15:49:53 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:49:53 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(0x0, 0x4000) r1 = dup3(0xffffffffffffffff, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:49:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 643.012254] dccp_close: ABORT with 2028 bytes unread [ 643.069077] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:49:56 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:49:56 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:49:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:49:56 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:49:56 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(0xffffffffffffffff, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 645.420565] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:49:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:49:56 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 645.613455] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:49:56 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:49:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 645.832566] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:49:56 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:49:56 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:49:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 646.181366] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:49:59 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:49:59 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:49:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:49:59 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 648.531294] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 648.565102] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:49:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 648.705917] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:49:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 648.929226] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:49:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:49:59 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 649.106415] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:49:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:49:59 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:49:59 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 649.358753] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 649.470064] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:02 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:02 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:02 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 651.609575] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 651.868117] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 651.989271] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:02 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, 0x0, 0x0) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:03 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:03 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:05 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:05 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, 0x0, 0x0) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:05 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 654.679174] validate_nla: 4 callbacks suppressed [ 654.679184] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 654.800379] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 654.980956] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:05 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 655.037537] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 655.164035] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:06 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:06 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 655.494781] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:08 executing program 2: r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:08 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:08 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:08 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:08 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 657.730144] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:08 executing program 2: r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 657.778586] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:08 executing program 2: r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 657.980490] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:09 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:09 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:09 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 658.496408] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:09 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:09 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:11 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:11 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:11 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:11 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:11 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 660.789312] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:12 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:12 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)='\n\\-') r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:12 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:12 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 661.569504] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:12 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:14 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:14 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:14 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x0) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:14 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 663.858103] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 664.132649] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:15 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:15 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:15 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:15 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 664.647404] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:15 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:17 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:17 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:17 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:17 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 666.924857] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 666.993897] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:18 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:18 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 667.705449] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:18 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:18 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:18 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:18 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 667.827120] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:18 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:18 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 668.029118] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 668.236245] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:19 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:19 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:19 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 668.588408] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 668.623301] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:19 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:19 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 668.778860] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 668.836763] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:19 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, 0x0) r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:20 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:22 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:22 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:22 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:22 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:22 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 672.029678] validate_nla: 9 callbacks suppressed [ 672.029688] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:22 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 672.203784] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 672.316186] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:25 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:25 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:25 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:25 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:25 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 674.715228] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 674.920050] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 675.085056] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:25 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r1 = dup3(r0, 0xffffffffffffffff, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 675.218557] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 675.332409] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 675.425610] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 675.585762] dccp_close: ABORT with 2028 bytes unread 15:50:28 executing program 0: r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:28 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:28 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:28 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:28 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:28 executing program 0: r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 677.815147] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:28 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:28 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 677.926909] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:28 executing program 0: r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:28 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r1 = dup3(r0, 0xffffffffffffffff, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 678.083081] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 678.213313] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:29 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:29 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:29 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:29 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:29 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 678.701230] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:29 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 678.890808] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:29 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 679.062971] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:29 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 679.193317] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:30 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:30 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:30 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:30 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:30 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 679.591366] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:30 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:30 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 679.826284] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:30 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:31 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:31 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:31 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:31 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:31 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:31 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:31 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:31 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:32 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:32 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:32 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:32 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:32 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:32 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:32 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:33 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x3, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:33 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:33 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:33 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 682.357085] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x7, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:33 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:33 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x9, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:33 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:50:33 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) [ 682.764515] netlink: 5 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:33 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:33 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x10, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:33 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x4000000, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:33 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) [ 683.199030] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x14, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 683.256762] validate_nla: 18 callbacks suppressed [ 683.256771] netlink: 'syz-executor.4': attribute type 15 has an invalid length. 15:50:34 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:34 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) r1 = dup3(0xffffffffffffffff, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 683.301854] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 683.574935] dccp_close: ABORT with 2028 bytes unread 15:50:34 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x18, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:34 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x25, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 683.659601] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 683.765034] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:34 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:34 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:34 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:34 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x39, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:34 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:34 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000240), 0x4) [ 684.122440] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:34 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:35 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x53, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:35 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:35 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:35 executing program 4: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000000c0)={0x0, 0x6, 0x4, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\b\x00\x00y'}, 0x0, 0x0, @userptr, 0x4}) 15:50:35 executing program 4: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x803, 0x0) syncfs(r0) ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, 0x0) pipe2(0x0, 0x4000) r1 = dup2(r0, r0) write$P9_RSTATFS(r1, 0x0, 0x0) dup(0xffffffffffffffff) socket$unix(0x1, 0x0, 0x0) pipe(0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RWALK(0xffffffffffffffff, 0x0, 0x0) r2 = gettid() chdir(0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x39, 0x0, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) tkill(r2, 0x1000000000016) [ 684.552433] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:37 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:37 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:50:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x3e0, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:37 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:50:37 executing program 4: pivot_root(0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = getpid() sched_setattr(r0, &(0x7f0000000180)={0x0, 0x2}, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x20400040c2, 0x0) r2 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r1, r2, 0x0, 0x10000) 15:50:37 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 687.135625] audit: type=1800 audit(1552146637.835:76): pid=30183 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.4" name="file0" dev="sda1" ino=17432 res=0 [ 687.169418] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:37 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) [ 687.180812] audit: type=1804 audit(1552146637.835:77): pid=30183 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir447922653/syzkaller.kPnHBI/846/file0" dev="sda1" ino=17432 res=1 15:50:38 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:50:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x3, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x4, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:38 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:50:38 executing program 3: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) [ 687.919980] audit: type=1804 audit(1552146638.615:78): pid=30215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir447922653/syzkaller.kPnHBI/846/file0" dev="sda1" ino=17432 res=1 15:50:40 executing program 2: 15:50:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x5, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:40 executing program 5: syz_execute_func(&(0x7f0000000280)="3666440f50f564ff0941c3c4c27d794e0026f2470f1f40003e0f1110c442019dcc") clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f00000003c0)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000180), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x176dd) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000380)=[@window={0x3, 0x0, 0x800}, @mss], 0x2037) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)}, 0x0) 15:50:40 executing program 3: socket$vsock_stream(0x28, 0x1, 0x0) semget$private(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000400)='./file0\x00', 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000000440)) clock_nanosleep(0x0, 0x0, &(0x7f0000000180)={0x0, 0x1c9c380}, &(0x7f00000007c0)) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x50, r0, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 15:50:40 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:40 executing program 4: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000000c0)={0x0, 0x4, 0x4, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\b\x00\x00y'}, 0x0, 0x0, @userptr, 0x4}) 15:50:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x6, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:41 executing program 5: 15:50:41 executing program 4: 15:50:41 executing program 2: 15:50:41 executing program 4: 15:50:41 executing program 2: 15:50:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x8, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:41 executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000000), 0x0) 15:50:41 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) io_setup(0x5, &(0x7f00000000c0)) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r2 = dup2(r0, r1) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, &(0x7f0000000000)) 15:50:41 executing program 3: socket$vsock_stream(0x28, 0x1, 0x0) semget$private(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000400)='./file0\x00', 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000000440)) clock_nanosleep(0x0, 0x0, &(0x7f0000000180)={0x0, 0x1c9c380}, &(0x7f00000007c0)) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x50, r0, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 15:50:41 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:41 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0xffffffffffffffff) 15:50:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x9, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="34000000000005"], 0x7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f000002eff0)={0x32b, &(0x7f0000000000)=[{}]}, 0x10) 15:50:41 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x1e, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e00000084000000000000009500000000000000cb0497154ec2e22ec22e7e402119f65ff9f65059e9434d6371d992cc8396c45e171119b73d373aa3cc2370cccd2d2e677bdd2b0250c0b99241dfa37bb690acc8950fc7f388b82d62bcf23688647d0f6e081c5981463ff173d661a64b8d6952fda695eeabca4fcd4b67c970b833f3c721b9176409b07e1523d6b32ae37f63020826ba14e23abedd42a4eb6c544ffdc6e8e9bfc8364315fadc6037085b889325cea80b2dc03295c45bf16d237f3deb758b4a14e9b27bd9a4e8d41ec2f3c90755f628305f1295a94e7601ebec9dd74c71aa5b1c44eed0247e36b0"], 0x0}, 0x48) 15:50:41 executing program 2: socket$vsock_stream(0x28, 0x1, 0x0) semget$private(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000400)='./file0\x00', 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000000440)) clock_nanosleep(0x0, 0x0, &(0x7f0000000180)={0x0, 0x1c9c380}, &(0x7f00000007c0)) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x50, r0, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 15:50:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0xa, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:41 executing program 5: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000240)) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:50:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0xb, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000240)) read$FUSE(r0, &(0x7f0000000380), 0x1000) [ 691.620233] dccp_close: ABORT with 2028 bytes unread 15:50:42 executing program 3: socket$vsock_stream(0x28, 0x1, 0x0) semget$private(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000400)='./file0\x00', 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000000440)) clock_nanosleep(0x0, 0x0, &(0x7f0000000180)={0x0, 0x1c9c380}, &(0x7f00000007c0)) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x50, r0, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 15:50:42 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000240)) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:50:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x10, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:42 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:42 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x11, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:42 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x12, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x13, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x14, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:43 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000), 0x4000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r3, 0x4004700c, 0x349) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000003) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r6, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r6, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r6, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:43 executing program 3: socket$vsock_stream(0x28, 0x1, 0x0) semget$private(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000400)='./file0\x00', 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000000440)) clock_nanosleep(0x0, 0x0, &(0x7f0000000180)={0x0, 0x1c9c380}, &(0x7f00000007c0)) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x50, r0, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 15:50:43 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x39, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x53, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:45 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000), 0x4000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r3, 0x4004700c, 0x349) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000003) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r6, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r6, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r6, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:45 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x63, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:45 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:45 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000240)) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:50:45 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x103, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x301, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:46 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000), 0x4000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r3, 0x4004700c, 0x349) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000003) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r6, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r6, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r6, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:46 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:46 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000240)) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:50:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x7ffffff2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x3, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 695.875583] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:48 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:48 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x5, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:48 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) dup3(r1, r0, 0x80000) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:48 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000240)) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:50:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x6, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 698.090885] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:48 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x9, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 698.425108] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:49 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:49 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0xa, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:49 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) dup3(r1, r0, 0x80000) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 698.737200] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0xb, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:51 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:51 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:50:51 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:50:51 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) dup3(r1, r0, 0x80000) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0xf, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 701.103109] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x10, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:51 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) [ 701.218542] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 701.368145] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:52 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x11, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:52 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:50:52 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) dup3(r1, r0, 0x80000) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000380), 0x1000) [ 701.778883] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:52 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000380), 0x1000) 15:50:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x12, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:52 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 702.006408] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000380), 0x1000) 15:50:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x13, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:53 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:50:53 executing program 2: r0 = socket$inet_sctp(0x2, 0x5, 0x84) connect$inet(r0, &(0x7f0000000380)={0x2, 0x4e24, @empty}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4, @multicast2}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000400)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x4, 0x37}, 0x90) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000180)=@generic={0x1, 0x5c, 0x9}) r2 = socket$caif_stream(0x25, 0x1, 0x4) setsockopt$CAIFSO_LINK_SELECT(r2, 0x116, 0x7f, &(0x7f0000000200)=0xf7, 0x4) syz_init_net_socket$ax25(0x6, 0x3, 0xfa) pipe(&(0x7f0000007400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$nfc_llcp(r3, &(0x7f0000000300)={0x27, 0x1, 0x0, 0x4, 0x401, 0x2, "9dc14b83ce339d0971023965ed620c41746778858ca4195a8cff2b6e0afda51f4fda1334961de15dfe2320b5249870faef85fbf516f94019a8a524827d98e2", 0x1}, 0x60) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000007440)={@loopback, @loopback, 0x0}, &(0x7f0000007480)=0xc) r6 = socket$kcm(0x10, 0x0, 0x10) sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)="2e0000002c00815fe45ae087185082cf0124b0eba06ec4000141000000000017000040030000000051894d965b2f", 0x2e}], 0x1}, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r3, 0x6685) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f00000018c0)={'icmp6\x00'}, &(0x7f0000001900)=0x1e) sendmsg$xdp(r4, &(0x7f0000007640)={&(0x7f00000074c0)={0x2c, 0x6, r5, 0xb}, 0x10, &(0x7f0000007600)=[{&(0x7f00000075c0)="e6b525542618dedb599256d098d4aa0a123e10958539df0c1be0afa8eda045accaffa5fa61de53a348b72e33135f152ce4ac9f225a", 0x35}], 0x1, 0x0, 0x0, 0x40000}, 0x8011) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000680)=ANY=[@ANYBLOB="00000000000000000000ffff000000070000000000000000000000000000000000000000ffffffffffffffffffffffffff000000000000ffffffffffffffffff626f6e645f736c6176655f30000000007465616d5f736c6176655f3100000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000204000000000000000000000000000000f00038010000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000008000000000000004800534e50540000000000000000000000000000000000000000000000000000ac1e0101000000000000000000000000ff0200000000000000000000000000011d1638ff00000000fe88000000000000000000000000000100000000000000000000000000000000ff000000ffffffff00000000ffffff00ffffffffff00000000000000000000006966623000000000000000000000000062617461647630000000000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bf00000101000000000000000000000000000000c80010010000000000000000000000000000000000000000000000004800444e50540000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ff020000000000000000000000000001191d000000000000fe8000000000000000000000000000aaff010000000000000000000000000001ffffffff00000000000000ffffffff00000000ffffffff00ffffffffffffff0076657468315f746f5f626f6e640000006c617062300000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000003f00620004000000000000000000000000000000c800080100000000000000000000000000000000000000000000000040005450524f5859000000000000000000000000000000000000000000000001000000000000000000000000000000000000ffffac1414aa4e22000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000bbffffff00ffffff00ffffffffffffffffffffffff00000000ffffffff00000000726f73653000000000000000000000006272696467655f736c6176655f30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff01080000000000000000000000000000001801600100000000000000000000000000000000000000000000000028006d6800000000000000000000000000000000000000000000000000000000ff060000000007002800727066696c7465720000000000000000000000000000000000000000000009000000000000004800534e5054000000000000000000000000000000000000000000000000000000000000000000000000000000000001e00000020000000000000000000000002f0304000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00000000000000000000180140010000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000007000000000000002800727066696c74657200000000000000000000000000000000000000000000020000000000909e28004e4651554555450000000000000000000000000000000000000000000000ffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000000000"], 0x1) r7 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) sendto$llc(r7, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x1a, 0x200000000304, 0x0, 0xffffffffffffffff, 0x0, 0x0, @random="0387945b9f37"}, 0x10) setsockopt$sock_timeval(r7, 0x1, 0x14, &(0x7f0000000080)={0x0, 0x2710}, 0x10) recvmmsg(r7, &(0x7f000000cd80)=[{{&(0x7f000000be80)=@ll, 0x80, 0x0, 0x0, 0x0, 0x0, 0xffffffff}}, {{0x0, 0xffffffffffffff6b, &(0x7f000000c600)=[{&(0x7f000000c3c0)=""/56, 0x38}, {&(0x7f000000c400)=""/74, 0x4a}, {&(0x7f000000c480)=""/114, 0x72}, {&(0x7f000000c500)=""/132, 0x84}, {&(0x7f000000c5c0)=""/15, 0xf}], 0x5, 0x0, 0x0, 0x7d48bddc}, 0x100000001}, {{0x0, 0x0, &(0x7f000000c700)=[{&(0x7f000000c680)=""/90, 0x5a}], 0x1, &(0x7f0000000640)=""/16, 0x10, 0x7f}, 0x200}, {{&(0x7f000000c780)=@ethernet, 0x80, &(0x7f000000ca00)=[{&(0x7f000000c800)=""/210, 0xd2}, {&(0x7f000000c900)=""/92, 0x34}, {&(0x7f000000c980)=""/82, 0x52}], 0x3, &(0x7f000000ca40)=""/40, 0x28}, 0x206}, {{&(0x7f000000ca80)=@pppol2tpv3in6, 0x80, &(0x7f000000cd00)=[{&(0x7f000000cb00)=""/255, 0xff}, {&(0x7f000000cc00)}, {&(0x7f000000cc40)=""/180, 0xb4}], 0x3, &(0x7f000000cd40)=""/5, 0x5, 0x2}, 0xffffffff}], 0x5, 0x20, 0x0) [ 702.384162] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x14, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:53 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 702.576926] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x2f, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:53 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 702.757906] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:53 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x39, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 702.964879] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:53 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:53 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:50:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x53, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:53 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) [ 703.295224] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 15:50:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x301, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:54 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:50:54 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:54 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x9, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:54 executing program 3: openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000380), 0x1000) [ 703.673055] netlink: 'syz-executor.1': attribute type 9 has an invalid length. 15:50:54 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:54 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:54 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:54 executing program 3: openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000380), 0x1000) 15:50:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xa, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:54 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:54 executing program 3: openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000380), 0x1000) 15:50:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x10, 0x3}]]}}}]}, 0x3c}}, 0x0) [ 704.338271] netlink: 'syz-executor.1': attribute type 16 has an invalid length. 15:50:55 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:55 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:55 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) 15:50:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x14, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:55 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:55 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) 15:50:55 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x39, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:55 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) 15:50:55 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:55 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:55 executing program 3: r0 = socket$inet_sctp(0x2, 0x5, 0x84) connect$inet(r0, &(0x7f0000000380)={0x2, 0x4e24, @empty}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4, @multicast2}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000400)={r1, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x4, 0x37}, 0x90) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000180)=@generic={0x1, 0x5c, 0x9}) r2 = socket$caif_stream(0x25, 0x1, 0x4) setsockopt$CAIFSO_LINK_SELECT(r2, 0x116, 0x7f, &(0x7f0000000200)=0xf7, 0x4) syz_init_net_socket$ax25(0x6, 0x3, 0xfa) pipe(&(0x7f0000007400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$nfc_llcp(r3, &(0x7f0000000300)={0x27, 0x1, 0x0, 0x4, 0x401, 0x2, "9dc14b83ce339d0971023965ed620c41746778858ca4195a8cff2b6e0afda51f4fda1334961de15dfe2320b5249870faef85fbf516f94019a8a524827d98e2", 0x1}, 0x60) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, 0x0, &(0x7f0000007480)) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)="2e0000002c00815fe45ae087185082cf0124b0eba06ec4000141000000000017000040030000000051894d965b2f", 0x2e}], 0x1}, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r3, 0x6685) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f00000018c0)={'icmp6\x00'}, &(0x7f0000001900)=0x1e) sendmsg$xdp(r4, &(0x7f0000007640)={&(0x7f00000074c0)={0x2c, 0x6, 0x0, 0xb}, 0x10, &(0x7f0000007600)=[{&(0x7f00000075c0)="e6b525542618dedb599256d098d4aa0a123e10958539df0c1be0afa8eda045accaffa5fa61de53a348b72e33135f152ce4ac9f225a", 0x35}], 0x1, 0x0, 0x0, 0x40000}, 0x8011) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000680)=ANY=[@ANYBLOB="00000000000000000000ffff000000070000000000000000000000000000000000000000ffffffffffffffffffffffffff000000000000ffffffffffffffffff626f6e645f736c6176655f30000000007465616d5f736c6176655f3100000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000204000000000000000000000000000000f00038010000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000008000000000000004800534e50540000000000000000000000000000000000000000000000000000ac1e0101000000000000000000000000ff0200000000000000000000000000011d1638ff00000000fe88000000000000000000000000000100000000000000000000000000000000ff000000ffffffff00000000ffffff00ffffffffff00000000000000000000006966623000000000000000000000000062617461647630000000000000000000000000000000000000ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bf00000101000000000000000000000000000000c80010010000000000000000000000000000000000000000000000004800444e50540000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ff020000000000000000000000000001191d000000000000fe8000000000000000000000000000aaff010000000000000000000000000001ffffffff00000000000000ffffffff00000000ffffffff00ffffffffffffff0076657468315f746f5f626f6e640000006c617062300000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000003f00620004000000000000000000000000000000c800080100000000000000000000000000000000000000000000000040005450524f5859000000000000000000000000000000000000000000000001000000000000000000000000000000000000ffffac1414aa4e22000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000bbffffff00ffffff00ffffffffffffffffffffffff00000000ffffffff00000000726f73653000000000000000000000006272696467655f736c6176655f30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff01080000000000000000000000000000001801600100000000000000000000000000000000000000000000000028006d6800000000000000000000000000000000000000000000000000000000ff060000000007002800727066696c7465720000000000000000000000000000000000000000000009000000000000004800534e5054000000000000000000000000000000000000000000000000000000000000000000000000000000000001e00000020000000000000000000000002f0304000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00000000000000000000180140010000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000007000000000000002800727066696c74657200000000000000000000000000000000000000000000020000000000909e28004e4651554555450000000000000000000000000000000000000000000000ffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000000000"], 0x1) r6 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) sendto$llc(r6, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x1a, 0x200000000304, 0x0, 0xffffffffffffffff, 0x0, 0x0, @random="0387945b9f37"}, 0x10) setsockopt$sock_timeval(r6, 0x1, 0x14, &(0x7f0000000080)={0x0, 0x2710}, 0x10) recvmmsg(r6, &(0x7f000000cd80)=[{{&(0x7f000000be80)=@ll, 0x80, 0x0, 0x0, 0x0, 0x0, 0xffffffff}}, {{0x0, 0xffffffffffffff6b, &(0x7f000000c600)=[{&(0x7f000000c3c0)=""/56, 0x38}, {&(0x7f000000c400)=""/74, 0x4a}, {&(0x7f000000c480)=""/114, 0x72}, {&(0x7f000000c500)=""/132, 0x84}, {&(0x7f000000c5c0)=""/15, 0xf}], 0x5, 0x0, 0x0, 0x7d48bddc}, 0x100000001}, {{0x0, 0x0, &(0x7f000000c700)=[{&(0x7f000000c680)=""/90, 0x5a}], 0x1, &(0x7f0000000640)=""/16, 0x10, 0x7f}, 0x200}, {{&(0x7f000000c780)=@ethernet, 0x80, &(0x7f000000ca00)=[{&(0x7f000000c800)=""/210, 0xd2}, {&(0x7f000000c900)=""/92, 0x34}, {&(0x7f000000c980)=""/82, 0x52}], 0x3, &(0x7f000000ca40)=""/40, 0x28}, 0x206}, {{&(0x7f000000ca80)=@pppol2tpv3in6, 0x80, &(0x7f000000cd00)=[{&(0x7f000000cb00)=""/255, 0xff}, {&(0x7f000000cc00)}, {&(0x7f000000cc40)=""/180, 0xb4}], 0x3, &(0x7f000000cd40)=""/5, 0x5, 0x2}, 0xffffffff}], 0x5, 0x20, 0x0) 15:50:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x53, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x63, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:56 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x301, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:56 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:56 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x6c, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x5f5e0ff, 0x3}]]}}}]}, 0x3c}}, 0x0) 15:50:56 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:56 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 706.304872] netlink: 'syz-executor.0': attribute type 15 has an invalid length. 15:50:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x2}]]}}}]}, 0x3c}}, 0x0) 15:50:57 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 706.532246] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x4}]]}}}]}, 0x3c}}, 0x0) 15:50:57 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:57 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 706.764317] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x7}]]}}}]}, 0x3c}}, 0x0) 15:50:57 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:57 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 707.054312] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x8}]]}}}]}, 0x3c}}, 0x0) 15:50:58 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:58 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 707.430918] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:58 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 707.486476] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:58 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0xa}]]}}}]}, 0x3c}}, 0x0) 15:50:58 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 707.713758] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:58 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x10}]]}}}]}, 0x3c}}, 0x0) [ 708.001748] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:50:58 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x14}]]}}}]}, 0x3c}}, 0x0) 15:50:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x39}]]}}}]}, 0x3c}}, 0x0) 15:50:59 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d024031") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:50:59 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:50:59 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:01 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x53}]]}}}]}, 0x3c}}, 0x0) 15:51:01 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:01 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:01 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) r1 = dup3(0xffffffffffffffff, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:01 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 710.634858] validate_nla: 2 callbacks suppressed [ 710.634868] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x103}]]}}}]}, 0x3c}}, 0x0) 15:51:01 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 710.861991] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x301}]]}}}]}, 0x3c}}, 0x0) [ 711.134239] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:01 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x801}]]}}}]}, 0x3c}}, 0x0) [ 711.384449] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0xe000}]]}}}]}, 0x3c}}, 0x0) [ 711.518147] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:04 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:04 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:04 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:04 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x9}}, 0x0) 15:51:04 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:04 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0xf}}, 0x0) 15:51:04 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:04 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000), 0x4000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r3, 0x4004700c, 0x349) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000003) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r6, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r6, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r6, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x10}}, 0x0) 15:51:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x53}}, 0x0) [ 714.346395] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:07 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:07 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000), 0x4000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r3, 0x4004700c, 0x349) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000003) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r6, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r6, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r6, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x63}}, 0x0) 15:51:07 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:07 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:07 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 716.766132] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0xc0}}, 0x0) [ 717.171745] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0xec0}}, 0x0) [ 717.475691] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x33fe0}}, 0x0) 15:51:08 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:08 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:08 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 717.670294] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 717.729017] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:10 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:10 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:10 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x200001bc}}, 0x0) 15:51:10 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:10 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:10 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x7ffff000}}, 0x0) 15:51:10 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:10 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:10 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0xfffffdef}}, 0x0) 15:51:10 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x2}, 0x0) 15:51:11 executing program 4: syz_open_dev$sndtimer(0x0, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 720.441490] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x3}, 0x0) [ 720.628258] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:11 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:13 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:13 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x5}, 0x0) 15:51:13 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000), 0x4000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r3, 0x4004700c, 0x349) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000003) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r6, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r6, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r6, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:13 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:13 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 722.924935] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:13 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x8}, 0x0) 15:51:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x9}, 0x0) [ 723.109063] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:13 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x10}, 0x0) [ 723.211427] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:13 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) dup3(r1, r0, 0x80000) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 723.260036] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:16 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x14}, 0x0) 15:51:16 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:16 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:16 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:16 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x25}, 0x0) 15:51:16 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:16 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x39}, 0x0) 15:51:16 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:16 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) dup3(r1, r0, 0x80000) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:16 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x53}, 0x0) 15:51:17 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:17 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:17 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:17 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x103}, 0x0) 15:51:17 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:17 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:17 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) dup3(r1, r0, 0x80000) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x300}, 0x0) 15:51:17 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:17 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x301}, 0x0) 15:51:18 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:18 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:18 executing program 3: perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:18 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x2800}, 0x0) 15:51:18 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) dup3(r1, r0, 0x80000) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:18 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:18 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) bind$inet6(0xffffffffffffffff, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x8200}, 0x0) 15:51:18 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:18 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x7ffffff9}, 0x0) 15:51:18 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) dup3(r1, r0, 0x80000) r2 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r2, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0xffffff1f}, 0x0) 15:51:19 executing program 3: perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:19 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:19 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x2}, 0x0) [ 728.624313] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x3}, 0x0) [ 728.856077] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:19 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) bind$inet6(0xffffffffffffffff, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4}, 0x0) 15:51:19 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 729.133032] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 729.224365] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x5}, 0x0) 15:51:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 729.472304] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:20 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:20 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:20 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6}, 0x0) 15:51:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x7}, 0x0) [ 729.688237] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:20 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) bind$inet6(0xffffffffffffffff, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:20 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 729.821611] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x8}, 0x0) 15:51:20 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:20 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 730.135765] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xa}, 0x0) 15:51:20 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 730.324504] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:21 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:21 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xc}, 0x0) 15:51:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xe}, 0x0) 15:51:21 executing program 4: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 730.573294] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:21 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf}, 0x0) 15:51:21 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:23 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:23 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) bind$inet6(0xffffffffffffffff, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x10}, 0x0) 15:51:23 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) bind$inet6(0xffffffffffffffff, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r3, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:23 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:23 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x48}, 0x0) 15:51:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4c}, 0x0) 15:51:24 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x60}, 0x0) 15:51:24 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:24 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 733.743753] validate_nla: 6 callbacks suppressed [ 733.743762] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:26 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x68}, 0x0) 15:51:26 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:26 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:26 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:26 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 736.340781] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 736.381953] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6c}, 0x0) [ 736.628398] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x74}, 0x0) 15:51:27 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:27 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:27 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:27 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 736.836176] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:30 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x7a}, 0x0) 15:51:30 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:30 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:30 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:30 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 739.387723] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf0}, 0x0) 15:51:30 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 739.585564] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x103}, 0x0) 15:51:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x300}, 0x0) [ 739.743726] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x301}, 0x0) 15:51:30 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 739.832158] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 739.832434] dccp_close: ABORT with 2028 bytes unread 15:51:30 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 739.939408] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:33 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x500}, 0x0) 15:51:33 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:33 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:33 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:33 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 742.488384] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 742.535859] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x600}, 0x0) [ 742.694825] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:33 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x700}, 0x0) 15:51:33 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 742.935198] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xa00}, 0x0) 15:51:33 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 743.080356] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:36 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xc00}, 0x0) 15:51:36 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:36 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:36 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:36 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xe00}, 0x0) [ 745.567540] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf00}, 0x0) [ 745.676701] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:36 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x1, 0x0) write$P9_RCLUNK(r1, &(0x7f00000000c0)={0xffffffffffffff30}, 0x7) [ 745.805958] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:36 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x2000}, 0x0) 15:51:36 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 745.952416] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:39 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x3f00}, 0x0) 15:51:39 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:51:39 executing program 4: bpf$MAP_CREATE(0x0, 0x0, 0xfe0a) syz_open_dev$usb(0x0, 0x0, 0x20000) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) futex(&(0x7f00000006c0)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x40) socket$can_raw(0x1d, 0x3, 0x1) setsockopt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) close(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) timer_delete(0x0) unshare(0x40000000) ioprio_get$uid(0x5, 0x0) sysfs$2(0x2, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, 0x0) 15:51:39 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:39 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:39 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 748.614820] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4000}, 0x0) 15:51:39 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 748.766154] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:39 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) accept4(r0, 0x0, 0x0, 0x0) 15:51:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4800}, 0x0) 15:51:39 executing program 2: bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x2}, 0xe) [ 748.920964] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:42 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:42 executing program 4: memfd_create(0x0, 0x200000000000001) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) listen(r0, 0x10001) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cachefiles\x00', 0x200000, 0x0) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000480), &(0x7f0000000500)=0x4) r2 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x0, 0x2) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000180)={0x0, 0x4, 0x43}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000100)={r4, 0x4, 0x101}, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r3, 0x4008ae48, &(0x7f0000000380)=0x106000) r5 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r5, 0x29, 0x41, 0x0, 0x0) bind$inet6(r5, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4}, 0x1c) socket$inet6_sctp(0xa, 0x5, 0x84) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/dlm_plock\x00', 0x7fffb, 0x0) getsockopt$inet_dccp_buf(r6, 0x21, 0xe, &(0x7f0000000080)=""/127, &(0x7f0000000140)=0x7f) r7 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) ioctl$BLKRESETZONE(r6, 0x40101283, &(0x7f0000000240)={0x3, 0x6}) r9 = socket$xdp(0x2c, 0x3, 0x0) ioctl$TUNGETVNETHDRSZ(r6, 0x800454d7, &(0x7f0000000280)) fcntl$F_GET_FILE_RW_HINT(r3, 0x40d, &(0x7f0000000400)) setsockopt$XDP_TX_RING(r9, 0x11b, 0x3, &(0x7f00000000c0)=0x2, 0xc6) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/17, 0x2000, 0x1000}, 0x48) ioctl$VIDIOC_G_OUTPUT(r2, 0x8004562e, &(0x7f0000000340)) setsockopt$XDP_UMEM_FILL_RING(r9, 0x11b, 0x5, &(0x7f00000008c0)=0x8, 0x4) bind$xdp(r9, &(0x7f0000000300)={0x2c, 0x2, r8}, 0x10) 15:51:42 executing program 2: bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x2}, 0xe) 15:51:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4c00}, 0x0) 15:51:42 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:42 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:42 executing program 2: bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x2}, 0xe) [ 751.719016] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x5865}, 0x0) 15:51:42 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:42 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:51:42 executing program 4: memfd_create(0x0, 0x200000000000001) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) listen(r0, 0x10001) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cachefiles\x00', 0x200000, 0x0) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000480), &(0x7f0000000500)=0x4) r2 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x0, 0x2) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000180)={0x0, 0x4, 0x43}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000100)={r4, 0x4, 0x101}, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r3, 0x4008ae48, &(0x7f0000000380)=0x106000) r5 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r5, 0x29, 0x41, 0x0, 0x0) bind$inet6(r5, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4}, 0x1c) socket$inet6_sctp(0xa, 0x5, 0x84) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/dlm_plock\x00', 0x7fffb, 0x0) getsockopt$inet_dccp_buf(r6, 0x21, 0xe, &(0x7f0000000080)=""/127, &(0x7f0000000140)=0x7f) r7 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) ioctl$BLKRESETZONE(r6, 0x40101283, &(0x7f0000000240)={0x3, 0x6}) r9 = socket$xdp(0x2c, 0x3, 0x0) ioctl$TUNGETVNETHDRSZ(r6, 0x800454d7, &(0x7f0000000280)) fcntl$F_GET_FILE_RW_HINT(r3, 0x40d, &(0x7f0000000400)) setsockopt$XDP_TX_RING(r9, 0x11b, 0x3, &(0x7f00000000c0)=0x2, 0xc6) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/17, 0x2000, 0x1000}, 0x48) ioctl$VIDIOC_G_OUTPUT(r2, 0x8004562e, &(0x7f0000000340)) setsockopt$XDP_UMEM_FILL_RING(r9, 0x11b, 0x5, &(0x7f00000008c0)=0x8, 0x4) bind$xdp(r9, &(0x7f0000000300)={0x2c, 0x2, r8}, 0x10) [ 751.921629] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6000}, 0x0) 15:51:42 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:51:42 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:42 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 752.075633] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6558}, 0x0) [ 752.224653] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:43 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:43 executing program 4: memfd_create(0x0, 0x200000000000001) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) listen(r0, 0x10001) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cachefiles\x00', 0x200000, 0x0) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000480), &(0x7f0000000500)=0x4) r2 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x0, 0x2) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000180)={0x0, 0x4, 0x43}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000100)={r4, 0x4, 0x101}, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r3, 0x4008ae48, &(0x7f0000000380)=0x106000) r5 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r5, 0x29, 0x41, 0x0, 0x0) bind$inet6(r5, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4}, 0x1c) socket$inet6_sctp(0xa, 0x5, 0x84) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/dlm_plock\x00', 0x7fffb, 0x0) getsockopt$inet_dccp_buf(r6, 0x21, 0xe, &(0x7f0000000080)=""/127, &(0x7f0000000140)=0x7f) r7 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) ioctl$BLKRESETZONE(r6, 0x40101283, &(0x7f0000000240)={0x3, 0x6}) r9 = socket$xdp(0x2c, 0x3, 0x0) ioctl$TUNGETVNETHDRSZ(r6, 0x800454d7, &(0x7f0000000280)) fcntl$F_GET_FILE_RW_HINT(r3, 0x40d, &(0x7f0000000400)) setsockopt$XDP_TX_RING(r9, 0x11b, 0x3, &(0x7f00000000c0)=0x2, 0xc6) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/17, 0x2000, 0x1000}, 0x48) ioctl$VIDIOC_G_OUTPUT(r2, 0x8004562e, &(0x7f0000000340)) setsockopt$XDP_UMEM_FILL_RING(r9, 0x11b, 0x5, &(0x7f00000008c0)=0x8, 0x4) bind$xdp(r9, &(0x7f0000000300)={0x2c, 0x2, r8}, 0x10) 15:51:43 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x2}, 0xe) 15:51:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6800}, 0x0) 15:51:43 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:43 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 752.601383] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:43 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x2}, 0xe) 15:51:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6c00}, 0x0) 15:51:43 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0x7, 0x0, &(0x7f0000000080)) 15:51:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x7400}, 0x0) [ 752.728584] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:43 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x2}, 0xe) 15:51:43 executing program 4: prlimit64(0x0, 0x7, &(0x7f0000000180), 0x0) socket$unix(0x1, 0x0, 0x0) gettid() getpeername(0xffffffffffffffff, 0x0, 0x0) inotify_init1(0x0) timer_create(0x0, 0x0, 0x0) inotify_init() [ 752.874136] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:44 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, 0x0, 0x0) 15:51:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x7a00}, 0x0) 15:51:44 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:44 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000080)={{}, {0x0, 0x6}}) 15:51:44 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:44 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 753.469690] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:44 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, 0x0, 0x0) 15:51:44 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_setup(0x1, &(0x7f0000000040)=0x0) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/current\x00', 0x2, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x200000, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x20c0, 0x0) accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000200), 0x0) pipe2$9p(&(0x7f0000000640), 0x0) io_submit(r1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xfffffffffffffdb1, &(0x7f0000000040)=[{0x0}], 0x1, 0x0, 0x323}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) unshare(0x400) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@remote, @in6}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xe8) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 15:51:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x8100}, 0x0) 15:51:44 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, 0x0, 0x0) [ 753.798022] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf000}, 0x0) 15:51:44 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000000)={0x0, 0xb00e, 0x0, 0x4}, 0xc) 15:51:44 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) io_setup(0x1, &(0x7f0000000040)=0x0) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/current\x00', 0x2, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x200000, 0x40) openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x20c0, 0x0) accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000200), 0x80800) pipe2$9p(&(0x7f0000000640), 0x0) io_submit(r1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x7) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00\x00\x00\x00\x00\x05\x00', 0x4001}) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) unshare(0x400) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@remote, @in6}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xe8) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000780)=ANY=[], 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=ANY=[@ANYBLOB="74000000000301002abd7000fcdbdf2503000004600053007c046d0a8ad623fd1676c91180be2f94a294d553d87494fc40606835df63b0ef8c737597d8d6e7c761bc57ec16bae3f2ddd5c1b768ee6e792ad4c1f961d21f338a07796477c6486c31c8cc715adca5bfdf6def1944e11259703bd700568140f9994a4c9d342c600a8e63586986ba32ba1705ae387202671cc0c4a306367ecae21206e698ca8adeee3d6ceb3069556d4ddd5724211a5d839e3d8b21f07c8f363718e4fbd92d2e9b0d9d2d7b"], 0xc3}, 0x1, 0x0, 0x0, 0x4000}, 0x8004) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r5, 0x4c80, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) [ 754.021837] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xfeff}, 0x0) 15:51:45 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:45 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x48) setuid(r1) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) 15:51:45 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:45 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xff0f}, 0x0) 15:51:45 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:45 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xfffe}, 0x0) 15:51:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x34000}, 0x0) 15:51:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x40000}, 0x0) 15:51:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x400300}, 0x0) 15:51:45 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:45 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf0ffff}, 0x0) 15:51:46 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x1000000}, 0x0) 15:51:46 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:46 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:46 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x1030000}, 0x0) 15:51:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x2000000}, 0x0) 15:51:46 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x3000000}, 0x0) 15:51:46 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:46 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x3010000}, 0x0) 15:51:47 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:47 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:47 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:47 executing program 2: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r5, 0x4004700c, 0x349) r6 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r6, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r6, 0x20000003) r7 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r7, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r8 = accept4(r6, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r8, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r8, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r8, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) 15:51:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4000000}, 0x0) 15:51:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x5000000}, 0x0) 15:51:47 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 756.754746] validate_nla: 17 callbacks suppressed [ 756.754756] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6000000}, 0x0) 15:51:47 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 756.952784] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x7000000}, 0x0) 15:51:47 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 757.089080] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 757.116642] dccp_close: ABORT with 2028 bytes unread 15:51:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x8000000}, 0x0) [ 757.266395] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:48 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x0, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:48 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, 0x0) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:48 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xa000000}, 0x0) 15:51:48 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, 0x0) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:48 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:48 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 757.479539] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xc000000}, 0x0) [ 757.636942] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:48 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:48 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:48 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:48 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:48 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xe000000}, 0x0) 15:51:48 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:48 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 15:51:48 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 758.298634] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:49 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf000000}, 0x0) 15:51:49 executing program 4: ioctl(0xffffffffffffffff, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) timerfd_create(0x0, 0x80000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x2000000000000001, 0x8210000000000084) bind$inet6(r3, &(0x7f00002aafe4)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) listen(r3, 0x0) r4 = socket$inet6_sctp(0xa, 0x400005, 0x84) sendto$inet6(r4, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x40000000100, 0x0) ioctl$RTC_IRQP_SET(r6, 0x4004700c, 0x349) r7 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r7, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r7, 0x20000003) r8 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r8, &(0x7f0000419000)={0xa, 0x4e20, 0x1f4, @loopback}, 0x1c) r9 = accept4(r7, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000040)=0x80, 0x0) write$binfmt_elf64(r9, &(0x7f0000001300)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065de00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff4000000000000000000000000000000000000000000000000ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018f3eb7afd9995826d89cbe8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043ee40e966c62f82e4fcdc96ed2d4f95616dc23050816251768870c4636f0fcdff6ffd8c3ceb70a69cb9f89a571a082ee889"], 0x7ec) setsockopt$inet6_opts(r9, 0x29, 0x37, &(0x7f0000000a80)=ANY=[@ANYBLOB="a945d4856e0c93889d1a0e5384276411cab760f094e759b7987f690c81fb140651913ddc8e93dc2538038984836cabfc4789c558a21d932bfc4c869670cacd748c95f16e58a57f191bd366969e232f408f7632bd8e83c47905f00000000000000000"], 0x1) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000080)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) [ 758.459379] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:49 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:49 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x10000000}, 0x0) 15:51:49 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, 0x0) r1 = dup2(r0, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x20001, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000440)='./file0\x00', 0x0) setreuid(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x1) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000400)='./file0/file0\x00', &(0x7f00000006c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 758.740142] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:49 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:49 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:49 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x20000000}, 0x0) 15:51:49 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:49 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(0x0, 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:49 executing program 4 (fault-call:1 fault-nth:0): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:51:49 executing program 2 (fault-call:1 fault-nth:0): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) [ 759.222468] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 759.222789] FAULT_INJECTION: forcing a failure. [ 759.222789] name failslab, interval 1, probability 0, space 0, times 1 15:51:50 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x3f000000}, 0x0) [ 759.266200] CPU: 1 PID: 1088 Comm: syz-executor.2 Not tainted 5.0.0+ #14 [ 759.273075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 759.282430] Call Trace: [ 759.285141] dump_stack+0x172/0x1f0 [ 759.288838] should_fail.cold+0xa/0x15 [ 759.292741] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 759.297916] ? ___might_sleep+0x163/0x280 [ 759.302115] __should_failslab+0x121/0x190 [ 759.306422] should_failslab+0x9/0x14 [ 759.310268] kmem_cache_alloc_trace+0x2d1/0x760 15:51:50 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 759.315018] snd_pcm_oss_change_params_locked+0x1a7/0x3750 [ 759.320716] ? __mutex_lock+0x3cd/0x1310 [ 759.324806] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 759.330614] ? mutex_trylock+0x1e0/0x1e0 [ 759.334726] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 759.340570] ? fsnotify+0x811/0xbc0 [ 759.344213] ? fsnotify+0xbc0/0xbc0 [ 759.344236] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 759.344253] snd_pcm_oss_read+0x326/0x6a0 [ 759.353091] __vfs_read+0x8d/0x110 [ 759.353105] ? snd_pcm_oss_read2+0x3f0/0x3f0 [ 759.353122] vfs_read+0x194/0x3e0 [ 759.368636] ksys_read+0xea/0x1f0 [ 759.368655] ? kernel_write+0x120/0x120 [ 759.368687] ? do_syscall_64+0x26/0x610 [ 759.368704] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 759.380132] ? do_syscall_64+0x26/0x610 [ 759.380168] __x64_sys_read+0x73/0xb0 [ 759.380184] do_syscall_64+0x103/0x610 [ 759.380200] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 759.393315] RIP: 0033:0x457f29 [ 759.393330] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 759.393338] RSP: 002b:00007f2afe648c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 759.393353] RAX: ffffffffffffffda RBX: 00007f2afe648c90 RCX: 0000000000457f29 [ 759.393362] RDX: 0000000000001000 RSI: 0000000020000380 RDI: 0000000000000003 [ 759.393371] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 759.393380] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2afe6496d4 15:51:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x40000000}, 0x0) 15:51:50 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:50 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 759.393388] R13: 00000000004c4b4e R14: 00000000004d8568 R15: 0000000000000004 15:51:50 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x48000000}, 0x0) 15:51:50 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x4000) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f00000000c0)=0x3, 0x4) chdir(&(0x7f0000000180)='./file0\x00') bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) socket$inet_icmp_raw(0x2, 0x3, 0x1) 15:51:50 executing program 2 (fault-call:1 fault-nth:1): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:51:50 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 760.106832] FAULT_INJECTION: forcing a failure. [ 760.106832] name failslab, interval 1, probability 0, space 0, times 0 [ 760.181142] CPU: 1 PID: 1119 Comm: syz-executor.2 Not tainted 5.0.0+ #14 [ 760.188025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 760.197403] Call Trace: [ 760.200006] dump_stack+0x172/0x1f0 [ 760.203683] should_fail.cold+0xa/0x15 [ 760.207590] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 760.212709] ? ___might_sleep+0x163/0x280 [ 760.216867] __should_failslab+0x121/0x190 [ 760.221120] should_failslab+0x9/0x14 [ 760.224943] kmem_cache_alloc_trace+0x2d1/0x760 [ 760.229661] snd_pcm_oss_change_params_locked+0x1df/0x3750 [ 760.235322] ? __mutex_lock+0x3cd/0x1310 [ 760.239414] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 760.245213] ? mutex_trylock+0x1e0/0x1e0 [ 760.249308] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 760.254848] ? fsnotify+0x811/0xbc0 [ 760.258488] ? fsnotify+0xbc0/0xbc0 [ 760.262133] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 760.267330] snd_pcm_oss_read+0x326/0x6a0 [ 760.271506] __vfs_read+0x8d/0x110 [ 760.275076] ? snd_pcm_oss_read2+0x3f0/0x3f0 [ 760.279530] vfs_read+0x194/0x3e0 [ 760.283021] ksys_read+0xea/0x1f0 [ 760.286485] ? kernel_write+0x120/0x120 [ 760.290471] ? do_syscall_64+0x26/0x610 [ 760.294447] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 760.299826] ? do_syscall_64+0x26/0x610 [ 760.303844] __x64_sys_read+0x73/0xb0 [ 760.307667] do_syscall_64+0x103/0x610 [ 760.311567] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 760.316756] RIP: 0033:0x457f29 [ 760.319951] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 760.338856] RSP: 002b:00007f2afe648c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 760.346568] RAX: ffffffffffffffda RBX: 00007f2afe648c90 RCX: 0000000000457f29 [ 760.353838] RDX: 0000000000001000 RSI: 0000000020000380 RDI: 0000000000000003 [ 760.361141] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 760.368420] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2afe6496d4 15:51:51 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4c000000}, 0x0) [ 760.375694] R13: 00000000004c4b4e R14: 00000000004d8568 R15: 0000000000000004 15:51:51 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:51 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x60000000}, 0x0) 15:51:51 executing program 2 (fault-call:1 fault-nth:2): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:51:51 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0xfffffffffffffffd, {0x0, 0xfffffffffffffffd, 0xfffffffffffffffd}, 0x2000000000}, 0xe) [ 760.727105] FAULT_INJECTION: forcing a failure. [ 760.727105] name failslab, interval 1, probability 0, space 0, times 0 [ 760.745175] CPU: 0 PID: 1256 Comm: syz-executor.2 Not tainted 5.0.0+ #14 [ 760.752046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 760.761400] Call Trace: [ 760.763999] dump_stack+0x172/0x1f0 [ 760.767647] should_fail.cold+0xa/0x15 [ 760.771587] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 760.776725] ? ___might_sleep+0x163/0x280 [ 760.780898] __should_failslab+0x121/0x190 [ 760.785147] should_failslab+0x9/0x14 [ 760.788957] kmem_cache_alloc_trace+0x2d1/0x760 [ 760.793651] snd_pcm_oss_change_params_locked+0x217/0x3750 [ 760.799288] ? __mutex_lock+0x3cd/0x1310 [ 760.803368] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 760.809175] ? mutex_trylock+0x1e0/0x1e0 [ 760.813252] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 760.818804] ? fsnotify+0x811/0xbc0 [ 760.822446] ? fsnotify+0xbc0/0xbc0 [ 760.826084] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 760.831283] snd_pcm_oss_read+0x326/0x6a0 [ 760.835447] __vfs_read+0x8d/0x110 [ 760.838992] ? snd_pcm_oss_read2+0x3f0/0x3f0 [ 760.843425] vfs_read+0x194/0x3e0 [ 760.846920] ksys_read+0xea/0x1f0 [ 760.850391] ? kernel_write+0x120/0x120 [ 760.854375] ? do_syscall_64+0x26/0x610 [ 760.858356] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 760.863722] ? do_syscall_64+0x26/0x610 [ 760.867706] __x64_sys_read+0x73/0xb0 [ 760.871513] do_syscall_64+0x103/0x610 [ 760.875427] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 760.881065] RIP: 0033:0x457f29 [ 760.884264] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 760.903191] RSP: 002b:00007f2afe648c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 760.910905] RAX: ffffffffffffffda RBX: 00007f2afe648c90 RCX: 0000000000457f29 [ 760.918203] RDX: 0000000000001000 RSI: 0000000020000380 RDI: 0000000000000003 [ 760.925490] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 760.933267] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2afe6496d4 [ 760.940550] R13: 00000000004c4b4e R14: 00000000004d8568 R15: 0000000000000004 15:51:51 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:51 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x65580000}, 0x0) 15:51:51 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:51:51 executing program 2 (fault-call:1 fault-nth:3): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:51:51 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x101402, 0x0) setsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000080)=0x100000000, 0x4) 15:51:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x68000000}, 0x0) [ 761.262158] FAULT_INJECTION: forcing a failure. [ 761.262158] name failslab, interval 1, probability 0, space 0, times 0 [ 761.273585] CPU: 1 PID: 1360 Comm: syz-executor.2 Not tainted 5.0.0+ #14 [ 761.280430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 761.289786] Call Trace: [ 761.292398] dump_stack+0x172/0x1f0 [ 761.296046] should_fail.cold+0xa/0x15 [ 761.299968] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 761.305088] ? ___might_sleep+0x163/0x280 [ 761.309338] __should_failslab+0x121/0x190 [ 761.313598] should_failslab+0x9/0x14 [ 761.317406] __kmalloc+0x2dc/0x740 [ 761.321003] ? unwind_get_return_address+0x61/0xa0 [ 761.325961] ? __save_stack_trace+0x8a/0xf0 [ 761.330337] ? constrain_params_by_rules+0x118/0x1180 [ 761.335562] constrain_params_by_rules+0x118/0x1180 [ 761.340598] ? save_stack+0xa9/0xd0 [ 761.344232] ? save_stack+0x45/0xd0 [ 761.347909] ? kmem_cache_alloc_trace+0x151/0x760 [ 761.352759] ? snd_pcm_oss_change_params_locked+0x217/0x3750 15:51:52 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:52 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6c000000}, 0x0) 15:51:52 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000380)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e23, 0x3ff, @dev={0xfe, 0x80, [], 0x15}, 0xffff0000}}}, 0x84) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x0, {0x0, 0x5, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xfffffffffffffffe}, 0xe) write$P9_RSTAT(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="710000007d010000006a00c8aa370f00000801000000030000000000000000000010090000000700000000000100000000000f0076626f786e6574316d643573756d400000280063707573657400626f786e6574307472757374656470726f637365637572697479266367726f7570a1fe"], 0x71) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x802}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x40, r3, 0x302, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x52}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x63}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x4080}, 0x4000) r4 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x0, 0x2) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') write$P9_ROPEN(r4, &(0x7f0000000100)={0x18, 0x71, 0x2, {{0x6, 0x2, 0x6}, 0x9}}, 0x18) sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x823000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='B\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="020027bd7000fedbdf250600000014000200080002004e240000080002004e220000"], 0x28}, 0x1, 0x0, 0x0, 0x4001}, 0x80) [ 761.358590] ? snd_pcm_mmap_status_fault+0x240/0x240 [ 761.363710] ? vfs_read+0x194/0x3e0 [ 761.367336] ? ksys_read+0xea/0x1f0 [ 761.370960] ? __x64_sys_read+0x73/0xb0 [ 761.374953] ? do_syscall_64+0x103/0x610 [ 761.379020] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 761.379078] ? __lock_acquire+0x548/0x3fb0 [ 761.379136] ? is_bpf_text_address+0xac/0x170 [ 761.393180] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 761.398219] ? snd_interval_refine+0x42a/0x720 [ 761.402811] snd_pcm_hw_refine+0xbf9/0xf20 [ 761.407066] ? constrain_params_by_rules+0x1180/0x1180 [ 761.412385] ? snd_pcm_oss_change_params_locked+0x217/0x3750 [ 761.418249] ? rcu_read_lock_sched_held+0x110/0x130 [ 761.423282] ? memset+0x32/0x40 [ 761.426567] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 761.432117] ? _snd_pcm_hw_param_min+0x29d/0x560 [ 761.436910] snd_pcm_oss_change_params_locked+0x6c2/0x3750 [ 761.442557] ? __mutex_lock+0x3cd/0x1310 [ 761.446636] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 761.452439] ? mutex_trylock+0x1e0/0x1e0 [ 761.456506] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 761.462087] ? fsnotify+0x811/0xbc0 [ 761.465728] ? fsnotify+0xbc0/0xbc0 [ 761.469388] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 761.474589] snd_pcm_oss_read+0x326/0x6a0 [ 761.478758] __vfs_read+0x8d/0x110 [ 761.482307] ? snd_pcm_oss_read2+0x3f0/0x3f0 [ 761.486722] vfs_read+0x194/0x3e0 [ 761.490188] ksys_read+0xea/0x1f0 [ 761.493650] ? kernel_write+0x120/0x120 [ 761.497630] ? do_syscall_64+0x26/0x610 [ 761.501609] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 761.506997] ? do_syscall_64+0x26/0x610 [ 761.510985] __x64_sys_read+0x73/0xb0 [ 761.514794] do_syscall_64+0x103/0x610 [ 761.518694] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 761.523888] RIP: 0033:0x457f29 [ 761.527114] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 761.546015] RSP: 002b:00007f2afe648c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 761.553730] RAX: ffffffffffffffda RBX: 00007f2afe648c90 RCX: 0000000000457f29 15:51:52 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 761.560996] RDX: 0000000000001000 RSI: 0000000020000380 RDI: 0000000000000003 [ 761.568271] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 761.575547] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2afe6496d4 [ 761.582822] R13: 00000000004c4b4e R14: 00000000004d8568 R15: 0000000000000004 15:51:52 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x74000000}, 0x0) 15:51:52 executing program 2 (fault-call:1 fault-nth:4): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:51:52 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) select(0x40, &(0x7f0000000040)={0x6, 0x1ff, 0x400, 0x800, 0x6, 0xfffffffffffffff7, 0xcf4, 0x45}, &(0x7f0000000080)={0x81, 0x9, 0xbdb, 0x0, 0x721, 0x100, 0x9ad3, 0x687}, &(0x7f00000000c0)={0x7, 0x101, 0x2, 0x101, 0x2, 0x401, 0xff, 0x9}, &(0x7f0000000100)={0x0, 0x2710}) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0xfffffffffffffffc, {0x0, 0x0, 0x7fff, 0x0, 0x4, 0xfffffffffffffffe}}, 0xe) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/btrfs-control\x00', 0x1, 0x0) [ 761.972228] validate_nla: 10 callbacks suppressed [ 761.972237] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 761.985563] FAULT_INJECTION: forcing a failure. [ 761.985563] name failslab, interval 1, probability 0, space 0, times 0 [ 762.059234] CPU: 0 PID: 1497 Comm: syz-executor.2 Not tainted 5.0.0+ #14 [ 762.066093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 762.075449] Call Trace: [ 762.078056] dump_stack+0x172/0x1f0 [ 762.081705] should_fail.cold+0xa/0x15 [ 762.085618] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 762.090738] ? ___might_sleep+0x163/0x280 [ 762.094902] __should_failslab+0x121/0x190 [ 762.099168] should_failslab+0x9/0x14 [ 762.102987] kmem_cache_alloc_trace+0x2d1/0x760 [ 762.107675] ? memset+0x32/0x40 [ 762.110981] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 762.116544] ? _snd_pcm_hw_param_min+0x29d/0x560 [ 762.121316] snd_pcm_oss_change_params_locked+0x75c/0x3750 [ 762.126967] ? __mutex_lock+0x3cd/0x1310 [ 762.131052] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 762.136857] ? mutex_trylock+0x1e0/0x1e0 [ 762.140969] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 762.146544] ? fsnotify+0x811/0xbc0 [ 762.150182] ? fsnotify+0xbc0/0xbc0 [ 762.153824] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 762.159018] snd_pcm_oss_read+0x326/0x6a0 [ 762.163180] __vfs_read+0x8d/0x110 [ 762.166723] ? snd_pcm_oss_read2+0x3f0/0x3f0 [ 762.171143] vfs_read+0x194/0x3e0 [ 762.174609] ksys_read+0xea/0x1f0 [ 762.178067] ? kernel_write+0x120/0x120 [ 762.182047] ? do_syscall_64+0x26/0x610 [ 762.186021] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 762.191396] ? do_syscall_64+0x26/0x610 [ 762.195379] __x64_sys_read+0x73/0xb0 [ 762.199186] do_syscall_64+0x103/0x610 [ 762.203083] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 762.208281] RIP: 0033:0x457f29 [ 762.211479] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 762.230415] RSP: 002b:00007f2afe648c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 762.238139] RAX: ffffffffffffffda RBX: 00007f2afe648c90 RCX: 0000000000457f29 [ 762.245402] RDX: 0000000000001000 RSI: 0000000020000380 RDI: 0000000000000003 [ 762.252668] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 15:51:52 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = shmget$private(0x0, 0x3000, 0x78001040, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_INFO(r1, 0xe, &(0x7f0000000040)=""/74) [ 762.259930] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2afe6496d4 [ 762.267195] R13: 00000000004c4b4e R14: 00000000004d8568 R15: 0000000000000004 15:51:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x7a000000}, 0x0) 15:51:53 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 762.481941] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:53 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x80000, 0x0) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{0x2, 0x4e21, @empty}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}}, 0x4, {0x2, 0x4e23, @empty}, 'netdevsim0\x00'}) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x4, 0x400) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000080)) 15:51:53 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x81000000}, 0x0) [ 762.638561] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x88a8ffff}, 0x0) 15:51:53 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1000) 15:51:53 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:53 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x480000, 0x0) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000080)='ppp0ppp0md5sum\x00') bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 762.827483] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x9effffff}, 0x0) 15:51:53 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x80, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000140)={r2, 0x2}) r3 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xfffffffffffffffb, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r3, 0xc0106418, &(0x7f0000000080)={0x20, 0x901d, 0xffff, 0x8000, 0x1c, 0x29fa}) [ 763.105019] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf0ffffff}, 0x0) 15:51:54 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 763.330078] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:54 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) 15:51:54 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xfeff0000}, 0x0) 15:51:54 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x4) [ 763.605257] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:54 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2c, &(0x7f0000000100)={0x8, {{0x2, 0x4e23, @local}}, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xc}}}}, 0x108) sendto$inet6(r1, &(0x7f0000000080)="c0", 0x1, 0x8042, &(0x7f00000000c0)={0xa, 0x4e20, 0x80000001, @dev={0xfe, 0x80, [], 0x25}, 0x100}, 0x1c) fcntl$getownex(r1, 0x10, &(0x7f0000000240)) 15:51:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xff0f0000}, 0x0) 15:51:54 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 763.813957] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:54 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) r2 = getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x5, 0x2400000000000000, 0x80000000000000, 0x80000000, 0x0, 0x4, 0x812, 0xd, 0x0, 0x93, 0x4, 0x101, 0x8, 0x6, 0x1, 0xf66, 0x4, 0x9, 0x9, 0x8, 0x4, 0x7, 0x0, 0x6, 0x80000000, 0x1, 0xfff, 0x1, 0x7ff, 0x1c4, 0x4, 0x8, 0x2, 0x20, 0x80, 0x1, 0x0, 0x1, 0x0, @perf_config_ext={0xffff, 0x2}, 0x20020, 0x9, 0x2, 0x6, 0x5, 0x0, 0x289}, r2, 0x4, 0xffffffffffffff9c, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 15:51:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xffffa888}, 0x0) 15:51:54 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 764.011468] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xfffff000}, 0x0) [ 764.233131] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:55 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:55 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:55 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:55 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000040)={'ip6erspan0\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x24}}}) 15:51:55 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0xf) 15:51:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xffffff7f}, 0x0) 15:51:55 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:51:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xffffff9e}, 0x0) 15:51:55 executing program 4: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x10, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x1}, 0x48) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000280), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(0xffffffffffffffff, 0x810c5701, &(0x7f0000000600)) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='tmpfs\x00', 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x49a, 0x8000) getpeername$unix(r1, &(0x7f0000000340)=@abs, &(0x7f00000002c0)=0x6e) r2 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r2) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469fb09e86d39a42e55723d2e3a66696c65302c776f0600000072"]) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x1fffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rmdir(&(0x7f0000000000)='./file0/file0\x00') ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000740)={0x7ff, 0x8, 0x587602a5, 0x197, [], [], [], 0x1, 0x9, 0x0, 0xd4e1, "9acbda68b9e6eaf201883ed741b93e44"}) ioctl$KVM_S390_INTERRUPT_CPU(0xffffffffffffffff, 0x4010ae94, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x2}, 0xe) 15:51:55 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:51:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xfffffff0}, 0x0) 15:51:55 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:51:55 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:55 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x500) 15:51:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4000000000000}, 0x0) 15:51:55 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cachefiles\x00', 0x600800, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f00000001c0)=@assoc_value={0x0, 0xffff}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000240)={0x4, 0x820b, 0x2, 0x1d, r2}, &(0x7f0000000280)=0x10) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x6c}, &(0x7f00000000c0)=0x8) setsockopt$inet_mreq(r3, 0x0, 0x27, &(0x7f0000000140)={@local, @loopback}, 0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000100)={0x80000001, 0xfffffffffffffffa, 0x200, 0x10000, 0x0, 0x7, 0x9, 0x40, r4}, 0x20) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:51:55 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:55 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:56 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) readlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/82, 0x52) 15:51:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x40030000000000}, 0x0) 15:51:56 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) writev(r0, &(0x7f0000001100)=[{&(0x7f0000000040)="ea9f1eb442816b17792ec9702c80e04ad1d36a2db581aabf68fc6c8c213dff5b193dcc296cee54f2ff34533e0393f7e6852acd07cd17e81cb8f8448f3efe4bb4", 0x40}, {&(0x7f0000000080)="aa59338f18cde177fc30cfaba609ba8ad96928721c7e3aa6ea9e5fc8fa9a88df60815457f5bfdf7ffca1750a5b2414f4b9c82821583e7857", 0x38}, {&(0x7f00000000c0)="53743e1dab6b97c85fea0f4e8b8076a95d72a83ba2c6635d1e0e26", 0x1b}, {&(0x7f0000000100)="b0c239f894d934f2df9cd07b36dde53eb02c83dc529d65e2455e71ef752c922d8fb19ace798227db28ac3c8d76b3b4b22ec56e30251ef8c594e99589efd92f5de32cc574f31be6f726125ff727313e9d1881e107b014019bdfdd2faa18d767b21c7b27c7c5cc4a92073575603fb094dc4c9ecf24249f167baedbdb069f6b89ccb250ad3ea969e3d24daa4787759373b434bb99529c2b062db69ba7c6f0542c5e997b7ffe0f6f1ff69a1974cc277c2c071a0fc24df7993f01e74c22663a130536a194ab659d37fbabdf26b7a248873181401faa7458b41809e90f1a8218666b307264ac64562dfc61f26d5776c237bc70ab2090379169c72b77e97e44d19db3d3f018e559b986bd6bc8a2c1c7cec99b4154bebf2459b4c01e237ce415f2586f97f819a1b28da4afea7cc7283932712f481fa0c0bcdba2a14a81a8bd969d49d9532444770f23f8430308947ce6552437778ea0abcd87df958d4a93b599ed32ba1f8b03a5c6a1ee685ffa356d66d237822e3c7a22ac9a794877a365f8bac976e36aac01b4acb064619c674f714e793b56ac2b1308e46e18318f10799a95152f9f1198e4725eb62ccd932f70023c221ad46590b1b9da51ee3a00360b559bf0ea224196da4fadec164d828253649c94048432b681df7d380864b02d8ae61f9eb51452be3f7bc4b124de84f83d021ab76ba46fc3694a318f2334ca79da89106e07c7fa6ef6d5a0b5ca14205f06024b25489ae4a29cbfef14436026943bbe400174b339a11db959ac391541737a72a4f47254100c0274c5c7815d77129e1f66b18987b4637314ffd9860e3813e193cce429ca4ffc81b71f4bc5bea66027a3a3b1ec1de73ac79840a6bcd174291a0eec77d2706a4b0fdff86306d0adbd6b25e292646412dfd6489b2fc1547124e0f26f6d7d29122f1a31d9caa829f585fdd96127a9993ad9f188fb00540f57a17071c2c754cdb79379ec2272b8c8ac705e1a1a1489ccf0e0b7787fa69c804135ac6b944b84c66edf65ff744c0291fb5d5e5904081ed1368263c088e61bdab25b75125cb31169490e589217efb851951f9f04f36ee4c93dea43685aa1af1acfe4eea7b18d9b0ee1093143cc39f5cbfc6d826d3d5f2b7f3b784e015c2610ef404d4bdd07c832f6f4594c91110ec542fe518efd8a0a5fa2c675b967cbf2c3e350e46a14e19e6efa32d5f3aba669a0b285229125646a98fdba68e2db70a60830874822ee716c4c2e71a6f9ecf2f467dbf4f10e300144e76a6984edc26d9c13f04d75e6a55753c2ac84b29f92243ed00cd619e17690b847d14d56a72a54d20dac328a02e32e855e2127da85be0fda95e25aea570a5ef4817358bb38408e11da18c2e1ddc4ec5196b7086a036312f8ee1424a62e66350b2fef72709411afd8ad9ff84bcfacd33f5fcafd498b482fa117abea2cf60a278c5323022d80b64943bd4b810522dc270e424a5aefa41dba49dbaf50da398a979bafdda4bc59de30e387774e4fd11e0141e35e35bd58cb3a648bc01cca336a7cbcdc85b533d4104336ed4a3a3b54a8b4f6afcf6630bfeaf7ef278e5d2a6e7a83e965686829aa9460707dc1128c24dd4bad047ca05727d1efb4062ec4c20763efe61f86cf8f5f53992b09a94e6e63b2247399f7776bf8b289eefa8a03eb944d56e1db7610f7c79f6bab4d091fb7acae5bba8297cdcf0ec7751a91b40d592ea5951aa2465bef73c565ccac090c75f943813165ecbf689a30a395e188d62e06c05751b6a896deb39e93d44d603905989dd4b335421e8da16ddb5802a325f62430d47dd999a3eed2864884b16f4d5a9db8d17c590ab67c1aa328020b69bcdf203cf0b0da332b116723c457ca1de4fc45cdd51b621dbc09bbcd2b327483d4ada9d5271f1219e0997ee1b2563e3d1c91dc8f1e8e2525930dc6ec00fb88826ada40481799bfedb9aa981a8ca609f6724bd120081ff846729a6d77ce563c792f94f9623c762c40f5ee5884f7ffa3467b10a00e2b22dc13df1b2071625e6e08fadd6cedbd8416606c30d2c4a44dd14a6f6e0076ebc4db0d4b04a36d080c5dd32bb1dc1119f3b73dffb0aa7e6e7e4b18fc2f479f11e14914ec55db66bacca7a1fb1aa5fb88689bce70ac2a07ccb6862ffdbdd35e1419fd3b5b3670d7dd63e023791a7c29561c848299c6b7f640e804342e27d952b6329e017429ade261dd660b5aa464fcad52f0b2c5eebca8b4031ace4a9aa40d8e8768e39e2e757a1cb26befc313637bd9050bd58d501b6ba5d9d26dcea4597c1586ea0f636be1ae82c901296a129c041c71b1285314c30f2fbd4709888cb767565ae31adc5ec8526367555ad0acd568bbb7fc9c02cb789d5a56cd8ac901b3fba41fd462fe4dba93e882c0c011af7b1dca07a79247b32c64a74fa9a8444f8621e46d537d902c1bc9b3cbdc2f74dde9835f502d4336f69803dd85cd705f508e27be1d70589427819a3374ac10db04933786306818a34ba97492c476f6105ecdca6e2160133a695fb4f6c741891b910a293fef8f0e3222d6dc822a6c00da26c9d8e3d9b35252a78d2c11d19d118e5ccc6f6d5979faf0e7ee12ae0ee7738154e8e62d123fb01b601f603d968bf0fc515afc5e4430ffc252cc084e6912a5f45cb1382e0e4729622fbef6c3a87cf763f3d52df9ef1f8efe35f22a3234384e8408cb6d81757c68a46eb7ec113b2603e8a8c9a818318e0e2b44828ca92d843a57167aab841ed4b9a6bd98a3d0cfd9a23772d7da1bb639b5fb7d2e6ce927c0dd52ed3f99acf02d3b9f0d9f2c5f2fd2138384979dbaa35a0d272847a76fbdc24e7a46fef1a357979fdda36d67591afffc0459b3cb9eeb5e6547edab789ad7bb28207b12be5963444734c4bd0bd200cc70d37c4c8b4e8582cd430d2d0402c811b0f81b08f6ee1afddb12d690dee8e0fd98b1b637e2cc9b17b302fd25fbab5de99a41d6fcdd51b66d654fcc4da9df56afe28d264f704ec9e1af5d4568ec17c3c589adcfaf6f155c7f8b363329a96b2f8c8cc071850754b291e0f01926fedfc7dcab1f3d468b6098f093b7ab185407984093f3e80478c07128425760176bef2c0a719e8db6572f80152c3ca1be9e3e151d484dbb9153b18ff3620ac1283e7ca23da84691efed6005c69c21dd2bb136eb502bf0eef25b0b5d19814f621dcfe9a7385ba03aebeef79dbd366bef7bab0fc51792fa50afb9a89ff4996a5641c8bd27a4c8feb75557eb724d5db3018093fb5b97cdd79c99ddc600f58bfb6028645b7ba910c05a9d30f8a20212fa5ed6e1d0def7858ee29f67471c5d34d1aad96e64b6505de940def6003cf3abda83985970586ec49ed40d830eb9cf11b1f940df6d554cbf415bf0be92afdc1b18bcfa5fb3584de01bb8f9ee5fa56ab2ae0c0facd4d82f66b2894969e10804e4887e4637d07cd86a08ebacb4e4d992e17ba5bdc762ef0bc1e7dbce328bff2243a376c154017b1c06c3f98a149b5f7fd77f09a90d0851bb11a4fef3bf62f9b95691c8b8ece6f99aa19b1cbfe9dc8093c4d214075de56f3ad433bb5b73d187c6bdef064e2f0b0fab210369e2031f85ace97aee7c25d993ff6fa974fc33d87d599b5703f9119897c9dc3ad592700d242848dae16e69bbbc38e9bb163545cef33c95999a8c87932e8f2c9557f757d452af2a3a4106469e922d72cb8cd342bfdebb3bd83f12338864b355b69c0c7ce15ea23a9985fc32302c808e40b09266e7530004d56e0413df39c6203c8de63f43147c202946c0fc27c40946fc23afe8095c817c883eebf88cd171e11dea6c1504f8bb07e1ae7af295b916194004c9fe6a523fe2adc94e9d1d11d199e7364c1dfc6caf7f890c62d818c704c9d67368a0711bebb50ba8b3153c94de7b832a064872f3daaa70b7c797b3c3a4b9dfe2a72081cd144b70eb680ff626022dbd38331ce5f9c91d1e06723e5b158149afb9c0118434b2e98a398cba3bf6dc4c2a3ac8adc3ccdf635d7f4276b3d53f106e29c2f276d4c149260593a4550be728d7ad7240a3e7758bf7b76a762fcc892f668145eef592891b1ab6ed150bb62528c37a467ce2b37826911907d05b2c2cb10d0bf3f7ef2ebc553c1919f88ec7f9582bda8e5967dcdffb65fdd2608f894a867adabedfe14627767fff2890db1f4a98289b8bf6046691532762ac4faedd2e5a22fce06c52f7a4958b7907eb4a037eb4ee4e88d7b73a63f0dceea8bcf26ad113f4d8f5dfccd988c83c846b153166a81f82cf61c846dcce99c21b5587ee6cfb9104cc93e75077d76228b7ef97148c2eaca48c968cf914af8ff12db2cafe02e7ea098c6abf1c083d6c94df5b74b9771c444239ce5c71030c31f33446950cf608814a1df92aa67d22712b156b296f4e76db2c2e139e730a99935e2d6379148fe01be3332143c869a4659246e67686daed8c9849846574a27c030996dbc6a80b25ce9cbfae1ffa3b4fcf2a8b2aa067240967869f7c011b17779637aa83d4b4c6b1b56f601f5c4da3717896f185668e1eb5dfdd72319231917062b88546c62208911525fcdd4ad5c0a26992399634b36133e5f62e78c2cbf4323e1a87ac3717ca92bf6580b46f2bb73f395fe10188f6b88b0ea0db1738f449f9b10ffd8193da3aada44331b76b25c75857d7ad13e1595f4d197b71e297e00b7eb910a2a985512aa66fb16d8a01df38f75c5840cacfdcd09ccf2056a9662ccb87c679f7b8743bbe41f2b7abd940775cb917daa7498329eb718bab51656c1d80279229f3ad1fec140756bdd44e946c8755097fc63d5a9f16bc9e53174f073c9187c36c0484418c07249c46595b0999278c063d965117bc85575008656c72ebd99eac4f6c01de75a63578914992f2d5dc619d9cca4fd8e09cef8862e1a1c343c22e692f0168b432174e1c6023612725bbad8a18a59a527d483054906b79c0fe4ee634829a09f261e01340f1e92567f087496e5733803afe1123bd99f3d91c4c0ab3a43732419111403e06e85fbaf97e1bbf79b1378d5cb224d2d53fce28bcd2b61a80b984fdc2bf88b970155cdd348f85a00932178df388d0df94bd3945413c4329d34b01fcbd3aaee390a715357640b593c44ae40de9dbe3ddc3c219731f1c46f57c322f2e37ef257c76583e39b6e3f5e2504a188bc1ab1ac0abe2546148a91b17463731913b5c8600c62abdd76b0f79fe1ca3c7783eb9a84c66d615b5cc0da6587f3b842b5d0dc506a26e028f13f00d4bcac2bb95702cec8262a6a4e705fc6f70bfcb00436467c1b7d3bb8424692de827c1b01677ee8f1fa4e765e588d5caa1beb720f46c435da316cd143f8a73fb4d1d11bfad3a71166b4799e06eea417f671e8119db083501b0c7921eb95026bfbd824996bc98d0b0c7201c781af2ec8aee7d78fef8feb065443af7d21d19fd7c741fadba50b8b124f26eaf9e8e1ea928c2c3bb91df4fa5bd1a8f441572a871f97b7c88b44c8af276c5bd846cbe4e29bf3967a3c1cb77e723888721f4798499e7749dcd29461188963d3ef8e73ad619c161aef3f3f39eddec528a72196c554081a1786f8602016e0cf855211cd3240337974077135b3cb4fcfa9a0312af552d29c7be3326840755487f50b1f3d46ead9418a074be70da828534434036f439548d5278ef85085ae27b245f0aeb0b8b61fbb4ac93c5355703f6b3bceb40c0ee22fd56a8fc4e710b29c8b5f31e3281b2764d99fa6c7ec18cb0184ce3d8e27260c01de005bb4c69b4e8d1f0382974c07c93e9ee27b24bfe71cae8fee3813fd94217a73879951e994b7bf89599cb634cdd174b63a9a247", 0x1000}], 0x4) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000001140), &(0x7f0000001180)=0x40) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f00000011c0)={'veth0_to_hsr\x00', {0x2, 0x4e22, @loopback}}) 15:51:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf0ffffffffffff}, 0x0) 15:51:56 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x700) 15:51:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x100000000000000}, 0x0) 15:51:56 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:56 executing program 4: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) 15:51:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x103000000000000}, 0x0) 15:51:56 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:57 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:57 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x0, 0x200) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x3fc976a2}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000100)={0x6, 0x8000, 0x20, 0x1, r2}, &(0x7f0000000140)=0x10) 15:51:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x200000000000000}, 0x0) 15:51:57 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0xa00) 15:51:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x300000000000000}, 0x0) 15:51:57 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) delete_module(&(0x7f00000000c0)='vmnet0posix_acl_accessvboxnet1vboxnet1\x00', 0x800) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x105100, 0x0) r3 = geteuid() getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) fsetxattr$system_posix_acl(r1, &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {0x1, 0x2}, [{0x2, 0x0, r3}], {0x4, 0x4}, [{0x8, 0x4, r4}], {}, {0x20, 0x4}}, 0x34, 0x3) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000080)=0x6, 0x4) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:51:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x301000000000000}, 0x0) 15:51:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x400000000000000}, 0x0) [ 767.136574] validate_nla: 15 callbacks suppressed [ 767.136582] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:57 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:57 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000340)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e22, 0x7, @local, 0x3}}, 0x7, 0x7fffffff}, &(0x7f0000000240)=0x90) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000280)={r2, 0x200}, &(0x7f00000002c0)=0x8) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x4000, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r3, 0x29, 0x2d, &(0x7f0000000080)={0x8, {{0xa, 0x4e21, 0x30, @mcast2, 0x6c}}}, 0x88) bind$bt_l2cap(r0, &(0x7f0000000140)={0x2, 0x5, {}, 0x0, 0xfffffffffffffffc}, 0xe) 15:51:57 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:57 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0xb00) 15:51:58 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x500000000000000}, 0x0) 15:51:58 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = shmget$private(0x0, 0x2000, 0x289, &(0x7f0000ffe000/0x2000)=nil) shmat(r1, &(0x7f0000ffd000/0x2000)=nil, 0x6000) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0xa0080, 0x0) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000080)={0x1, 0x0, [{0x1, 0x7, 0x0, 0x0, @msi={0x7, 0x7ff, 0x2}}]}) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f00000000c0)) [ 767.436045] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 767.548997] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x600000000000000}, 0x0) 15:51:58 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = accept4$x25(0xffffffffffffff9c, &(0x7f0000000040)={0x9, @remote}, &(0x7f0000000080)=0x12, 0x800) ioctl$SIOCX25GFACILITIES(r1, 0x89e2, &(0x7f00000000c0)) r2 = syz_open_dev$vcsn(&(0x7f0000002580)='/dev/vcs#\x00', 0x10001, 0x80000) connect$bt_sco(r2, &(0x7f00000025c0)={0x1f, {0x4, 0x4557, 0x9, 0x7, 0x3, 0x7}}, 0x8) [ 767.763249] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 767.823575] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:58 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0xc00) 15:51:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x700000000000000}, 0x0) 15:51:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="7100000076d4d6202f78317225ce3a791c9651b3023945e3b7daafa274b5724e59c360e8a6d61dfe065c96d0e854f22e7efe8b74b1f44dc6cf82c789a1cf2b5681e0089810ebb17903a0e2093b72903be5cd0ea7216acee2a12705710886b61b403c9b85cf8add6278a843ab44340aac1c15000000"], &(0x7f00000001c0)=0x79) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000100)={r1, 0x8, 0x6}, 0x273) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='nodev\x00', r0}, 0x10) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getpeername$inet(r0, &(0x7f0000000240)={0x2, 0x0, @initdev}, &(0x7f0000000280)=0x10) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f00000002c0)={r1, @in={{0x2, 0x4e20, @loopback}}}, 0x84) 15:51:58 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:58 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 768.122509] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x800000000000000}, 0x0) 15:51:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xa00000000000000}, 0x0) [ 768.269119] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:59 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:59 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}}, 0xe) [ 768.413127] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xc00000000000000}, 0x0) 15:51:59 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = getpgid(0xffffffffffffffff) ptrace(0xffffffffffffffff, r1) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:51:59 executing program 4: r0 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r1, &(0x7f0000000040)={0x2, 0x0, {0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x3f}, 0xe) 15:51:59 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0xd00) [ 768.629311] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xe00000000000000}, 0x0) 15:51:59 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x0, {0x0, 0x0, 0xfffffffffffffffe}}, 0xe) [ 768.872673] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:51:59 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:59 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:51:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf00000000000000}, 0x0) 15:51:59 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/current\x00', 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:52:00 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xe00000000000000}, 0x0) 15:52:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x1000000000000000}, 0x0) 15:52:00 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1001) 15:52:00 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x4080, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000000080)) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:52:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x2000000000000000}, 0x0) 15:52:00 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:00 executing program 4: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000040)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa}}, 0xe) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) 15:52:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x3f00000000000000}, 0x0) 15:52:00 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:00 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:00 executing program 4: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$selinux_validatetrans(r0, &(0x7f0000000080)={'system_u:object_r:dhcp_etc_t:s0', 0x20, 'system_u:object_r:auditctl_exec_t:s0', 0x20, 0x7, 0x20, 'unconfined\x00'}, 0x65) r1 = geteuid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000140)={{{@in=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}}}, &(0x7f0000000240)=0xe8) sendmsg$nl_netfilter(r0, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000280)={0x214, 0x6, 0x8, 0x2, 0x70bd25, 0x25dfdbfb, {0x7, 0x0, 0xa}, [@nested={0xac, 0x1d, [@typed={0x14, 0x75, @ipv6=@loopback}, @typed={0x8, 0x7e, @uid=r1}, @generic="e1edad7945a571027638b40f8b40a91bc0932cfb0b4cedaf973941d62f167da11eb54c8e2f4d88ff427f8a0dff07eea41f1a9914ac121e63a3b8b4977f5bb117686921ca1920d5d7b0e2142044087d2164aeb558398e9699b59d929a621711463039085dcfae8e98d4221bb17788d2ebd3cfd8ca657868", @typed={0x14, 0x7b, @ipv6=@rand_addr="b633b62b7c2aae8275cf5745a91e9134"}]}, @nested={0x154, 0x23, [@generic="65ea2db530e2787caa4f6760b428f84119f68476a9388ef0e402a48463d67add3d0724668f66d4e996c4be0ddbe86b0fd3085c62a7b08711bd88748f34e869cf7cd50ca8fc4fc20c9c12bf3776ade56fb62b83e0e8289821611653d4a63b191c040bf957561503a0f1513ed880c61d3de6bec218a708ffc0819633cd252618bc4f3d3a397ca5be1cb944214f84890e76027a59223848c420e6161b48745bad8dbcc905322407b8ed", @generic="4f5e1aab7a65dcf4d34bba600c7e35dbc7202581e062e5d19565478952843c9805226895d97e85d8d58155477be38f60d6b84aa1d86a47969c3673544197be0a13f729ec2dc6184d8e0ba498a06ce9809219b326b9f56913d926c66946b9a95c4dba2e09f4146166fdf47df7b208e0fdd2e7a672da36199e623f95539ca3dc4da52276592ba17778080293", @typed={0xc, 0x87, @u64=0x3}, @typed={0x8, 0x13, @uid=r2}, @typed={0x8, 0x39, @str='\x00'}]}]}, 0x214}, 0x1, 0x0, 0x0, 0x40011}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x2}, 0xe) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000540)={0x40, 0x6, 0x400, 0x1ff, "c3eab884dfa226e635891ffd10421414b64c2baed9f70ace3bd6fb65b557fb5b"}) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000580)=0x7ff) 15:52:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4000000000000000}, 0x0) 15:52:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4800000000000000}, 0x0) 15:52:01 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x6, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x101000, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f00000000c0)={0x9}, 0x1) r2 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)="dc112ef7aa73db63fce01bc06d94eb671152e310f596c99f13647f69cfbdba764ba49c9107221c2292b9f140f82ff387abe2d42da4852d412366e90831446e392521d641d55131d4ae837c3185db9461e504b1cb9f7fe5f36c1bf7a5a06184852a", 0x61, 0xfffffffffffffff8) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000200)='logon\x00', &(0x7f0000000240)=@secondary='builtin_and_secondary_trusted\x00') ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000080)) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:52:01 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1002) 15:52:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x4c00000000000000}, 0x0) 15:52:01 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0x1e8) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000080)='\x00', 0x1) 15:52:01 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x0, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6000000000000000}, 0x0) 15:52:01 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x0, {0x0, 0x2, 0x0, 0x0, 0x0, 0x1}, 0x1}, 0xe) 15:52:01 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:01 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6558000000000000}, 0x0) 15:52:01 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffff9c, 0xae41, 0x2) ioctl$KVM_ENABLE_CAP_CPU(r1, 0x4068aea3, &(0x7f00000001c0)={0x7b, 0x0, [0x4, 0x8, 0x6d0, 0x3]}) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x2) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) getsockopt$bt_sco_SCO_CONNINFO(r2, 0x11, 0x2, &(0x7f00000000c0)=""/179, &(0x7f0000000180)=0xb3) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x30, {0x21d7, 0x4, 0x3, 0x10001, 0x10000, 0x1000}, 0x0, 0x8}, 0xe) 15:52:01 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6800000000000000}, 0x0) 15:52:01 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1003) 15:52:01 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000040)="6339491ecdae0ce67c22e46a272e8f35b0679bba788e57dfcaecb3e48975466baec01c7798fb4d18c98c46d35ebc43fe8c8a50e8b0c6f7ce1085f7c2261ad9ad3f55bfdc7e92002af28c2f3a2343ee368b07db34d780b5a43ff417a1b20cc3a13634e08de404b901f0144d8613ff42c1bf0840454b715f31f6965775fe7b1c55a807ef9cb90f1c6254ea6aebdfc0b59d22cad149aa3e81d5880756dc5829275993fc163b06118aa112c7c1573996c282a80594c897f4fefdb8e358d5d73f190ebf8554b71e7d05d4bf2cb8de30cea46c528846d0dae51059225bf2dce33a31f2a1085973c8589b8b8ec724f30a2c936a8b8e5520b0cd663914d0fa7e997ff7eb") bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000240)='/dev/btrfs-control\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000280)=[@in={0x2, 0x4e24, @local}, @in={0x2, 0x4e22, @empty}, @in={0x2, 0x4e23, @multicast2}, @in={0x2, 0x4e20, @broadcast}, @in6={0xa, 0x4e23, 0xfffffffffffffff9, @loopback, 0x4d2}, @in={0x2, 0x4e20, @remote}], 0x6c) r2 = accept4(r1, &(0x7f0000000140)=@can, &(0x7f00000001c0)=0x46, 0x7fc) ioctl$IMSETDEVNAME(r2, 0x80184947, &(0x7f0000000200)={0x10000, 'syz0\x00'}) 15:52:01 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:02 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x6c00000000000000}, 0x0) 15:52:02 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:52:02 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x1, 0x100) timer_create(0x3, &(0x7f0000000140)={0x0, 0x2a, 0x4, @tid=0xffffffffffffffff}, &(0x7f0000000180)=0x0) timer_getoverrun(r2) ioctl$VHOST_GET_VRING_ENDIAN(r1, 0x4008af14, &(0x7f0000000080)={0x3, 0x8001}) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f00000000c0)) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x20000000, {0x0, 0x8}}, 0xe) 15:52:02 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:02 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:52:02 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) prctl$PR_GET_FPEMU(0x9, &(0x7f00000000c0)) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x402, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000140)={0x0, 0x0, 0x10001, 0x5}) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000180)={0xf5a7, r2, 0x10002, 0x2}) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x40000, 0x0) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e21, 0x5, @mcast2, 0x4}, 0x1c) 15:52:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x7400000000000000}, 0x0) 15:52:02 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:52:02 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1004) 15:52:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x7a00000000000000}, 0x0) 15:52:02 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x0, {0x0, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0xfffffffffffffffc}, 0xe) r1 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x101, 0x12000) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x8}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000001c0)={r2, 0x48, &(0x7f0000000140)=[@in={0x2, 0x4e22, @rand_addr=0xfff}, @in6={0xa, 0x4e22, 0x0, @rand_addr="fabe293d45e9c9827b6193211593c895", 0x1fa7112f}, @in6={0xa, 0x4e20, 0x2, @local, 0x3f}]}, &(0x7f0000000200)=0x10) syz_open_dev$video(&(0x7f0000000040)='/dev/video#\x00', 0x8, 0x100) [ 772.208292] validate_nla: 15 callbacks suppressed [ 772.208302] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:52:03 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:52:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x8100000000000000}, 0x0) 15:52:03 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:03 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000040)={0x2, 0x0, {0x0, 0x1f, 0x0, 0x54800ae8, 0xfffffffffffffffe}, 0x3}, 0xe) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$RTC_AIE_OFF(r1, 0x7002) [ 772.408633] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:52:03 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x88a8ffff00000000}, 0x0) 15:52:03 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf0ffffff}, 0x0) 15:52:03 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socket$inet_smc(0x2b, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000040)={0x2, 0x0, {0x3, 0x40000000000}, 0x5}, 0xe) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x80, 0x0) 15:52:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x9effffff00000000}, 0x0) [ 772.752645] netlink: 'syz-executor.0': attribute type 15 has an invalid length. [ 772.774202] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 772.869803] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:52:03 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1005) 15:52:03 executing program 0: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:03 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xf0ffffff00000000}, 0x0) 15:52:03 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x20000, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x22000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x7fff}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x4) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 773.118962] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:52:04 executing program 5: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:04 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xfeff000000000000}, 0x0) 15:52:04 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) fsync(r0) r1 = fcntl$getown(r0, 0x9) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000080)="8c3eddb54ea8b047fb84f55a0d2fd4a859e77119d703340e43f6397b68f98cc26a8565a0ff498c5af6c1f82eface979bf0ccc56d1fbd2f031829f4913fcc5fd2968fc2d152b6caafb4a12b162bcbdeee462f1051b3a933b65ab569faadf14b365fb3847cb23ad0f6cb08c7de58a85e1ac2169899fe3b3d63d0cced4046555ab9fd81be25f6deb3e1178165751d8f32e1d25a4d0a6f1b4d5b5b544a25684b4a59f9ef47d59e5db0db9cba486c917b150963c6201eae390866c6856470ea7e22cf960d4b97bf48c7384ad74370e9530649352a3922870413c770ffe34c6277c489a5840237ae4a276cd2d8c9fd9bc43ad090d6313098b63e2eba991f0e4476bd13") sched_setparam(r1, &(0x7f0000000040)=0x80) [ 773.376457] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:52:04 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:52:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xff0f000000000000}, 0x0) 15:52:04 executing program 4: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x101000, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r0, &(0x7f00000002c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xe0, r1, 0x404, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x4c, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x329}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd1}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}]}, @TIPC_NLA_SOCK={0x4c, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xf800000000000000}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}]}]}, 0x163}, 0x1, 0x0, 0x0, 0x40}, 0x8000) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$KIOCSOUND(r0, 0x4b2f, 0x6) bind$bt_l2cap(r2, &(0x7f0000000000)={0x2, 0x0, {0x0, 0x10000000000000}}, 0xe) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='scalable\x00', 0x9) [ 773.696809] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:52:04 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1006) 15:52:04 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:52:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xffffff7f00000000}, 0x0) 15:52:04 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(0xffffffffffffffff, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:04 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x0, {0x200000000000}, 0x0, 0x4}, 0xe) [ 774.055813] netlink: 'syz-executor.1': attribute type 15 has an invalid length. 15:52:05 executing program 5 (fault-call:4 fault-nth:0): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:05 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, 0x0, 0x0) 15:52:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xffffffff00000000}, 0x0) 15:52:05 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x0, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000180)={0x7, 0x393}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r2, 0xc008640a, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f00000000c0)={0x0, 0x0, 0x8001}) ioctl$DRM_IOCTL_GEM_FLINK(r2, 0xc008640a, &(0x7f0000000100)={r3, r4}) bind$bt_l2cap(r1, &(0x7f0000000000)={0x2}, 0xe) [ 774.338685] netlink: 'syz-executor.1': attribute type 15 has an invalid length. [ 774.407499] FAULT_INJECTION: forcing a failure. [ 774.407499] name failslab, interval 1, probability 0, space 0, times 0 [ 774.444630] CPU: 1 PID: 5789 Comm: syz-executor.5 Not tainted 5.0.0+ #14 [ 774.451485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 774.460858] Call Trace: [ 774.463474] dump_stack+0x172/0x1f0 [ 774.467138] should_fail.cold+0xa/0x15 [ 774.471045] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 774.476166] ? ___might_sleep+0x163/0x280 [ 774.480328] __should_failslab+0x121/0x190 [ 774.484576] should_failslab+0x9/0x14 [ 774.488381] kmem_cache_alloc_trace+0x2d1/0x760 [ 774.493087] snd_pcm_oss_change_params_locked+0x1a7/0x3750 [ 774.498728] ? __mutex_lock+0x3cd/0x1310 [ 774.502798] ? common_interrupt+0x5/0xf [ 774.506833] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 774.512635] ? mutex_trylock+0x1e0/0x1e0 [ 774.516712] ? ___might_sleep+0x1c4/0x280 [ 774.520874] ? ___might_sleep+0x163/0x280 [ 774.525036] ? __might_sleep+0x95/0x190 [ 774.529031] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 774.534245] snd_pcm_oss_write+0x42b/0x8f0 [ 774.538494] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 774.544054] __vfs_write+0x8d/0x110 [ 774.547688] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 774.552545] vfs_write+0x20c/0x580 [ 774.556096] ksys_write+0xea/0x1f0 [ 774.559649] ? __ia32_sys_read+0xb0/0xb0 [ 774.563724] ? do_syscall_64+0x26/0x610 [ 774.567700] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 774.573081] ? do_syscall_64+0x26/0x610 [ 774.577093] __x64_sys_write+0x73/0xb0 [ 774.580985] do_syscall_64+0x103/0x610 [ 774.584877] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 774.590096] RIP: 0033:0x457f29 15:52:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0xfffffffffffff000}, 0x0) 15:52:05 executing program 3 (fault-call:4 fault-nth:0): arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 774.593291] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 774.612194] RSP: 002b:00007f343a299c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 774.619958] RAX: ffffffffffffffda RBX: 00007f343a299c90 RCX: 0000000000457f29 [ 774.627264] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 [ 774.634542] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 774.641827] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f343a29a6d4 [ 774.649097] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 15:52:05 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x0, {0x0, 0x8000}}, 0xe) socket$can_raw(0x1d, 0x3, 0x1) ioctl$int_out(r0, 0x0, &(0x7f0000000180)) r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x9dd, 0x600) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000080)={0x3, 0x0, [{0xc0000005, 0x1b15, 0x1, 0x7f, 0x8, 0x8}, {0x2, 0xace, 0x3, 0x1, 0x7fffffff, 0x5f, 0xdb}, {0xc000000f, 0x8, 0x2, 0x7, 0x7ff, 0x0, 0x1}]}) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000100), &(0x7f0000000140)=0x4) [ 774.751445] FAULT_INJECTION: forcing a failure. [ 774.751445] name failslab, interval 1, probability 0, space 0, times 0 [ 774.786063] CPU: 1 PID: 5862 Comm: syz-executor.3 Not tainted 5.0.0+ #14 [ 774.792919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 774.802286] Call Trace: [ 774.804881] dump_stack+0x172/0x1f0 [ 774.808552] should_fail.cold+0xa/0x15 [ 774.812460] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 774.817583] ? ___might_sleep+0x163/0x280 [ 774.821744] __should_failslab+0x121/0x190 [ 774.825986] should_failslab+0x9/0x14 [ 774.829799] kmem_cache_alloc_trace+0x2d1/0x760 [ 774.834484] snd_pcm_oss_change_params_locked+0x1a7/0x3750 [ 774.840122] ? __mutex_lock+0x3cd/0x1310 [ 774.844194] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 774.848969] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 774.853727] ? lockdep_hardirqs_on+0x418/0x5d0 [ 774.858323] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 774.864160] ? mutex_trylock+0x1e0/0x1e0 [ 774.868245] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 774.873013] ? retint_kernel+0x2d/0x2d [ 774.876957] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 774.882158] snd_pcm_oss_write+0x42b/0x8f0 [ 774.886403] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 774.891969] __vfs_write+0x8d/0x110 [ 774.895599] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 774.900446] vfs_write+0x20c/0x580 [ 774.904001] ksys_write+0xea/0x1f0 [ 774.907573] ? __ia32_sys_read+0xb0/0xb0 [ 774.911641] ? do_syscall_64+0x26/0x610 [ 774.915621] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 774.920989] ? do_syscall_64+0x26/0x610 [ 774.924981] __x64_sys_write+0x73/0xb0 [ 774.928888] do_syscall_64+0x103/0x610 [ 774.932788] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 774.937981] RIP: 0033:0x457f29 [ 774.941178] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 774.960079] RSP: 002b:00007f8e487fac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 774.967798] RAX: ffffffffffffffda RBX: 00007f8e487fac90 RCX: 0000000000457f29 [ 774.975069] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 [ 774.982339] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 774.989609] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e487fb6d4 [ 774.996877] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 15:52:05 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1007) 15:52:05 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x4000000000009, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000040)={0x4, 0x0, 0x2, 0x200000, 0x3056, 0x9, 0x26}, 0xc) 15:52:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x2}, 0x0) 15:52:05 executing program 0 (fault-call:4 fault-nth:0): arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:05 executing program 5 (fault-call:4 fault-nth:1): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:05 executing program 3 (fault-call:4 fault-nth:1): arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x3}, 0x0) 15:52:05 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getresuid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r4 = accept$alg(r3, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000600)=ANY=[], 0xfec8) recvmmsg(r4, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000004700)=[{&(0x7f00000012c0)=""/167, 0xa7}, {&(0x7f00000023c0)=""/49, 0x31}], 0x2}}], 0x1, 0x0, &(0x7f0000008000)={0x0, 0x989680}) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="02000000010007000000000002000100", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="82442b79e72f2b0e4901e0dbe54bd2d538858d4b27831d739fe38e03bf9f10d9f1ef4f1ccdcd5aa2764ce283dabdb75f30276449", @ANYRESHEX=r2, @ANYRES32=r1, @ANYRES64=r3, @ANYRES64=r0, @ANYRES16=r2], @ANYBLOB="a0000000000000000800345203d1fa523f7897a9bf0000", @ANYRES32=r5, @ANYBLOB="10000200000000002000010000000000"], 0x5, 0x3) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 775.233458] FAULT_INJECTION: forcing a failure. [ 775.233458] name failslab, interval 1, probability 0, space 0, times 0 [ 775.313556] FAULT_INJECTION: forcing a failure. [ 775.313556] name failslab, interval 1, probability 0, space 0, times 0 [ 775.326529] CPU: 1 PID: 6050 Comm: syz-executor.5 Not tainted 5.0.0+ #14 [ 775.333384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 775.334951] FAULT_INJECTION: forcing a failure. [ 775.334951] name failslab, interval 1, probability 0, space 0, times 0 [ 775.342737] Call Trace: [ 775.342762] dump_stack+0x172/0x1f0 [ 775.342789] should_fail.cold+0xa/0x15 [ 775.342814] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 775.342839] ? ___might_sleep+0x163/0x280 [ 775.342860] __should_failslab+0x121/0x190 [ 775.342898] should_failslab+0x9/0x14 [ 775.342914] kmem_cache_alloc_trace+0x2d1/0x760 [ 775.342942] snd_pcm_oss_change_params_locked+0x1df/0x3750 [ 775.342963] ? __mutex_lock+0x3cd/0x1310 [ 775.395766] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 775.401586] ? mutex_trylock+0x1e0/0x1e0 [ 775.405667] ? find_held_lock+0x35/0x130 [ 775.409748] ? ___might_sleep+0x163/0x280 [ 775.413921] ? __might_sleep+0x95/0x190 [ 775.417927] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 775.423127] snd_pcm_oss_write+0x42b/0x8f0 [ 775.427376] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 775.432932] __vfs_write+0x8d/0x110 [ 775.436564] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 775.441416] vfs_write+0x20c/0x580 [ 775.444968] ksys_write+0xea/0x1f0 [ 775.448526] ? __ia32_sys_read+0xb0/0xb0 [ 775.452600] ? do_syscall_64+0x26/0x610 [ 775.456609] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 775.461973] ? do_syscall_64+0x26/0x610 [ 775.465953] __x64_sys_write+0x73/0xb0 [ 775.469863] do_syscall_64+0x103/0x610 [ 775.473755] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 775.478958] RIP: 0033:0x457f29 [ 775.482195] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 775.501139] RSP: 002b:00007f343a299c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 15:52:06 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0xc6bb76d36f97b327, 0x0) r2 = fcntl$dupfd(r0, 0x406, r1) setsockopt$netrom_NETROM_T4(r2, 0x103, 0x6, &(0x7f0000000000)=0xd1, 0x4) [ 775.508874] RAX: ffffffffffffffda RBX: 00007f343a299c90 RCX: 0000000000457f29 [ 775.516143] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 [ 775.523412] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 775.530679] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f343a29a6d4 [ 775.537947] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 [ 775.545300] CPU: 0 PID: 6085 Comm: syz-executor.3 Not tainted 5.0.0+ #14 [ 775.552153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 775.561503] Call Trace: [ 775.564105] dump_stack+0x172/0x1f0 [ 775.567746] should_fail.cold+0xa/0x15 [ 775.571647] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 775.576758] ? ___might_sleep+0x163/0x280 [ 775.580926] __should_failslab+0x121/0x190 [ 775.585163] should_failslab+0x9/0x14 [ 775.588981] kmem_cache_alloc_trace+0x2d1/0x760 [ 775.593669] snd_pcm_oss_change_params_locked+0x1df/0x3750 [ 775.599300] ? __mutex_lock+0x3cd/0x1310 [ 775.603375] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 775.609172] ? mutex_trylock+0x1e0/0x1e0 [ 775.613239] ? lockdep_hardirqs_on+0x418/0x5d0 [ 775.617884] ? trace_hardirqs_on_caller+0x6a/0x220 [ 775.622837] ? ___might_sleep+0x163/0x280 [ 775.627010] ? __might_sleep+0x95/0x190 [ 775.630988] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 775.636189] snd_pcm_oss_write+0x42b/0x8f0 [ 775.640428] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 775.645988] __vfs_write+0x8d/0x110 [ 775.649615] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 775.654460] vfs_write+0x20c/0x580 [ 775.658013] ksys_write+0xea/0x1f0 [ 775.661591] ? __ia32_sys_read+0xb0/0xb0 [ 775.665653] ? do_syscall_64+0x26/0x610 [ 775.669645] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 775.675011] ? do_syscall_64+0x26/0x610 [ 775.678991] __x64_sys_write+0x73/0xb0 [ 775.682881] do_syscall_64+0x103/0x610 [ 775.686773] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 775.691971] RIP: 0033:0x457f29 [ 775.695159] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 775.714054] RSP: 002b:00007f8e487fac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 775.721767] RAX: ffffffffffffffda RBX: 00007f8e487fac90 RCX: 0000000000457f29 [ 775.729031] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 [ 775.736297] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 775.743590] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e487fb6d4 [ 775.750861] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 [ 775.758148] CPU: 1 PID: 6086 Comm: syz-executor.0 Not tainted 5.0.0+ #14 [ 775.765000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 775.774351] Call Trace: [ 775.776941] dump_stack+0x172/0x1f0 [ 775.780583] should_fail.cold+0xa/0x15 [ 775.784482] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 775.789609] ? ___might_sleep+0x163/0x280 [ 775.793775] __should_failslab+0x121/0x190 [ 775.798020] should_failslab+0x9/0x14 [ 775.801839] kmem_cache_alloc_trace+0x2d1/0x760 [ 775.806580] snd_pcm_oss_change_params_locked+0x1a7/0x3750 [ 775.812211] ? __mutex_lock+0x3cd/0x1310 [ 775.816299] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 775.822101] ? mutex_trylock+0x1e0/0x1e0 [ 775.826166] ? find_held_lock+0x35/0x130 [ 775.830248] ? ___might_sleep+0x163/0x280 [ 775.834405] ? __might_sleep+0x95/0x190 [ 775.838398] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 775.843605] snd_pcm_oss_write+0x42b/0x8f0 [ 775.847860] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 775.853412] __vfs_write+0x8d/0x110 [ 775.857069] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 775.861937] vfs_write+0x20c/0x580 [ 775.865483] ksys_write+0xea/0x1f0 [ 775.869033] ? __ia32_sys_read+0xb0/0xb0 [ 775.875096] ? do_syscall_64+0x26/0x610 [ 775.880293] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 775.885671] ? do_syscall_64+0x26/0x610 [ 775.889693] __x64_sys_write+0x73/0xb0 [ 775.893608] do_syscall_64+0x103/0x610 [ 775.897508] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 775.902714] RIP: 0033:0x457f29 [ 775.905916] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 775.924820] RSP: 002b:00007f09dd590c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 775.932801] RAX: ffffffffffffffda RBX: 00007f09dd590c90 RCX: 0000000000457f29 [ 775.937460] FAULT_INJECTION: forcing a failure. [ 775.937460] name failslab, interval 1, probability 0, space 0, times 0 [ 775.940068] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000003 [ 775.940076] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 15:52:06 executing program 5 (fault-call:4 fault-nth:2): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:06 executing program 3 (fault-call:4 fault-nth:2): arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x4}, 0x0) [ 775.940084] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09dd5916d4 [ 775.940093] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000004 [ 775.989130] CPU: 0 PID: 6295 Comm: syz-executor.5 Not tainted 5.0.0+ #14 [ 775.996008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 776.005354] Call Trace: [ 776.005374] dump_stack+0x172/0x1f0 [ 776.005396] should_fail.cold+0xa/0x15 [ 776.005416] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 776.005434] ? ___might_sleep+0x163/0x280 [ 776.011623] __should_failslab+0x121/0x190 [ 776.011643] should_failslab+0x9/0x14 [ 776.011660] kmem_cache_alloc_trace+0x2d1/0x760 [ 776.011687] snd_pcm_oss_change_params_locked+0x217/0x3750 [ 776.020653] ? mark_held_locks+0xa4/0xf0 [ 776.029472] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 776.052334] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 776.057095] ? lockdep_hardirqs_on+0x418/0x5d0 [ 776.061896] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 776.067724] ? retint_kernel+0x2d/0x2d [ 776.071635] ? snd_pcm_oss_make_ready_locked+0x15/0x130 [ 776.077014] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 776.082217] snd_pcm_oss_write+0x42b/0x8f0 [ 776.082611] FAULT_INJECTION: forcing a failure. [ 776.082611] name failslab, interval 1, probability 0, space 0, times 0 [ 776.086459] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 776.086481] __vfs_write+0x8d/0x110 [ 776.086498] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 776.111780] vfs_write+0x20c/0x580 [ 776.115331] ksys_write+0xea/0x1f0 [ 776.118876] ? __ia32_sys_read+0xb0/0xb0 [ 776.122944] ? do_syscall_64+0x26/0x610 [ 776.126930] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.132320] ? do_syscall_64+0x26/0x610 [ 776.136305] __x64_sys_write+0x73/0xb0 [ 776.140203] do_syscall_64+0x103/0x610 [ 776.144094] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.149296] RIP: 0033:0x457f29 [ 776.152493] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 776.171414] RSP: 002b:00007f343a299c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 776.179123] RAX: ffffffffffffffda RBX: 00007f343a299c90 RCX: 0000000000457f29 [ 776.186394] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 [ 776.193694] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 776.200963] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f343a29a6d4 [ 776.208234] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 [ 776.215580] CPU: 1 PID: 6301 Comm: syz-executor.3 Not tainted 5.0.0+ #14 [ 776.222464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 776.231817] Call Trace: [ 776.234411] dump_stack+0x172/0x1f0 [ 776.238052] should_fail.cold+0xa/0x15 [ 776.241949] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 776.247063] ? ___might_sleep+0x163/0x280 [ 776.251212] __should_failslab+0x121/0x190 [ 776.255459] should_failslab+0x9/0x14 [ 776.259266] kmem_cache_alloc_trace+0x2d1/0x760 [ 776.263962] snd_pcm_oss_change_params_locked+0x217/0x3750 [ 776.269606] ? __mutex_lock+0x3cd/0x1310 [ 776.273689] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 776.279498] ? mutex_trylock+0x1e0/0x1e0 [ 776.283588] ? find_held_lock+0x35/0x130 [ 776.287664] ? ___might_sleep+0x163/0x280 [ 776.291823] ? __might_sleep+0x95/0x190 [ 776.295810] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 776.301029] snd_pcm_oss_write+0x42b/0x8f0 [ 776.305281] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 776.310836] __vfs_write+0x8d/0x110 [ 776.314480] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 776.319342] vfs_write+0x20c/0x580 [ 776.322890] ksys_write+0xea/0x1f0 [ 776.326440] ? __ia32_sys_read+0xb0/0xb0 [ 776.330507] ? do_syscall_64+0x26/0x610 [ 776.334494] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.339873] ? do_syscall_64+0x26/0x610 [ 776.343863] __x64_sys_write+0x73/0xb0 [ 776.347758] do_syscall_64+0x103/0x610 [ 776.351657] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.356851] RIP: 0033:0x457f29 15:52:06 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x1008) 15:52:06 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x100, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x2, 0x0, {0x0, 0x4, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x2}, 0x2) 15:52:07 executing program 0 (fault-call:4 fault-nth:1): arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:07 executing program 5 (fault-call:4 fault-nth:3): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 776.360069] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 776.378966] RSP: 002b:00007f8e487d9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 776.386438] FAULT_INJECTION: forcing a failure. [ 776.386438] name failslab, interval 1, probability 0, space 0, times 0 [ 776.386672] RAX: ffffffffffffffda RBX: 00007f8e487d9c90 RCX: 0000000000457f29 [ 776.386682] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 15:52:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x5}, 0x0) [ 776.386691] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 776.386700] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e487da6d4 [ 776.386709] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 [ 776.467126] FAULT_INJECTION: forcing a failure. [ 776.467126] name failslab, interval 1, probability 0, space 0, times 0 [ 776.480086] CPU: 0 PID: 6309 Comm: syz-executor.0 Not tainted 5.0.0+ #14 [ 776.486941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 776.496298] Call Trace: [ 776.498906] dump_stack+0x172/0x1f0 [ 776.502578] should_fail.cold+0xa/0x15 [ 776.506479] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 776.511605] ? ___might_sleep+0x163/0x280 [ 776.515763] __should_failslab+0x121/0x190 [ 776.520009] should_failslab+0x9/0x14 [ 776.523816] kmem_cache_alloc_trace+0x2d1/0x760 [ 776.528527] snd_pcm_oss_change_params_locked+0x1df/0x3750 [ 776.534165] ? __mutex_lock+0x3cd/0x1310 [ 776.538244] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 776.544052] ? mutex_trylock+0x1e0/0x1e0 [ 776.548118] ? find_held_lock+0x35/0x130 [ 776.552195] ? ___might_sleep+0x163/0x280 [ 776.556353] ? __might_sleep+0x95/0x190 [ 776.560340] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 776.565553] snd_pcm_oss_write+0x42b/0x8f0 [ 776.569801] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 776.575355] __vfs_write+0x8d/0x110 [ 776.578987] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 776.583836] vfs_write+0x20c/0x580 [ 776.587381] ksys_write+0xea/0x1f0 [ 776.590926] ? __ia32_sys_read+0xb0/0xb0 [ 776.594996] ? do_syscall_64+0x26/0x610 [ 776.598971] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.604340] ? do_syscall_64+0x26/0x610 [ 776.608321] __x64_sys_write+0x73/0xb0 [ 776.612220] do_syscall_64+0x103/0x610 15:52:07 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$VIDIOC_G_FBUF(r1, 0x8030560a, &(0x7f00000000c0)={0x40, 0x62, &(0x7f0000000040)="c70494b68b26c169d4391739d42785b1f3de9e8d4fa4027d37b362ef99e6e2f6fb81d685543b9b142b6ca85f4f097793fd6646f54df891cf5b48f09fd9a1bed438f6286fdcc39362f4dd501dc21d6a961ca7fd2fe208076c232184184db3a88661e04aba69cc0f9afa04e49cb362", {0x0, 0x7f, 0x41415270, 0x1, 0x6, 0x6, 0x0, 0xca}}) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 776.616115] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.621307] RIP: 0033:0x457f29 [ 776.624532] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 776.643436] RSP: 002b:00007f09dd590c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 776.651156] RAX: ffffffffffffffda RBX: 00007f09dd590c90 RCX: 0000000000457f29 [ 776.658424] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000003 15:52:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x6}, 0x0) 15:52:07 executing program 3 (fault-call:4 fault-nth:3): arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 776.665694] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 776.672967] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09dd5916d4 [ 776.680235] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000004 [ 776.701205] CPU: 1 PID: 6311 Comm: syz-executor.5 Not tainted 5.0.0+ #14 [ 776.708070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 776.717422] Call Trace: [ 776.720042] dump_stack+0x172/0x1f0 [ 776.720066] should_fail.cold+0xa/0x15 [ 776.720087] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 776.720122] ? ___might_sleep+0x163/0x280 [ 776.720140] __should_failslab+0x121/0x190 [ 776.741085] should_failslab+0x9/0x14 [ 776.744894] __kmalloc+0x2dc/0x740 [ 776.744911] ? retint_kernel+0x2d/0x2d [ 776.744932] ? constrain_params_by_rules+0x118/0x1180 [ 776.744953] constrain_params_by_rules+0x118/0x1180 [ 776.744999] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 776.745015] ? lockdep_hardirqs_on+0x418/0x5d0 [ 776.757636] ? trace_hardirqs_on_caller+0x6a/0x220 [ 776.757658] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 776.757677] ? snd_pcm_mmap_status_fault+0x240/0x240 [ 776.757694] ? retint_kernel+0x2d/0x2d [ 776.757723] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 776.757738] ? snd_interval_refine+0x42a/0x720 [ 776.800264] snd_pcm_hw_refine+0xbf9/0xf20 [ 776.804535] ? constrain_params_by_rules+0x1180/0x1180 [ 776.804564] ? retint_kernel+0x2d/0x2d [ 776.804586] ? _snd_pcm_hw_param_any+0x21/0x2a0 [ 776.804604] ? audit_add_tree_rule.cold+0x37/0x37 [ 776.804618] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 776.804637] ? _snd_pcm_hw_param_min+0x29d/0x560 [ 776.813805] snd_pcm_oss_change_params_locked+0x6c2/0x3750 [ 776.813828] ? __mutex_lock+0x3cd/0x1310 [ 776.813855] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 776.813870] ? mutex_trylock+0x1e0/0x1e0 [ 776.813884] ? find_held_lock+0x35/0x130 [ 776.813912] ? __might_sleep+0x95/0x190 [ 776.813933] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 776.813953] snd_pcm_oss_write+0x42b/0x8f0 [ 776.870612] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 776.876167] __vfs_write+0x8d/0x110 [ 776.879798] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 776.882299] FAULT_INJECTION: forcing a failure. [ 776.882299] name failslab, interval 1, probability 0, space 0, times 0 [ 776.884692] vfs_write+0x20c/0x580 [ 776.884714] ksys_write+0xea/0x1f0 [ 776.884732] ? __ia32_sys_read+0xb0/0xb0 [ 776.884749] ? do_syscall_64+0x26/0x610 [ 776.884762] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.884779] ? do_syscall_64+0x26/0x610 [ 776.920354] __x64_sys_write+0x73/0xb0 [ 776.924243] do_syscall_64+0x103/0x610 [ 776.928311] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.933504] RIP: 0033:0x457f29 [ 776.936710] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 776.955609] RSP: 002b:00007f343a299c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 15:52:07 executing program 0 (fault-call:4 fault-nth:2): arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 776.963317] RAX: ffffffffffffffda RBX: 00007f343a299c90 RCX: 0000000000457f29 [ 776.970588] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 [ 776.977857] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 776.985126] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f343a29a6d4 [ 776.992394] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 [ 776.999702] CPU: 0 PID: 6425 Comm: syz-executor.0 Not tainted 5.0.0+ #14 [ 777.006648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 777.015998] Call Trace: [ 777.018601] dump_stack+0x172/0x1f0 [ 777.022274] should_fail.cold+0xa/0x15 [ 777.026206] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 777.031333] ? ___might_sleep+0x163/0x280 [ 777.035487] __should_failslab+0x121/0x190 [ 777.039748] should_failslab+0x9/0x14 [ 777.043566] kmem_cache_alloc_trace+0x2d1/0x760 [ 777.048253] snd_pcm_oss_change_params_locked+0x217/0x3750 [ 777.053893] ? __mutex_lock+0x3cd/0x1310 [ 777.057965] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 777.063330] FAULT_INJECTION: forcing a failure. 15:52:07 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000040)={0x4, 0x7, 0x3, 0x4, 0x2, [{0x5, 0x8, 0xbf, 0x0, 0x0, 0x1100}, {0x80, 0x18000, 0x2, 0x0, 0x0, 0x2001}]}) [ 777.063330] name failslab, interval 1, probability 0, space 0, times 0 [ 777.063803] ? mutex_trylock+0x1e0/0x1e0 [ 777.063816] ? find_held_lock+0x35/0x130 [ 777.063836] ? ___might_sleep+0x163/0x280 [ 777.063851] ? __might_sleep+0x95/0x190 [ 777.091248] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 777.096446] snd_pcm_oss_write+0x42b/0x8f0 [ 777.100712] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.106288] __vfs_write+0x8d/0x110 [ 777.109945] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 777.114797] vfs_write+0x20c/0x580 [ 777.118348] ksys_write+0xea/0x1f0 [ 777.121897] ? __ia32_sys_read+0xb0/0xb0 [ 777.125963] ? do_syscall_64+0x26/0x610 [ 777.129956] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 777.135338] ? do_syscall_64+0x26/0x610 [ 777.139321] __x64_sys_write+0x73/0xb0 [ 777.143215] do_syscall_64+0x103/0x610 [ 777.147110] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 777.152297] RIP: 0033:0x457f29 [ 777.155487] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 777.174394] RSP: 002b:00007f09dd590c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 777.182103] RAX: ffffffffffffffda RBX: 00007f09dd590c90 RCX: 0000000000457f29 [ 777.189373] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000003 [ 777.196642] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 777.203913] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09dd5916d4 [ 777.211179] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000004 [ 777.221778] CPU: 1 PID: 6426 Comm: syz-executor.3 Not tainted 5.0.0+ #14 [ 777.228660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 777.238005] Call Trace: [ 777.240597] dump_stack+0x172/0x1f0 [ 777.244227] should_fail.cold+0xa/0x15 [ 777.248128] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 777.253237] ? __should_failslab+0x45/0x190 [ 777.257559] __should_failslab+0x121/0x190 [ 777.261795] should_failslab+0x9/0x14 [ 777.265593] __kmalloc+0x2dc/0x740 [ 777.269130] ? unwind_get_return_address+0x61/0xa0 [ 777.274062] ? constrain_params_by_rules+0x118/0x1180 [ 777.279255] constrain_params_by_rules+0x118/0x1180 [ 777.284269] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 777.289028] ? lockdep_hardirqs_on+0x418/0x5d0 [ 777.293635] ? trace_hardirqs_on_caller+0x6a/0x220 [ 777.298579] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 777.303335] ? snd_pcm_mmap_status_fault+0x240/0x240 [ 777.308435] ? retint_kernel+0x2d/0x2d [ 777.312334] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 777.317346] ? snd_interval_refine+0x42a/0x720 [ 777.321933] snd_pcm_hw_refine+0xbf9/0xf20 [ 777.326174] ? lockdep_hardirqs_on+0x418/0x5d0 [ 777.330786] ? constrain_params_by_rules+0x1180/0x1180 [ 777.336129] ? retint_kernel+0x2d/0x2d [ 777.340035] ? snd_pcm_oss_change_params_locked+0x4ab/0x3750 [ 777.345837] snd_pcm_oss_change_params_locked+0x6c2/0x3750 [ 777.351469] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 777.356223] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 777.360974] ? lockdep_hardirqs_on+0x418/0x5d0 [ 777.365562] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 777.371371] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 777.376153] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 777.381345] snd_pcm_oss_write+0x42b/0x8f0 [ 777.385580] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.391119] __vfs_write+0x8d/0x110 [ 777.394739] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 777.399582] vfs_write+0x20c/0x580 [ 777.403141] ksys_write+0xea/0x1f0 [ 777.406682] ? __ia32_sys_read+0xb0/0xb0 [ 777.410744] ? do_syscall_64+0x26/0x610 [ 777.414718] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 777.420080] ? do_syscall_64+0x26/0x610 [ 777.424060] __x64_sys_write+0x73/0xb0 [ 777.427946] do_syscall_64+0x103/0x610 [ 777.431837] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 777.437027] RIP: 0033:0x457f29 [ 777.440218] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 777.459113] RSP: 002b:00007f8e487fac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 15:52:08 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x100a) [ 777.466817] RAX: ffffffffffffffda RBX: 00007f8e487fac90 RCX: 0000000000457f29 [ 777.474082] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 [ 777.481349] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 777.488613] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e487fb6d4 [ 777.495879] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 15:52:08 executing program 5 (fault-call:4 fault-nth:4): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:08 executing program 0 (fault-call:4 fault-nth:3): arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x7}, 0x0) 15:52:08 executing program 3 (fault-call:4 fault-nth:4): arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:08 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x3, 0x2) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:52:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x8}, 0x0) [ 777.734308] FAULT_INJECTION: forcing a failure. [ 777.734308] name failslab, interval 1, probability 0, space 0, times 0 [ 777.760443] CPU: 1 PID: 6547 Comm: syz-executor.5 Not tainted 5.0.0+ #14 [ 777.767300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 777.776656] Call Trace: [ 777.779284] dump_stack+0x172/0x1f0 [ 777.782952] should_fail.cold+0xa/0x15 [ 777.786863] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 777.791989] ? ___might_sleep+0x163/0x280 [ 777.796159] __should_failslab+0x121/0x190 [ 777.800407] should_failslab+0x9/0x14 [ 777.804217] kmem_cache_alloc_trace+0x2d1/0x760 [ 777.808891] ? memset+0x32/0x40 [ 777.812187] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.817729] ? _snd_pcm_hw_param_min+0x29d/0x560 [ 777.822504] snd_pcm_oss_change_params_locked+0x75c/0x3750 [ 777.828159] ? __mutex_lock+0x3cd/0x1310 [ 777.832243] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 777.838052] ? mutex_trylock+0x1e0/0x1e0 [ 777.838595] FAULT_INJECTION: forcing a failure. [ 777.838595] name failslab, interval 1, probability 0, space 0, times 0 [ 777.842115] ? find_held_lock+0x35/0x130 [ 777.842140] ? lockdep_hardirqs_on+0x418/0x5d0 [ 777.842154] ? retint_kernel+0x2d/0x2d [ 777.842169] ? trace_hardirqs_on_caller+0x6a/0x220 [ 777.842186] ? __might_sleep+0x95/0x190 [ 777.874744] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 777.879969] snd_pcm_oss_write+0x42b/0x8f0 [ 777.884242] __vfs_write+0x8d/0x110 [ 777.887888] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 777.892741] vfs_write+0x20c/0x580 [ 777.896303] ksys_write+0xea/0x1f0 [ 777.899855] ? __ia32_sys_read+0xb0/0xb0 [ 777.903962] __x64_sys_write+0x73/0xb0 [ 777.907874] ? do_syscall_64+0x5b/0x610 [ 777.911877] do_syscall_64+0x103/0x610 [ 777.915778] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 777.920971] RIP: 0033:0x457f29 [ 777.924172] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 777.943328] RSP: 002b:00007f343a299c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 777.951059] RAX: ffffffffffffffda RBX: 00007f343a299c90 RCX: 0000000000457f29 [ 777.958334] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 [ 777.965607] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 777.972882] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f343a29a6d4 15:52:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0xa}, 0x0) 15:52:08 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000040)=0x7ba, 0x1) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:52:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0xc}, 0x0) 15:52:08 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x100b) [ 777.980151] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 [ 778.016257] FAULT_INJECTION: forcing a failure. [ 778.016257] name failslab, interval 1, probability 0, space 0, times 0 [ 778.020925] CPU: 0 PID: 6546 Comm: syz-executor.0 Not tainted 5.0.0+ #14 [ 778.034439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 778.043791] Call Trace: [ 778.046400] dump_stack+0x172/0x1f0 [ 778.050043] should_fail.cold+0xa/0x15 [ 778.053940] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 778.059288] ? ___might_sleep+0x163/0x280 [ 778.063468] __should_failslab+0x121/0x190 [ 778.067712] should_failslab+0x9/0x14 [ 778.071552] __kmalloc+0x2dc/0x740 [ 778.075111] ? unwind_get_return_address+0x61/0xa0 [ 778.080047] ? __save_stack_trace+0x8a/0xf0 [ 778.084378] ? constrain_params_by_rules+0x118/0x1180 [ 778.089579] constrain_params_by_rules+0x118/0x1180 [ 778.094615] ? save_stack+0xa9/0xd0 [ 778.098260] ? save_stack+0x45/0xd0 [ 778.101892] ? kmem_cache_alloc_trace+0x151/0x760 [ 778.106756] ? snd_pcm_oss_change_params_locked+0x217/0x3750 [ 778.112566] ? snd_pcm_mmap_status_fault+0x240/0x240 [ 778.117685] ? vfs_write+0x20c/0x580 [ 778.121400] ? ksys_write+0xea/0x1f0 [ 778.125118] ? __x64_sys_write+0x73/0xb0 [ 778.129184] ? do_syscall_64+0x103/0x610 [ 778.133255] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 778.138624] ? __lock_acquire+0x548/0x3fb0 [ 778.142871] ? is_bpf_text_address+0xac/0x170 [ 778.147377] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 778.152412] ? snd_interval_refine+0x42a/0x720 [ 778.157002] snd_pcm_hw_refine+0xbf9/0xf20 [ 778.161246] ? constrain_params_by_rules+0x1180/0x1180 [ 778.166547] ? snd_pcm_oss_change_params_locked+0x217/0x3750 [ 778.172354] ? rcu_read_lock_sched_held+0x110/0x130 [ 778.177381] ? memset+0x32/0x40 [ 778.180664] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.186205] ? _snd_pcm_hw_param_min+0x29d/0x560 [ 778.190974] snd_pcm_oss_change_params_locked+0x6c2/0x3750 [ 778.196611] ? __mutex_lock+0x3cd/0x1310 [ 778.200701] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 778.206501] ? mutex_trylock+0x1e0/0x1e0 [ 778.210601] ? find_held_lock+0x35/0x130 [ 778.214683] ? __might_sleep+0x95/0x190 [ 778.218670] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 778.223869] snd_pcm_oss_write+0x42b/0x8f0 [ 778.228113] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.233660] __vfs_write+0x8d/0x110 [ 778.237305] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 778.242153] vfs_write+0x20c/0x580 [ 778.245702] ksys_write+0xea/0x1f0 [ 778.249250] ? __ia32_sys_read+0xb0/0xb0 [ 778.253317] ? do_syscall_64+0x26/0x610 [ 778.257290] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 778.262659] ? do_syscall_64+0x26/0x610 [ 778.266644] __x64_sys_write+0x73/0xb0 [ 778.270548] do_syscall_64+0x103/0x610 [ 778.274448] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 778.279653] RIP: 0033:0x457f29 [ 778.282845] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 778.301746] RSP: 002b:00007f09dd590c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 778.309459] RAX: ffffffffffffffda RBX: 00007f09dd590c90 RCX: 0000000000457f29 [ 778.316725] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000003 [ 778.323991] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 778.331258] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09dd5916d4 [ 778.338553] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000004 [ 778.345860] CPU: 1 PID: 6549 Comm: syz-executor.3 Not tainted 5.0.0+ #14 [ 778.352711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 778.362057] Call Trace: [ 778.364664] dump_stack+0x172/0x1f0 [ 778.368303] should_fail.cold+0xa/0x15 [ 778.372208] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 778.377329] ? ___might_sleep+0x163/0x280 [ 778.381491] __should_failslab+0x121/0x190 [ 778.385753] should_failslab+0x9/0x14 [ 778.389568] kmem_cache_alloc_trace+0x2d1/0x760 [ 778.394250] ? memset+0x32/0x40 [ 778.397549] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.403099] ? _snd_pcm_hw_param_min+0x29d/0x560 [ 778.407886] snd_pcm_oss_change_params_locked+0x75c/0x3750 [ 778.413533] ? __mutex_lock+0x3cd/0x1310 [ 778.417618] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 778.423430] ? mutex_trylock+0x1e0/0x1e0 [ 778.427493] ? find_held_lock+0x35/0x130 [ 778.431584] ? __might_sleep+0x95/0x190 [ 778.435602] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 778.440815] snd_pcm_oss_write+0x42b/0x8f0 [ 778.445066] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.450617] __vfs_write+0x8d/0x110 [ 778.454252] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 778.459106] vfs_write+0x20c/0x580 [ 778.462673] ksys_write+0xea/0x1f0 [ 778.466245] ? __ia32_sys_read+0xb0/0xb0 [ 778.470323] ? do_syscall_64+0x26/0x610 [ 778.474302] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 778.479671] ? do_syscall_64+0x26/0x610 [ 778.483658] __x64_sys_write+0x73/0xb0 [ 778.487561] do_syscall_64+0x103/0x610 [ 778.491462] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 778.496657] RIP: 0033:0x457f29 [ 778.499857] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 15:52:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0xe}, 0x0) 15:52:09 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x200000, 0x0) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000080)={0xa54b, 0xffff, 0x8}) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) time(&(0x7f00000000c0)) [ 778.518774] RSP: 002b:00007f8e487fac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 778.526526] RAX: ffffffffffffffda RBX: 00007f8e487fac90 RCX: 0000000000457f29 [ 778.533798] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000004 [ 778.541078] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 778.548349] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e487fb6d4 [ 778.555619] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000005 15:52:09 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0xf}, 0x0) 15:52:09 executing program 4: r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x100000000, 0x40100) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f0000000080)=0x81) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x2}, 0xe) 15:52:09 executing program 0 (fault-call:4 fault-nth:4): arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:09 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) [ 778.761991] FAULT_INJECTION: forcing a failure. [ 778.761991] name failslab, interval 1, probability 0, space 0, times 0 [ 778.789257] CPU: 1 PID: 6876 Comm: syz-executor.0 Not tainted 5.0.0+ #14 [ 778.796118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 778.805470] Call Trace: [ 778.808070] dump_stack+0x172/0x1f0 [ 778.811726] should_fail.cold+0xa/0x15 [ 778.815636] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 778.820758] ? ___might_sleep+0x163/0x280 [ 778.824922] __should_failslab+0x121/0x190 [ 778.829182] should_failslab+0x9/0x14 [ 778.833002] kmem_cache_alloc_trace+0x2d1/0x760 [ 778.837699] ? memset+0x32/0x40 [ 778.840987] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.846546] ? _snd_pcm_hw_param_min+0x29d/0x560 [ 778.851312] snd_pcm_oss_change_params_locked+0x75c/0x3750 [ 778.856952] ? __mutex_lock+0x3cd/0x1310 [ 778.861037] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 778.866842] ? mutex_trylock+0x1e0/0x1e0 [ 778.870910] ? find_held_lock+0x35/0x130 [ 778.875009] ? __might_sleep+0x95/0x190 [ 778.879006] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 778.884212] snd_pcm_oss_write+0x42b/0x8f0 [ 778.888455] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.894028] __vfs_write+0x8d/0x110 [ 778.897669] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 778.902530] vfs_write+0x20c/0x580 [ 778.906086] ksys_write+0xea/0x1f0 [ 778.909638] ? __ia32_sys_read+0xb0/0xb0 [ 778.913724] ? do_syscall_64+0x26/0x610 [ 778.917704] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 778.923072] ? do_syscall_64+0x26/0x610 [ 778.927080] __x64_sys_write+0x73/0xb0 [ 778.930982] do_syscall_64+0x103/0x610 [ 778.934889] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 778.940093] RIP: 0033:0x457f29 [ 778.943292] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 15:52:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x10}, 0x0) 15:52:09 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x10, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) dup3(r0, r0, 0x80000) 15:52:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x48}, 0x0) 15:52:09 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) fchdir(r0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 778.962200] RSP: 002b:00007f09dd590c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 778.969910] RAX: ffffffffffffffda RBX: 00007f09dd590c90 RCX: 0000000000457f29 [ 778.977179] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000003 [ 778.984544] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 778.991815] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09dd5916d4 [ 778.999114] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000004 [ 779.141588] protocol 88fb is buggy, dev hsr_slave_0 [ 779.147206] protocol 88fb is buggy, dev hsr_slave_1 15:52:09 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x100d) 15:52:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x4c}, 0x0) 15:52:10 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x3, 0x10802) ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f0000000080)) 15:52:10 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x3, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x60}, 0x0) 15:52:10 executing program 4: r0 = creat(&(0x7f00000021c0)='./file0\x00', 0x140) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000002200)) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x0, 0x900) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000002140)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000002100)={0xffffffffffffffff}, 0x117, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000002180)={0xf, 0x8, 0xfa00, {r3, 0xb}}, 0x10) ioctl$KVM_GET_NESTED_STATE(r2, 0xc080aebe, &(0x7f0000000080)={0x0, 0x0, 0x2080}) bind$bt_l2cap(r1, &(0x7f0000000000)={0x2}, 0xe) 15:52:12 executing program 0 (fault-call:4 fault-nth:5): arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x68}, 0x0) 15:52:12 executing program 4: personality(0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) write$P9_RRENAME(r1, &(0x7f0000000080)={0x7, 0x15, 0x1}, 0x7) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000140)) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) 15:52:12 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x3, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:12 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x4, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:12 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x100e) 15:52:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x6c}, 0x0) [ 781.865571] FAULT_INJECTION: forcing a failure. [ 781.865571] name failslab, interval 1, probability 0, space 0, times 0 [ 781.935586] CPU: 0 PID: 7427 Comm: syz-executor.0 Not tainted 5.0.0+ #14 [ 781.942449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 781.951803] Call Trace: [ 781.954420] dump_stack+0x172/0x1f0 [ 781.958075] should_fail.cold+0xa/0x15 [ 781.961987] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 781.967104] ? ___might_sleep+0x163/0x280 [ 781.971265] __should_failslab+0x121/0x190 [ 781.975520] should_failslab+0x9/0x14 [ 781.979336] __kmalloc+0x2dc/0x740 [ 781.982882] ? unwind_get_return_address+0x61/0xa0 [ 781.987818] ? __save_stack_trace+0x8a/0xf0 [ 781.992151] ? constrain_params_by_rules+0x118/0x1180 [ 781.997390] constrain_params_by_rules+0x118/0x1180 [ 782.002420] ? save_stack+0xa9/0xd0 [ 782.006066] ? save_stack+0x45/0xd0 [ 782.009703] ? kmem_cache_alloc_trace+0x151/0x760 [ 782.014561] ? snd_pcm_oss_change_params_locked+0x75c/0x3750 [ 782.020362] ? snd_pcm_mmap_status_fault+0x240/0x240 [ 782.025469] ? vfs_write+0x20c/0x580 [ 782.029183] ? ksys_write+0xea/0x1f0 [ 782.032899] ? __x64_sys_write+0x73/0xb0 [ 782.036962] ? do_syscall_64+0x103/0x610 [ 782.041026] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 782.046399] ? __lock_acquire+0x548/0x3fb0 [ 782.050655] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 782.056208] ? snd_interval_refine+0x42a/0x720 [ 782.061071] snd_pcm_hw_refine+0xbf9/0xf20 [ 782.065322] ? constrain_params_by_rules+0x1180/0x1180 [ 782.070600] ? snd_interval_refine+0x42a/0x720 [ 782.075191] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 782.080766] ? _snd_pcm_hw_param_set.constprop.0+0x282/0x590 [ 782.086584] ? snd_pcm_oss_change_params_locked+0x75c/0x3750 [ 782.092393] ? rcu_read_lock_sched_held+0x110/0x130 [ 782.097417] ? snd_pcm_oss_open+0x60/0x60 [ 782.101585] snd_pcm_oss_change_params_locked+0xc99/0x3750 [ 782.107231] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 782.113036] ? mutex_trylock+0x1e0/0x1e0 [ 782.117100] ? find_held_lock+0x35/0x130 [ 782.121180] ? __might_sleep+0x95/0x190 [ 782.125166] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 782.130361] snd_pcm_oss_write+0x42b/0x8f0 [ 782.134604] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 782.140149] __vfs_write+0x8d/0x110 [ 782.143783] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 782.148635] vfs_write+0x20c/0x580 [ 782.152189] ksys_write+0xea/0x1f0 [ 782.155752] ? __ia32_sys_read+0xb0/0xb0 [ 782.159820] ? do_syscall_64+0x26/0x610 [ 782.163793] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 782.169170] ? do_syscall_64+0x26/0x610 [ 782.173152] __x64_sys_write+0x73/0xb0 [ 782.177055] do_syscall_64+0x103/0x610 [ 782.180947] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 782.186137] RIP: 0033:0x457f29 [ 782.189335] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 782.208240] RSP: 002b:00007f09dd590c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 782.215950] RAX: ffffffffffffffda RBX: 00007f09dd590c90 RCX: 0000000000457f29 [ 782.223227] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000003 15:52:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x74}, 0x0) [ 782.230517] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 782.237806] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09dd5916d4 [ 782.245074] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000004 15:52:13 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x200000, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x94, r1, 0x4, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8fa3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xa5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1f}, @TIPC_NLA_MON_REF={0x8}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0x38, 0x2, [@TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x45dd}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfff000000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfa}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@local, 0xfffffffffffffffe, 0x1, 0x3, 0x9, 0x20, 0x1000}, &(0x7f00000000c0)=0x20) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x2}, 0xe) connect$rxrpc(r0, &(0x7f00000002c0)=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e23, 0x8, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x30}}, 0x24) 15:52:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x7a}, 0x0) 15:52:13 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x0, {}, 0x4}, 0xe) 15:52:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0xf0}, 0x0) 15:52:15 executing program 0 (fault-call:4 fault-nth:6): arch_prctl$ARCH_GET_FS(0x1003, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r0, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:15 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0xc84, 0x400000) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000080)={0x9, 0x5, 0x8, 0x0, '\x00', 0x1}) 15:52:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x103}, 0x0) 15:52:15 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380), 0x100f) 15:52:15 executing program 3: arch_prctl$ARCH_GET_FS(0x1003, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x4, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:15 executing program 5: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r0, 0x800040c004500a, &(0x7f0000000040)=0x80000002) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x6, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 15:52:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x300}, 0x0) [ 784.504557] FAULT_INJECTION: forcing a failure. [ 784.504557] name failslab, interval 1, probability 0, space 0, times 0 [ 784.598031] CPU: 1 PID: 7664 Comm: syz-executor.0 Not tainted 5.0.0+ #14 [ 784.604897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 784.614247] Call Trace: [ 784.616844] dump_stack+0x172/0x1f0 [ 784.620489] should_fail.cold+0xa/0x15 [ 784.624409] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 784.629564] ? ___might_sleep+0x163/0x280 [ 784.633729] __should_failslab+0x121/0x190 [ 784.637989] should_failslab+0x9/0x14 [ 784.641827] kmem_cache_alloc_trace+0x2d1/0x760 [ 784.646549] snd_pcm_hw_param_near.constprop.0+0xec/0x890 [ 784.652088] ? mark_held_locks+0xa4/0xf0 [ 784.656155] ? snd_pcm_oss_change_params_locked+0x2b1c/0x3750 [ 784.662050] ? snd_pcm_oss_release_file.part.0+0xa0/0xa0 [ 784.667519] ? snd_pcm_oss_change_params_locked+0x2b1c/0x3750 [ 784.673444] snd_pcm_oss_change_params_locked+0xa0a/0x3750 [ 784.679136] ? _snd_pcm_hw_param_set.constprop.0+0x590/0x590 [ 784.684952] ? mutex_trylock+0x1e0/0x1e0 [ 784.689018] ? find_held_lock+0x35/0x130 [ 784.693101] ? __might_sleep+0x95/0x190 [ 784.697084] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 784.702282] snd_pcm_oss_write+0x42b/0x8f0 [ 784.706539] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 784.712095] __vfs_write+0x8d/0x110 [ 784.715722] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 784.720575] vfs_write+0x20c/0x580 [ 784.724125] ksys_write+0xea/0x1f0 [ 784.727668] ? __ia32_sys_read+0xb0/0xb0 [ 784.731734] ? do_syscall_64+0x26/0x610 [ 784.735715] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 784.741100] ? do_syscall_64+0x26/0x610 [ 784.745096] __x64_sys_write+0x73/0xb0 [ 784.748992] do_syscall_64+0x103/0x610 [ 784.752913] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 784.758104] RIP: 0033:0x457f29 [ 784.761301] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 784.780218] RSP: 002b:00007f09dd590c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 784.787929] RAX: ffffffffffffffda RBX: 00007f09dd590c90 RCX: 0000000000457f29 15:52:15 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0xff7ffffffffffffd, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) [ 784.795198] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000003 [ 784.802484] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 784.809760] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09dd5916d4 [ 784.817035] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000004 [ 784.833252] ================================================================== [ 784.840866] BUG: KASAN: slab-out-of-bounds in default_write_copy_kernel+0xdc/0x130 [ 784.848589] Read of size 64 at addr ffff8880a4aded00 by task syz-executor.0/7664 [ 784.856120] [ 784.857754] CPU: 0 PID: 7664 Comm: syz-executor.0 Not tainted 5.0.0+ #14 [ 784.864594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 784.873946] Call Trace: [ 784.876554] dump_stack+0x172/0x1f0 [ 784.880203] ? default_write_copy_kernel+0xdc/0x130 [ 784.885263] print_address_description.cold+0x7c/0x20d [ 784.890553] ? default_write_copy_kernel+0xdc/0x130 [ 784.895575] ? default_write_copy_kernel+0xdc/0x130 [ 784.900601] kasan_report.cold+0x1b/0x40 [ 784.904678] ? snd_pcm_stream_unlock_irq+0x50/0xc0 [ 784.909613] ? default_write_copy_kernel+0xdc/0x130 [ 784.914639] check_memory_region+0x123/0x190 [ 784.919059] memcpy+0x24/0x50 [ 784.922183] default_write_copy_kernel+0xdc/0x130 [ 784.927552] ? __bpf_trace_applptr+0x40/0x40 [ 784.931965] interleaved_copy+0xd0/0x100 [ 784.936036] __snd_pcm_lib_xfer+0xea3/0x1cfa [ 784.940460] ? snd_pcm_hw_rule_step+0x440/0x440 [ 784.945136] ? __bpf_trace_applptr+0x40/0x40 15:52:15 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2}, 0xe) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mISDNtimer\x00', 0x0, 0x0) [ 784.949554] ? pcm_lib_apply_appl_ptr+0x440/0x440 [ 784.954410] ? memcpy+0x46/0x50 [ 784.957693] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 784.962714] ? linear_transfer+0x74f/0x970 [ 784.966983] snd_pcm_oss_write3+0xee/0x230 [ 784.971263] io_playback_transfer+0x280/0x330 [ 784.975799] snd_pcm_plug_write_transfer+0x30c/0x400 [ 784.980913] ? snd_pcm_plug_client_channels_buf+0x450/0x450 [ 784.986628] ? snd_pcm_format_physical_width+0x75/0x90 [ 784.991918] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 784.996942] ? snd_pcm_plug_client_channels_buf+0x212/0x450 [ 785.002667] snd_pcm_oss_write2+0x250/0x410 [ 785.007008] ? snd_pcm_oss_write3+0x230/0x230 [ 785.011537] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 785.017095] ? snd_pcm_oss_prepare+0x118/0x150 [ 785.021686] snd_pcm_oss_write+0x6c2/0x8f0 [ 785.025934] __vfs_write+0x8d/0x110 [ 785.029563] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 785.034410] vfs_write+0x20c/0x580 [ 785.037963] ksys_write+0xea/0x1f0 [ 785.041524] ? __ia32_sys_read+0xb0/0xb0 [ 785.045593] ? do_syscall_64+0x26/0x610 [ 785.049581] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.054947] ? do_syscall_64+0x26/0x610 [ 785.058925] __x64_sys_write+0x73/0xb0 [ 785.062820] do_syscall_64+0x103/0x610 [ 785.066731] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.071931] RIP: 0033:0x457f29 [ 785.075125] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 785.094026] RSP: 002b:00007f09dd590c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 785.101755] RAX: ffffffffffffffda RBX: 00007f09dd590c90 RCX: 0000000000457f29 [ 785.109025] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000003 [ 785.116297] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 785.123566] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09dd5916d4 [ 785.130853] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000004 [ 785.138135] [ 785.139780] Allocated by task 7664: [ 785.143427] save_stack+0x45/0xd0 15:52:15 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x22400) restart_syscall() setsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000080), 0x4) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f00000000c0)) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0xfffffffffffffffc, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}, 0xe) [ 785.146888] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 785.151826] kasan_kmalloc+0x9/0x10 [ 785.155458] __kmalloc_node+0x4e/0x70 [ 785.159322] kvmalloc_node+0x68/0x100 [ 785.163143] snd_pcm_plugin_alloc+0x585/0x770 [ 785.167637] snd_pcm_plug_alloc+0x212/0x330 [ 785.171977] snd_pcm_oss_change_params_locked+0x2118/0x3750 [ 785.177689] snd_pcm_oss_make_ready_locked+0xbc/0x130 [ 785.182884] snd_pcm_oss_write+0x42b/0x8f0 [ 785.187132] __vfs_write+0x8d/0x110 [ 785.190783] vfs_write+0x20c/0x580 [ 785.194325] ksys_write+0xea/0x1f0 [ 785.197864] __x64_sys_write+0x73/0xb0 [ 785.201753] do_syscall_64+0x103/0x610 [ 785.205643] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.210824] [ 785.212447] Freed by task 711: [ 785.215638] save_stack+0x45/0xd0 [ 785.219097] __kasan_slab_free+0x102/0x150 [ 785.223338] kasan_slab_free+0xe/0x10 [ 785.227142] kfree+0xcf/0x230 [ 785.230309] security_task_free+0x9a/0xf0 [ 785.234525] copy_process.part.0+0x35c8/0x7980 [ 785.239115] _do_fork+0x257/0xfd0 [ 785.242580] __x64_sys_clone+0xbf/0x150 [ 785.246587] do_syscall_64+0x103/0x610 [ 785.250475] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.255668] [ 785.257299] The buggy address belongs to the object at ffff8880a4aded00 [ 785.257299] which belongs to the cache kmalloc-32 of size 32 [ 785.269784] The buggy address is located 0 bytes inside of [ 785.269784] 32-byte region [ffff8880a4aded00, ffff8880a4aded20) [ 785.281389] The buggy address belongs to the page: [ 785.286320] page:ffffea000292b780 count:1 mapcount:0 mapping:ffff88812c3f01c0 index:0xffff8880a4adefc1 [ 785.295761] flags: 0x1fffc0000000200(slab) [ 785.300007] raw: 01fffc0000000200 ffffea000293a908 ffffea000274db48 ffff88812c3f01c0 [ 785.307911] raw: ffff8880a4adefc1 ffff8880a4ade000 000000010000003f 0000000000000000 [ 785.315790] page dumped because: kasan: bad access detected [ 785.321489] [ 785.323125] Memory state around the buggy address: [ 785.328067] ffff8880a4adec00: 00 01 fc fc fc fc fc fc 05 fc fc fc fc fc fc fc [ 785.335440] ffff8880a4adec80: 00 00 fc fc fc fc fc fc 00 00 00 00 fc fc fc fc [ 785.342801] >ffff8880a4aded00: 00 00 00 00 fc fc fc fc 00 fc fc fc fc fc fc fc 15:52:16 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x200000000104, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x2, 0x0, {0x0, 0x4000000, 0x0, 0x7fffffff}}, 0xe) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x4000, 0x0) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000080)=""/36) 15:52:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {0x4000000000000}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0xf, 0x3}]]}}}]}, 0x3c}, 0x1, 0x0, 0x301}, 0x0) [ 785.350154] ^ [ 785.354565] ffff8880a4aded80: 00 fc fc fc fc fc fc fc 05 fc fc fc fc fc fc fc [ 785.361939] ffff8880a4adee00: 00 00 00 00 fc fc fc fc 00 01 fc fc fc fc fc fc [ 785.369321] ================================================================== [ 785.376675] Disabling lock debugging due to kernel taint [ 785.409283] Kernel panic - not syncing: panic_on_warn set ... [ 785.415193] CPU: 0 PID: 7664 Comm: syz-executor.0 Tainted: G B 5.0.0+ #14 [ 785.423421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 785.432768] Call Trace: [ 785.435361] dump_stack+0x172/0x1f0 [ 785.439003] panic+0x2cb/0x65c [ 785.442206] ? __warn_printk+0xf3/0xf3 [ 785.442414] kobject: 'loop2' (00000000577a7423): kobject_uevent_env [ 785.446100] ? default_write_copy_kernel+0xdc/0x130 [ 785.454994] kobject: 'loop2' (00000000577a7423): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 785.457532] ? preempt_schedule+0x4b/0x60 [ 785.457550] ? ___preempt_schedule+0x16/0x18 [ 785.475504] ? trace_hardirqs_on+0x5e/0x230 [ 785.479849] ? default_write_copy_kernel+0xdc/0x130 [ 785.484888] end_report+0x47/0x4f [ 785.488348] ? default_write_copy_kernel+0xdc/0x130 [ 785.493372] kasan_report.cold+0xe/0x40 [ 785.497350] ? snd_pcm_stream_unlock_irq+0x50/0xc0 [ 785.502285] ? default_write_copy_kernel+0xdc/0x130 [ 785.507309] check_memory_region+0x123/0x190 [ 785.511722] memcpy+0x24/0x50 [ 785.514851] default_write_copy_kernel+0xdc/0x130 [ 785.519703] ? __bpf_trace_applptr+0x40/0x40 [ 785.524108] interleaved_copy+0xd0/0x100 [ 785.528173] __snd_pcm_lib_xfer+0xea3/0x1cfa [ 785.532601] ? snd_pcm_hw_rule_step+0x440/0x440 [ 785.537275] ? __bpf_trace_applptr+0x40/0x40 [ 785.541681] ? pcm_lib_apply_appl_ptr+0x440/0x440 [ 785.546558] ? memcpy+0x46/0x50 [ 785.549857] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 785.554893] ? linear_transfer+0x74f/0x970 [ 785.559127] snd_pcm_oss_write3+0xee/0x230 [ 785.563346] io_playback_transfer+0x280/0x330 [ 785.567819] snd_pcm_plug_write_transfer+0x30c/0x400 [ 785.572903] ? snd_pcm_plug_client_channels_buf+0x450/0x450 [ 785.578588] ? snd_pcm_format_physical_width+0x75/0x90 [ 785.583888] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 785.588880] ? snd_pcm_plug_client_channels_buf+0x212/0x450 [ 785.594568] snd_pcm_oss_write2+0x250/0x410 [ 785.598867] ? snd_pcm_oss_write3+0x230/0x230 [ 785.603341] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 785.608854] ? snd_pcm_oss_prepare+0x118/0x150 [ 785.613417] snd_pcm_oss_write+0x6c2/0x8f0 [ 785.617634] __vfs_write+0x8d/0x110 [ 785.621241] ? snd_pcm_oss_ioctl_compat+0x30/0x30 [ 785.626061] vfs_write+0x20c/0x580 [ 785.629577] ksys_write+0xea/0x1f0 [ 785.633099] ? __ia32_sys_read+0xb0/0xb0 [ 785.637136] ? do_syscall_64+0x26/0x610 [ 785.641099] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.646447] ? do_syscall_64+0x26/0x610 [ 785.650414] __x64_sys_write+0x73/0xb0 [ 785.654283] do_syscall_64+0x103/0x610 [ 785.658151] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.663316] RIP: 0033:0x457f29 [ 785.666483] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 785.685358] RSP: 002b:00007f09dd590c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 785.693056] RAX: ffffffffffffffda RBX: 00007f09dd590c90 RCX: 0000000000457f29 [ 785.700316] RDX: 00000000fffffefd RSI: 00000000200000c0 RDI: 0000000000000003 [ 785.707579] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 785.714827] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09dd5916d4 [ 785.722072] R13: 00000000004c6ed7 R14: 00000000004dc798 R15: 0000000000000004 [ 785.730101] Kernel Offset: disabled [ 785.733720] Rebooting in 86400 seconds..