program:
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
socket$inet6_mptcp(0xa, 0x1, 0x106)
socket$nl_route(0x10, 0x3, 0x0)
r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xf0)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb52}, 0x94)
r3 = signalfd(r1, &(0x7f0000000140)={[0x4]}, 0x8)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f00000001c0)={&(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x4})
r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002)
ioctl$SCSI_IOCTL_GET_PCI(r4, 0x2284, &(0x7f00000003c0))
setsockopt$ax25_int(r2, 0x101, 0x9, &(0x7f0000000340)=0x7fffffff, 0x4)
syz_open_dev$dri(&(0x7f0000000100), 0x2, 0x329200)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001800010d00000000000000850a000000000000000500000014000500200100000000000000000100000000001c00090008000000", @ANYRES32=r1, @ANYRES32=r5], 0x4c}}, 0x0)
sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0)
connect$ax25(r2, &(0x7f0000000040)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x6}, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @null]}, 0x48)
[ 84.683065][ T5306] Bluetooth: hci0: command tx timeout
[ 84.724211][ T5331] ------------[ cut here ]------------
[ 84.727412][ T5331] WARNING: CPU: 0 PID: 5331 at drivers/net/netdevsim/fib.c:831 nsim_fib_event_nb+0xed8/0x1080
[ 84.741983][ T5331] Modules linked in:
[ 84.743874][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 84.747840][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 84.752993][ T5331] RIP: 0010:nsim_fib_event_nb+0xed8/0x1080
[ 84.755571][ T5331] Code: fa be 02 00 00 00 eb 0a e8 e5 0f e0 fa be 01 00 00 00 4c 89 f7 e8 88 31 ab fd 4c 8b 64 24 08 e9 91 f4 ff ff e8 c9 0f e0 fa 90 <0f> 0b 90 e9 70 fb ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 35
[ 84.764719][ T5331] RSP: 0018:ffffc9000d2f6ee8 EFLAGS: 00010283
[ 84.767484][ T5331] RAX: ffffffff86e00387 RBX: 0000000000000001 RCX: 0000000000100000
[ 84.770956][ T5331] RDX: ffffc9000e302000 RSI: 0000000000000433 RDI: 0000000000000434
[ 84.774936][ T5331] RBP: dffffc0000000000 R08: ffff88803f44502f R09: 1ffff11007e88a05
[ 84.778369][ T5331] R10: dffffc0000000000 R11: ffffed1007e88a06 R12: ffff888051bc1000
[ 84.782461][ T5331] R13: ffffc9000d2f7060 R14: 0000000000000000 R15: ffffc9000d2f7078
[ 84.785821][ T5331] FS: 00007fda9a4ba6c0(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000
[ 84.789681][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 84.792983][ T5331] CR2: 00007fda995733e0 CR3: 00000000358e9000 CR4: 0000000000352ef0
[ 84.796552][ T5331] Call Trace:
[ 84.798081][ T5331]
[ 84.799489][ T5331] notifier_call_chain+0x1b6/0x3e0
[ 84.801832][ T5331] ? atomic_notifier_call_chain+0x26/0x180
[ 84.804373][ T5331] atomic_notifier_call_chain+0xda/0x180
[ 84.806872][ T5331] call_fib_notifiers+0x31/0x60
[ 84.809078][ T5331] call_fib6_multipath_entry_notifiers+0xe6/0x150
[ 84.812110][ T5331] ? __pfx_call_fib6_multipath_entry_notifiers+0x10/0x10
[ 84.815211][ T5331] ? inet6_rtm_newroute+0xe8b/0x18c0
[ 84.817615][ T5331] inet6_rtm_newroute+0x12f5/0x18c0
[ 84.819911][ T5331] ? kmem_cache_free+0x19b/0x690
[ 84.822200][ T5331] ? __pfx_inet6_rtm_newroute+0x10/0x10
[ 84.824380][ T5331] ? __local_bh_enable_ip+0x12d/0x1c0
[ 84.826721][ T5331] ? __dev_queue_xmit+0x27b/0x3b50
[ 84.829399][ T5331] ? __dev_queue_xmit+0x1d79/0x3b50
[ 84.832176][ T5331] ? kasan_save_track+0x3e/0x80
[ 84.834349][ T5331] ? __kasan_slab_alloc+0x6c/0x80
[ 84.836529][ T5331] ? __pfx_inet6_rtm_newroute+0x10/0x10
[ 84.838993][ T5331] rtnetlink_rcv_msg+0x7cf/0xb70
[ 84.841212][ T5331] ? rtnetlink_rcv_msg+0x1ab/0xb70
[ 84.843620][ T5331] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 84.846098][ T5331] ? ref_tracker_free+0x63a/0x7d0
[ 84.848421][ T5331] ? __asan_memcpy+0x40/0x70
[ 84.850563][ T5331] ? __pfx_ref_tracker_free+0x10/0x10
[ 84.852992][ T5331] ? __skb_clone+0x63/0x7a0
[ 84.854993][ T5331] netlink_rcv_skb+0x208/0x470
[ 84.857303][ T5331] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 84.859834][ T5331] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 84.862272][ T5331] ? netlink_deliver_tap+0x2e/0x1b0
[ 84.864647][ T5331] netlink_unicast+0x82f/0x9e0
[ 84.866867][ T5331] ? __pfx_netlink_unicast+0x10/0x10
[ 84.869232][ T5331] ? netlink_sendmsg+0x642/0xb30
[ 84.871522][ T5331] ? skb_put+0x11b/0x210
[ 84.873622][ T5331] netlink_sendmsg+0x805/0xb30
[ 84.875820][ T5331] ? __pfx_netlink_sendmsg+0x10/0x10
[ 84.878326][ T5331] ? aa_sock_msg_perm+0xf1/0x1d0
[ 84.880583][ T5331] ? bpf_lsm_socket_sendmsg+0x9/0x20
[ 84.883154][ T5331] ? __pfx_netlink_sendmsg+0x10/0x10
[ 84.885509][ T5331] __sock_sendmsg+0x21c/0x270
[ 84.887641][ T5331] ____sys_sendmsg+0x52d/0x830
[ 84.890498][ T5331] ? __pfx_____sys_sendmsg+0x10/0x10
[ 84.892935][ T5331] ? import_iovec+0x74/0xa0
[ 84.894853][ T5331] ___sys_sendmsg+0x21f/0x2a0
[ 84.896920][ T5331] ? __pfx____sys_sendmsg+0x10/0x10
[ 84.899055][ T5331] ? preempt_schedule+0xae/0xc0
[ 84.901092][ T5331] ? __fget_files+0x2a/0x420
[ 84.903170][ T5331] ? __fget_files+0x3a0/0x420
[ 84.905546][ T5331] __sys_sendmmsg+0x227/0x430
[ 84.908168][ T5331] ? __pfx___sys_sendmmsg+0x10/0x10
[ 84.910987][ T5331] ? rcu_is_watching+0x15/0xb0
[ 84.913068][ T5331] __x64_sys_sendmmsg+0xa0/0xc0
[ 84.915268][ T5331] do_syscall_64+0xfa/0xfa0
[ 84.917231][ T5331] ? lockdep_hardirqs_on+0x9c/0x150
[ 84.919544][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 84.922228][ T5331] ? clear_bhb_loop+0x60/0xb0
[ 84.924173][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 84.926608][ T5331] RIP: 0033:0x7fda9958f749
[ 84.928504][ T5331] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 84.936739][ T5331] RSP: 002b:00007fda9a4ba038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 84.940422][ T5331] RAX: ffffffffffffffda RBX: 00007fda997e5fa0 RCX: 00007fda9958f749
[ 84.944219][ T5331] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003
[ 84.947673][ T5331] RBP: 00007fda99613f91 R08: 0000000000000000 R09: 0000000000000000
[ 84.951044][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 84.954600][ T5331] R13: 00007fda997e6038 R14: 00007fda997e5fa0 R15: 00007fff85f46718
[ 84.957957][ T5331]
[ 84.959339][ T5331] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 84.962619][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 84.966646][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 84.971449][ T5331] Call Trace:
[ 84.973030][ T5331]
[ 84.974409][ T5331] dump_stack_lvl+0x99/0x250
[ 84.976539][ T5331] ? __asan_memcpy+0x40/0x70
[ 84.978641][ T5331] ? __pfx_dump_stack_lvl+0x10/0x10
[ 84.980892][ T5331] ? __pfx__printk+0x10/0x10
[ 84.982890][ T5331] vpanic+0x237/0x6d0
[ 84.984664][ T5331] ? __pfx_vpanic+0x10/0x10
[ 84.986696][ T5331] panic+0xb9/0xc0
[ 84.988375][ T5331] ? __pfx_panic+0x10/0x10
[ 84.990415][ T5331] __warn+0x31b/0x4b0
[ 84.992209][ T5331] ? nsim_fib_event_nb+0xed8/0x1080
[ 84.994562][ T5331] ? nsim_fib_event_nb+0xed8/0x1080
[ 84.996828][ T5331] report_bug+0x2be/0x4f0
[ 84.998754][ T5331] ? nsim_fib_event_nb+0xed8/0x1080
[ 85.001040][ T5331] ? nsim_fib_event_nb+0xed8/0x1080
[ 85.003347][ T5331] ? nsim_fib_event_nb+0xeda/0x1080
[ 85.005624][ T5331] handle_bug+0x84/0x160
[ 85.007560][ T5331] exc_invalid_op+0x1a/0x50
[ 85.009633][ T5331] asm_exc_invalid_op+0x1a/0x20
[ 85.011821][ T5331] RIP: 0010:nsim_fib_event_nb+0xed8/0x1080
[ 85.014466][ T5331] Code: fa be 02 00 00 00 eb 0a e8 e5 0f e0 fa be 01 00 00 00 4c 89 f7 e8 88 31 ab fd 4c 8b 64 24 08 e9 91 f4 ff ff e8 c9 0f e0 fa 90 <0f> 0b 90 e9 70 fb ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 35
[ 85.022756][ T5331] RSP: 0018:ffffc9000d2f6ee8 EFLAGS: 00010283
[ 85.025358][ T5331] RAX: ffffffff86e00387 RBX: 0000000000000001 RCX: 0000000000100000
[ 85.029058][ T5331] RDX: ffffc9000e302000 RSI: 0000000000000433 RDI: 0000000000000434
[ 85.032469][ T5331] RBP: dffffc0000000000 R08: ffff88803f44502f R09: 1ffff11007e88a05
[ 85.035622][ T5331] R10: dffffc0000000000 R11: ffffed1007e88a06 R12: ffff888051bc1000
[ 85.038710][ T5331] R13: ffffc9000d2f7060 R14: 0000000000000000 R15: ffffc9000d2f7078
[ 85.042022][ T5331] ? nsim_fib_event_nb+0xed7/0x1080
[ 85.044290][ T5331] ? nsim_fib_event_nb+0xed7/0x1080
[ 85.046539][ T5331] notifier_call_chain+0x1b6/0x3e0
[ 85.048774][ T5331] ? atomic_notifier_call_chain+0x26/0x180
[ 85.051289][ T5331] atomic_notifier_call_chain+0xda/0x180
[ 85.053661][ T5331] call_fib_notifiers+0x31/0x60
[ 85.055767][ T5331] call_fib6_multipath_entry_notifiers+0xe6/0x150
[ 85.058607][ T5331] ? __pfx_call_fib6_multipath_entry_notifiers+0x10/0x10
[ 85.061654][ T5331] ? inet6_rtm_newroute+0xe8b/0x18c0
[ 85.063880][ T5331] inet6_rtm_newroute+0x12f5/0x18c0
[ 85.066125][ T5331] ? kmem_cache_free+0x19b/0x690
[ 85.068269][ T5331] ? __pfx_inet6_rtm_newroute+0x10/0x10
[ 85.070672][ T5331] ? __local_bh_enable_ip+0x12d/0x1c0
[ 85.072897][ T5331] ? __dev_queue_xmit+0x27b/0x3b50
[ 85.075021][ T5331] ? __dev_queue_xmit+0x1d79/0x3b50
[ 85.077195][ T5331] ? kasan_save_track+0x3e/0x80
[ 85.079274][ T5331] ? __kasan_slab_alloc+0x6c/0x80
[ 85.081486][ T5331] ? __pfx_inet6_rtm_newroute+0x10/0x10
[ 85.083830][ T5331] rtnetlink_rcv_msg+0x7cf/0xb70
[ 85.086055][ T5331] ? rtnetlink_rcv_msg+0x1ab/0xb70
[ 85.088290][ T5331] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 85.090668][ T5331] ? ref_tracker_free+0x63a/0x7d0
[ 85.092835][ T5331] ? __asan_memcpy+0x40/0x70
[ 85.095035][ T5331] ? __pfx_ref_tracker_free+0x10/0x10
[ 85.097458][ T5331] ? __skb_clone+0x63/0x7a0
[ 85.099544][ T5331] netlink_rcv_skb+0x208/0x470
[ 85.101669][ T5331] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 85.104256][ T5331] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 85.106868][ T5331] ? netlink_deliver_tap+0x2e/0x1b0
[ 85.109208][ T5331] netlink_unicast+0x82f/0x9e0
[ 85.111353][ T5331] ? __pfx_netlink_unicast+0x10/0x10
[ 85.113536][ T5331] ? netlink_sendmsg+0x642/0xb30
[ 85.116040][ T5331] ? skb_put+0x11b/0x210
[ 85.118281][ T5331] netlink_sendmsg+0x805/0xb30
[ 85.120794][ T5331] ? __pfx_netlink_sendmsg+0x10/0x10
[ 85.123376][ T5331] ? aa_sock_msg_perm+0xf1/0x1d0
[ 85.125713][ T5331] ? bpf_lsm_socket_sendmsg+0x9/0x20
[ 85.128032][ T5331] ? __pfx_netlink_sendmsg+0x10/0x10
[ 85.130106][ T5331] __sock_sendmsg+0x21c/0x270
[ 85.132113][ T5331] ____sys_sendmsg+0x52d/0x830
[ 85.134489][ T5331] ? __pfx_____sys_sendmsg+0x10/0x10
[ 85.137143][ T5331] ? import_iovec+0x74/0xa0
[ 85.139295][ T5331] ___sys_sendmsg+0x21f/0x2a0
[ 85.141345][ T5331] ? __pfx____sys_sendmsg+0x10/0x10
[ 85.143651][ T5331] ? preempt_schedule+0xae/0xc0
[ 85.145763][ T5331] ? __fget_files+0x2a/0x420
[ 85.147898][ T5331] ? __fget_files+0x3a0/0x420
[ 85.150006][ T5331] __sys_sendmmsg+0x227/0x430
[ 85.152096][ T5331] ? __pfx___sys_sendmmsg+0x10/0x10
[ 85.154405][ T5331] ? rcu_is_watching+0x15/0xb0
[ 85.156536][ T5331] __x64_sys_sendmmsg+0xa0/0xc0
[ 85.158697][ T5331] do_syscall_64+0xfa/0xfa0
[ 85.160711][ T5331] ? lockdep_hardirqs_on+0x9c/0x150
[ 85.162921][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.165560][ T5331] ? clear_bhb_loop+0x60/0xb0
[ 85.167677][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.170263][ T5331] RIP: 0033:0x7fda9958f749
[ 85.172225][ T5331] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 85.180375][ T5331] RSP: 002b:00007fda9a4ba038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 85.184030][ T5331] RAX: ffffffffffffffda RBX: 00007fda997e5fa0 RCX: 00007fda9958f749
[ 85.187590][ T5331] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003
[ 85.191031][ T5331] RBP: 00007fda99613f91 R08: 0000000000000000 R09: 0000000000000000
[ 85.194485][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 85.197887][ T5331] R13: 00007fda997e6038 R14: 00007fda997e5fa0 R15: 00007fff85f46718
[ 85.201364][ T5331]
[ 85.203081][ T5331] Kernel Offset: disabled
[ 85.204878][ T5331] Rebooting in 86400 seconds..