZlU=.\x18)\xcf\x1am\xd5\xe0\xdb\xdc\xd7\x8e\xe0\xa3\x82\xec\x9b\xfb\xc9\x81\x9c\xdc\xb7\x0f\xdd\xd3\xd7\xbe\x89\x7f3\x1d\x1c@\x8eu\x85\xces\x89\x95&3FX\xb1\xaf\xa6\x96\xa2\x13\x1f-\b\xcf1J\xd9\x13Q\x94R/\xdf\x1e\x9e\xe57\xda{\xe1D\x00\x00\x00\x00H\xe6\x0f\xe0]\xef\x8b\xcdk\xfe\xf6\xcc+rp\xd5\b~\xf6\xa2\x87\xed<\xc2bO\x88\x03n% \xf8{^\xd6\xcc\x10\xc1\xb3\x9f\xb8IbR:/q~\xad}\xa1^\xa7\xcd\xe2\xb9\x86\x89\x8e\xf0>\x12\x13\xf5\xe9ho{pI\xac\xbe\x9dBF\xd4\b8\xdd\xf0D\xd21S%\xf7\xf7 G\xc4\'cH\xa8\xcf/\xad\x1d\xbbn\xa6\xe1t<,_\xbcz|0GT\n\xb4\x14\xef\x11&\xca\x00\x9d\x81\x9ezJ\x96\xa2\xc2\x14\x0fT\x19D\xe2v0o\x1a\xe2|\xe1\xe5\x80\xbf\x1d\xd6\xe04L\xea\xfd\x9b\x1e\xdcx\xd4\x16\x17\xb7\x04S\xd8\x18\f\xb5\xe9\x1b.|\xe9\x01\x97*\xf2lty\x0e\x8c4O\xb93\xd7', 0x0)
fcntl$setlease(r0, 0x400, 0x1)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000)
r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
write$apparmor_exec(r1, &(0x7f0000000000)={'exec ', ':\x00'}, 0x7)
fcntl$setlease(r0, 0x400, 0x0)

[  765.744142][T25193] xt_hashlimit: max too large, truncated to 1048576
[  765.751029][T25193] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:55 executing program 3:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff}, 0x111}}, 0x20)
write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0xffffffffffffffff}}}, 0x90)

18:34:55 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x800000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:55 executing program 2:
clone(0x200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000540)='\x97&\x89\\\xd0\xe7\xca\xc7ZO\x94:\xe1\x01\xe5`iq@Nse;\xa8Fpj\x0e\x04!\xd5\xc5YBz\x94\xaf\x13\xe9\xd2\x0f\xc2G\x86\x06\x00\xf1/V\x8cvS\xa6K&u\x9dX\xcc\r\x12\x11\x99\xe7\xce\xaeA\xb8-E\xa1\xf8\xe4~IS\xc1\x04\xf78\xf1\'\xdfv\x90\xbc\xd1\xda\x88j\x16\xeb>\x8c\xa1\x03\xf3\xaf\xfd\xf4&a?\xcaG\n\x02j\x9b}\xc6G\x86\xb2\xdeY\x17yX $\xfcU\x9d\x02\x00\x00\x00\x00\x00\x00\x02\x00\xe6\xff\x00\x00\x00\x81\n\xf3\v\x8d\x12pa\x91\x9b\x8cxd\x06\xa7k\n\x86\xc3\xb6\x910\xf2\x03\x00\xaf\xe1jd\xda\x1f\x8b\x9eVrd\xa4\xb34\xfcUj\x1ad:#\x96\xf9\xd3\x1c]ImZlU=.\x18)\xcf\x1am\xd5\xe0\xdb\xdc\xd7\x8e\xe0\xa3\x82\xec\x9b\xfb\xc9\x81\x9c\xdc\xb7\x0f\xdd\xd3\xd7\xbe\x89\x7f3\x1d\x1c@\x8eu\x85\xces\x89\x95&3FX\xb1\xaf\xa6\x96\xa2\x13\x1f-\b\xcf1J\xd9\x13Q\x94R/\xdf\x1e\x9e\xe57\xda{\xe1D\x00\x00\x00\x00H\xe6\x0f\xe0]\xef\x8b\xcdk\xfe\xf6\xcc+rp\xd5\b~\xf6\xa2\x87\xed<\xc2bO\x88\x03n% \xf8{^\xd6\xcc\x10\xc1\xb3\x9f\xb8IbR:/q~\xad}\xa1^\xa7\xcd\xe2\xb9\x86\x89\x8e\xf0>\x12\x13\xf5\xe9ho{pI\xac\xbe\x9dBF\xd4\b8\xdd\xf0D\xd21S%\xf7\xf7 G\xc4\'cH\xa8\xcf/\xad\x1d\xbbn\xa6\xe1t<,_\xbcz|0GT\n\xb4\x14\xef\x11&\xca\x00\x9d\x81\x9ezJ\x96\xa2\xc2\x14\x0fT\x19D\xe2v0o\x1a\xe2|\xe1\xe5\x80\xbf\x1d\xd6\xe04L\xea\xfd\x9b\x1e\xdcx\xd4\x16\x17\xb7\x04S\xd8\x18\f\xb5\xe9\x1b.|\xe9\x01\x97*\xf2lty\x0e\x8c4O\xb93\xd7', 0x0)
fcntl$setlease(r0, 0x400, 0x1)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000)
r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
write$apparmor_exec(r1, &(0x7f0000000000)={'exec ', ':\x00'}, 0x7)
fcntl$setlease(r0, 0x400, 0x0)

18:34:55 executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0)

[  766.220522][T25209] xt_hashlimit: max too large, truncated to 1048576
[  766.227537][T25209] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:55 executing program 3:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff}, 0x111}}, 0x20)
write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0xffffffffffffffff}}}, 0x90)

18:34:56 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x900000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:56 executing program 5:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff}, 0x111}}, 0x20)
write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0xffffffffffffffff}}}, 0x90)

18:34:56 executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

18:34:56 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xa00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:56 executing program 1:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

18:34:56 executing program 3:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff}, 0x111}}, 0x20)
write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0xffffffffffffffff}}}, 0x90)

18:34:56 executing program 2:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f00000001c0))

18:34:56 executing program 5:
semget(0x2, 0x4, 0x0)

[  767.112856][T25239] hashlimit_mt_check_common: 1 callbacks suppressed
[  767.119949][T25239] xt_hashlimit: max too large, truncated to 1048576
[  767.126973][T25239] hashlimit_mt_check_common: 1 callbacks suppressed
[  767.127031][T25239] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:56 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xb00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:57 executing program 1:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

18:34:57 executing program 2:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f00000001c0))

18:34:57 executing program 3:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

18:34:57 executing program 5:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

[  767.749668][T25254] xt_hashlimit: max too large, truncated to 1048576
[  767.756755][T25254] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:57 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xc00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  768.148750][T25244] syz-executor.0 (25244): drop_caches: 2
[  768.210287][T25238] syz-executor.0 (25238): drop_caches: 2
[  768.210570][T25271] xt_hashlimit: max too large, truncated to 1048576
[  768.223364][T25271] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:58 executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

18:34:58 executing program 1:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

18:34:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xd00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:58 executing program 2:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f00000001c0))

18:34:58 executing program 3:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

18:34:58 executing program 5:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

[  768.576872][T25279] xt_hashlimit: max too large, truncated to 1048576
[  768.583931][T25279] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xe00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:58 executing program 3:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

18:34:58 executing program 1:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

[  768.858093][T25290] syz-executor.0 (25290): drop_caches: 2
18:34:58 executing program 2:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f00000001c0))

18:34:58 executing program 5:
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0)
bind$can_raw(r0, &(0x7f00000000c0), 0x10)
setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000140)=[{{}, {0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x1}}, {{0x0, 0x1}}], 0x18)

[  769.005265][T25293] xt_hashlimit: max too large, truncated to 1048576
[  769.012122][T25293] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1000000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:58 executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

18:34:59 executing program 3:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

[  769.417696][T25307] xt_hashlimit: max too large, truncated to 1048576
[  769.424787][T25307] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:59 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@polexpire={0xcc, 0x1b, 0x1, 0x0, 0x0, {{{@in6=@mcast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xcc}}, 0x0)

18:34:59 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r1, 0x0)
preadv(r1, &(0x7f00000001c0)=[{0x0}], 0x1, 0xb20, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x32, &(0x7f0000000080)={@loopback}, 0x20)

[  769.528924][T25312] syz-executor.0 (25312): drop_caches: 2
18:34:59 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1100000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:59 executing program 5:
syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0)
r0 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x0}, &(0x7f00000002c0)="f5", 0x6a, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0)

[  769.763642][T25315] syz-executor.3 (25315): drop_caches: 2
18:34:59 executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

[  769.907840][T25322] xt_hashlimit: max too large, truncated to 1048576
[  769.914772][T25322] xt_hashlimit: overflow, try lower: 1711341568/0
18:34:59 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1200000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:34:59 executing program 3:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

18:34:59 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@polexpire={0xcc, 0x1b, 0x1, 0x0, 0x0, {{{@in6=@mcast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xcc}}, 0x0)

[  770.184640][T25330] syz-executor.0 (25330): drop_caches: 2
18:34:59 executing program 5:
syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0)
r0 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x0}, &(0x7f00000002c0)="f5", 0x6a, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0)

18:34:59 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r1, 0x0)
preadv(r1, &(0x7f00000001c0)=[{0x0}], 0x1, 0xb20, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x32, &(0x7f0000000080)={@loopback}, 0x20)

[  770.412755][T25336] xt_hashlimit: max too large, truncated to 1048576
[  770.420139][T25336] xt_hashlimit: overflow, try lower: 1711341568/0
[  770.432408][T25335] syz-executor.3 (25335): drop_caches: 2
18:35:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1900000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:00 executing program 0:
clock_gettime(0x5, &(0x7f0000000040))

18:35:00 executing program 3:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

18:35:00 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@polexpire={0xcc, 0x1b, 0x1, 0x0, 0x0, {{{@in6=@mcast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xcc}}, 0x0)

[  770.883227][T25348] xt_hashlimit: max too large, truncated to 1048576
[  770.890065][T25348] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:00 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r1, 0x0)
preadv(r1, &(0x7f00000001c0)=[{0x0}], 0x1, 0xb20, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x32, &(0x7f0000000080)={@loopback}, 0x20)

18:35:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x1a00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:00 executing program 5:
syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0)
r0 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x0}, &(0x7f00000002c0)="f5", 0x6a, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0)

[  771.086403][T25354] syz-executor.3 (25354): drop_caches: 2
18:35:00 executing program 0:
clock_gettime(0x5, &(0x7f0000000040))

[  771.292437][T25363] xt_hashlimit: max too large, truncated to 1048576
[  771.299404][T25363] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:01 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x2000000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:01 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@polexpire={0xcc, 0x1b, 0x1, 0x0, 0x0, {{{@in6=@mcast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xcc}}, 0x0)

18:35:01 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x200300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000002, 0x0)
r2 = getpid()
rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f0000000000))
ptrace(0x10, r2)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3")
ptrace$getregset(0x4205, r2, 0x2, &(0x7f00000005c0)={0x0})

18:35:01 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2800004, 0x12, r1, 0x0)
preadv(r1, &(0x7f00000001c0)=[{0x0}], 0x1, 0xb20, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x32, &(0x7f0000000080)={@loopback}, 0x20)

18:35:01 executing program 5:
syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0)
r0 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x0}, &(0x7f00000002c0)="f5", 0x6a, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0)

18:35:01 executing program 0:
clock_gettime(0x5, &(0x7f0000000040))

18:35:01 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x200300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000002, 0x0)
r2 = getpid()
rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f0000000000))
ptrace(0x10, r2)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3")
ptrace$getregset(0x4205, r2, 0x2, &(0x7f00000005c0)={0x0})

18:35:01 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x200300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000002, 0x0)
r2 = getpid()
rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f0000000000))
ptrace(0x10, r2)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3")
ptrace$getregset(0x4205, r2, 0x2, &(0x7f00000005c0)={0x0})

18:35:01 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x2500000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:01 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x200300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000002, 0x0)
r2 = getpid()
rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f0000000000))
ptrace(0x10, r2)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3")
ptrace$getregset(0x4205, r2, 0x2, &(0x7f00000005c0)={0x0})

18:35:01 executing program 5:
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x4000}, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x1c, 0x16, 0xa01, 0x0, 0x0, {}, [@nested={0x4}, @nested={0x4, 0x8}]}, 0x1c}}, 0x0)

18:35:01 executing program 2:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x2c24, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xb, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x6}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000007c0)={0x24, 0x0, 0x0, &(0x7f0000000740)={0x0, 0x22, 0x6, {[@main=@item_4={0x3, 0x0, 0xc, "7590959f"}, @global]}}, 0x0}, 0x0)

18:35:01 executing program 0:
clock_gettime(0x5, &(0x7f0000000040))

18:35:02 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x200300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000002, 0x0)
r2 = getpid()
rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f0000000000))
ptrace(0x10, r2)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3")
ptrace$getregset(0x4205, r2, 0x2, &(0x7f00000005c0)={0x0})

[  772.440608][T25402] hashlimit_mt_check_common: 1 callbacks suppressed
[  772.440675][T25402] xt_hashlimit: max too large, truncated to 1048576
[  772.443435][T25400] netlink: 'syz-executor.5': attribute type 8 has an invalid length.
[  772.447847][T25402] hashlimit_mt_check_common: 1 callbacks suppressed
[  772.447897][T25402] xt_hashlimit: overflow, try lower: 1711341568/0
[  772.487915][T25405] netlink: 'syz-executor.5': attribute type 8 has an invalid length.
18:35:02 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x200300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000002, 0x0)
r2 = getpid()
rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f0000000000))
ptrace(0x10, r2)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3")
ptrace$getregset(0x4205, r2, 0x2, &(0x7f00000005c0)={0x0})

18:35:02 executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x200300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000002, 0x0)
r2 = getpid()
rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f0000000000))
ptrace(0x10, r2)
ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3")
ptrace$getregset(0x4205, r2, 0x2, &(0x7f00000005c0)={0x0})

18:35:02 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x270b000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:02 executing program 5:
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x4000}, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x1c, 0x16, 0xa01, 0x0, 0x0, {}, [@nested={0x4}, @nested={0x4, 0x8}]}, 0x1c}}, 0x0)

[  772.813603][ T2058] usb 3-1: new high-speed USB device number 25 using dummy_hcd
18:35:02 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:02 executing program 1:
r0 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x4}}, 0x10)

18:35:02 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="d800000018008100e00f80ecdb4cb9ac0a4465ef0b007c05e87c55a1bc000100b8000699020000000500150007008103a80005006f94007134cf6efb8000a007a290457f0189b3162b26b1b745f13a12e642b2f67f3543277ce06bbace8017a9ec4c2ee5a7cef5090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe04000000730d16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db791262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace813f0b7fece0b40d9ecbee5de6ccd40dd6e4edef3d93452a92307f0500000000", 0xd8}], 0x1}, 0x0)

[  773.073066][ T2058] usb 3-1: Using ep0 maxpacket: 8
[  773.088916][T25430] xt_hashlimit: max too large, truncated to 1048576
[  773.097311][T25430] xt_hashlimit: overflow, try lower: 1711341568/0
[  773.110529][T25432] netlink: 'syz-executor.5': attribute type 8 has an invalid length.
18:35:02 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x2802000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  773.180264][T25437] IPv6: NLM_F_CREATE should be specified when creating new route
[  773.207632][ T2058] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  773.218798][ T2058] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  773.228841][ T2058] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11
[  773.242025][ T2058] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.40
[  773.251555][ T2058] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
18:35:03 executing program 5:
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x4000}, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x1c, 0x16, 0xa01, 0x0, 0x0, {}, [@nested={0x4}, @nested={0x4, 0x8}]}, 0x1c}}, 0x0)

[  773.514269][ T2058] usb 3-1: config 0 descriptor??
[  773.558580][T25440] xt_hashlimit: max too large, truncated to 1048576
[  773.565781][T25440] xt_hashlimit: overflow, try lower: 1711341568/0
[  773.655599][T25447] netlink: 'syz-executor.5': attribute type 8 has an invalid length.
[  774.010651][ T2058] pyra 0003:1E7D:2C24.0001: collection stack underflow
[  774.022121][ T2058] pyra 0003:1E7D:2C24.0001: item 0 4 0 12 parsing failed
[  774.097571][ T2058] pyra 0003:1E7D:2C24.0001: parse failed
[  774.103703][ T2058] pyra: probe of 0003:1E7D:2C24.0001 failed with error -22
[  774.210684][    T5] usb 3-1: USB disconnect, device number 25
[  774.983463][ T8447] usb 3-1: new high-speed USB device number 26 using dummy_hcd
[  775.233388][ T8447] usb 3-1: Using ep0 maxpacket: 8
[  775.353255][ T8447] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  775.364574][ T8447] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  775.374773][ T8447] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11
[  775.388074][ T8447] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.40
[  775.397377][ T8447] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  775.555431][ T8447] usb 3-1: config 0 descriptor??
18:35:05 executing program 1:
r0 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x4}}, 0x10)

18:35:05 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:05 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="d800000018008100e00f80ecdb4cb9ac0a4465ef0b007c05e87c55a1bc000100b8000699020000000500150007008103a80005006f94007134cf6efb8000a007a290457f0189b3162b26b1b745f13a12e642b2f67f3543277ce06bbace8017a9ec4c2ee5a7cef5090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe04000000730d16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db791262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace813f0b7fece0b40d9ecbee5de6ccd40dd6e4edef3d93452a92307f0500000000", 0xd8}], 0x1}, 0x0)

18:35:05 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x280b000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:05 executing program 2:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x2c24, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xb, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x6}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000007c0)={0x24, 0x0, 0x0, &(0x7f0000000740)={0x0, 0x22, 0x6, {[@main=@item_4={0x3, 0x0, 0xc, "7590959f"}, @global]}}, 0x0}, 0x0)

18:35:05 executing program 5:
r0 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x4000}, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x1c, 0x16, 0xa01, 0x0, 0x0, {}, [@nested={0x4}, @nested={0x4, 0x8}]}, 0x1c}}, 0x0)

[  775.641999][ T8447] usb 3-1: can't set config #0, error -71
[  775.689185][ T8447] usb 3-1: USB disconnect, device number 26
[  775.780779][T25479] netlink: 'syz-executor.5': attribute type 8 has an invalid length.
[  775.842702][T25486] xt_hashlimit: max too large, truncated to 1048576
[  775.849797][T25486] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:05 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x4800000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:05 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:05 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:05 executing program 1:
r0 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x4}}, 0x10)

18:35:05 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="d800000018008100e00f80ecdb4cb9ac0a4465ef0b007c05e87c55a1bc000100b8000699020000000500150007008103a80005006f94007134cf6efb8000a007a290457f0189b3162b26b1b745f13a12e642b2f67f3543277ce06bbace8017a9ec4c2ee5a7cef5090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe04000000730d16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db791262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace813f0b7fece0b40d9ecbee5de6ccd40dd6e4edef3d93452a92307f0500000000", 0xd8}], 0x1}, 0x0)

[  776.300698][T25495] xt_hashlimit: max too large, truncated to 1048576
[  776.307704][T25495] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:06 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x4c00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  776.353129][ T2058] usb 3-1: new high-speed USB device number 27 using dummy_hcd
[  776.613101][ T2058] usb 3-1: Using ep0 maxpacket: 8
18:35:06 executing program 1:
r0 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x4}}, 0x10)

[  776.739809][T25511] xt_hashlimit: max too large, truncated to 1048576
[  776.746815][T25511] xt_hashlimit: overflow, try lower: 1711341568/0
[  776.755597][ T2058] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  776.766957][ T2058] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  776.777174][ T2058] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11
18:35:06 executing program 3:
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="d800000018008100e00f80ecdb4cb9ac0a4465ef0b007c05e87c55a1bc000100b8000699020000000500150007008103a80005006f94007134cf6efb8000a007a290457f0189b3162b26b1b745f13a12e642b2f67f3543277ce06bbace8017a9ec4c2ee5a7cef5090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe04000000730d16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db791262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace813f0b7fece0b40d9ecbee5de6ccd40dd6e4edef3d93452a92307f0500000000", 0xd8}], 0x1}, 0x0)

18:35:06 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:06 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

[  776.793355][ T2058] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.40
[  776.802564][ T2058] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  776.849079][ T2058] usb 3-1: config 0 descriptor??
[  777.347184][ T2058] pyra 0003:1E7D:2C24.0002: collection stack underflow
[  777.354397][ T2058] pyra 0003:1E7D:2C24.0002: item 0 4 0 12 parsing failed
[  777.368020][ T2058] pyra 0003:1E7D:2C24.0002: parse failed
[  777.374123][ T2058] pyra: probe of 0003:1E7D:2C24.0002 failed with error -22
[  777.558026][ T2058] usb 3-1: USB disconnect, device number 27
18:35:07 executing program 2:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x2c24, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xb, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x6}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000007c0)={0x24, 0x0, 0x0, &(0x7f0000000740)={0x0, 0x22, 0x6, {[@main=@item_4={0x3, 0x0, 0xc, "7590959f"}, @global]}}, 0x0}, 0x0)

18:35:07 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x5801000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:07 executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:07 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:07 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:07 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

[  778.313786][T25552] xt_hashlimit: max too large, truncated to 1048576
[  778.323511][T25552] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:08 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6000000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:08 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:08 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newnexthop={0x20, 0x1e, 0x3, 0x0, 0x0, {0xa}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0)
openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x11, 0x800000003, 0x0)
bind(r2, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r2, &(0x7f0000000740)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001400210100000000000000000a000000", @ANYRES32=r3, @ANYBLOB="14000100fc0200000000000000000000008000001400020000000000000000000000000000000001"], 0x40}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x11, 0x800000003, 0x0)
bind(r4, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r4, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)

18:35:08 executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:08 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

[  778.713419][ T4678] usb 3-1: new high-speed USB device number 28 using dummy_hcd
[  778.749788][T25566] xt_hashlimit: max too large, truncated to 1048576
[  778.756761][T25566] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:08 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6800000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  778.963706][ T4678] usb 3-1: Using ep0 maxpacket: 8
[  779.073184][T25583] xt_hashlimit: max too large, truncated to 1048576
[  779.080080][T25583] xt_hashlimit: overflow, try lower: 1711341568/0
[  779.090709][ T4678] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  779.102135][ T4678] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  779.112242][ T4678] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11
[  779.125604][ T4678] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.40
[  779.137174][ T4678] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  779.389341][ T4678] usb 3-1: config 0 descriptor??
[  779.896956][ T4678] pyra 0003:1E7D:2C24.0003: collection stack underflow
[  779.904171][ T4678] pyra 0003:1E7D:2C24.0003: item 0 4 0 12 parsing failed
[  779.917693][ T4678] pyra 0003:1E7D:2C24.0003: parse failed
[  779.923850][ T4678] pyra: probe of 0003:1E7D:2C24.0003 failed with error -22
[  780.127081][ T8447] usb 3-1: USB disconnect, device number 28
18:35:10 executing program 2:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x2c24, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xb, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x6}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000007c0)={0x24, 0x0, 0x0, &(0x7f0000000740)={0x0, 0x22, 0x6, {[@main=@item_4={0x3, 0x0, 0xc, "7590959f"}, @global]}}, 0x0}, 0x0)

18:35:10 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x6c00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:10 executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:10 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newnexthop={0x20, 0x1e, 0x3, 0x0, 0x0, {0xa}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0)
openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x11, 0x800000003, 0x0)
bind(r2, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r2, &(0x7f0000000740)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001400210100000000000000000a000000", @ANYRES32=r3, @ANYBLOB="14000100fc0200000000000000000000008000001400020000000000000000000000000000000001"], 0x40}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x11, 0x800000003, 0x0)
bind(r4, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r4, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)

18:35:10 executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

18:35:10 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
read$alg(r1, &(0x7f0000000600)=""/224, 0xe0)
write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8)

[  781.145202][T25619] xt_hashlimit: max too large, truncated to 1048576
[  781.151982][T25619] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:10 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x7400000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:11 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newnexthop={0x20, 0x1e, 0x3, 0x0, 0x0, {0xa}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0)
openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x11, 0x800000003, 0x0)
bind(r2, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r2, &(0x7f0000000740)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001400210100000000000000000a000000", @ANYRES32=r3, @ANYBLOB="14000100fc0200000000000000000000008000001400020000000000000000000000000000000001"], 0x40}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x11, 0x800000003, 0x0)
bind(r4, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r4, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)

18:35:11 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sysvipc/sem\x00', 0x0, 0x0)
readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000040)=""/118, 0x76}], 0x1)

18:35:11 executing program 1:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

18:35:11 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newnexthop={0x20, 0x1e, 0x3, 0x0, 0x0, {0xa}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0)
openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x11, 0x800000003, 0x0)
bind(r2, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r2, &(0x7f0000000740)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001400210100000000000000000a000000", @ANYRES32=r3, @ANYBLOB="14000100fc0200000000000000000000008000001400020000000000000000000000000000000001"], 0x40}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x11, 0x800000003, 0x0)
bind(r4, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r4, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)

[  781.639448][T25629] xt_hashlimit: max too large, truncated to 1048576
[  781.646341][T25629] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:11 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x7a00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  781.683562][ T2058] usb 3-1: new high-speed USB device number 29 using dummy_hcd
[  781.923781][ T2058] usb 3-1: Using ep0 maxpacket: 8
[  782.054628][ T2058] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  782.065854][ T2058] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  782.075904][ T2058] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11
[  782.089087][ T2058] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.40
[  782.098673][ T2058] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  782.159445][T25648] xt_hashlimit: max too large, truncated to 1048576
[  782.166386][T25648] xt_hashlimit: overflow, try lower: 1711341568/0
[  782.262219][ T2058] usb 3-1: config 0 descriptor??
[  782.766474][ T2058] pyra 0003:1E7D:2C24.0004: collection stack underflow
[  782.773831][ T2058] pyra 0003:1E7D:2C24.0004: item 0 4 0 12 parsing failed
[  782.811332][ T2058] pyra 0003:1E7D:2C24.0004: parse failed
[  782.829522][ T2058] pyra: probe of 0003:1E7D:2C24.0004 failed with error -22
[  782.994025][ T2058] usb 3-1: USB disconnect, device number 29
18:35:13 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newnexthop={0x20, 0x1e, 0x3, 0x0, 0x0, {0xa}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0)
openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x11, 0x800000003, 0x0)
bind(r2, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r2, &(0x7f0000000740)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001400210100000000000000000a000000", @ANYRES32=r3, @ANYBLOB="14000100fc0200000000000000000000008000001400020000000000000000000000000000000001"], 0x40}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x11, 0x800000003, 0x0)
bind(r4, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r4, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)

18:35:13 executing program 3:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

18:35:13 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newnexthop={0x20, 0x1e, 0x3, 0x0, 0x0, {0xa}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0)
openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x11, 0x800000003, 0x0)
bind(r2, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r2, &(0x7f0000000740)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001400210100000000000000000a000000", @ANYRES32=r3, @ANYBLOB="14000100fc0200000000000000000000008000001400020000000000000000000000000000000001"], 0x40}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x11, 0x800000003, 0x0)
bind(r4, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r4, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)

18:35:13 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x8000000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:13 executing program 1:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

[  783.796655][T25681] xt_hashlimit: max too large, truncated to 1048576
[  783.803737][T25681] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:13 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xe003000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:13 executing program 2:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

18:35:13 executing program 5:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

18:35:13 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newnexthop={0x20, 0x1e, 0x3, 0x0, 0x0, {0xa}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0)
openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x11, 0x800000003, 0x0)
bind(r2, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r2, &(0x7f0000000740)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001400210100000000000000000a000000", @ANYRES32=r3, @ANYBLOB="14000100fc0200000000000000000000008000001400020000000000000000000000000000000001"], 0x40}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket(0x11, 0x800000003, 0x0)
bind(r4, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r4, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14)

18:35:13 executing program 1:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

[  784.336636][T25690] xt_hashlimit: max too large, truncated to 1048576
[  784.343556][T25690] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:14 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xff00000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:14 executing program 2:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

18:35:14 executing program 5:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

[  784.728063][T25707] xt_hashlimit: max too large, truncated to 1048576
[  784.735097][T25707] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:14 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0xffffffff00000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:14 executing program 3:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

18:35:14 executing program 0:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

18:35:14 executing program 1:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

[  785.113095][T25717] xt_hashlimit: max too large, truncated to 1048576
[  785.119894][T25717] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:14 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x2}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:14 executing program 2:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

18:35:15 executing program 5:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

18:35:15 executing program 0:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

[  785.587431][T25734] xt_hashlimit: max too large, truncated to 1048576
[  785.594689][T25734] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:15 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x3}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  785.709941][T25730] not chained 30000 origins
[  785.714486][T25730] CPU: 0 PID: 25730 Comm: syz-executor.3 Not tainted 5.12.0-rc6-syzkaller #0
[  785.723277][T25730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  785.733341][T25730] Call Trace:
[  785.736628][T25730]  dump_stack+0x24c/0x2e0
[  785.740988][T25730]  kmsan_internal_chain_origin+0x6f/0x130
[  785.746727][T25730]  ? update_load_avg+0x876/0x1340
[  785.751873][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.757098][T25730]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  785.762912][T25730]  ? __msan_metadata_ptr_for_load_4+0x10/0x20
[  785.768984][T25730]  ? __perf_event_task_sched_out+0x2ef7/0x2f80
[  785.775191][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.781610][T25730]  ? __msan_get_context_state+0x9/0x20
[  785.787155][T25730]  ? update_misfit_status+0x2c/0xd80
[  785.792440][T25730]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  785.798263][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.803465][T25730]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  785.809315][T25730]  ? __msan_metadata_ptr_for_load_8+0x10/0x20
[  785.815762][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.820967][T25730]  ? kmsan_internal_set_origin+0x85/0xc0
[  785.826598][T25730]  ? kmsan_internal_unpoison_shadow+0x42/0x70
[  785.833125][T25730]  ? kmsan_unpoison_shadow+0x74/0xa0
[  785.838436][T25730]  ? _copy_from_user+0x1fd/0x300
[  785.843477][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.848776][T25730]  __msan_chain_origin+0x54/0xa0
[  785.853713][T25730]  __copy_msghdr_from_user+0x4cf/0xc10
[  785.859174][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.864372][T25730]  __sys_sendmmsg+0x673/0x1010
[  785.869142][T25730]  ? __msan_metadata_ptr_for_load_4+0x10/0x20
[  785.875212][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.880410][T25730]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  785.886217][T25730]  ? __msan_metadata_ptr_for_store_1+0x13/0x20
[  785.892370][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.897566][T25730]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  785.903374][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.908570][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.913767][T25730]  ? kmsan_internal_set_origin+0x85/0xc0
[  785.919398][T25730]  ? kmsan_internal_unpoison_shadow+0x42/0x70
[  785.925464][T25730]  ? __msan_instrument_asm_store+0x107/0x130
[  785.931450][T25730]  ? kmsan_get_metadata+0x116/0x180
[  785.936649][T25730]  __se_sys_sendmmsg+0xbd/0xe0
[  785.941520][T25730]  __x64_sys_sendmmsg+0x56/0x70
[  785.946375][T25730]  do_syscall_64+0x9f/0x140
[  785.950883][T25730]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  785.956775][T25730] RIP: 0033:0x4665d9
[  785.960663][T25730] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  785.980271][T25730] RSP: 002b:00007f0f646c6188 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  785.988706][T25730] RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 00000000004665d9
[  785.996673][T25730] RDX: 0400000000000107 RSI: 0000000020008440 RDI: 0000000000000006
[  786.004643][T25730] RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
[  786.012608][T25730] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008
[  786.020586][T25730] R13: 0000000000a9fb1f R14: 00007f0f646c6300 R15: 0000000000022000
[  786.028559][T25730] Uninit was stored to memory at:
[  786.033565][T25730]  kmsan_internal_chain_origin+0xad/0x130
[  786.039291][T25730]  __msan_chain_origin+0x54/0xa0
[  786.044227][T25730]  __copy_msghdr_from_user+0x4cf/0xc10
[  786.049685][T25730]  __sys_sendmmsg+0x673/0x1010
[  786.054446][T25730]  __se_sys_sendmmsg+0xbd/0xe0
[  786.059207][T25730]  __x64_sys_sendmmsg+0x56/0x70
[  786.064167][T25730]  do_syscall_64+0x9f/0x140
[  786.068672][T25730]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  786.074562][T25730] 
[  786.076869][T25730] Uninit was stored to memory at:
[  786.081884][T25730]  kmsan_internal_chain_origin+0xad/0x130
[  786.087600][T25730]  __msan_chain_origin+0x54/0xa0
[  786.092534][T25730]  __copy_msghdr_from_user+0x4cf/0xc10
[  786.098128][T25730]  __sys_sendmmsg+0x673/0x1010
[  786.102900][T25730]  __se_sys_sendmmsg+0xbd/0xe0
[  786.107670][T25730]  __x64_sys_sendmmsg+0x56/0x70
[  786.112521][T25730]  do_syscall_64+0x9f/0x140
[  786.117021][T25730]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  786.122912][T25730] 
[  786.125224][T25730] Uninit was stored to memory at:
[  786.130228][T25730]  kmsan_internal_chain_origin+0xad/0x130
[  786.135942][T25730]  __msan_chain_origin+0x54/0xa0
[  786.140875][T25730]  __copy_msghdr_from_user+0x4cf/0xc10
[  786.146333][T25730]  __sys_sendmmsg+0x673/0x1010
[  786.151095][T25730]  __se_sys_sendmmsg+0xbd/0xe0
[  786.155869][T25730]  __x64_sys_sendmmsg+0x56/0x70
[  786.160718][T25730]  do_syscall_64+0x9f/0x140
[  786.165224][T25730]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  786.171117][T25730] 
[  786.173430][T25730] Uninit was stored to memory at:
[  786.178533][T25730]  kmsan_internal_chain_origin+0xad/0x130
[  786.184251][T25730]  __msan_chain_origin+0x54/0xa0
[  786.189290][T25730]  __copy_msghdr_from_user+0x4cf/0xc10
[  786.194747][T25730]  __sys_sendmmsg+0x673/0x1010
[  786.199510][T25730]  __se_sys_sendmmsg+0xbd/0xe0
[  786.204274][T25730]  __x64_sys_sendmmsg+0x56/0x70
[  786.209123][T25730]  do_syscall_64+0x9f/0x140
[  786.213627][T25730]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  786.219517][T25730] 
[  786.221826][T25730] Uninit was stored to memory at:
[  786.226825][T25730]  kmsan_internal_chain_origin+0xad/0x130
[  786.232542][T25730]  __msan_chain_origin+0x54/0xa0
[  786.237475][T25730]  __copy_msghdr_from_user+0x4cf/0xc10
[  786.242931][T25730]  __sys_sendmmsg+0x673/0x1010
[  786.247797][T25730]  __se_sys_sendmmsg+0xbd/0xe0
[  786.252558][T25730]  __x64_sys_sendmmsg+0x56/0x70
[  786.257404][T25730]  do_syscall_64+0x9f/0x140
[  786.261904][T25730]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  786.267801][T25730] 
[  786.270114][T25730] Uninit was stored to memory at:
[  786.275121][T25730]  kmsan_internal_chain_origin+0xad/0x130
[  786.280841][T25730]  __msan_chain_origin+0x54/0xa0
[  786.285774][T25730]  __copy_msghdr_from_user+0x4cf/0xc10
[  786.291230][T25730]  __sys_sendmmsg+0x673/0x1010
[  786.295990][T25730]  __se_sys_sendmmsg+0xbd/0xe0
[  786.300752][T25730]  __x64_sys_sendmmsg+0x56/0x70
[  786.305601][T25730]  do_syscall_64+0x9f/0x140
[  786.310103][T25730]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  786.316000][T25730] 
[  786.318326][T25730] Uninit was stored to memory at:
[  786.323334][T25730]  kmsan_internal_chain_origin+0xad/0x130
[  786.329053][T25730]  __msan_chain_origin+0x54/0xa0
[  786.333985][T25730]  __copy_msghdr_from_user+0x4cf/0xc10
[  786.339444][T25730]  __sys_sendmmsg+0x673/0x1010
[  786.344205][T25730]  __se_sys_sendmmsg+0xbd/0xe0
[  786.348971][T25730]  __x64_sys_sendmmsg+0x56/0x70
[  786.353824][T25730]  do_syscall_64+0x9f/0x140
[  786.358339][T25730]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  786.364233][T25730] 
[  786.366544][T25730] Local variable ----msg_sys@__sys_sendmmsg created at:
[  786.373463][T25730]  __sys_sendmmsg+0xbd/0x1010
[  786.378140][T25730]  __sys_sendmmsg+0xbd/0x1010
18:35:16 executing program 1:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

18:35:16 executing program 2:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

18:35:16 executing program 5:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet(0x10, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x24}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="330600002e"], 0x2}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x84ffe2, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

18:35:16 executing program 0:
syz_io_uring_setup(0x1, &(0x7f0000000240), &(0x7f0000fc2000/0x1000)=nil, &(0x7f0000d7a000/0x4000)=nil, 0x0, 0x0)
syz_io_uring_setup(0x3428, &(0x7f0000000000), &(0x7f0000400000/0xc00000)=nil, &(0x7f000050f000/0x3000)=nil, &(0x7f0000000080), 0x0)
syz_io_uring_setup(0x2bbe, &(0x7f0000000380), &(0x7f0000aaf000/0x3000)=nil, &(0x7f0000805000/0x3000)=nil, &(0x7f00000001c0), 0x0)
syz_io_uring_setup(0x2, &(0x7f00000002c0), &(0x7f0000f3e000/0x1000)=nil, &(0x7f0000e1b000/0x1000)=nil, &(0x7f00000004c0), 0x0)
syz_io_uring_setup(0x61eb, &(0x7f0000000140), &(0x7f0000a8a000/0x4000)=nil, &(0x7f00005aa000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200))

[  787.132443][T25759] __nla_validate_parse: 3 callbacks suppressed
[  787.132508][T25759] netlink: 1551 bytes leftover after parsing attributes in process `syz-executor.5'.
[  787.149620][T25760] xt_hashlimit: max too large, truncated to 1048576
[  787.156705][T25760] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:17 executing program 3:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

18:35:17 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x4}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  787.996953][T25772] xt_hashlimit: max too large, truncated to 1048576
[  788.004039][T25772] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:17 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast2, @in6=@mcast2}, {@in6=@empty, 0x0, 0x32}, @in6=@empty, {}, {}, {}, 0x0, 0x0, 0x2, 0x4, 0x0, 0x64}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0)

18:35:17 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x5}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:17 executing program 5:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet(0x10, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x24}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="330600002e"], 0x2}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x84ffe2, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

18:35:17 executing program 2:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

18:35:17 executing program 1:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

[  788.463125][T25785] xt_hashlimit: max too large, truncated to 1048576
[  788.469924][T25785] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:18 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x6}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  788.650713][T25793] netlink: 1551 bytes leftover after parsing attributes in process `syz-executor.5'.
18:35:18 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x7}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  789.035687][T25800] xt_hashlimit: max too large, truncated to 1048576
[  789.042662][T25800] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:19 executing program 3:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

18:35:19 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast2, @in6=@mcast2}, {@in6=@empty, 0x0, 0x32}, @in6=@empty, {}, {}, {}, 0x0, 0x0, 0x2, 0x4, 0x0, 0x64}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0)

18:35:19 executing program 5:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet(0x10, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x24}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="330600002e"], 0x2}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x84ffe2, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

[  789.706795][T25816] xt_hashlimit: max too large, truncated to 1048576
[  789.713704][T25816] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:19 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x8}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:19 executing program 1:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

[  790.077929][T25828] netlink: 1551 bytes leftover after parsing attributes in process `syz-executor.5'.
18:35:19 executing program 2:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x81, 0xa8a1}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0)
setrlimit(0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000180))
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x1cb9a15322083ae0)
lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000200)=@md5={0x1, "718fd25bf1be8b849190cff330582a1a"}, 0x11, 0x5)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket$inet6(0xa, 0x803, 0x2)
connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x40000}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1000004000}, 0x0, 0x0, 0x80000000000001, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0x2, @in6=@empty, 0x3506, 0x4, 0x2, 0x1}}, 0xe8)
sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0)

[  790.298450][T25835] xt_hashlimit: max too large, truncated to 1048576
[  790.305814][T25835] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:20 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x9}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:20 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast2, @in6=@mcast2}, {@in6=@empty, 0x0, 0x32}, @in6=@empty, {}, {}, {}, 0x0, 0x0, 0x2, 0x4, 0x0, 0x64}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0)

[  790.792698][T25846] xt_hashlimit: max too large, truncated to 1048576
[  790.799728][T25846] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:20 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xa}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:20 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000800), 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000003c0)=[@enter_looper, @request_death={0x630b}], 0x0, 0x0, 0x0})

18:35:20 executing program 5:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet(0x10, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x24}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="330600002e"], 0x2}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x84ffe2, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0)

[  791.292644][T25854] xt_hashlimit: max too large, truncated to 1048576
[  791.299571][T25854] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:21 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast2, @in6=@mcast2}, {@in6=@empty, 0x0, 0x32}, @in6=@empty, {}, {}, {}, 0x0, 0x0, 0x2, 0x4, 0x0, 0x64}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0)

18:35:21 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xb}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:21 executing program 1:
r0 = getpgrp(0xffffffffffffffff)
prctl$PR_SET_PTRACER(0x59616d61, r0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
r2 = creat(&(0x7f0000000300)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000100)=<r3=>0x0)
io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x200a00}])
ptrace$setopts(0x4206, r1, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
tkill(r1, 0x2)
wait4(0xffffffffffffffff, 0x0, 0x0, 0x0)

[  791.425709][T25860] binder: 25855:25860 unknown command 0
[  791.431394][T25860] binder: 25855:25860 ioctl c0306201 20000100 returned -22
[  791.537987][T25863] binder: 25855:25863 unknown command 0
[  791.544010][T25863] binder: 25855:25863 ioctl c0306201 20000100 returned -22
18:35:21 executing program 2:
r0 = eventfd(0xd549)
write$eventfd(r0, &(0x7f0000000040)=0xffffffffffffbff9, 0x8)
read$eventfd(r0, &(0x7f0000000000), 0x8)

[  791.608025][T25864] netlink: 1551 bytes leftover after parsing attributes in process `syz-executor.5'.
[  791.710040][T25869] xt_hashlimit: max too large, truncated to 1048576
[  791.716969][T25869] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:21 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xc}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:21 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000800), 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000003c0)=[@enter_looper, @request_death={0x630b}], 0x0, 0x0, 0x0})

18:35:21 executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0xa)
bind$rxrpc(r0, &(0x7f00000000c0)=@in6={0x21, 0x0, 0x2, 0x1c, {0x2, 0x0, 0x0, @loopback}}, 0x24)

18:35:21 executing program 2:
r0 = eventfd(0xd549)
write$eventfd(r0, &(0x7f0000000040)=0xffffffffffffbff9, 0x8)
read$eventfd(r0, &(0x7f0000000000), 0x8)

18:35:21 executing program 1:
r0 = getpgrp(0xffffffffffffffff)
prctl$PR_SET_PTRACER(0x59616d61, r0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
r2 = creat(&(0x7f0000000300)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000100)=<r3=>0x0)
io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x200a00}])
ptrace$setopts(0x4206, r1, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
tkill(r1, 0x2)
wait4(0xffffffffffffffff, 0x0, 0x0, 0x0)

[  792.215669][T25884] xt_hashlimit: max too large, truncated to 1048576
[  792.222630][T25884] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:21 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xd}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  792.281757][T25886] binder: 25883:25886 unknown command 0
[  792.287844][T25886] binder: 25883:25886 ioctl c0306201 20000100 returned -22
18:35:22 executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0xa)
bind$rxrpc(r0, &(0x7f00000000c0)=@in6={0x21, 0x0, 0x2, 0x1c, {0x2, 0x0, 0x0, @loopback}}, 0x24)

18:35:22 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000800), 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000003c0)=[@enter_looper, @request_death={0x630b}], 0x0, 0x0, 0x0})

[  792.633593][T25898] xt_hashlimit: max too large, truncated to 1048576
[  792.640418][T25898] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:22 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xe}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:22 executing program 5:
r0 = getpgrp(0xffffffffffffffff)
prctl$PR_SET_PTRACER(0x59616d61, r0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
r2 = creat(&(0x7f0000000300)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000100)=<r3=>0x0)
io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x200a00}])
ptrace$setopts(0x4206, r1, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
tkill(r1, 0x2)
wait4(0xffffffffffffffff, 0x0, 0x0, 0x0)

18:35:22 executing program 2:
r0 = eventfd(0xd549)
write$eventfd(r0, &(0x7f0000000040)=0xffffffffffffbff9, 0x8)
read$eventfd(r0, &(0x7f0000000000), 0x8)

[  792.996999][T25909] binder: 25907:25909 unknown command 0
[  792.998034][T25911] xt_hashlimit: max too large, truncated to 1048576
[  793.002743][T25909] binder: 25907:25909 ioctl c0306201 20000100 returned -22
[  793.016907][T25911] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:22 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x10}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:22 executing program 5:
r0 = getpgrp(0xffffffffffffffff)
prctl$PR_SET_PTRACER(0x59616d61, r0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
r2 = creat(&(0x7f0000000300)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000100)=<r3=>0x0)
io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x200a00}])
ptrace$setopts(0x4206, r1, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
tkill(r1, 0x2)
wait4(0xffffffffffffffff, 0x0, 0x0, 0x0)

18:35:22 executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0xa)
bind$rxrpc(r0, &(0x7f00000000c0)=@in6={0x21, 0x0, 0x2, 0x1c, {0x2, 0x0, 0x0, @loopback}}, 0x24)

18:35:22 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000800), 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000003c0)=[@enter_looper, @request_death={0x630b}], 0x0, 0x0, 0x0})

18:35:23 executing program 2:
r0 = eventfd(0xd549)
write$eventfd(r0, &(0x7f0000000040)=0xffffffffffffbff9, 0x8)
read$eventfd(r0, &(0x7f0000000000), 0x8)

[  793.440211][T25922] xt_hashlimit: max too large, truncated to 1048576
[  793.447203][T25922] xt_hashlimit: overflow, try lower: 1711341568/0
[  793.606759][T25931] binder: 25929:25931 unknown command 0
[  793.612466][T25931] binder: 25929:25931 ioctl c0306201 20000100 returned -22
18:35:25 executing program 1:
r0 = getpgrp(0xffffffffffffffff)
prctl$PR_SET_PTRACER(0x59616d61, r0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
r2 = creat(&(0x7f0000000300)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000100)=<r3=>0x0)
io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x200a00}])
ptrace$setopts(0x4206, r1, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
tkill(r1, 0x2)
wait4(0xffffffffffffffff, 0x0, 0x0, 0x0)

18:35:25 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x11}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:25 executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0xa)
bind$rxrpc(r0, &(0x7f00000000c0)=@in6={0x21, 0x0, 0x2, 0x1c, {0x2, 0x0, 0x0, @loopback}}, 0x24)

18:35:25 executing program 2:
r0 = eventfd(0xd549)
write$eventfd(r0, &(0x7f0000000040)=0xffffffffffffbff9, 0x8)
read$eventfd(r0, &(0x7f0000000000), 0x8)

18:35:25 executing program 3:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f00000000c0))

[  795.692286][T25945] xt_hashlimit: max too large, truncated to 1048576
[  795.699311][T25945] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:25 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x12}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:25 executing program 0:
r0 = semget$private(0x0, 0x3, 0x0)
semtimedop(r0, &(0x7f0000000040)=[{0x2, 0x9}, {0x0, 0x7fff}, {0x0, 0x0, 0x1000}], 0x3, 0x0)
semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x7f])

18:35:25 executing program 3:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f00000000c0))

[  796.113238][T25958] xt_hashlimit: max too large, truncated to 1048576
[  796.120056][T25958] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:26 executing program 5:
r0 = getpgrp(0xffffffffffffffff)
prctl$PR_SET_PTRACER(0x59616d61, r0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
r2 = creat(&(0x7f0000000300)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000100)=<r3=>0x0)
io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x200a00}])
ptrace$setopts(0x4206, r1, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
tkill(r1, 0x2)
wait4(0xffffffffffffffff, 0x0, 0x0, 0x0)

18:35:26 executing program 2:
r0 = eventfd(0xd549)
write$eventfd(r0, &(0x7f0000000040)=0xffffffffffffbff9, 0x8)
read$eventfd(r0, &(0x7f0000000000), 0x8)

18:35:26 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x19}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:26 executing program 3:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f00000000c0))

[  796.766785][T25976] xt_hashlimit: max too large, truncated to 1048576
[  796.773675][T25976] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:28 executing program 1:
r0 = getpgrp(0xffffffffffffffff)
prctl$PR_SET_PTRACER(0x59616d61, r0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
r2 = creat(&(0x7f0000000300)='./bus\x00', 0x0)
io_setup(0x81, &(0x7f0000000100)=<r3=>0x0)
io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x200a00}])
ptrace$setopts(0x4206, r1, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0)
tkill(r1, 0x2)
wait4(0xffffffffffffffff, 0x0, 0x0, 0x0)

18:35:28 executing program 0:
r0 = semget$private(0x0, 0x3, 0x0)
semtimedop(r0, &(0x7f0000000040)=[{0x2, 0x9}, {0x0, 0x7fff}, {0x0, 0x0, 0x1000}], 0x3, 0x0)
semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x7f])

18:35:28 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x1a}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:28 executing program 3:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f00000000c0))

18:35:28 executing program 2:
r0 = eventfd(0xd549)
write$eventfd(r0, &(0x7f0000000040)=0xffffffffffffbff9, 0x8)
read$eventfd(r0, &(0x7f0000000000), 0x8)

[  799.120767][T25994] xt_hashlimit: max too large, truncated to 1048576
[  799.127925][T25994] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:28 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x25}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:29 executing program 3:
r0 = semget$private(0x0, 0x3, 0x0)
semtimedop(r0, &(0x7f0000000040)=[{0x2, 0x9}, {0x0, 0x7fff}, {0x0, 0x0, 0x1000}], 0x3, 0x0)
semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x7f])

18:35:29 executing program 2:
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000500)={&(0x7f0000000780)={0x90, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x67, 0x33, @probe_response={@with_ht={{{}, {}, @device_b, @device_a, @from_mac}}, 0x0, @random, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @val={0x3, 0x1}, @val={0x4, 0x6}, @val={0x6, 0x2}, @val={0x2d, 0x1a}, @val={0x72, 0x6}, @void}}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x971}], @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}]}, 0x90}}, 0x0)

[  799.486551][T26008] xt_hashlimit: max too large, truncated to 1048576
[  799.493507][T26008] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:29 executing program 3:
r0 = semget$private(0x0, 0x3, 0x0)
semtimedop(r0, &(0x7f0000000040)=[{0x2, 0x9}, {0x0, 0x7fff}, {0x0, 0x0, 0x1000}], 0x3, 0x0)
semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x7f])

18:35:29 executing program 0:
r0 = semget$private(0x0, 0x3, 0x0)
semtimedop(r0, &(0x7f0000000040)=[{0x2, 0x9}, {0x0, 0x7fff}, {0x0, 0x0, 0x1000}], 0x3, 0x0)
semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x7f])

18:35:29 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x48}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:29 executing program 2:
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000500)={&(0x7f0000000780)={0x90, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x67, 0x33, @probe_response={@with_ht={{{}, {}, @device_b, @device_a, @from_mac}}, 0x0, @random, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @val={0x3, 0x1}, @val={0x4, 0x6}, @val={0x6, 0x2}, @val={0x2d, 0x1a}, @val={0x72, 0x6}, @void}}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x971}], @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}]}, 0x90}}, 0x0)

[  800.254084][T26029] xt_hashlimit: max too large, truncated to 1048576
[  800.260863][T26029] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:31 executing program 2:
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000500)={&(0x7f0000000780)={0x90, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x67, 0x33, @probe_response={@with_ht={{{}, {}, @device_b, @device_a, @from_mac}}, 0x0, @random, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @val={0x3, 0x1}, @val={0x4, 0x6}, @val={0x6, 0x2}, @val={0x2d, 0x1a}, @val={0x72, 0x6}, @void}}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x971}], @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}]}, 0x90}}, 0x0)

18:35:31 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file1\x00')
mknod$loop(&(0x7f00000002c0)='./file0\x00', 0x6000, 0x1)
mknod$loop(&(0x7f0000000040)='./file1\x00', 0x0, 0x0)

18:35:31 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x4c}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:31 executing program 5:
r0 = syz_open_dev$vbi(&(0x7f0000000180), 0x3, 0x2)
ioctl$VIDIOC_S_PARM(r0, 0xc0205649, &(0x7f0000000240)={0xf010000, @output={0x0, 0x0, {0xff000000}}})

18:35:31 executing program 3:
r0 = semget$private(0x0, 0x3, 0x0)
semtimedop(r0, &(0x7f0000000040)=[{0x2, 0x9}, {0x0, 0x7fff}, {0x0, 0x0, 0x1000}], 0x3, 0x0)
semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x7f])

18:35:31 executing program 0:
r0 = semget$private(0x0, 0x3, 0x0)
semtimedop(r0, &(0x7f0000000040)=[{0x2, 0x9}, {0x0, 0x7fff}, {0x0, 0x0, 0x1000}], 0x3, 0x0)
semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x7f])

[  802.497080][T26054] xt_hashlimit: max too large, truncated to 1048576
[  802.504116][T26054] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:32 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x60}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:32 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0)

18:35:32 executing program 2:
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000500)={&(0x7f0000000780)={0x90, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x67, 0x33, @probe_response={@with_ht={{{}, {}, @device_b, @device_a, @from_mac}}, 0x0, @random, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @val={0x3, 0x1}, @val={0x4, 0x6}, @val={0x6, 0x2}, @val={0x2d, 0x1a}, @val={0x72, 0x6}, @void}}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x971}], @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}]}, 0x90}}, 0x0)

18:35:32 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f715134d82ce9c0952d6441576", 0x56}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x34)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x9, r0, 0x0, 0x0)

18:35:32 executing program 5:
r0 = syz_open_dev$vbi(&(0x7f0000000180), 0x3, 0x2)
ioctl$VIDIOC_S_PARM(r0, 0xc0205649, &(0x7f0000000240)={0xf010000, @output={0x0, 0x0, {0xff000000}}})

18:35:32 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x68}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  802.908906][T26063] xt_hashlimit: max too large, truncated to 1048576
[  802.915882][T26063] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:32 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file1\x00')
mknod$loop(&(0x7f00000002c0)='./file0\x00', 0x6000, 0x1)
mknod$loop(&(0x7f0000000040)='./file1\x00', 0x0, 0x0)

[  803.183162][T26081] xt_hashlimit: max too large, truncated to 1048576
[  803.190139][T26081] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:32 executing program 5:
r0 = syz_open_dev$vbi(&(0x7f0000000180), 0x3, 0x2)
ioctl$VIDIOC_S_PARM(r0, 0xc0205649, &(0x7f0000000240)={0xf010000, @output={0x0, 0x0, {0xff000000}}})

18:35:32 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x6c}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:32 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0)

18:35:33 executing program 2:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
sendto$inet(r0, &(0x7f0000000100)="e8", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
shutdown(r0, 0x1)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x1a, &(0x7f00000000c0), &(0x7f0000000000)=0x8)

18:35:33 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x74}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  803.546432][T26090] xt_hashlimit: max too large, truncated to 1048576
[  803.553621][T26090] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:33 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file1\x00')
mknod$loop(&(0x7f00000002c0)='./file0\x00', 0x6000, 0x1)
mknod$loop(&(0x7f0000000040)='./file1\x00', 0x0, 0x0)

18:35:33 executing program 5:
r0 = syz_open_dev$vbi(&(0x7f0000000180), 0x3, 0x2)
ioctl$VIDIOC_S_PARM(r0, 0xc0205649, &(0x7f0000000240)={0xf010000, @output={0x0, 0x0, {0xff000000}}})

18:35:33 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0)

[  803.876535][T26104] xt_hashlimit: max too large, truncated to 1048576
[  803.883592][T26104] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:35 executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
sendto$inet(r0, &(0x7f0000000100)="e8", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
shutdown(r0, 0x1)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x1a, &(0x7f00000000c0), &(0x7f0000000000)=0x8)

18:35:35 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x7a}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:35 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)='./file1\x00')
mknod$loop(&(0x7f00000002c0)='./file0\x00', 0x6000, 0x1)
mknod$loop(&(0x7f0000000040)='./file1\x00', 0x0, 0x0)

18:35:35 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a000000060001"], 0x1c}}, 0x0)

18:35:35 executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0)

18:35:35 executing program 2:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
sendto$inet(r0, &(0x7f0000000100)="e8", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
shutdown(r0, 0x1)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x1a, &(0x7f00000000c0), &(0x7f0000000000)=0x8)

18:35:35 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x158}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  806.137879][T26133] xt_hashlimit: max too large, truncated to 1048576
[  806.144942][T26133] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:35 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a000000060001"], 0x1c}}, 0x0)

18:35:36 executing program 0:
perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x101910b00, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev, 0x0, 0x40002, 'rr\x00'}, 0x2c)
mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000))
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

18:35:36 executing program 1:
socket$vsock_stream(0x28, 0x1, 0x0)

18:35:36 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x228}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  806.571984][T26150] xt_hashlimit: max too large, truncated to 1048576
[  806.582501][T26150] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:36 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a000000060001"], 0x1c}}, 0x0)

[  806.908021][T26163] xt_hashlimit: max too large, truncated to 1048576
[  806.915232][T26163] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:37 executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
sendto$inet(r0, &(0x7f0000000100)="e8", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
shutdown(r0, 0x1)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x1a, &(0x7f00000000c0), &(0x7f0000000000)=0x8)

18:35:37 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x300}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:37 executing program 0:
perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x101910b00, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev, 0x0, 0x40002, 'rr\x00'}, 0x2c)
mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000))
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

18:35:37 executing program 1:
perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x101910b00, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev, 0x0, 0x40002, 'rr\x00'}, 0x2c)
mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000))
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

18:35:37 executing program 2:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
sendto$inet(r0, &(0x7f0000000100)="e8", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
shutdown(r0, 0x1)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x1a, &(0x7f00000000c0), &(0x7f0000000000)=0x8)

18:35:37 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0)
preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a000000060001"], 0x1c}}, 0x0)

18:35:37 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x3e0}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  807.496111][T26173] xt_hashlimit: max too large, truncated to 1048576
[  807.504388][T26173] xt_hashlimit: overflow, try lower: 1711341568/0
[  807.827541][T26195] xt_hashlimit: max too large, truncated to 1048576
[  807.834722][T26195] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:37 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x500}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:37 executing program 5:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f715134d82ce9c0952d644157684e3dae491de7642a7c52cc2d5", 0x63}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x5)
tkill(r0, 0x3a)
ptrace$cont(0x18, r0, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000400)="4dc3", 0x2}], 0xffffffffffffffe}, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
exit_group(0x0)

18:35:37 executing program 1:
perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x101910b00, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev, 0x0, 0x40002, 'rr\x00'}, 0x2c)
mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000))
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

18:35:37 executing program 0:
perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x101910b00, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev, 0x0, 0x40002, 'rr\x00'}, 0x2c)
mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000))
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

[  808.213304][T26206] xt_hashlimit: max too large, truncated to 1048576
[  808.221424][T26206] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:37 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x600}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  808.690722][T26224] xt_hashlimit: max too large, truncated to 1048576
[  808.697674][T26224] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:38 executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
sendto$inet(r0, &(0x7f0000000100)="e8", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
shutdown(r0, 0x1)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x1a, &(0x7f00000000c0), &(0x7f0000000000)=0x8)

18:35:38 executing program 2:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
sendto$inet(r0, &(0x7f0000000100)="e8", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
shutdown(r0, 0x1)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x1a, &(0x7f00000000c0), &(0x7f0000000000)=0x8)

18:35:38 executing program 5:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f715134d82ce9c0952d644157684e3dae491de7642a7c52cc2d5", 0x63}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x5)
tkill(r0, 0x3a)
ptrace$cont(0x18, r0, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000400)="4dc3", 0x2}], 0xffffffffffffffe}, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
exit_group(0x0)

18:35:38 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x700}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:38 executing program 1:
perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x101910b00, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev, 0x0, 0x40002, 'rr\x00'}, 0x2c)
mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000))
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

18:35:38 executing program 0:
perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
clone(0x101910b00, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev, 0x0, 0x40002, 'rr\x00'}, 0x2c)
mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000))
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

18:35:38 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x900}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  809.086697][T26237] xt_hashlimit: max too large, truncated to 1048576
[  809.093549][T26237] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:38 executing program 5:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f715134d82ce9c0952d644157684e3dae491de7642a7c52cc2d5", 0x63}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x5)
tkill(r0, 0x3a)
ptrace$cont(0x18, r0, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000400)="4dc3", 0x2}], 0xffffffffffffffe}, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
exit_group(0x0)

[  809.430054][T26258] xt_hashlimit: max too large, truncated to 1048576
[  809.437390][T26258] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:39 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xa00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:39 executing program 1:
socket(0x2, 0xa, 0x0)

18:35:39 executing program 5:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f715134d82ce9c0952d644157684e3dae491de7642a7c52cc2d5", 0x63}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x5)
tkill(r0, 0x3a)
ptrace$cont(0x18, r0, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000400)="4dc3", 0x2}], 0xffffffffffffffe}, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
exit_group(0x0)

18:35:39 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001c40)={&(0x7f0000000340)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x6000}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback={0xfec0ffff00000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @dev}}]}, 0x5c}}, 0x0)

[  809.853556][T26268] xt_hashlimit: max too large, truncated to 1048576
[  809.863644][T26268] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:39 executing program 1:
socket(0x2, 0xa, 0x0)

18:35:39 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xb00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:39 executing program 2:
unshare(0x24000400)
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff})
fremovexattr(r0, 0x0)

18:35:39 executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000240ac05438240000000000109022400010000002009040000fd0301000009210000000022010009058103"], 0x0)

18:35:39 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001c40)={&(0x7f0000000340)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x6000}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback={0xfec0ffff00000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @dev}}]}, 0x5c}}, 0x0)

18:35:40 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000540)="bfeb8cb2a5f80ebb778b1da8fe34b90ecb94b631ddb9a821ed16a88abe93fc908ce60e79e0", 0x25}], 0x1}, 0x0)
read$alg(r1, &(0x7f00000005c0)=""/4096, 0x1000)

[  810.378384][T26283] xt_hashlimit: max too large, truncated to 1048576
[  810.385549][T26283] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:40 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xb27}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:40 executing program 2:
unshare(0x24000400)
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff})
fremovexattr(r0, 0x0)

18:35:40 executing program 1:
socket(0x2, 0xa, 0x0)

[  810.759632][T26302] xt_hashlimit: max too large, truncated to 1048576
[  810.767039][T26302] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:40 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xb28}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  810.846725][    T5] usb 4-1: new high-speed USB device number 2 using dummy_hcd
18:35:40 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001c40)={&(0x7f0000000340)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x6000}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback={0xfec0ffff00000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @dev}}]}, 0x5c}}, 0x0)

18:35:40 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000540)="bfeb8cb2a5f80ebb778b1da8fe34b90ecb94b631ddb9a821ed16a88abe93fc908ce60e79e0", 0x25}], 0x1}, 0x0)
read$alg(r1, &(0x7f00000005c0)=""/4096, 0x1000)

18:35:40 executing program 1:
socket(0x2, 0xa, 0x0)

[  811.201407][T26316] xt_hashlimit: max too large, truncated to 1048576
[  811.208611][T26316] xt_hashlimit: overflow, try lower: 1711341568/0
[  811.222427][    T5] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30
[  811.234042][    T5] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
18:35:40 executing program 2:
unshare(0x24000400)
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff})
fremovexattr(r0, 0x0)

[  811.245335][    T5] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  811.247682][T26318] xt_hashlimit: max too large, truncated to 1048576
[  811.255444][    T5] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253
[  811.262060][T26318] xt_hashlimit: overflow, try lower: 1711341568/0
[  811.281814][    T5] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40
[  811.292223][    T5] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  811.354076][    T5] usb 4-1: config 0 descriptor??
18:35:41 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001c40)={&(0x7f0000000340)={0x5c, r1, 0x917, 0x0, 0x0, {0x1, 0x0, 0x6000}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback={0xfec0ffff00000000}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @dev}}]}, 0x5c}}, 0x0)

[  811.404157][    T5] usbhid 4-1:0.0: can't add hid device: -22
[  811.410591][    T5] usbhid: probe of 4-1:0.0 failed with error -22
[  811.602228][    T5] usb 4-1: USB disconnect, device number 2
[  812.403357][ T8447] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[  812.813286][ T8447] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30
[  812.825493][ T8447] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  812.837003][ T8447] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  812.846990][ T8447] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253
[  812.860303][ T8447] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40
[  812.869593][ T8447] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  812.971721][ T8447] usb 4-1: config 0 descriptor??
[  813.024428][ T8447] usbhid 4-1:0.0: can't add hid device: -22
[  813.032066][ T8447] usbhid: probe of 4-1:0.0 failed with error -22
[  813.245031][ T8447] usb 4-1: USB disconnect, device number 3
18:35:42 executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000240ac05438240000000000109022400010000002009040000fd0301000009210000000022010009058103"], 0x0)

18:35:42 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

18:35:42 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xc00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:42 executing program 2:
unshare(0x24000400)
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff})
fremovexattr(r0, 0x0)

18:35:42 executing program 0:
syz_emit_ethernet(0x7a, &(0x7f0000000780)={@link_local, @random="d2634d83cdbe", @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "07c251", 0x44, 0x2f, 0x0, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}}}}}}, 0x0)

18:35:42 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000540)="bfeb8cb2a5f80ebb778b1da8fe34b90ecb94b631ddb9a821ed16a88abe93fc908ce60e79e0", 0x25}], 0x1}, 0x0)
read$alg(r1, &(0x7f00000005c0)=""/4096, 0x1000)

[  813.437671][T26358] xt_hashlimit: max too large, truncated to 1048576
[  813.445949][T26358] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:43 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xd00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:43 executing program 2:
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8000000000010b04000000000000000002000000240001801400018008000100ac141400080002007f0020010c00028005000100000000001c001080080003974600000008000140150000000800024000000000240002801400018008000100ac9414bb08000200000000000c0002800500010000000000080007"], 0x80}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0)

18:35:43 executing program 0:
syz_emit_ethernet(0x7a, &(0x7f0000000780)={@link_local, @random="d2634d83cdbe", @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "07c251", 0x44, 0x2f, 0x0, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}}}}}}, 0x0)

[  813.943229][T26376] xt_hashlimit: max too large, truncated to 1048576
[  813.950063][T26376] xt_hashlimit: overflow, try lower: 1711341568/0
[  813.963391][ T8447] usb 4-1: new high-speed USB device number 4 using dummy_hcd
18:35:43 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xe00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  814.325136][ T8447] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30
[  814.336487][ T8447] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  814.347779][ T8447] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  814.357795][ T8447] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253
[  814.372167][ T8447] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40
[  814.381681][ T8447] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  814.489198][T26388] xt_hashlimit: max too large, truncated to 1048576
[  814.496575][T26388] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:44 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r1 = accept$alg(r0, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000540)="bfeb8cb2a5f80ebb778b1da8fe34b90ecb94b631ddb9a821ed16a88abe93fc908ce60e79e0", 0x25}], 0x1}, 0x0)
read$alg(r1, &(0x7f00000005c0)=""/4096, 0x1000)

18:35:44 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x1100}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  814.704215][ T8447] usb 4-1: config 0 descriptor??
[  814.774958][ T8447] usbhid 4-1:0.0: can't add hid device: -22
[  814.781262][ T8447] usbhid: probe of 4-1:0.0 failed with error -22
[  814.897822][T26399] xt_hashlimit: max too large, truncated to 1048576
[  814.904977][T26399] xt_hashlimit: overflow, try lower: 1711341568/0
[  814.987408][T14515] usb 4-1: USB disconnect, device number 4
18:35:45 executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000240ac05438240000000000109022400010000002009040000fd0301000009210000000022010009058103"], 0x0)

18:35:45 executing program 0:
syz_emit_ethernet(0x7a, &(0x7f0000000780)={@link_local, @random="d2634d83cdbe", @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "07c251", 0x44, 0x2f, 0x0, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}}}}}}, 0x0)

18:35:45 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x1200}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:45 executing program 2:
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8000000000010b04000000000000000002000000240001801400018008000100ac141400080002007f0020010c00028005000100000000001c001080080003974600000008000140150000000800024000000000240002801400018008000100ac9414bb08000200000000000c0002800500010000000000080007"], 0x80}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0)

18:35:45 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

[  815.731155][T26415] xt_hashlimit: max too large, truncated to 1048576
[  815.738089][T26415] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:45 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

18:35:45 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x1900}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  815.989959][T26425] xt_hashlimit: max too large, truncated to 1048576
[  815.996989][T26425] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:45 executing program 0:
syz_emit_ethernet(0x7a, &(0x7f0000000780)={@link_local, @random="d2634d83cdbe", @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "07c251", 0x44, 0x2f, 0x0, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}}}}}}, 0x0)

18:35:45 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x1a00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  816.163674][ T9214] usb 4-1: new high-speed USB device number 5 using dummy_hcd
18:35:46 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x2000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  816.462729][T26437] xt_hashlimit: max too large, truncated to 1048576
[  816.469765][T26437] xt_hashlimit: overflow, try lower: 1711341568/0
[  816.524826][ T9214] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30
[  816.536024][ T9214] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  816.547235][ T9214] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  816.557339][ T9214] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253
[  816.570603][ T9214] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40
[  816.580838][ T9214] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
18:35:46 executing program 2:
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8000000000010b04000000000000000002000000240001801400018008000100ac141400080002007f0020010c00028005000100000000001c001080080003974600000008000140150000000800024000000000240002801400018008000100ac9414bb08000200000000000c0002800500010000000000080007"], 0x80}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0)

18:35:46 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

[  817.050709][T26439] xt_hashlimit: max too large, truncated to 1048576
[  817.057911][T26439] xt_hashlimit: overflow, try lower: 1711341568/0
[  817.058003][ T3127] ieee802154 phy0 wpan0: encryption failed: -22
[  817.071046][ T3127] ieee802154 phy1 wpan1: encryption failed: -22
[  817.090302][ T9214] usb 4-1: config 0 descriptor??
[  817.164466][ T9214] usbhid 4-1:0.0: can't add hid device: -22
[  817.170777][ T9214] usbhid: probe of 4-1:0.0 failed with error -22
[  817.377695][    T5] usb 4-1: USB disconnect, device number 5
18:35:47 executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000240ac05438240000000000109022400010000002009040000fd0301000009210000000022010009058103"], 0x0)

18:35:47 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x2500}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  818.394449][T26458] xt_hashlimit: max too large, truncated to 1048576
[  818.401241][T26458] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:48 executing program 2:
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8000000000010b04000000000000000002000000240001801400018008000100ac141400080002007f0020010c00028005000100000000001c001080080003974600000008000140150000000800024000000000240002801400018008000100ac9414bb08000200000000000c0002800500010000000000080007"], 0x80}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0)

18:35:48 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x270b}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  818.862432][T26469] xt_hashlimit: max too large, truncated to 1048576
[  818.872444][T26469] xt_hashlimit: overflow, try lower: 1711341568/0
[  818.893527][T26341] usb 4-1: new high-speed USB device number 6 using dummy_hcd
18:35:48 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

[  819.254530][T26341] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30
[  819.265696][T26341] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  819.278229][T26341] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  819.288446][T26341] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253
[  819.301837][T26341] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.40
[  819.311271][T26341] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  819.344313][T26341] usb 4-1: config 0 descriptor??
18:35:49 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

18:35:49 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x2802}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  819.390985][T26341] usbhid 4-1:0.0: can't add hid device: -22
[  819.397870][T26341] usbhid: probe of 4-1:0.0 failed with error -22
[  819.572745][T26480] xt_hashlimit: max too large, truncated to 1048576
[  819.579703][T26480] xt_hashlimit: overflow, try lower: 1711341568/0
[  819.630175][   T18] usb 4-1: USB disconnect, device number 6
18:35:49 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x280b}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:49 executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x4c}}, 0x0)

[  820.047485][T26492] xt_hashlimit: max too large, truncated to 1048576
[  820.054444][T26492] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:49 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x4800}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:49 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

18:35:50 executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x4c}}, 0x0)

[  820.572127][T26502] xt_hashlimit: max too large, truncated to 1048576
[  820.579195][T26502] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:50 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x4c00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:50 executing program 3:
r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc02864ca, &(0x7f0000000800)={0x0, 0x0})

[  821.141052][T26510] xt_hashlimit: max too large, truncated to 1048576
[  821.148040][T26510] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:50 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x5801}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:50 executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x4c}}, 0x0)

[  821.661049][T26520] xt_hashlimit: max too large, truncated to 1048576
[  821.668314][T26520] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:52 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

18:35:52 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

18:35:52 executing program 3:
r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc02864ca, &(0x7f0000000800)={0x0, 0x0})

18:35:52 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x6000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:52 executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x4c}}, 0x0)

[  822.909754][T26532] xt_hashlimit: max too large, truncated to 1048576
[  822.916778][T26532] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:52 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x6800}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  823.368283][T26541] xt_hashlimit: max too large, truncated to 1048576
[  823.378408][T26541] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:53 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000300)={@multicast1, @local}, 0xc)
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast1, @local, 0x1, 0x1, [@local]}, 0x14)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x80000e0, 0x0)

18:35:53 executing program 3:
r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc02864ca, &(0x7f0000000800)={0x0, 0x0})

18:35:53 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@getneightbl={0x14, 0x42, 0x201}, 0x14}}, 0x0)
recvmmsg(r1, &(0x7f0000001b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000480)=""/4096, 0x15e0}], 0x1, 0x0, 0xffffffffffffffe2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0)

18:35:53 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x6c00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  823.762706][T26551] xt_hashlimit: max too large, truncated to 1048576
[  823.769731][T26551] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:53 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x7400}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:53 executing program 3:
r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc02864ca, &(0x7f0000000800)={0x0, 0x0})

[  824.318767][T26540] not chained 40000 origins
[  824.323321][T26540] CPU: 0 PID: 26540 Comm: syz-executor.5 Not tainted 5.12.0-rc6-syzkaller #0
[  824.332100][T26540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  824.342162][T26540] Call Trace:
[  824.345446][T26540]  dump_stack+0x24c/0x2e0
[  824.349803][T26540]  kmsan_internal_chain_origin+0x6f/0x130
[  824.355547][T26540]  ? kmsan_get_metadata+0x116/0x180
[  824.360764][T26540]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  824.366618][T26540]  ? __msan_metadata_ptr_for_load_8+0x10/0x20
[  824.372789][T26540]  ? kmsan_get_metadata+0x116/0x180
[  824.378000][T26540]  ? kmsan_internal_set_origin+0x85/0xc0
[  824.383646][T26540]  ? kmsan_internal_unpoison_shadow+0x42/0x70
[  824.389714][T26540]  ? kmsan_unpoison_shadow+0x74/0xa0
[  824.394999][T26540]  ? _copy_from_user+0x1fd/0x300
[  824.399937][T26540]  ? kmsan_get_metadata+0x116/0x180
[  824.405136][T26540]  __msan_chain_origin+0x54/0xa0
[  824.410072][T26540]  __copy_msghdr_from_user+0x4cf/0xc10
[  824.415533][T26540]  ? kmsan_get_metadata+0x116/0x180
[  824.420734][T26540]  __sys_sendmmsg+0x673/0x1010
[  824.425501][T26540]  ? __msan_metadata_ptr_for_load_4+0x10/0x20
[  824.431571][T26540]  ? kmsan_get_metadata+0x116/0x180
[  824.436772][T26540]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  824.442578][T26540]  ? __msan_metadata_ptr_for_store_1+0x13/0x20
[  824.448733][T26540]  ? kmsan_get_metadata+0x116/0x180
[  824.453929][T26540]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  824.459822][T26540]  ? kmsan_get_metadata+0x116/0x180
[  824.465017][T26540]  ? kmsan_get_metadata+0x116/0x180
[  824.470213][T26540]  ? kmsan_internal_set_origin+0x85/0xc0
[  824.475843][T26540]  ? kmsan_internal_unpoison_shadow+0x42/0x70
[  824.483387][T26540]  ? __msan_instrument_asm_store+0x107/0x130
[  824.489625][T26540]  ? kmsan_get_metadata+0x116/0x180
[  824.494832][T26540]  __se_sys_sendmmsg+0xbd/0xe0
[  824.499614][T26540]  __x64_sys_sendmmsg+0x56/0x70
[  824.504474][T26540]  do_syscall_64+0x9f/0x140
[  824.508997][T26540]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  824.514909][T26540] RIP: 0033:0x4665d9
[  824.518807][T26540] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  824.538419][T26540] RSP: 002b:00007f398d3aa188 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  824.546863][T26540] RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665d9
[  824.554834][T26540] RDX: 00000000080000e0 RSI: 0000000020007fc0 RDI: 0000000000000004
[  824.562886][T26540] RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
[  824.570860][T26540] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
[  824.578828][T26540] R13: 0000000000a9fb1f R14: 00007f398d3aa300 R15: 0000000000022000
[  824.586803][T26540] Uninit was stored to memory at:
[  824.591811][T26540]  kmsan_internal_chain_origin+0xad/0x130
[  824.597531][T26540]  __msan_chain_origin+0x54/0xa0
[  824.602477][T26540]  __copy_msghdr_from_user+0x4cf/0xc10
[  824.607934][T26540]  __sys_sendmmsg+0x673/0x1010
[  824.612696][T26540]  __se_sys_sendmmsg+0xbd/0xe0
[  824.617456][T26540]  __x64_sys_sendmmsg+0x56/0x70
[  824.622321][T26540]  do_syscall_64+0x9f/0x140
[  824.626823][T26540]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  824.632716][T26540] 
[  824.635024][T26540] Uninit was stored to memory at:
[  824.640027][T26540]  kmsan_internal_chain_origin+0xad/0x130
[  824.645742][T26540]  __msan_chain_origin+0x54/0xa0
[  824.650677][T26540]  __copy_msghdr_from_user+0x4cf/0xc10
[  824.656133][T26540]  __sys_sendmmsg+0x673/0x1010
[  824.660892][T26540]  __se_sys_sendmmsg+0xbd/0xe0
[  824.665653][T26540]  __x64_sys_sendmmsg+0x56/0x70
[  824.670503][T26540]  do_syscall_64+0x9f/0x140
[  824.675002][T26540]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  824.680894][T26540] 
[  824.683202][T26540] Uninit was stored to memory at:
[  824.688205][T26540]  kmsan_internal_chain_origin+0xad/0x130
[  824.693919][T26540]  __msan_chain_origin+0x54/0xa0
[  824.698850][T26540]  __copy_msghdr_from_user+0x4cf/0xc10
[  824.704305][T26540]  __sys_sendmmsg+0x673/0x1010
[  824.709066][T26540]  __se_sys_sendmmsg+0xbd/0xe0
[  824.713835][T26540]  __x64_sys_sendmmsg+0x56/0x70
[  824.718681][T26540]  do_syscall_64+0x9f/0x140
[  824.723182][T26540]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  824.729073][T26540] 
[  824.731381][T26540] Uninit was stored to memory at:
[  824.736383][T26540]  kmsan_internal_chain_origin+0xad/0x130
[  824.742102][T26540]  __msan_chain_origin+0x54/0xa0
[  824.747554][T26540]  __copy_msghdr_from_user+0x4cf/0xc10
[  824.753016][T26540]  __sys_sendmmsg+0x673/0x1010
[  824.757780][T26540]  __se_sys_sendmmsg+0xbd/0xe0
[  824.762541][T26540]  __x64_sys_sendmmsg+0x56/0x70
[  824.767393][T26540]  do_syscall_64+0x9f/0x140
[  824.771895][T26540]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  824.777783][T26540] 
[  824.780094][T26540] Uninit was stored to memory at:
[  824.785096][T26540]  kmsan_internal_chain_origin+0xad/0x130
[  824.790810][T26540]  __msan_chain_origin+0x54/0xa0
[  824.795740][T26540]  __copy_msghdr_from_user+0x4cf/0xc10
[  824.801199][T26540]  __sys_sendmmsg+0x673/0x1010
[  824.805961][T26540]  __se_sys_sendmmsg+0xbd/0xe0
[  824.810724][T26540]  __x64_sys_sendmmsg+0x56/0x70
[  824.815574][T26540]  do_syscall_64+0x9f/0x140
[  824.820077][T26540]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  824.825966][T26540] 
[  824.828282][T26540] Uninit was stored to memory at:
[  824.833293][T26540]  kmsan_internal_chain_origin+0xad/0x130
[  824.839025][T26540]  __msan_chain_origin+0x54/0xa0
[  824.843979][T26540]  __copy_msghdr_from_user+0x4cf/0xc10
[  824.849449][T26540]  __sys_sendmmsg+0x673/0x1010
[  824.854210][T26540]  __se_sys_sendmmsg+0xbd/0xe0
[  824.858973][T26540]  __x64_sys_sendmmsg+0x56/0x70
[  824.863825][T26540]  do_syscall_64+0x9f/0x140
[  824.868328][T26540]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  824.874220][T26540] 
[  824.876535][T26540] Uninit was stored to memory at:
[  824.881546][T26540]  kmsan_internal_chain_origin+0xad/0x130
[  824.887277][T26540]  __msan_chain_origin+0x54/0xa0
[  824.892215][T26540]  __copy_msghdr_from_user+0x4cf/0xc10
[  824.897679][T26540]  __sys_sendmmsg+0x673/0x1010
[  824.902448][T26540]  __se_sys_sendmmsg+0xbd/0xe0
[  824.907210][T26540]  __x64_sys_sendmmsg+0x56/0x70
[  824.912061][T26540]  do_syscall_64+0x9f/0x140
[  824.916565][T26540]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  824.922457][T26540] 
[  824.924769][T26540] Local variable ----msg_sys@__sys_sendmmsg created at:
[  824.931720][T26540]  __sys_sendmmsg+0xbd/0x1010
[  824.936399][T26540]  __sys_sendmmsg+0xbd/0x1010
[  825.049918][T26559] xt_hashlimit: max too large, truncated to 1048576
[  825.056899][T26559] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:55 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@getneightbl={0x14, 0x42, 0x201}, 0x14}}, 0x0)
recvmmsg(r1, &(0x7f0000001b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000480)=""/4096, 0x15e0}], 0x1, 0x0, 0xffffffffffffffe2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0)

18:35:55 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x7a00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:55 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@getneightbl={0x14, 0x42, 0x201}, 0x14}}, 0x0)
recvmmsg(r1, &(0x7f0000001b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000480)=""/4096, 0x15e0}], 0x1, 0x0, 0xffffffffffffffe2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0)

18:35:56 executing program 5:
r0 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0)
unshare(0x2a000400)
ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40044103, &(0x7f00000002c0))

18:35:56 executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', <r2=>0x0})
sendmmsg(r0, &(0x7f0000007740)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, r2}, 0x80, 0x0, 0x0, &(0x7f0000000100)=[{0x10, 0x1, 0x2}, {0x10}], 0x20}}], 0x1, 0x0)

[  826.495293][T26569] xt_hashlimit: max too large, truncated to 1048576
[  826.502124][T26569] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:56 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xe003}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  826.992586][T26580] xt_hashlimit: max too large, truncated to 1048576
[  826.999461][T26580] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:56 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xff00}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:56 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@getneightbl={0x14, 0x42, 0x201}, 0x14}}, 0x0)
recvmmsg(r1, &(0x7f0000001b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000480)=""/4096, 0x15e0}], 0x1, 0x0, 0xffffffffffffffe2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0)

18:35:56 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@getneightbl={0x14, 0x42, 0x201}, 0x14}}, 0x0)
recvmmsg(r1, &(0x7f0000001b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000480)=""/4096, 0x15e0}], 0x1, 0x0, 0xffffffffffffffe2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0)

18:35:56 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x7ffffff7ffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x89, &(0x7f0000000080)={0x0, 0xa502, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ee8000/0x1000)=nil, &(0x7f0000000000)=<r1=>0x0, &(0x7f0000000040)=<r2=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x450c, 0x0, 0x0, 0x0, 0x0)

18:35:56 executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', <r2=>0x0})
sendmmsg(r0, &(0x7f0000007740)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, r2}, 0x80, 0x0, 0x0, &(0x7f0000000100)=[{0x10, 0x1, 0x2}, {0x10}], 0x20}}], 0x1, 0x0)

18:35:56 executing program 5:
r0 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0)
unshare(0x2a000400)
ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40044103, &(0x7f00000002c0))

[  827.349605][T26592] xt_hashlimit: max too large, truncated to 1048576
[  827.356842][T26592] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:57 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x40000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:57 executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@getneightbl={0x14, 0x42, 0x201}, 0x14}}, 0x0)
recvmmsg(r1, &(0x7f0000001b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000480)=""/4096, 0x15e0}], 0x1, 0x0, 0xffffffffffffffe2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0)

18:35:57 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@getneightbl={0x14, 0x42, 0x201}, 0x14}}, 0x0)
recvmmsg(r1, &(0x7f0000001b80)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000480)=""/4096, 0x15e0}], 0x1, 0x0, 0xffffffffffffffe2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0)

[  827.769231][T26604] xt_hashlimit: max too large, truncated to 1048576
[  827.777493][T26604] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:57 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x100000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:57 executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', <r2=>0x0})
sendmmsg(r0, &(0x7f0000007740)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, r2}, 0x80, 0x0, 0x0, &(0x7f0000000100)=[{0x10, 0x1, 0x2}, {0x10}], 0x20}}], 0x1, 0x0)

18:35:57 executing program 5:
r0 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0)
unshare(0x2a000400)
ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40044103, &(0x7f00000002c0))

18:35:57 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x7ffffff7ffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x89, &(0x7f0000000080)={0x0, 0xa502, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ee8000/0x1000)=nil, &(0x7f0000000000)=<r1=>0x0, &(0x7f0000000040)=<r2=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x450c, 0x0, 0x0, 0x0, 0x0)

[  828.150917][T26620] xt_hashlimit: max too large, truncated to 1048576
[  828.158265][T26620] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:57 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:35:57 executing program 2:
symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00')
lremovexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='system.posix_acl_default\x00')

18:35:57 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xe0ffff}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:58 executing program 5:
r0 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0)
unshare(0x2a000400)
ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40044103, &(0x7f00000002c0))

18:35:58 executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
r1 = socket$packet(0x11, 0x2, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', <r2=>0x0})
sendmmsg(r0, &(0x7f0000007740)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, r2}, 0x80, 0x0, 0x0, &(0x7f0000000100)=[{0x10, 0x1, 0x2}, {0x10}], 0x20}}], 0x1, 0x0)

[  828.571379][T26635] xt_hashlimit: max too large, truncated to 1048576
[  828.578367][T26635] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x1000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:58 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x7ffffff7ffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x89, &(0x7f0000000080)={0x0, 0xa502, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ee8000/0x1000)=nil, &(0x7f0000000000)=<r1=>0x0, &(0x7f0000000040)=<r2=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x450c, 0x0, 0x0, 0x0, 0x0)

[  828.647247][T26634] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:35:58 executing program 2:
symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00')
lremovexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='system.posix_acl_default\x00')

[  828.750053][T26634] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  828.846166][T26634] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:35:58 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket(0x20000000000000a, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c)
getsockopt$sock_buf(r1, 0x1, 0x19, &(0x7f0000019780)=""/102400, &(0x7f0000000000)=0x19000)

[  829.005264][T26649] xt_hashlimit: max too large, truncated to 1048576
[  829.012090][T26649] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:58 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x2000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:58 executing program 1:
socket$inet6(0xa, 0x200000000003, 0x87)
syz_emit_ethernet(0x46, &(0x7f0000000180)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00/\x00', 0x10, 0x2b, 0x0, @empty, @local, {[@hopopts={0x87}], {0x0, 0x0, 0x8}}}}}}, 0x0)

[  829.284289][T26640] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:35:59 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x7ffffff7ffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x89, &(0x7f0000000080)={0x0, 0xa502, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ee8000/0x1000)=nil, &(0x7f0000000000)=<r1=>0x0, &(0x7f0000000040)=<r2=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_FSYNC={0x3, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x450c, 0x0, 0x0, 0x0, 0x0)

[  829.335627][T26634] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  829.500711][T26663] xt_hashlimit: max too large, truncated to 1048576
[  829.507639][T26663] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:59 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:35:59 executing program 2:
symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00')
lremovexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='system.posix_acl_default\x00')

18:35:59 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x3000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:59 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket(0x20000000000000a, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c)
getsockopt$sock_buf(r1, 0x1, 0x19, &(0x7f0000019780)=""/102400, &(0x7f0000000000)=0x19000)

18:35:59 executing program 1:
socket$inet6(0xa, 0x200000000003, 0x87)
syz_emit_ethernet(0x46, &(0x7f0000000180)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00/\x00', 0x10, 0x2b, 0x0, @empty, @local, {[@hopopts={0x87}], {0x0, 0x0, 0x8}}}}}}, 0x0)

[  829.852342][T26676] xt_hashlimit: max too large, truncated to 1048576
[  829.859485][T26676] xt_hashlimit: overflow, try lower: 1711341568/0
18:35:59 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x4000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:35:59 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket(0x20000000000000a, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c)
getsockopt$sock_buf(r1, 0x1, 0x19, &(0x7f0000019780)=""/102400, &(0x7f0000000000)=0x19000)

[  829.942161][T26678] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:35:59 executing program 2:
symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00')
lremovexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='system.posix_acl_default\x00')

[  830.035915][T26678] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  830.114672][T26683] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:35:59 executing program 1:
socket$inet6(0xa, 0x200000000003, 0x87)
syz_emit_ethernet(0x46, &(0x7f0000000180)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00/\x00', 0x10, 0x2b, 0x0, @empty, @local, {[@hopopts={0x87}], {0x0, 0x0, 0x8}}}}}}, 0x0)

18:35:59 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket(0x20000000000000a, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c)
getsockopt$sock_buf(r1, 0x1, 0x19, &(0x7f0000019780)=""/102400, &(0x7f0000000000)=0x19000)

[  830.276769][T26688] xt_hashlimit: max too large, truncated to 1048576
[  830.283735][T26688] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x5000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:00 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket(0x20000000000000a, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c)
getsockopt$sock_buf(r1, 0x1, 0x19, &(0x7f0000019780)=""/102400, &(0x7f0000000000)=0x19000)

18:36:00 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:36:00 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:36:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x6000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  830.746678][T26701] xt_hashlimit: max too large, truncated to 1048576
[  830.753900][T26701] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:00 executing program 1:
socket$inet6(0xa, 0x200000000003, 0x87)
syz_emit_ethernet(0x46, &(0x7f0000000180)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00/\x00', 0x10, 0x2b, 0x0, @empty, @local, {[@hopopts={0x87}], {0x0, 0x0, 0x8}}}}}}, 0x0)

18:36:00 executing program 5:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket(0x20000000000000a, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c)
getsockopt$sock_buf(r1, 0x1, 0x19, &(0x7f0000019780)=""/102400, &(0x7f0000000000)=0x19000)

[  830.945748][T26708] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  830.982507][T26710] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  831.040239][T26708] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  831.083905][T26710] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  831.114037][T26719] xt_hashlimit: max too large, truncated to 1048576
[  831.120842][T26719] xt_hashlimit: overflow, try lower: 1711341568/0
[  831.122257][T26711] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:00 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r0, 0x0)
preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0)
r1 = socket(0x20000000000000a, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c)
getsockopt$sock_buf(r1, 0x1, 0x19, &(0x7f0000019780)=""/102400, &(0x7f0000000000)=0x19000)

18:36:00 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x7000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  831.208556][T26723] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:00 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:36:01 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

[  831.543899][T26728] xt_hashlimit: max too large, truncated to 1048576
[  831.550704][T26728] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:01 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x8000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  831.652023][T26730] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  831.674404][ T8447] wlan1: authenticate with 08:02:11:00:00:00
[  831.681961][ T8447] wlan1: send auth to 08:02:11:00:00:00 (try 1/3)
[  831.747759][  T775] wlan1: authenticated
[  831.748572][T26730] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  831.752417][   T18] mac80211_hwsim hwsim15 wlan1: disabling HT/VHT/HE as WMM/QoS is not supported by the AP
[  831.787046][T26734] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:01 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

[  831.787890][  T775] wlan1: associate with 08:02:11:00:00:00 (try 1/3)
18:36:01 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

[  831.883240][T26739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  831.884603][T26738] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  831.921920][  T775] wlan1: RX AssocResp from 08:02:11:00:00:00 (capab=0x1 status=0 aid=1)
[  831.930952][  T775] wlan1: associated
18:36:01 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

[  831.957312][T26734] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.019215][T26741] xt_hashlimit: max too large, truncated to 1048576
[  832.026503][T26741] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:01 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x9000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  832.167941][T26748] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.197929][T26746] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.222200][T26750] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.260346][T26752] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.299652][T26753] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.310698][T26754] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.337838][T26752] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.393091][T26751] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.425968][T26756] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.443332][T26757] xt_hashlimit: max too large, truncated to 1048576
[  832.450122][T26757] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:02 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xa000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:02 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:36:02 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

[  832.688079][T26763] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.772398][T26767] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.785268][T26765] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.860212][T26769] xt_hashlimit: max too large, truncated to 1048576
[  832.867106][T26769] xt_hashlimit: overflow, try lower: 1711341568/0
[  832.867505][T26767] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  832.891126][T26771] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:02 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xb000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:02 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

[  832.980857][T26765] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  833.060063][    C0] =====================================================
[  833.067042][    C0] BUG: KMSAN: uninit-value in ieee80211_sta_tx_notify+0x3b1/0x920
[  833.074927][    C0] CPU: 0 PID: 775 Comm: kworker/u4:8 Not tainted 5.12.0-rc6-syzkaller #0
[  833.083339][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  833.093390][    C0] Workqueue: phy16 ieee80211_beacon_connection_loss_work
[  833.100423][    C0] Call Trace:
[  833.103694][    C0]  <IRQ>
[  833.106529][    C0]  dump_stack+0x24c/0x2e0
[  833.110870][    C0]  kmsan_report+0xfb/0x1e0
[  833.115288][    C0]  __msan_warning+0x5c/0xa0
[  833.119790][    C0]  ieee80211_sta_tx_notify+0x3b1/0x920
[  833.125256][    C0]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  833.131064][    C0]  ? kmsan_get_metadata+0x116/0x180
[  833.136264][    C0]  ieee80211_tx_status_ext+0x1291/0x4fa0
[  833.141968][    C0]  ieee80211_tx_status+0x221/0x270
[  833.147088][    C0]  ieee80211_tasklet_handler+0x322/0x390
[  833.152728][    C0]  ? ieee80211_reconfig_filter+0x50/0x50
[  833.158366][    C0]  tasklet_action_common+0x3de/0x640
[  833.164598][    C0]  ? __msan_metadata_ptr_for_store_8+0x13/0x20
[  833.170760][    C0]  ? tasklet_kill+0x210/0x210
[  833.175441][    C0]  tasklet_action+0x30/0x40
[  833.179948][    C0]  __do_softirq+0x1b9/0x715
[  833.184450][    C0]  ? idle_cpu+0x9a/0x1d0
[  833.188744][    C0]  ? __irq_exit_rcu+0x83/0x280
[  833.193511][    C0]  do_softirq+0x123/0x1c0
[  833.197844][    C0]  </IRQ>
[  833.200768][    C0]  __local_bh_enable_ip+0xa1/0xb0
[  833.205798][    C0]  local_bh_enable+0x36/0x40
[  833.210426][    C0]  __ieee80211_tx_skb_tid_band+0x28f/0x390
[  833.216328][    C0]  ieee80211_send_nullfunc+0x59a/0x6e0
[  833.221794][    C0]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  833.227612][    C0]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  833.232992][    C0]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  833.239677][    C0]  ? ieee80211_chswitch_work+0x1470/0x1470
[  833.245486][    C0]  process_one_work+0x1219/0x1fe0
[  833.250569][    C0]  worker_thread+0x10ec/0x2340
[  833.255349][    C0]  kthread+0x521/0x560
[  833.259434][    C0]  ? process_one_work+0x1fe0/0x1fe0
[  833.264665][    C0]  ? kthread_blkcg+0x110/0x110
[  833.269432][    C0]  ret_from_fork+0x1f/0x30
[  833.273853][    C0] 
[  833.276167][    C0] Uninit was created at:
[  833.280390][    C0]  kmsan_internal_poison_shadow+0x5c/0xf0
[  833.286117][    C0]  kmsan_slab_alloc+0x8e/0xe0
[  833.290883][    C0]  __kmalloc_node_track_caller+0xa4f/0x1470
[  833.296779][    C0]  __alloc_skb+0x4dd/0xe90
[  833.301196][    C0]  __netdev_alloc_skb+0x45d/0x810
[  833.306217][    C0]  ieee80211_nullfunc_get+0x2b6/0x820
[  833.311590][    C0]  ieee80211_send_nullfunc+0x216/0x6e0
[  833.317069][    C0]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  833.322876][    C0]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  833.328264][    C0]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  833.334956][    C0]  process_one_work+0x1219/0x1fe0
[  833.339997][    C0]  worker_thread+0x10ec/0x2340
[  833.344775][    C0]  kthread+0x521/0x560
[  833.348869][    C0]  ret_from_fork+0x1f/0x30
[  833.353296][    C0] =====================================================
[  833.360224][    C0] Disabling lock debugging due to kernel taint
18:36:03 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:36:03 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

[  833.748128][T26780] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  833.762309][T26779] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:03 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

[  833.791336][T26781] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  833.811261][T26782] xt_hashlimit: max too large, truncated to 1048576
[  833.819262][T26782] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:03 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

[  833.841914][T26780] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  833.873162][T26787] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  833.886075][T26781] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:03 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xc000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  833.932687][T26783] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  833.961692][T26779] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  833.980633][T26786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  834.065928][T26792] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  834.094716][T26793] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:03 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xd000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  834.132630][T26796] xt_hashlimit: max too large, truncated to 1048576
[  834.139834][T26796] xt_hashlimit: overflow, try lower: 1711341568/0
[  834.163085][T26799] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  834.199331][T26793] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  834.271445][T26793] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  834.283779][T26799] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  834.341511][T26802] xt_hashlimit: max too large, truncated to 1048576
[  834.348696][T26802] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:04 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0xe000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:04 executing program 2:
r0 = socket$inet6(0xa, 0x3, 0x5)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5}}, 0x1c)
getsockname(r0, 0x0, &(0x7f0000000080))

18:36:04 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:36:04 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:36:04 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x10000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  834.845146][T26816] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:04 executing program 5:
r0 = syz_open_dev$I2C(&(0x7f0000000100), 0x0, 0x0)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x0})

[  834.916141][T26818] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:04 executing program 1:
r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
syz_io_uring_setup(0xd1d, &(0x7f0000000080), &(0x7f0000fed000/0x13000)=nil, &(0x7f0000fed000/0x2000)=nil, 0x0, 0x0)
pidfd_send_signal(r0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0xffff4edd}, 0x0)

[  834.963952][T26820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  835.014099][T26818] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  835.049889][T26819] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  835.060658][    C1] =====================================================
[  835.067599][    C1] BUG: KMSAN: uninit-value in ieee80211_sta_tx_notify+0x3b1/0x920
[  835.075437][    C1] CPU: 1 PID: 280 Comm: kworker/u4:5 Tainted: G    B             5.12.0-rc6-syzkaller #0
[  835.085260][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  835.095329][    C1] Workqueue: phy16 ieee80211_beacon_connection_loss_work
[  835.102398][    C1] Call Trace:
[  835.105677][    C1]  <IRQ>
[  835.108528][    C1]  dump_stack+0x24c/0x2e0
[  835.112883][    C1]  kmsan_report+0xfb/0x1e0
[  835.117321][    C1]  __msan_warning+0x5c/0xa0
[  835.121843][    C1]  ieee80211_sta_tx_notify+0x3b1/0x920
[  835.127331][    C1]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  835.133158][    C1]  ? kmsan_get_metadata+0x116/0x180
[  835.138381][    C1]  ieee80211_tx_status_ext+0x1291/0x4fa0
[  835.144052][    C1]  ieee80211_tx_status+0x221/0x270
[  835.149197][    C1]  ieee80211_tasklet_handler+0x322/0x390
[  835.154866][    C1]  ? ieee80211_reconfig_filter+0x50/0x50
[  835.160518][    C1]  tasklet_action_common+0x3de/0x640
[  835.165826][    C1]  ? __msan_metadata_ptr_for_store_8+0x13/0x20
[  835.172000][    C1]  ? tasklet_kill+0x210/0x210
[  835.176696][    C1]  tasklet_action+0x30/0x40
[  835.181217][    C1]  __do_softirq+0x1b9/0x715
[  835.185737][    C1]  ? idle_cpu+0x9a/0x1d0
[  835.189999][    C1]  ? __irq_exit_rcu+0x83/0x280
[  835.194785][    C1]  do_softirq+0x123/0x1c0
[  835.199138][    C1]  </IRQ>
[  835.202073][    C1]  __local_bh_enable_ip+0xa1/0xb0
[  835.207134][    C1]  local_bh_enable+0x36/0x40
18:36:04 executing program 2:
r0 = socket$inet6(0xa, 0x3, 0x5)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5}}, 0x1c)
getsockname(r0, 0x0, &(0x7f0000000080))

[  835.211746][    C1]  __ieee80211_tx_skb_tid_band+0x28f/0x390
[  835.217611][    C1]  ieee80211_send_nullfunc+0x59a/0x6e0
[  835.223095][    C1]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  835.228936][    C1]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  835.234334][    C1]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  835.241036][    C1]  ? ieee80211_chswitch_work+0x1470/0x1470
[  835.246866][    C1]  process_one_work+0x1219/0x1fe0
[  835.251928][    C1]  worker_thread+0x10ec/0x2340
[  835.256728][    C1]  kthread+0x521/0x560
[  835.260816][    C1]  ? process_one_work+0x1fe0/0x1fe0
[  835.266040][    C1]  ? kthread_blkcg+0x110/0x110
[  835.270822][    C1]  ret_from_fork+0x1f/0x30
[  835.275256][    C1] 
[  835.277584][    C1] Uninit was created at:
[  835.281826][    C1]  kmsan_internal_poison_shadow+0x5c/0xf0
[  835.287577][    C1]  kmsan_slab_alloc+0x8e/0xe0
[  835.292259][    C1]  __kmalloc_node_track_caller+0xa4f/0x1470
[  835.298538][    C1]  __alloc_skb+0x4dd/0xe90
[  835.302956][    C1]  __netdev_alloc_skb+0x45d/0x810
[  835.307985][    C1]  ieee80211_nullfunc_get+0x2b6/0x820
[  835.313363][    C1]  ieee80211_send_nullfunc+0x216/0x6e0
[  835.318843][    C1]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  835.324656][    C1]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  835.330047][    C1]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  835.336729][    C1]  process_one_work+0x1219/0x1fe0
[  835.341763][    C1]  worker_thread+0x10ec/0x2340
[  835.346535][    C1]  kthread+0x521/0x560
[  835.350607][    C1]  ret_from_fork+0x1f/0x30
[  835.355026][    C1] =====================================================
[  835.370292][T26821] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  835.552327][T26825] hashlimit_mt_check_common: 1 callbacks suppressed
[  835.552393][T26825] xt_hashlimit: max too large, truncated to 1048576
[  835.567435][T26825] hashlimit_mt_check_common: 1 callbacks suppressed
[  835.567495][T26825] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:05 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x11000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:05 executing program 1:
r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
syz_io_uring_setup(0xd1d, &(0x7f0000000080), &(0x7f0000fed000/0x13000)=nil, &(0x7f0000fed000/0x2000)=nil, 0x0, 0x0)
pidfd_send_signal(r0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0xffff4edd}, 0x0)

18:36:05 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={@wo_ht={{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36)
nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380))
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e)
nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480))
syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={@wo_ht={{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28)

18:36:05 executing program 0:
r0 = socket$inet6(0xa, 0x3, 0x5)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5}}, 0x1c)
getsockname(r0, 0x0, &(0x7f0000000080))

18:36:05 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x12000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  835.990955][T26838] xt_hashlimit: max too large, truncated to 1048576
[  835.997921][T26838] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:05 executing program 5:
r0 = syz_open_dev$I2C(&(0x7f0000000100), 0x0, 0x0)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x0})

18:36:05 executing program 2:
r0 = socket$inet6(0xa, 0x3, 0x5)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5}}, 0x1c)
getsockname(r0, 0x0, &(0x7f0000000080))

[  836.213909][T26846] xt_hashlimit: max too large, truncated to 1048576
[  836.220711][T26846] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:05 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x19000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  836.286139][T26847] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  836.378171][T26859] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:06 executing program 0:
r0 = socket$inet6(0xa, 0x3, 0x5)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5}}, 0x1c)
getsockname(r0, 0x0, &(0x7f0000000080))

[  836.459302][T26847] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
18:36:06 executing program 5:
r0 = syz_open_dev$I2C(&(0x7f0000000100), 0x0, 0x0)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x0})

18:36:06 executing program 2:
r0 = socket$inet6(0xa, 0x3, 0x5)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5}}, 0x1c)
getsockname(r0, 0x0, &(0x7f0000000080))

18:36:06 executing program 1:
r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
syz_io_uring_setup(0xd1d, &(0x7f0000000080), &(0x7f0000fed000/0x13000)=nil, &(0x7f0000fed000/0x2000)=nil, 0x0, 0x0)
pidfd_send_signal(r0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0xffff4edd}, 0x0)

[  836.641636][T26863] xt_hashlimit: max too large, truncated to 1048576
[  836.648487][T26863] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:06 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x1a000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:06 executing program 0:
r0 = socket$inet6(0xa, 0x3, 0x5)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5}}, 0x1c)
getsockname(r0, 0x0, &(0x7f0000000080))

[  837.017162][T26877] xt_hashlimit: max too large, truncated to 1048576
[  837.024164][T26877] xt_hashlimit: overflow, try lower: 1711341568/0
[  837.053853][    C0] =====================================================
[  837.060816][    C0] BUG: KMSAN: uninit-value in ieee80211_sta_tx_notify+0x3b1/0x920
[  837.068654][    C0] CPU: 0 PID: 280 Comm: kworker/u4:5 Tainted: G    B             5.12.0-rc6-syzkaller #0
[  837.078467][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  837.088536][    C0] Workqueue: phy16 ieee80211_beacon_connection_loss_work
[  837.095596][    C0] Call Trace:
[  837.098880][    C0]  <IRQ>
[  837.101730][    C0]  dump_stack+0x24c/0x2e0
[  837.106087][    C0]  kmsan_report+0xfb/0x1e0
[  837.110525][    C0]  __msan_warning+0x5c/0xa0
[  837.115041][    C0]  ieee80211_sta_tx_notify+0x3b1/0x920
[  837.120510][    C0]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  837.126322][    C0]  ? kmsan_get_metadata+0x116/0x180
[  837.131522][    C0]  ieee80211_tx_status_ext+0x1291/0x4fa0
[  837.137186][    C0]  ieee80211_tx_status+0x221/0x270
[  837.142309][    C0]  ieee80211_tasklet_handler+0x322/0x390
[  837.147959][    C0]  ? ieee80211_reconfig_filter+0x50/0x50
[  837.153597][    C0]  tasklet_action_common+0x3de/0x640
[  837.158975][    C0]  ? __msan_metadata_ptr_for_store_8+0x13/0x20
[  837.165131][    C0]  ? tasklet_kill+0x210/0x210
[  837.169812][    C0]  tasklet_action+0x30/0x40
[  837.174317][    C0]  __do_softirq+0x1b9/0x715
[  837.178823][    C0]  ? idle_cpu+0x9a/0x1d0
[  837.183070][    C0]  ? __irq_exit_rcu+0x83/0x280
[  837.187861][    C0]  do_softirq+0x123/0x1c0
[  837.192197][    C0]  </IRQ>
[  837.195124][    C0]  __local_bh_enable_ip+0xa1/0xb0
[  837.200158][    C0]  local_bh_enable+0x36/0x40
[  837.204758][    C0]  __ieee80211_tx_skb_tid_band+0x28f/0x390
[  837.210578][    C0]  ieee80211_send_nullfunc+0x59a/0x6e0
[  837.216041][    C0]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  837.221854][    C0]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  837.227236][    C0]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  837.233918][    C0]  ? ieee80211_chswitch_work+0x1470/0x1470
[  837.239730][    C0]  process_one_work+0x1219/0x1fe0
[  837.244769][    C0]  worker_thread+0x10ec/0x2340
[  837.249547][    C0]  kthread+0x521/0x560
[  837.253618][    C0]  ? process_one_work+0x1fe0/0x1fe0
[  837.258826][    C0]  ? kthread_blkcg+0x110/0x110
[  837.263600][    C0]  ret_from_fork+0x1f/0x30
[  837.268022][    C0] 
[  837.270334][    C0] Uninit was created at:
[  837.274557][    C0]  kmsan_internal_poison_shadow+0x5c/0xf0
[  837.280285][    C0]  kmsan_slab_alloc+0x8e/0xe0
[  837.284958][    C0]  __kmalloc_node_track_caller+0xa4f/0x1470
[  837.290862][    C0]  __alloc_skb+0x4dd/0xe90
[  837.295300][    C0]  __netdev_alloc_skb+0x45d/0x810
[  837.300339][    C0]  ieee80211_nullfunc_get+0x2b6/0x820
[  837.305727][    C0]  ieee80211_send_nullfunc+0x216/0x6e0
[  837.311187][    C0]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  837.317001][    C0]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  837.322381][    C0]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  837.329068][    C0]  process_one_work+0x1219/0x1fe0
[  837.334109][    C0]  worker_thread+0x10ec/0x2340
[  837.338882][    C0]  kthread+0x521/0x560
[  837.342985][    C0]  ret_from_fork+0x1f/0x30
[  837.347403][    C0] =====================================================
18:36:07 executing program 2:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000580)=""/143, &(0x7f0000000340)=0xfee5)
open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000640)={0x0, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000480), 0xd}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x3, 0x3, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfb, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2, 0x5e22, @local}, 0x10)
open(&(0x7f00000002c0)='./file0\x00', 0x0, 0x0)
sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[]}}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0)
ioctl$KVM_NMI(r2, 0xae9a)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380))
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:36:07 executing program 5:
r0 = syz_open_dev$I2C(&(0x7f0000000100), 0x0, 0x0)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x0})

18:36:07 executing program 1:
r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
syz_io_uring_setup(0xd1d, &(0x7f0000000080), &(0x7f0000fed000/0x13000)=nil, &(0x7f0000fed000/0x2000)=nil, 0x0, 0x0)
pidfd_send_signal(r0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0xffff4edd}, 0x0)

18:36:07 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x20000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:07 executing program 3:
openat$vfio(0xffffffffffffff9c, &(0x7f0000000040), 0x49f40, 0x0)

18:36:07 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0)
close(r0)

[  837.754061][T26888] xt_hashlimit: max too large, truncated to 1048576
[  837.760896][T26888] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:07 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x25000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:07 executing program 5:
r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000004180), 0x2, 0x0)
read$FUSE(r0, &(0x7f0000000000)={0x2020, 0x0, <r1=>0x0}, 0x2020)
read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020)
write$FUSE_DIRENTPLUS(r0, &(0x7f000000c3c0)={0x10, 0x0, r1}, 0x10)

18:36:07 executing program 1:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
read(r0, 0x0, 0x0)

18:36:07 executing program 3:
r0 = open(&(0x7f00000000c0)='./bus\x00', 0x1031fe, 0x0)
write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x1f)
ftruncate(r0, 0x40204)
sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe)
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0)
r1 = socket(0x2, 0x803, 0xff)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10)
r2 = dup(r1)
r3 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0)
sendfile(r2, r3, 0x0, 0x8000fffffffe)
write(0xffffffffffffffff, 0x0, 0x0)

[  838.160428][T26910] xt_hashlimit: max too large, truncated to 1048576
[  838.167877][T26910] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:07 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x270b0000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:07 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0)
close(r0)

18:36:08 executing program 2:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000580)=""/143, &(0x7f0000000340)=0xfee5)
open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000640)={0x0, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000480), 0xd}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x3, 0x3, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfb, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2, 0x5e22, @local}, 0x10)
open(&(0x7f00000002c0)='./file0\x00', 0x0, 0x0)
sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[]}}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0)
ioctl$KVM_NMI(r2, 0xae9a)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380))
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  838.470845][T26921] xt_hashlimit: max too large, truncated to 1048576
[  838.477785][T26921] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:08 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x28020000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:08 executing program 1:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
read(r0, 0x0, 0x0)

18:36:08 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0)
close(r0)

18:36:08 executing program 5:
r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000004180), 0x2, 0x0)
read$FUSE(r0, &(0x7f0000000000)={0x2020, 0x0, <r1=>0x0}, 0x2020)
read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020)
write$FUSE_DIRENTPLUS(r0, &(0x7f000000c3c0)={0x10, 0x0, r1}, 0x10)

[  839.000475][T26938] xt_hashlimit: max too large, truncated to 1048576
[  839.007396][T26938] xt_hashlimit: overflow, try lower: 1711341568/0
[  839.056457][    C0] =====================================================
[  839.063421][    C0] BUG: KMSAN: uninit-value in ieee80211_sta_tx_notify+0x3b1/0x920
[  839.071262][    C0] CPU: 0 PID: 300 Comm: kworker/u4:6 Tainted: G    B             5.12.0-rc6-syzkaller #0
[  839.081083][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  839.091151][    C0] Workqueue: phy16 ieee80211_beacon_connection_loss_work
[  839.098232][    C0] Call Trace:
[  839.101518][    C0]  <IRQ>
[  839.104373][    C0]  dump_stack+0x24c/0x2e0
[  839.108727][    C0]  kmsan_report+0xfb/0x1e0
[  839.113196][    C0]  __msan_warning+0x5c/0xa0
[  839.117720][    C0]  ieee80211_sta_tx_notify+0x3b1/0x920
[  839.123201][    C0]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  839.129029][    C0]  ? kmsan_get_metadata+0x116/0x180
[  839.134247][    C0]  ieee80211_tx_status_ext+0x1291/0x4fa0
[  839.139918][    C0]  ieee80211_tx_status+0x221/0x270
[  839.145058][    C0]  ieee80211_tasklet_handler+0x322/0x390
[  839.150721][    C0]  ? ieee80211_reconfig_filter+0x50/0x50
[  839.156384][    C0]  tasklet_action_common+0x3de/0x640
[  839.161710][    C0]  ? __msan_metadata_ptr_for_store_8+0x13/0x20
[  839.167886][    C0]  ? tasklet_kill+0x210/0x210
[  839.173540][    C0]  tasklet_action+0x30/0x40
[  839.178072][    C0]  __do_softirq+0x1b9/0x715
[  839.182595][    C0]  ? idle_cpu+0x9a/0x1d0
[  839.186862][    C0]  ? __irq_exit_rcu+0x83/0x280
[  839.191648][    C0]  do_softirq+0x123/0x1c0
[  839.196002][    C0]  </IRQ>
[  839.198940][    C0]  __local_bh_enable_ip+0xa1/0xb0
[  839.203998][    C0]  local_bh_enable+0x36/0x40
[  839.208610][    C0]  __ieee80211_tx_skb_tid_band+0x28f/0x390
[  839.214877][    C0]  ieee80211_send_nullfunc+0x59a/0x6e0
[  839.220364][    C0]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  839.226200][    C0]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  839.231599][    C0]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  839.238300][    C0]  ? ieee80211_chswitch_work+0x1470/0x1470
[  839.244131][    C0]  process_one_work+0x1219/0x1fe0
[  839.249192][    C0]  worker_thread+0x10ec/0x2340
[  839.254104][    C0]  kthread+0x521/0x560
[  839.258196][    C0]  ? process_one_work+0x1fe0/0x1fe0
[  839.263432][    C0]  ? kthread_blkcg+0x110/0x110
[  839.268217][    C0]  ret_from_fork+0x1f/0x30
[  839.272658][    C0] 
[  839.275033][    C0] Uninit was created at:
[  839.279267][    C0]  kmsan_internal_poison_shadow+0x5c/0xf0
[  839.285016][    C0]  kmsan_slab_alloc+0x8e/0xe0
[  839.289707][    C0]  __kmalloc_node_track_caller+0xa4f/0x1470
[  839.295636][    C0]  __alloc_skb+0x4dd/0xe90
[  839.300069][    C0]  __netdev_alloc_skb+0x45d/0x810
[  839.305109][    C0]  ieee80211_nullfunc_get+0x2b6/0x820
[  839.310507][    C0]  ieee80211_send_nullfunc+0x216/0x6e0
[  839.315994][    C0]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  839.321837][    C0]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  839.327234][    C0]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  839.333934][    C0]  process_one_work+0x1219/0x1fe0
[  839.338985][    C0]  worker_thread+0x10ec/0x2340
[  839.343774][    C0]  kthread+0x521/0x560
[  839.347865][    C0]  ret_from_fork+0x1f/0x30
18:36:09 executing program 1:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
read(r0, 0x0, 0x0)

[  839.352304][    C0] =====================================================
18:36:09 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x280b0000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:09 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x0, 0x0)
close(r0)

18:36:09 executing program 2:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000580)=""/143, &(0x7f0000000340)=0xfee5)
open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000640)={0x0, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000480), 0xd}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x3, 0x3, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfb, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2, 0x5e22, @local}, 0x10)
open(&(0x7f00000002c0)='./file0\x00', 0x0, 0x0)
sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[]}}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0)
ioctl$KVM_NMI(r2, 0xae9a)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380))
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:36:09 executing program 3:
r0 = open(&(0x7f00000000c0)='./bus\x00', 0x1031fe, 0x0)
write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x1f)
ftruncate(r0, 0x40204)
sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe)
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0)
r1 = socket(0x2, 0x803, 0xff)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10)
r2 = dup(r1)
r3 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0)
sendfile(r2, r3, 0x0, 0x8000fffffffe)
write(0xffffffffffffffff, 0x0, 0x0)

18:36:09 executing program 5:
r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000004180), 0x2, 0x0)
read$FUSE(r0, &(0x7f0000000000)={0x2020, 0x0, <r1=>0x0}, 0x2020)
read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020)
write$FUSE_DIRENTPLUS(r0, &(0x7f000000c3c0)={0x10, 0x0, r1}, 0x10)

[  839.800396][T26955] xt_hashlimit: max too large, truncated to 1048576
[  839.807506][T26955] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:09 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x48000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:09 executing program 1:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
read(r0, 0x0, 0x0)

18:36:09 executing program 0:
r0 = open(&(0x7f00000000c0)='./bus\x00', 0x1031fe, 0x0)
write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x1f)
ftruncate(r0, 0x40204)
sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe)
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0)
r1 = socket(0x2, 0x803, 0xff)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10)
r2 = dup(r1)
r3 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0)
sendfile(r2, r3, 0x0, 0x8000fffffffe)
write(0xffffffffffffffff, 0x0, 0x0)

18:36:10 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x4c000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:10 executing program 5:
r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000004180), 0x2, 0x0)
read$FUSE(r0, &(0x7f0000000000)={0x2020, 0x0, <r1=>0x0}, 0x2020)
read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020)
write$FUSE_DIRENTPLUS(r0, &(0x7f000000c3c0)={0x10, 0x0, r1}, 0x10)

18:36:10 executing program 2:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000580)=""/143, &(0x7f0000000340)=0xfee5)
open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000640)={0x0, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000480), 0xd}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x3, 0x3, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfb, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2, 0x5e22, @local}, 0x10)
open(&(0x7f00000002c0)='./file0\x00', 0x0, 0x0)
sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[]}}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0)
ioctl$KVM_NMI(r2, 0xae9a)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380))
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:36:10 executing program 1:
r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000004180), 0x2, 0x0)
read$FUSE(r0, &(0x7f0000000000)={0x2020, 0x0, <r1=>0x0}, 0x2020)
read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020)
write$FUSE_DIRENTPLUS(r0, &(0x7f000000c3c0)={0x10, 0x0, r1}, 0x10)

[  840.848212][T26989] hashlimit_mt_check_common: 1 callbacks suppressed
[  840.848272][T26989] xt_hashlimit: max too large, truncated to 1048576
[  840.861956][T26989] hashlimit_mt_check_common: 1 callbacks suppressed
[  840.862019][T26989] xt_hashlimit: overflow, try lower: 1711341568/0
[  841.054423][    C1] =====================================================
[  841.061392][    C1] BUG: KMSAN: uninit-value in ieee80211_sta_tx_notify+0x3b1/0x920
[  841.069356][    C1] CPU: 1 PID: 25706 Comm: kworker/u4:2 Tainted: G    B             5.12.0-rc6-syzkaller #0
[  841.079348][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  841.089407][    C1] Workqueue: phy16 ieee80211_beacon_connection_loss_work
[  841.096462][    C1] Call Trace:
[  841.099742][    C1]  <IRQ>
[  841.102585][    C1]  dump_stack+0x24c/0x2e0
[  841.106940][    C1]  kmsan_report+0xfb/0x1e0
[  841.111373][    C1]  __msan_warning+0x5c/0xa0
[  841.115879][    C1]  ieee80211_sta_tx_notify+0x3b1/0x920
[  841.121343][    C1]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  841.127322][    C1]  ? kmsan_get_metadata+0x116/0x180
[  841.132523][    C1]  ieee80211_tx_status_ext+0x1291/0x4fa0
[  841.138170][    C1]  ieee80211_tx_status+0x221/0x270
[  841.143308][    C1]  ieee80211_tasklet_handler+0x322/0x390
[  841.148949][    C1]  ? ieee80211_reconfig_filter+0x50/0x50
[  841.154585][    C1]  tasklet_action_common+0x3de/0x640
[  841.159892][    C1]  ? __msan_metadata_ptr_for_store_8+0x13/0x20
[  841.166049][    C1]  ? tasklet_kill+0x210/0x210
[  841.170731][    C1]  tasklet_action+0x30/0x40
[  841.175235][    C1]  __do_softirq+0x1b9/0x715
[  841.179758][    C1]  ? idle_cpu+0x9a/0x1d0
[  841.184028][    C1]  ? __irq_exit_rcu+0x83/0x280
[  841.188797][    C1]  do_softirq+0x123/0x1c0
[  841.193139][    C1]  </IRQ>
[  841.196084][    C1]  __local_bh_enable_ip+0xa1/0xb0
[  841.201111][    C1]  local_bh_enable+0x36/0x40
[  841.205707][    C1]  __ieee80211_tx_skb_tid_band+0x28f/0x390
[  841.211522][    C1]  ieee80211_send_nullfunc+0x59a/0x6e0
[  841.216986][    C1]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  841.222802][    C1]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  841.228179][    C1]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  841.234862][    C1]  ? ieee80211_chswitch_work+0x1470/0x1470
[  841.240672][    C1]  process_one_work+0x1219/0x1fe0
[  841.245707][    C1]  worker_thread+0x10ec/0x2340
[  841.250480][    C1]  ? kmsan_get_metadata+0x116/0x180
[  841.255682][    C1]  kthread+0x521/0x560
[  841.259753][    C1]  ? process_one_work+0x1fe0/0x1fe0
[  841.264959][    C1]  ? kthread_blkcg+0x110/0x110
[  841.269726][    C1]  ret_from_fork+0x1f/0x30
[  841.274146][    C1] 
[  841.276458][    C1] Uninit was created at:
[  841.280678][    C1]  kmsan_internal_poison_shadow+0x5c/0xf0
[  841.286410][    C1]  kmsan_slab_alloc+0x8e/0xe0
[  841.291084][    C1]  __kmalloc_node_track_caller+0xa4f/0x1470
[  841.296980][    C1]  __alloc_skb+0x4dd/0xe90
[  841.301397][    C1]  __netdev_alloc_skb+0x45d/0x810
[  841.306432][    C1]  ieee80211_nullfunc_get+0x2b6/0x820
[  841.311916][    C1]  ieee80211_send_nullfunc+0x216/0x6e0
[  841.319393][    C1]  ieee80211_mgd_probe_ap_send+0x88d/0xb30
[  841.325231][    C1]  ieee80211_mgd_probe_ap+0x52c/0x6e0
[  841.330608][    C1]  ieee80211_beacon_connection_loss_work+0x19b/0x420
[  841.337288][    C1]  process_one_work+0x1219/0x1fe0
[  841.343126][    C1]  worker_thread+0x10ec/0x2340
[  841.347915][    C1]  kthread+0x521/0x560
[  841.351986][    C1]  ret_from_fork+0x1f/0x30
[  841.356407][    C1] =====================================================
18:36:11 executing program 5:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000580)=""/143, &(0x7f0000000340)=0xfee5)
open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000640)={0x0, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000480), 0xd}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x3, 0x3, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfb, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2, 0x5e22, @local}, 0x10)
open(&(0x7f00000002c0)='./file0\x00', 0x0, 0x0)
sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[]}}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0)
ioctl$KVM_NMI(r2, 0xae9a)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380))
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:36:11 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x58010000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:11 executing program 3:
r0 = open(&(0x7f00000000c0)='./bus\x00', 0x1031fe, 0x0)
write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x1f)
ftruncate(r0, 0x40204)
sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe)
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0)
r1 = socket(0x2, 0x803, 0xff)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10)
r2 = dup(r1)
r3 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0)
sendfile(r2, r3, 0x0, 0x8000fffffffe)
write(0xffffffffffffffff, 0x0, 0x0)

18:36:11 executing program 0:
r0 = open(&(0x7f00000000c0)='./bus\x00', 0x1031fe, 0x0)
write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x1f)
ftruncate(r0, 0x40204)
sendfile(r0, r0, &(0x7f00000001c0), 0x8080fffffffe)
perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0)
r1 = socket(0x2, 0x803, 0xff)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10)
r2 = dup(r1)
r3 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0)
sendfile(r2, r3, 0x0, 0x8000fffffffe)
write(0xffffffffffffffff, 0x0, 0x0)

18:36:11 executing program 1:
r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000004180), 0x2, 0x0)
read$FUSE(r0, &(0x7f0000000000)={0x2020, 0x0, <r1=>0x0}, 0x2020)
read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020)
write$FUSE_DIRENTPLUS(r0, &(0x7f000000c3c0)={0x10, 0x0, r1}, 0x10)

[  841.792646][T27005] xt_hashlimit: max too large, truncated to 1048576
[  841.799534][T27005] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:11 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x60000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  842.090093][T27023] xt_hashlimit: max too large, truncated to 1048576
[  842.097127][T27023] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:11 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x68000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

18:36:12 executing program 5:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000580)=""/143, &(0x7f0000000340)=0xfee5)
open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000640)={0x0, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000480), 0xd}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x3, 0x3, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfb, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x2, 0x5e22, @local}, 0x10)
open(&(0x7f00000002c0)='./file0\x00', 0x0, 0x0)
sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[]}}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0)
ioctl$KVM_NMI(r2, 0xae9a)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380))
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:36:12 executing program 1:
r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000004180), 0x2, 0x0)
read$FUSE(r0, &(0x7f0000000000)={0x2020, 0x0, <r1=>0x0}, 0x2020)
read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020)
write$FUSE_DIRENTPLUS(r0, &(0x7f000000c3c0)={0x10, 0x0, r1}, 0x10)

[  842.540239][T27030] xt_hashlimit: max too large, truncated to 1048576
[  842.547342][T27030] xt_hashlimit: overflow, try lower: 1711341568/0
18:36:12 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x6c000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)

[  842.972079][T27043] xt_hashlimit: max too large, truncated to 1048576
[  842.979268][T27043] xt_hashlimit: overflow, try lower: 1711341568/0
[  842.987344][    C0] =====================================================
[  842.994296][    C0] BUG: KMSAN: uninit-value in ieee80211_sta_tx_notify+0x3b1/0x920
[  843.002137][    C0] CPU: 0 PID: 300 Comm: kworker/u4:6 Tainted: G    B             5.12.0-rc6-syzkaller #0
[  843.012047][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  843.022116][    C0] Workqueue: phy16 ieee80211_beacon_connection_loss_work
[  843.029172][    C0] Call Trace:
[  843.032455][    C0]  <IRQ>
[  843.035302][    C0]  dump_stack+0x24c/0x2e0
[  843.039668][    C0]  kmsan_report+0xfb/0x1e0
[  843.044107][    C0]  __msan_warning+0x5c/0xa0
[  843.048732][    C0]  ieee80211_sta_tx_notify+0x3b1/0x920
[  843.054224][    C0]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  843.060056][    C0]  ? kmsan_get_metadata+0x116/0x180
[  843.065278][    C0]  ieee80211_tx_status_ext+0x1291/0x4fa0
18:36:12 executing program 4:
r0 = syz_open_dev$audion(&(0x7f0000000000), 0x0, 0x0)
fcntl$getown(r0, 0x9)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
clone(0x26140900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x4001, 0x3, 0x2c0, 0x158, 0x0, 0x148, 0x0, 0x148, 0x228, 0x240, 0x240, 0x228, 0x224, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x158, 0x0, {0x0, 0x74000000}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x66010000, 0x0, 0x0, 0x3000000, 0xed, 0x7}}}, @common=@inet=@socket2={{0x28, 'socket\x00', 0x3}, 0x8}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}, {{@ip={@empty, @private, 0x0, 0x0, 'veth0_to_bond\x00', 'bond_slave_0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320)